BeyondTrust

Security In Context

Bringing you news and commentary on solutions and strategies for protecting your critical IT infrastructure.

Flame Burns a Little Brighter

Post by BeyondTrust Research Team June 4, 2012

Did you know that Microsoft’s Terminal Server Licensing Service (we’ll call it TSLS for convenience) generated certificates that could be used to sign code? No? Neither did Redmond. Flame leveraged a “0day” (zero day) within TSLS to sign its own code, allowing it to appear as if the code came from Microsoft. This allowed Flame to propagate itself in a network by fooling other machines into believing it was serving Windows Update packages, when in actuality, it was serving up Microsoft signed versions of Flame. More details follow… but first, here is some actionable intelligence:

What does this mean for you and your organization? Apply this fix (Bulletin, Patch) immediately. Unless the patch is applied, your machines may end up trusting malicious code. Retina provides detection for the vulnerable certificates via audit 16497 – Microsoft Revocation of Fraudulent Certificates (2718704).

What does this mean for Flame? It is the first confirmed 0day used by Flame. Albeit, this 0day does not grant an attacker the ability to remotely control a machine with the use of a malformed packet or PDF. However, the use of this vulnerability shows sophistication and access to undisclosed exploitable bugs that may hint at the overall cleverness of Flame. Flame has moved beyond the realm of exploiting known flaws, to the fertile lands of 0day.

So how did this all go down? Well that is a very interesting, yet brief, tale. It all starts with an infected machine on a network. We’ll call that infected box… “Machine A”. Machine A is infected and is looking for opportunities to infect other machines on its network. It sets up a server by the name of “MSHOME-F3BE293C” and starts listening to WPAD requests sent by machines set to automatically configure its proxy settings (Internet Properties –>Connections –>LAN Settings–>Automatically detect settings).

By listening and replying to WPAD requests, the infected machine can point other machines to its proxy configuration file (PAC); effectively, an attacker can then dictate that traffic pass through the infected machine. Once it falsely declares itself as the proxy for the domain, other unwitting (and currently uninfected) machines start routing traffic through Machine A. When Machine A eventually sees some Windows Update queries come across its desk, it replies with a fake update that proceeds to download Flame and *BLAM*, the infection spreads.

By leveraging WPAD weaknesses (which are no stranger to WPAD, see http://technet.microsoft.com/en-us/security/advisory/945713) and Microsoft signed executables, Flame was able to redirect traffic and then subsequently push malicious code onto target machines without any warnings or prompts, because MS code is to be trusted implicitly… Flame may potentially be more sophisticated and refined than its massive size may lead some to believe. Granted, Flame is still being analyzed, and from all estimates there is a long way to go, so stay tuned.

Tags:
, , ,

Leave a Reply

Additional articles

BI-Qualys-Connector-IMG1

Getting More Value from QualysGuard Vulnerability Data with BeyondInsight v5.1

If your vulnerability assessment scans can’t produce meaningful and actionable reports, performing a scan does no good for anyone. If you’ve read my other blog posts, you know I have no qualms about stating that BeyondTrust provides the best vulnerability reporting in the industry. Ask your favorite analyst and they’ll tend to agree. Of course,…

Post by Morey Haber April 18, 2014
Tags:
, , , , , , , ,
insider-threat-fed

Mitigating Inside Threats to U.S. Federal IT Environments

Recent high-profile cases have increased the perceived risks that go along with disclosure and usage of confidential information. One of the most difficult security threats to mitigate is an attack from the inside. When an over-privileged user, such as an unhappy current or former employee, contractor, or consultant, begins navigating your network, how will you…

Post by BeyondTrust Software April 17, 2014
Tags:
, , , , ,

Are you a Target? Investigating Security Breaches with Kevin Johnson

Last week, over 1,000 IT security professionals watched as Kevin Johnson, CEO of Secure Ideas, presented his expert opinion on lessons learned from recent, high-profile retail breaches. Here’s a summary of key takeaways from the webcast plus an on-demand recording of the full, 60-minute presentation. Understanding the “why” behind attacks According to Kevin, the primary…

Post by Chris Burd April 17, 2014
Tags:
, , , , ,