Intelligence Agency Achieves "Holy Grail" of Malware Attacks
Flame, believed by experts to have been created by a Western intelligence agency for purposes of information gathering and espionage, has achieved what has long been called the “holy grail” for malware: replicating via Microsoft Windows’ built-in update system.
As Mikko Hypponen, chief research officer at F-Secure, outlined at the “News from the Lab” blog:
The full mechanism isn’t yet completely analyzed, but Flame has a module which appears to attempt to do a man-in-the-middle attack on the Microsoft Update or Windows Server Update Services (WSUS) system. If successful, the attack drops a file called WUSETUPV.EXE to the target computer.
This file is signed by Microsoft with a certificate that is chained up to Microsoft root.
Except it isn’t signed really by Microsoft.
Signed certificates are how computers know whom to trust. You’re using them every time your web browser switches over to the “https://” mode used by your bank and for e-commerce.
The larger, and to me more incredible, trend here is that Western intelligence agencies are now executing attacks more sophisticated than anything seen previously. In the wake of the astonishingly elaborate Stuxnet attack, if there’s one thing this new Flame exploit proves, it’s that some of the best hackers on the planet are now employed by governments.
This is not an entirely intuitive outcome, when you consider that hacking has traditionally been the bailiwick of a loose and more or less open source confederation of geniuses and malcontents – the sort of hive mind that is difficult to capture within the presumably small, secretive groups working at intelligence agencies.
Keep Reading
Most Popular
The inside story of how ChatGPT was built from the people who made it
Exclusive conversations that take us behind the scenes of a cultural phenomenon.
How Rust went from a side project to the world’s most-loved programming language
For decades, coders wrote critical systems in C and C++. Now they turn to Rust.
ChatGPT is about to revolutionize the economy. We need to decide what that looks like.
New large language models will transform many jobs. Whether they will lead to widespread prosperity or not is up to us.
Design thinking was supposed to fix the world. Where did it go wrong?
An approach that promised to democratize design may have done the opposite.
Stay connected
Get the latest updates from
MIT Technology Review
Discover special offers, top stories, upcoming events, and more.