,
5 tweets,
2 min read
Read on Twitter
Those non-existent norms were originally shattered by Flame subverting the actual Windows Update mechanism via an unheard of md5 collision to impersonate signing certs (implemented in its GADGET module).
For the curious:
@alexsotirov 's slides on the MD5 collision in Flame: speakerdeck.com/asotirov/analy…
And Kaspersky's analysis of the GADGET module:
securelist.com/gadget-in-the-…
@alexsotirov 's slides on the MD5 collision in Flame: speakerdeck.com/asotirov/analy…
And Kaspersky's analysis of the GADGET module:
securelist.com/gadget-in-the-…
Flame really doesn't get the credit it deserves as the first public harbinger of so many trends we'd come to know all too well in cyberespionage over the following 7 years.
In a sliver of nearly two years Stuxnet, Duqu, Flame, and Gauss forcefully taught the industry about: multiple modular design philosophies, lawyer-assisted target scoping, true 0-day burn rates, subverting security supply chains (by breaking into CAs and stealing certs)...
...threat actor supergroups, target environment encrypted payloads (that elude us to this day), good (and bad) cleanup and infection suicide methods, and, yes... subverting trusted update mechanisms.
