Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Putting out the Flames

Posted May 30, 2012    Marc Maiffret

Stop me if you’ve heard this one before: there is a new piece of malware and this one is even worse than the last one. It is bigger, scarier, more complex and will take years, according to some estimates, to actually ever know what the malware really does. And of course it already has a plethora of names  depending on which anti-virus company or research group tried to stake their claim of being the first to discover it.  Welcome to this month’s installment of Scary Malware Theater, starring Flame.

While the anti-virus industry does as they always do and spends the vast majority of their time breaking down this piece of malware in a game of “let my firm tell the media some new interesting fact before the competing firm” the rest of you actually working in the real world of IT are stuck wondering when you will be hit by this malware (or the next one) and why this constant cycle of reactive discovery seems to have no end.

Don’t get lost in all of the noise though; the reality is this malware attack is still limited in scope and from all that we know so far, it is very easily preventable with the right solutions and process.  Yes, that’s right, a security company just told you to relax, breathe and respond, not just react. We want to help by providing some context.

Success in security does not come from the constant cycle of malware analysis but rather the relentless analysis of the ways that malware can get onto a system in the first place. That is to say we need to work towards proper IT security practices that reduce attack surface and provide streamlined operational processes for doing something about preventing these attacks.

To that end, for the tireless IT and security folks at large and customers of eEye and BeyondTrust, I want to break down how this malware is currently known to spread and what you can do about it.

The Flame malware is currently leveraging two older Microsoft vulnerabilities that have been patched since August and September of 2010(specifically, that is Microsoft Security Bulletin’s MS10-046 and MS10-061).

In this case you should have a proper vulnerability and patch management process within your organization to verify that you do not have these unpatched vulnerabilities which Flame has been known to use.

Secondarily, the Flame malware has been shown to have capabilities to leverage Windows Domain Administrator credentials to further spread to other systems. While some investigation is being done it is recommended that best practices are followed to ensure your organization is running with “least privilege ” user accounts so as to not more easily allow malware to embed within a system and further propagate.

Specifically for eEye, now BeyondTrust customers and community users there are many ways that the BeyondTrust Retina CS Vulnerability Management platform can help you get visibility and control over this Flame malware. If you don’t already us our free Retina Community security products, now is as good a time as any to go grab it.  Go ahead, we’ll wait right here.

Flame Vulnerability/Malware/Attack Identification

Stay Cool with these Flame Retardant Steps

BeyondTrust’s flagship Retina CS Vulnerability Management solution has the capability to identify both systems infected with the Flame malware and systems with vulnerabilities that Flame malware can leverage for infection. The following are the relevant product related audits/identifiers.

Detection of Flame malware

Retina Network Security Scanner

  • Audit ID: 16484 – Audit Name: Flame/sKyWIper Malware Detected – Modules
  • Audit ID: 16486 – Audit Name: Flame/sKyWIper Malware Detected – ~DEB93D.tmp
  • Audit ID: 16487 – Audit Name: Flame/sKyWIper Malware Detected – Registry
  • Audit ID: 16488 – Audit Name: Flame/sKyWIper Malware Detected – Audio Driver

Blink Endpoint Security

  • Malware Signature Name: W32/Flamer.A

Blink Endpoint Security/Retina Protection Agent

  • Rule ID: 10133 – Attack Rule Name: Print Spooler RCE Attack
  • Rule ID: 110287 – Attack Rule Name: LNK File Attack

Detection of Flame vulnerabilities

Microsoft Bulletin MS10-046

  • Audit ID: 13247 – Audit Name: Microsoft Windows Shortcut Remote Code Execution (2286198)

Microsoft Bulletin MS10-061

  • Audit ID: 13426 – Audit Name: Microsoft Windows Print Spooler Remote Code Execution (2347290) – Remote
  • Audit ID: 13432 – Audit Name: Microsoft Windows Print Spooler Remote Code Execution (2347290)

Remediation of Flame vulnerabilities

  • Retina CS has the ability to do patching of Microsoft and third party application vulnerabilities in a closed loop process that takes you all the way from identifying vulnerabilities, such as those used by Flame, to remediation, through the deployment of a patch.
  • Retina CS specifically has the capability to automate the deployment of the two known Microsoft vulnerabilities that Flame has been leveraging.

The most important thing about the solutions we provide our customers and the community is that we not only provide the most comprehensive means to identify, prevent and remediate even the most sophisticated attacks but we do so in a way that is operationally efficient – true Context Aware Security Intelligence.

To that end I will close off this blog post with a screen shot of a simple “Smart Rule” group that customers and the community can create to have a quick view within less than 1 minute of what the Flame malware means to your organization. I hope this shows how quickly our solutions can give you back the visibility and control of security in your organization to cut through the noise and get down to what the scary “threat of the moment” really means to your organization.

Smart Rules in Retina CS

, , , ,

Leave a Reply

Additional articles


The “insider” threat. Is it real, or is it being blown out of proportion?

Posted March 4, 2015    G. Mark Hardy

A lot depends on whether or not you’ve been compromised. And therein lies the problem. Cyber threats are often ignored until they cause some damage, at which point management looks for people to blame and gives all kinds of attention to fixing the problem – until the next crisis in accounting or warehousing or staffing comes along.

, , ,

Webinar March 4th: Recreating the Carbanak Breach & Techniques for Mitigating Similar Attacks

Posted March 3, 2015    Lindsay Marsh

Join BeyondTrust Research and Development team for an in-depth live webinar that will explore the attack vectors used in the Carbanak Bank Breach and share successful mitigation techniques needed to prevent this type of attack.

, ,
VMware Hardening Guidelines-img3

How to Audit VMware ESX and ESXi Servers Against the VMware Hardening Guidelines with Retina CS

Posted February 27, 2015    BeyondTrust Research Team

Retina CS Enterprise Vulnerability Management has included advanced VMware auditing capabilities for some time, including virtual machine discovery and scanning through a cloud connection, plus the ability to scan ESX and ESXi hosts using SSH. However, in response to recent security concerns associated with SSH, VMware has disabled SSH by default in its more recent…

, , , ,