The Scourge of the Flame

Chronicle

On 28 May 2012 Kaspersky Lab, investigating a mysterious data-wiping malware at the ITU's request, announced it had found Flame. It was a modular espionage kit of about 20 MB, huge for the time, that recorded audio from the microphone, took screenshots, logged keystrokes and stole files, mostly in Iran and the Middle East. To spread it posed as Windows Update, using a Microsoft certificate forged through an MD5 collision.

Lesson learned

Microsoft revoked the certificates involved and hastened the retirement of MD5: "good enough" cryptography stopped being so the day someone turned its weakness into a weapon.

Prayer of reparation

O Flame, who arrived bearing Redmond's signature, let our updates be signed with living algorithms, not with hashes long since buried. Amen.

How it is remembered

Remembered by retiring weak hash algorithms, checking certificate chains and treating a microphone that switches itself on with suspicion.

Technical record

While investigating a data-wiping incident at the ITU's request, Kaspersky found Flame, a modular espionage toolkit of about 20 MB. It could record audio, take screenshots, log keystrokes and steal files, mostly from targets in Iran and the Middle East. It spread through Windows Update using a forged Microsoft certificate obtained with an MD5 collision attack.