cancel
Showing results for 
Search instead for 
Did you mean: 

Flame Virus.

Community Veteran
Posts: 8,513
Thanks: 937
Fixes: 9
Registered: 02-08-2007

Flame Virus.

Now don't be losing any sleep over this but,
The infamous Flame virus can infect even secure PCs by tricking them into believing its malicious payload is actually an update from Microsoft.
As we already know, Flame has gained traction by tapping into security certificates for Microsoft's Terminal Server. Though they appear to be digitally signed by Microsoft, the certificates are actually cooked up by the people behind Flame, thereby tricking PCs into accepting them as legitimate.
Microsoft and Symantec revealed yesterday that the virus can up the ante by using the fake certificates to spoof Microsoft's own Windows Update service. As such, Windows PCs could receive an update that claims to be from Microsoft but is in fact a launcher for the malware.
Symantec described the method behind Flame's madness: The virus, also known as Flamer, uses three applications to infect PCs -- Snack, Munch, and Gadget. Collectively, this trio can trick PCs into redirecting Internet traffic to an infected computer with a fake Web server,. Once infected, a PC thinks the file that loads Flame is actually a Windows Update from Microsoft.
And as Symantec explained in its blog, spoofing Windows Update is not a trivial matter.
    Hijacking Windows Update is not trivial because updates must be signed by Microsoft. However, Flamer bypasses this restriction by using a certificate that chains to the Microsoft Root Authority and improperly allows code signing. So when a Windows Update request is received, the GADGET module through MUNCH provides a binary signed by a certificate that appears to belong to Microsoft.
The unsuspecting PC then downloads and executes the binary file, believing it to be a legitimate Windows Update file, Symantec added. The binary is not the Flame virus itself but a loader for Flame.
Microsoft also confirmed the risk to Windows Update, explaining that the vulnerability could be used to attack customers who weren't the focus of the original Flame virus.
2 REPLIES
Community Veteran
Posts: 4,868
Thanks: 126
Fixes: 24
Registered: 14-07-2009

Re: Flame Virus.

Presumably addressed by this update http://support.microsoft.com/kb/2718704 that my computer installed yesterday.
Community Veteran
Posts: 5,616
Thanks: 627
Fixes: 1
Registered: 21-03-2011

Re: Flame Virus.

Flame commits suicide ... http://www.theregister.co.uk/2012/06/07/flame_suicide_command/
Now Zen, but a +Net residue.