Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Putting out the Flames

Posted May 30, 2012    Marc Maiffret

Stop me if you’ve heard this one before: there is a new piece of malware and this one is even worse than the last one. It is bigger, scarier, more complex and will take years, according to some estimates, to actually ever know what the malware really does. And of course it already has a plethora of names  depending on which anti-virus company or research group tried to stake their claim of being the first to discover it.  Welcome to this month’s installment of Scary Malware Theater, starring Flame.

While the anti-virus industry does as they always do and spends the vast majority of their time breaking down this piece of malware in a game of “let my firm tell the media some new interesting fact before the competing firm” the rest of you actually working in the real world of IT are stuck wondering when you will be hit by this malware (or the next one) and why this constant cycle of reactive discovery seems to have no end.

Don’t get lost in all of the noise though; the reality is this malware attack is still limited in scope and from all that we know so far, it is very easily preventable with the right solutions and process.  Yes, that’s right, a security company just told you to relax, breathe and respond, not just react. We want to help by providing some context.

Success in security does not come from the constant cycle of malware analysis but rather the relentless analysis of the ways that malware can get onto a system in the first place. That is to say we need to work towards proper IT security practices that reduce attack surface and provide streamlined operational processes for doing something about preventing these attacks.

To that end, for the tireless IT and security folks at large and customers of eEye and BeyondTrust, I want to break down how this malware is currently known to spread and what you can do about it.

The Flame malware is currently leveraging two older Microsoft vulnerabilities that have been patched since August and September of 2010(specifically, that is Microsoft Security Bulletin’s MS10-046 and MS10-061).

In this case you should have a proper vulnerability and patch management process within your organization to verify that you do not have these unpatched vulnerabilities which Flame has been known to use.

Secondarily, the Flame malware has been shown to have capabilities to leverage Windows Domain Administrator credentials to further spread to other systems. While some investigation is being done it is recommended that best practices are followed to ensure your organization is running with “least privilege ” user accounts so as to not more easily allow malware to embed within a system and further propagate.

Specifically for eEye, now BeyondTrust customers and community users there are many ways that the BeyondTrust Retina CS Vulnerability Management platform can help you get visibility and control over this Flame malware. If you don’t already us our free Retina Community security products, now is as good a time as any to go grab it.  Go ahead, we’ll wait right here.

Flame Vulnerability/Malware/Attack Identification

Stay Cool with these Flame Retardant Steps

BeyondTrust’s flagship Retina CS Vulnerability Management solution has the capability to identify both systems infected with the Flame malware and systems with vulnerabilities that Flame malware can leverage for infection. The following are the relevant product related audits/identifiers.

Detection of Flame malware

Retina Network Security Scanner

  • Audit ID: 16484 – Audit Name: Flame/sKyWIper Malware Detected – Modules
  • Audit ID: 16486 – Audit Name: Flame/sKyWIper Malware Detected – ~DEB93D.tmp
  • Audit ID: 16487 – Audit Name: Flame/sKyWIper Malware Detected – Registry
  • Audit ID: 16488 – Audit Name: Flame/sKyWIper Malware Detected – Audio Driver

Blink Endpoint Security

  • Malware Signature Name: W32/Flamer.A

Blink Endpoint Security/Retina Protection Agent

  • Rule ID: 10133 – Attack Rule Name: Print Spooler RCE Attack
  • Rule ID: 110287 – Attack Rule Name: LNK File Attack

Detection of Flame vulnerabilities

Microsoft Bulletin MS10-046

  • Audit ID: 13247 – Audit Name: Microsoft Windows Shortcut Remote Code Execution (2286198)

Microsoft Bulletin MS10-061

  • Audit ID: 13426 – Audit Name: Microsoft Windows Print Spooler Remote Code Execution (2347290) – Remote
  • Audit ID: 13432 – Audit Name: Microsoft Windows Print Spooler Remote Code Execution (2347290)

Remediation of Flame vulnerabilities

  • Retina CS has the ability to do patching of Microsoft and third party application vulnerabilities in a closed loop process that takes you all the way from identifying vulnerabilities, such as those used by Flame, to remediation, through the deployment of a patch.
  • Retina CS specifically has the capability to automate the deployment of the two known Microsoft vulnerabilities that Flame has been leveraging.

The most important thing about the solutions we provide our customers and the community is that we not only provide the most comprehensive means to identify, prevent and remediate even the most sophisticated attacks but we do so in a way that is operationally efficient – true Context Aware Security Intelligence.

To that end I will close off this blog post with a screen shot of a simple “Smart Rule” group that customers and the community can create to have a quick view within less than 1 minute of what the Flame malware means to your organization. I hope this shows how quickly our solutions can give you back the visibility and control of security in your organization to cut through the noise and get down to what the scary “threat of the moment” really means to your organization.

Smart Rules in Retina CS

, , , ,

Leave a Reply

Additional articles

Are Your Data Security Efforts Focused in the Right Area?

Posted January 28, 2015    Scott Lang

Vormetric Data Security recently released an insider threat report, with research conducted by HarrisPoll and analyzed by Ovum. Based on the survey responses, it is apparent that there is still a great deal of insecurity over data. However, the results also show that there may be misplaced investments to address those insecurities. I will explain…


GHOST Vulnerability…Scary Indeed

Posted January 28, 2015    BeyondTrust Research Team

A vulnerability discovered by Qualys security researchers has surfaced within the GNU C Library that affects virtually all Linux operating systems. The vulnerability lies within the various gethostbyname*() functions and, as such, has been dubbed “GHOST.” GHOST is particularly nasty considering remote, arbitrary code execution can be achieved. In an effort to avoid taxing DNS lookups, glibc developers introduced…


Your New Years Resolution: Controlling Privileged Users

Posted January 27, 2015    Dave Shackleford

Is 2015 the year you get a better handle on security? The news last year was grim – so much so, in fact, that many in the information security community despaired a bit. Really, the end-of-the-year infosec cocktail parties were a bit glum. OK, let’s be honest, infosec cocktail parties are usually not that wild…

, , ,