Cyberweapon Flame Takes Cyber-Cyanide Pill, Is Systematically Deleting Itself

There’s all kinds of dangerous malware out there these days between Stuxnet, the stuff packed into North Korean video games and who knows what else. One particularly dangerous and efficient example, Flame, is actually helping solve the problem, kind of. Security researches have actually caught instances of Flame deleting itself.

Flame, which was being used as sort of cyber spy in the Middle East, is an extremely sophisticated and powerful instance of malware. Sneaking into systems by detecting antivirus programs and modifying its behavior to be undetectable to the particular software in use, Flame is capable of recording audio, taking screenshots, recording keystrokes, and monitoring network traffic. Now, it seems that Flame is also capable of deleting itself and covering up its tracks with garbage data.

Since Flame’s discovery, Symantec has been keeping a close eye on Flame through the use of “honey pot” computers, which report back the symptoms of infection. Last week, they noticed that some of Flame’s command and control computers were sending urgent messages to infected computers. Upon receiving this command, infected computers would systematically delete all Flame files, replacing the areas in which they were stored with randomized data to obscure any trace of the malware’s existence. Earlier examination of Flame’s code had turned up modules named “SUICIDE.” It now seems pretty clear what they were for.

In addition to Flames sophisticated code and impressive load-out of functionality, this cyanide pill behavior only lends more credence to the claims that this malware was not designed by some l33t h4x0r with a bag of Doritos, but rather carefully crafted by skilled professionals, who happen to be under the employ of a monied and powerful entity. Whether it’s a government, a fraction of a government, or Them, is still up for debate, but if Stuxnet was government, Flame may be as well. In any event, Flame is serious business; it knows it’s dangerously sophisticated and it’s keen on keeping its secrets to itself. That is to say, those in charge of it do. If it gains sentience, it’s time to run for the hills.

(via BBC)

Relevant to your interests

• Stuxnet
• North Korean video game malware
• The Android Malware Genome Project