BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Putting out the Flames

Posted May 30, 2012    Marc Maiffret

Stop me if you’ve heard this one before: there is a new piece of malware and this one is even worse than the last one. It is bigger, scarier, more complex and will take years, according to some estimates, to actually ever know what the malware really does. And of course it already has a plethora of names  depending on which anti-virus company or research group tried to stake their claim of being the first to discover it.  Welcome to this month’s installment of Scary Malware Theater, starring Flame.

While the anti-virus industry does as they always do and spends the vast majority of their time breaking down this piece of malware in a game of “let my firm tell the media some new interesting fact before the competing firm” the rest of you actually working in the real world of IT are stuck wondering when you will be hit by this malware (or the next one) and why this constant cycle of reactive discovery seems to have no end.

Don’t get lost in all of the noise though; the reality is this malware attack is still limited in scope and from all that we know so far, it is very easily preventable with the right solutions and process.  Yes, that’s right, a security company just told you to relax, breathe and respond, not just react. We want to help by providing some context.

Success in security does not come from the constant cycle of malware analysis but rather the relentless analysis of the ways that malware can get onto a system in the first place. That is to say we need to work towards proper IT security practices that reduce attack surface and provide streamlined operational processes for doing something about preventing these attacks.

To that end, for the tireless IT and security folks at large and customers of eEye and BeyondTrust, I want to break down how this malware is currently known to spread and what you can do about it.

The Flame malware is currently leveraging two older Microsoft vulnerabilities that have been patched since August and September of 2010(specifically, that is Microsoft Security Bulletin’s MS10-046 and MS10-061).

In this case you should have a proper vulnerability and patch management process within your organization to verify that you do not have these unpatched vulnerabilities which Flame has been known to use.

Secondarily, the Flame malware has been shown to have capabilities to leverage Windows Domain Administrator credentials to further spread to other systems. While some investigation is being done it is recommended that best practices are followed to ensure your organization is running with “least privilege ” user accounts so as to not more easily allow malware to embed within a system and further propagate.

Specifically for eEye, now BeyondTrust customers and community users there are many ways that the BeyondTrust Retina CS Vulnerability Management platform can help you get visibility and control over this Flame malware. If you don’t already us our free Retina Community security products, now is as good a time as any to go grab it.  Go ahead, we’ll wait right here.

Flame Vulnerability/Malware/Attack Identification

Stay Cool with these Flame Retardant Steps

BeyondTrust’s flagship Retina CS Vulnerability Management solution has the capability to identify both systems infected with the Flame malware and systems with vulnerabilities that Flame malware can leverage for infection. The following are the relevant product related audits/identifiers.

Detection of Flame malware

Retina Network Security Scanner

  • Audit ID: 16484 – Audit Name: Flame/sKyWIper Malware Detected – Modules
  • Audit ID: 16486 – Audit Name: Flame/sKyWIper Malware Detected – ~DEB93D.tmp
  • Audit ID: 16487 – Audit Name: Flame/sKyWIper Malware Detected – Registry
  • Audit ID: 16488 – Audit Name: Flame/sKyWIper Malware Detected – Audio Driver

Blink Endpoint Security

  • Malware Signature Name: W32/Flamer.A

Blink Endpoint Security/Retina Protection Agent

  • Rule ID: 10133 – Attack Rule Name: Print Spooler RCE Attack
  • Rule ID: 110287 – Attack Rule Name: LNK File Attack

Detection of Flame vulnerabilities

Microsoft Bulletin MS10-046

  • Audit ID: 13247 – Audit Name: Microsoft Windows Shortcut Remote Code Execution (2286198)

Microsoft Bulletin MS10-061

  • Audit ID: 13426 – Audit Name: Microsoft Windows Print Spooler Remote Code Execution (2347290) – Remote
  • Audit ID: 13432 – Audit Name: Microsoft Windows Print Spooler Remote Code Execution (2347290)

Remediation of Flame vulnerabilities

  • Retina CS has the ability to do patching of Microsoft and third party application vulnerabilities in a closed loop process that takes you all the way from identifying vulnerabilities, such as those used by Flame, to remediation, through the deployment of a patch.
  • Retina CS specifically has the capability to automate the deployment of the two known Microsoft vulnerabilities that Flame has been leveraging.

The most important thing about the solutions we provide our customers and the community is that we not only provide the most comprehensive means to identify, prevent and remediate even the most sophisticated attacks but we do so in a way that is operationally efficient – true Context Aware Security Intelligence.

To that end I will close off this blog post with a screen shot of a simple “Smart Rule” group that customers and the community can create to have a quick view within less than 1 minute of what the Flame malware means to your organization. I hope this shows how quickly our solutions can give you back the visibility and control of security in your organization to cut through the noise and get down to what the scary “threat of the moment” really means to your organization.

Smart Rules in Retina CS

Tags:
, , , ,

Leave a Reply

Additional articles

Dark Reading

2014: The Year of Privilege Vulnerabilities

Posted December 18, 2014    Chris Burd

Of the 30 critical-rated Microsoft Security Bulletins this year, 24 involved vulnerabilities where the age-old best practice of “least privilege” could limit the impact of malware and raise the bar of difficulty for attackers.

Tags:
, , , , ,
dave-shackleford-headshot

Looking back on information security in 2014

Posted December 16, 2014    Dave Shackleford

Dave Shackleford is a SANS Instructor and founder of Voodoo Security. Join Dave for a closer look at the year in security, and learn what you can do to prepare for 2015, with this upcoming webinar. 2014 has been one heck of an insane year for information security professionals. To start with, we’ve been forced…

Tags:
, ,
patch-tuesday

December 2014 Patch Tuesday

Posted December 9, 2014    BeyondTrust Research Team

This month marks the final Patch Tuesday of 2014. Most of what is being patched this month includes Internet Explorer, Exchange, Office, etc… and continues a trend of the greatest hits collection of commonly attacked Microsoft software. Probably the one thing that broke the mold this month is that for once there is not some…

Tags:
,