Price tag for Microsoft piece of Flame malware $1M, researcher says

Back when the Microsoft Update piece of the Flame espionage-software package was still undetected it could have sold for $1 million on the malware black market, a security researcher says.

“That discovery is worth a lot of money,” says Marcus Carey, security researcher at vulnerability-management firm Rapid7, “at least six figures and probably more — seven figures. That’s how elite that attack is.”

Since Flame and its components were unmasked, though, that has all changed. “Nobody’s going to pay that now,” he says.

The vulnerability that first came to light Sunday when Microsoft issued a rare out-of-cycle security update was an obscure part of a complex and stealthy platform that had evaded detection for more than four years.

MORE: Flame malware’s structure among most complex ever seen, says Kaspersky Lab

BACKGROUND: Flame Malware: All You Need to Know

In particular, Flame exploited Microsoft Terminal Services by having its certificate authority generate fake digital signatures that authenticated malware as legitimate Microsoft updates. This allowed the attackers to alter and update its code at will.

But that was just one feature of the entire Flame architecture. Other sophisticated elements include the ability to delete all or parts of itself from infected machines and then overwrite those parts to eliminate any trace.

It also had a command-and-control infrastructure “unlike anything we’ve ever seen before,” according to Kaspersky Lab researchers. It operated out of 80 domains, and the servers involved were apparently unhacked machines deployed in legitimate businesses. The servers attempted updates to set alternative C&C paths, Kaspersky says.

Creators of Flame were among the elite of malware creators, Carey says. “They had to have a higher aptitude — a world-class understanding of how to exploit software and of cryptography.”

The Microsoft piece of Flame involved a technique called MP5 collisions that have been known since 2008 but that had never been applied to Microsoft software before, he says. Doing something similar with Microsoft certificates opened the door to installing and tailoring Flame to a vast number of computers, he says.

Flame was so stealthy that it sat in a code archive maintained by F-Secure for two years, undetected as malware, according to a blog post on Wired.

Carey says Flame is an impressive piece of work, but it doesn’t appear to pose a threat to most corporate networks because it seems to have been crafted for targeted attacks against networks in the Middle East.

Tim Greene covers Microsoft for Network World and writes the Mostly Microsoft blog. Reach him at tgreene@nww.com and follow him on Twitter @Tim_Greene.