The Flame Burning Inside Stuxnet

Last Updated on May 24, 2015

While the U.S. and Israel keep on mutually claiming the Stuxnet’s paternity, Kaspersky Lab has unveiled further details about Flame that allow to connect it with the infamous malware targeting Iranian Nuclear Plants.

Are the two 21st century Cyber Weapons really correlated? Due to some architectural differences, the first data seemed to exclude any similarities between the two platforms: the so-called Tilded platform which Stuxnet and Duqu are based on, and the brand new platform from which Flame has been developed. In any case never trust appearances, as a small detail dating back to 2012 has unveiled a landscape that seems completely different from what was previously believed, which suggests the hypothesis that the Stuxnet malware had a kind of “proto flame” inside.

The Cyber Spy Story begins in October 2010 when the automated systems by Kaspersky Lab detected a False (Stuxnet) Positive. This sample apparently looked like a new variant (Worm.Win32.Stuxnet.s) but a deeper analysis showed (then) no apparent correlation with Stuxnet so it was subsequently dubbed Tocy.a.

Only two years later, in 2012, after the discovery of Flame, the russian security firm started to compare the brand new malware with previously detected samples to find any similarities. And guess what? The nearly forgotten Tocy.a was nearly identical to Flame. A further check to logs, allowed to discover that the Tocy.a, apparently an early module of Flame, was actually similar to “resource 207” from Stuxnet, and this similarity was the reason why the automatic system had previously classified it as Stuxnet.

Resource 207 is a 520,192 bytes Stuxnet encrypted DLL file that contains another PE file inside (351,768 bytes). It was found in the 2009 version of Stuxnet, despite it was dropped in the 2010 evolution, with its code merged into other modules. The PE file is actually a Flame Plugin, while the purpose of Resource 207 on the 2009 variant of Stuxnet was just to allow the malware propagation to removable USB drives via autorun.inf, as well as to exploit a then-unknown vulnerability (MS09-025) to escalate privileges in the system during the infection from USB drive.

Given the evidences collected, researchers suggests that, although Flame has been discovered a couple of years after Stuxnet, it was already in existence when Stuxnet was created (Jan-Jun 2009), having already a modular structure. The “Resource 207” module was removed from Stuxnet in 2010 due to the addition of a new method of propagation (vulnerability MS10-046), while the Flame module in Stuxnet exploited a vulnerability which was unknown then, allowing an escalation of privileges, presumably exploiting MS09-025.

Part of the Flame code was used in Stuxnet despite, after 2009, the evolution of the Flame platform continued independently from Stuxnet.

Probably, this is the second important discovery about Flame after the MD5 Collision Attack, which enabled to malware to hide the download of its own modules behind Windows Updates.

Regarding the MD5 Collision Attack, I suggest you to have a look at this very interesting presentation. You will be amazed in discovering that the first successful demonstration of this attack took, in 2008 (the alleged year in which Flame was created), about 2 days on a cluster of 200 PS3s (corresponding to about $20k on Amazon EC2). Together with the complexity of the attack, this aspect is enough to suggest a state-sponsored origin for the malware (i.e. the need of huge resources and know-how). But there’s more: to make the MD5 Collision Attack successful in Flame, the Attackers, had to overcome a huge obstacle corresponding to prediction the Serial Number of the Certificate (which is based on a sequential certificate number and the current time). Nothing strange apparently, except for the fact that they had a 1-millisecond window to get the certificate issued. What does this mean in simple words? A large number of attempts required to get the certificate issued at the right moment, an effort 10-100x more costly that the original MD5 Collision Attack Demonstration.

Now I understand why the Iran Cyber Warfare Budget is estimated to be “only” USD 100 Million…