?Gadget? in the middle: Flame malware spreading vector identifiedIn our <a href=https://www.securelist.com/en/blog/208193522/The_Flame_Questions_and_Answers>FAQ on Flame</a> posted on May 28, 2012, we postulated there might be a still undiscovered zero-day vulnerability in Flame:</p><p> <p><i> “At the moment, we haven’t seen use of any 0-days; however, the worm is known to have infected fully-patched Windows 7 systems through the network, which might indicate the presence of a high risk 0-day.”</i></p><p> <p> Our suspicion was heightened because fully patched Windows 7 machines were being infected over the network in a very suspicious manner.</p><p>We can now confirm this is the main purpose of a special module of Flame called “Gadget” together with another module called “Munch”.</p><p><i>(NOTE: It’s important to understand that the initial Flame infection could still be happening through zero-day vulnerabilities. The “Gadget” module is simply used to spread within a network from a machine that is already infected with the malware).</i></p> The “Gadget” and “Munch” modules implement an interesting man-in-the-middle attack against other computers in a network. </p> When a machine tries to connect to Microsoft’s Windows Update, it redirects the connection through an infected machine and it sends a fake, malicious Windows Update to the client.</p> The fake update claims to be the following:</p> <p><i>“update description="Allows you to display gadgets on your desktop." displayName="Desktop Gadget Platform" name="WindowsGadgetPlatform"></i></p> In the process of infecting a client, 8 CAB files are used. One of them contains a specifically built program called WuSetupV.exe:</p> <p class=c><img src="images/pictures/klblog/208193559.png" border="1" alt="" title=""></p> This program (also detected as Worm.Win32.Flame.a), which is 28KB in size, has been signed by a fake Microsoft certificate:</p> <p class=c><img src="images/pictures/klblog/208193563.png" border="1" alt="" title=""></p><p>This allows it to run in the victim’s machine without any warnings.</p><p>The Flame “Gadget” downloader was compiled on December 27th, 2010. It was signed on December 28 and it was finally put into the CAB archive on Jan 11, 2011.</p> <p class=c><img src="images/pictures/klblog/208193564.png" border="1" alt="" title=""></p><p>The following is exactly how the process occurs: the infected machine sets up a <b>fake server by the name “MSHOME-F3BE293C”</b>, which hosts a script that serves a full body of the Flame malware to victim machines. This is done by the module called “Munch”. </p> When a victim updates itself via Windows Update, the query is intercepted and the fake update is pushed. The fake update proceeds to download the main body and infect the computer. </p> <p class=c><img src="images/pictures/klblog/208193565.png" border="1" alt="" title=""></p> <center>Gadget plugin downloads the main body of the malware</center></p> <p> The interception of the query to the official Windows Update (the man-in-the-middle attack) is done by announcing the infected machine as a proxy for the domain. This is done via <a href=http://en.wikipedia.org/wiki/Web_Proxy_Autodiscovery_Protocol>WPAD</a>. To get infected, the machines do need however to have their System Proxy settings configured to “Auto”.</p> As we continue our investigation of Flame, more and more details appear which indicate our initial statement: this is one of the most interesting and complex malicious programs we have ever seen.</p> <b> Important information:</b> One June 4th, 2012, Microsoft released a number of blog posts and an Update for Windows which is blocking three fraudulent certificates used by Flame. We recommend that Windows users apply this update immediately. </p> Microsoft SRD blog:<a href=http://blogs.technet.com/b/srd/archive/2012/06/03/microsoft-certification-authority-signing-certificates-added-to-the-untrusted-certificate-store.aspx>http://blogs.technet.com/b/srd/archive/2012/06/03/microsoft-certification-authority-signing-certificates-added-to-the-untrusted-certificate-store.aspx</a></p> Microsoft security advisory 2718704:<a href=http://technet.microsoft.com/en-us/security/advisory/2718704>http://technet.microsoft.com/en-us/security/advisory/2718704</a></p> MSRC blog:<a href=http://blogs.technet.com/b/msrc/archive/2012/06/03/microsoft-releases-security-advisory-2718704.aspx>http://blogs.technet.com/b/msrc/archive/2012/06/03/microsoft-releases-security-advisory-2718704.aspx</a></p>
Source:
?Gadget? in the middle: Flame malware spreading vector identified
