BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Flame Burns a Little Brighter

Posted June 4, 2012    BeyondTrust Research Team

Did you know that Microsoft’s Terminal Server Licensing Service (we’ll call it TSLS for convenience) generated certificates that could be used to sign code? No? Neither did Redmond. Flame leveraged a “0day” (zero day) within TSLS to sign its own code, allowing it to appear as if the code came from Microsoft. This allowed Flame to propagate itself in a network by fooling other machines into believing it was serving Windows Update packages, when in actuality, it was serving up Microsoft signed versions of Flame. More details follow… but first, here is some actionable intelligence:

What does this mean for you and your organization? Apply this fix (Bulletin, Patch) immediately. Unless the patch is applied, your machines may end up trusting malicious code. Retina provides detection for the vulnerable certificates via audit 16497 – Microsoft Revocation of Fraudulent Certificates (2718704).

What does this mean for Flame? It is the first confirmed 0day used by Flame. Albeit, this 0day does not grant an attacker the ability to remotely control a machine with the use of a malformed packet or PDF. However, the use of this vulnerability shows sophistication and access to undisclosed exploitable bugs that may hint at the overall cleverness of Flame. Flame has moved beyond the realm of exploiting known flaws, to the fertile lands of 0day.

So how did this all go down? Well that is a very interesting, yet brief, tale. It all starts with an infected machine on a network. We’ll call that infected box… “Machine A”. Machine A is infected and is looking for opportunities to infect other machines on its network. It sets up a server by the name of “MSHOME-F3BE293C” and starts listening to WPAD requests sent by machines set to automatically configure its proxy settings (Internet Properties –>Connections –>LAN Settings–>Automatically detect settings).

By listening and replying to WPAD requests, the infected machine can point other machines to its proxy configuration file (PAC); effectively, an attacker can then dictate that traffic pass through the infected machine. Once it falsely declares itself as the proxy for the domain, other unwitting (and currently uninfected) machines start routing traffic through Machine A. When Machine A eventually sees some Windows Update queries come across its desk, it replies with a fake update that proceeds to download Flame and *BLAM*, the infection spreads.

By leveraging WPAD weaknesses (which are no stranger to WPAD, see http://technet.microsoft.com/en-us/security/advisory/945713) and Microsoft signed executables, Flame was able to redirect traffic and then subsequently push malicious code onto target machines without any warnings or prompts, because MS code is to be trusted implicitly… Flame may potentially be more sophisticated and refined than its massive size may lead some to believe. Granted, Flame is still being analyzed, and from all estimates there is a long way to go, so stay tuned.

Tags:
, , ,

Leave a Reply

Additional articles

randy franklin smith

At the End of Day You Can’t Control What Privileged Users Do: It’s about Detective/Deterrent Controls and Accountability

Posted March 31, 2015    Randy Franklin Smith

Live Webinar: Thursday, April 2, 2015 | 10am PT/1pm ET | REGISTER NOW! In this webinar, Security Expert Randy Franklin Smith will look at how to audit what admins do inside Linux and UNIX with sudo’s logging capabilities.

Tags:
, ,
BA_Hacked

British Airways Executive Club Member Accounts Hacked

Posted March 30, 2015    Brian Chappell

British Airways has released information regarding the hacking of a number of their Executive Club (BA’s frequent flyer programme) member’s accounts.

Tags:
, , ,
webinar_ondemand

On Demand Webinar – Why You Still Suck at Patching

Posted March 27, 2015    Lindsay Marsh

On Demand Webinar: Dave Shackleford recounts some of his personal experiences in patch management failure, and breaks down the most critical issues holding many teams back from patching more effectively.

Tags:
,