Flame Malware

[Michael]

Hello all,

 

Thought I'd make you all aware of a new malware called 'Flame', here are some details.

 

It looks particularly nasty as it creates unauthorised certificates as if they came from Microsoft themselves. That's only going to cause trouble!

 

This affects Windows XP/2003/Vista/2008/7/2008 R2, both x86 and x64.

 

I suspect Windows 8 and Server 2012 will include the patch by default.

[Netwacky87]

Yeah, saw this on the BBC website the other day...info here: BBC News - Flame: Attackers 'sought confidential Iran data' Apparently its been around for years, in some form or another....:/ Edited June 5, 2012 by Netwacky87

[Michael]

On a related issue, if you've setup WSUS as per my recommendations here, you'll find your servers should already be patched!

 

2008 R2 installs the update without needing a restart. 2003 does need a restart to complete the update.

[Arthur]

Already posted in the Security forum...

 

www.edugeek.net/forums/security/95903-flame-massive-cyber-attack-discovered.html

[zlorimer]

These updates broke my WSUS and I cannot get anything to work again. I guess I will be rebuilding the server... Edited June 11, 2012 by zlorimer

[Arthur]

These updates broke my WSUS

Could it be proxy related?

 

The company's Windows Server Update Services, which businesses and organizations use to deliver patches to large fleets of PCs, will no longer work through network proxies that use deep packet content inspection, Microsoft representatives said in an advisory published Friday afternoon. Such proxies act as man-in-the-middle devices that can peek inside encrypted traffic as it travels from a local network onto the Internet. Enterprises that have inspection servers in place will have to create exception rules so all Windows Update traffic is bypassed.

[zlorimer]

Nah. We don't use proxies here. I cannot open the MMC using the Internal MS DB setup on WSUS3.0 SP2. I am thinking I am going to have to rebuild it because I cannot find any real answers or anything. Edited June 11, 2012 by zlorimer

[Michael]

I've not had any problems applying the update to WSUS 3.0 SP2 on both 2003 and 2008 R2 servers. I'd try repairing the product and this should resolve it.

[Michael]

And I just remembered, today is Patch Tuesday with 7 updates being released later today!

[X-13]

If this is the "Flame" I'm thinking of... It's a Stuxnet variant.

 

That is to say, it's the same level of shenanigans and subterfuge... by the same people.

 

 

Also: Stuxnet/Flame comparison

Edited June 12, 2012 by X-13

[Oaktech]

see here... http://www.crysys.hu/skywiper/skywiper.pdf it's a very interesting in depth article containing a comparison of flame/skywiper and stuxnet, they are not the same at all, or even derived from each other. They contain some similar components and modes of operation but are very different beasts.

[X-13]

see here... http://www.crysys.hu/skywiper/skywiper.pdf it's a very interesting in depth article containing a comparison of flame/skywiper and stuxnet, they are not the same at all, or even derived from each other. They contain some similar components and modes of operation but are very different beasts.

 

From what I've heard, and I may have misread, it's looking likely that it was made by the US/Iranian government... Like Stuxnet.

 

This is what I was saying. If true, it looks like it's more cloak+dagger cyber shenanigans... and not really anything the average end-user needs to worrk about.

[Oaktech]

From what I've heard, and I may have misread, it's looking likely that it was made by the US/Iranian government... Like Stuxnet.

 

This is what I was saying. If true, it looks like it's more cloak+dagger cyber shenanigans... and not really anything the average end-user needs to worrk about.

 

Right ho...

 

The finger has been pointed at the US and or israel for stuxnet, flame is significantly different in style, probably not the same group of coders, but a broadly similar idea. No one is really able to point the finger for flame yet.

 

Obviously it's not a great idea to have backdoor access software floating around on ones pc/network, but i agree that it is probably of very little concern for most people... it's got bigger fish to fry!

[zlorimer]

I've not had any problems applying the update to WSUS 3.0 SP2 on both 2003 and 2008 R2 servers. I'd try repairing the product and this should resolve it.

It seems to be a common problem I will post up if I can find a fix, but just a forewarning to everyone, be careful.

WSUS 3.0 SP2 will not run after installing update 2720211

[Michael]

It seems to be a common problem I will post up if I can find a fix, but just a forewarning to everyone, be careful.

WSUS 3.0 SP2 will not run after installing update 2720211

 

Looking at that, I wonder if the common factor are admins using SQL 2008 instead of the Windows Internal Database (WID). I use WID in all instances.

[zlorimer]

I use WID as well for WSUS. I only use one server in WSUS, but I am getting ASP.NET 2.0.x.x errors in addition to the WID errors.

 

But yeah, I'm basically dead in the water currently since I cannot do anything and no one in my network is receiving updates now. Thankfully, summer just started so I have some time to be patient.

Edited June 12, 2012 by zlorimer

[zlorimer]

Well if anyone comes across the same problem that I did, I fixed it. I had to uninstall everything involving WSUS and reinstall everything. It wasn't bad, but it took some time.