Courcy's Future Threats - 12 June 2012

The militarisation of cyberspace is now a recognised phenomenon and the discovery of Flame, another piece of malware that appears to have been developed with state backing, does not come as a surprise. But there is enough information now to infer what else is out there on this invisible battlefield, and to extrapolate a likely future trajectory for this type of threat.

On 28 May security firm Kaspersky revealed the existence of an all-in-one “worm, trojan and backdoor” it dubbed Flame. It is a remotely reprogrammable data stealer that can seize, transmit and then delete files. Its six megabyte core can download extra modules until it swells to 20 MB. The cyberweapon, which it can quite justifiably be called, is remarkably versatile. It can steal huge amounts of data and transmit them back to its creator, and it can delete information from infected computers. It is not yet known what Flame’s full range of tricks is, but it can do a lot more than just steal data; it can manipulate hardware. Symantec has demonstrated that Flame can be used to turn on microphones and webcams attached to infected systems, record audio and video files, and monitor screen activity. The usefulness of this kind of tool to intelligence organisations hardly needs discussing.

Flame’s greatest strength so far has been its stealth. The country hit hardest (as far as we know) is Iran, whose national Computer Emergency Response Team revealed the code’s malicious components were undetectable by 43 antivirus programs. An official statement indicated that Flame was the cause of “recent incidents of mass data loss” in Iran, particularly linked to the oil industry.

Whose weapon?

There has been much speculation about the origins of Flame. It is written in part in the Lua scripting language, a relatively unusual language whose primary claim to fame is in video game scripting. This spawned some quite entertaining theories that it had been created by a hitherto unknown cult of video game players, though of course Lua has broader applications than just video games, and its similarity to Scheme potentially makes it a very powerful language.

It may well never be clear who created this weapon, but there are a number of clues that point towards it being state backed, and by a Western nation rather than China or Russia. Firstly, the (supposed) target. This is a useful indicator as long as only a handful of nations appear to have been targeted, although it is possibly the least suggestive clue. The country hit hardest by Flame is thought to be Iran, which certainly points towards Israel, the US or one of its allies. However, it is also known that Israel was hit quite hard. It is also possible that other countries have suffered badly, but they have chosen not to admit it. It is a well understood open secret that nations spy on allies just as much as on enemies, so there is at least a possibility that Iran’s suffering is a red herring.

Secondly, there are some links to other well known and allegedly state backed pieces of malware, the related Stuxnet and Duqu viruses. These also appeared to target Iran, although in the case of Stuxnet it was the nuclear sector that was targeted; specifically it appeared to be designed to cause damage to centrifuges used in the uranium enrichment process. The critical link appears to be that there are similarities between coding elements in Flame and early versions of Stuxnet. Overall the coding is different enough to suggest the two projects were the work of different teams, but that there was communication between them.

Olympic Games

In a newly released book, Confront and Conceal: Obama’s Secret Wars and Surprising Use of American Power, David Sanger presents evidence he says is based on interviews with current and former American, European and Israeli officials involved in a US led, covert programme to develop Stuxnet, codenamed ‘Olympic Games’. He claims the programme was begun under Bush, and gained even stronger support under Obama.

Sanger alleges that Israel was brought into the programme as it was believed that if it believed that it was deeply involved in developing a cyberweapon use against Iran it would deter it from launching an overt military attack.

This analysis may be a little simplistic, though. It seems unlikely that Israel would only be prepared to pursue one course of action at a time.

Sanger also suggests that the reason Stuxnet made it onto the open web was that Israel made an alteration to the code and accidentally introduced an error, so that when an Iranian technician connected an infected computer to the internet it failed to recognise the change in environment and gave itself away.

However, Sanger also claims that American officials say that Flame was not part of Olympic Games. This makes links in the code between Stuxnet and Flame all the more mysterious.

The invisible battlefield

The concern about Flame is not that it exists, but what it suggests about various nations’ activities in cyberspace. Flame was only discovered in its current form very recently, but the consensus among security experts is that Flame has existed for at least two years and possibly for seven or eight. Whichever state actually created Flame, it seems improbable that other nations are not also making efforts in this direction.

It now appears that far from being a new phenomenon that are launched and quickly detected, these sophisticated cyberweapons can go undetected for years. Any computer could already be infected with sophisticated state backed malware that we know nothing about.

A serious risk linked to this is the appropriation of these tools by malicious non-state entities. Since the code for Stuxnet hit the open web it has been commandeered by other groups. It seems unfortunately inevitable that if more of these tools are out there, sooner or later some of them will get into the hands of criminals.

Some experts suggest that this has already happened. BAE Systems Detica technical director Henry Harrison believes that Flame may be just the tip of the iceberg. “Targeted data-stealing attacks are a common phenomenon,” he says, “but in most cases they don’t get reported. That's either because the companies affected didn’t report the attacks, for fear of reputational damage or, most of the time, because the attacks are so successful that the targets don’t even realize that their data has been stolen.”

Countermeasures

A vital question is how can these threats be defended against? As Mikko Hypponen, founder of antivirus firm F-Secure says, “Stuxnet, Duqu and Flame are all examples of cases where we - the antivirus industry - have failed”.

Now that it has been identified systems will soon be defendable against this particular piece of malware. Anti-virus companies are already able to include Flame detection in their solutions, and BitDefender has produced a free removal tool for what its chief security researcher, Catalin Cosoi, calls “the scariest cyber espionage tool we’ve yet seen.”

Security experts are now suggesting a change in emphasis in anti-virus protocols to guard against sophisticated weapons like Flame. Rather than focusing all energies on protecting systems against infection, it may be better simply to work from the assumption that systems are already infected, and to work at identifying threats that are already present.

According to James Todd of FireEye, “While most now recognise that breaches are a matter of when and not if, what they don’t realise is that the ‘when’ might have already happened, as evidenced by the failure to discover Flame until now.”

Cyber-security expert Ross Brewer, MD and VP at LogRhythm, believes that advanced log management is a strategy that organisations can use to identify sophisticated malware that has already infiltrated their systems. “The continuous monitoring and advanced correlation of IT log data,” he suggests, “can offer the insight required to piece together seemingly isolated events, ultimately facilitating deep forensic analysis into increasingly sophisticated cyber attacks.”

Extrapolating the future

The fact that on nation, or group of nations, has already made a concerted effort to use cyberweapons against other nations leads to the inevitable conclusion that it is something that other nations are also engaged in. There may be nations that do not, but many will aspire to include this type of weapon in their arsenal. Whenever a one nation develops a new weapon that gives it a strategic advantage, other nations will develop similar technologies to maintain parity, and to try to move ahead.

It is, ultimately, an arms race. The battlefield of cyberspace offers many temptations to nations wishing to harm their enemies. They can engage in offensive action without committing troops, and possibly without anyone realising there has been an attack. If care is taken, then even if the attack is revealed the country has deniability. Where the nuclear arms race has, at least for most countries, slowed almost to a halt, the cyberweapon arms race has a long time left to run.