杏吧原创

HERE we go again. Antivirus firms are warning that another computer worm has evaded their radar. Nicknamed Flame, it is described as one of the most complex viruses ever and has the power to cripple national infrastructure. But a full two years after the last major threat 鈥� Stuxnet 鈥� was discovered, its authors have still not been exposed, although suggests they work for US and Israeli intelligence (see 鈥�Obama 鈥榞ave full backing to Stuxnet attack on Iran鈥�鈥�). So what chance is there of tracking down the creators of this latest threat?

Parts of Flame surfaced online as far back as 2004, according to Boldizs谩r Bencs谩th of the at the Budapest University of Technology and Economics in Hungary. Despite this, it was not formally identified until Kaspersky Lab of Moscow, Russia, discovered what was deleting data on hundreds of computers across the Middle East. Iran and Israel took the biggest hits, with Flame even briefly disrupting Iran鈥檚 oil industry, according to senior Iranian officials.

On 28 May, Kaspersky revealed the cause: an all-in-one 鈥渨orm, trojan and backdoor鈥� Flame. It is a remotely reprogrammable data stealer that can seize, transmit and then delete files. Its six-megabyte heart can download extra modules until it swells to 20 MB, giving it a broad range of data-stealing tricks, says Gavin O鈥橤orman at 鈥榮 lab in Dublin, Ireland. 鈥淚t鈥檚 most likely this info-stealing is for espionage. It can turn a mic on to record audio, or video what you are doing on screen,鈥� he says.

It鈥檚 stealthy, too. Iran鈥檚 national says the code鈥檚 malicious components were undetectable by 43 antivirus programs. 鈥淪tuxnet, Duqu and Flame are all examples of cases where we 鈥� the antivirus industry 鈥� have failed,鈥� says Mikko Hypponen, founder of antivirus firm F-Secure. But while the industry tries to work out why it failed, it looks almost impossible for the malware鈥檚 creators to be found.

Here鈥檚 why. 鈥淚f I write the code 鈥榩rint 鈥淗ello鈥濃�� and then load it to a forum via a proxy or Tor connection, what link is there to me? Simply, none. The same principle exists with malware,鈥� says Nick Furneaux of e-forensics firm in Bristol, UK. Attackers can also cover their tracks by bouncing commands to the malware via cascades of servers, says Bencs谩th. 鈥淚f an attacker hides by using multiple jumping points, it is almost impossible to identify them,鈥� he says. 鈥淎nd the forensics mostly lead you to a computer that is fully cleared, erased.鈥�

To catch them, investigators have to pray their quarry makes a mistake. 鈥淚鈥檝e seen mistakes made in malware such as hard coding IP and email addresses, or a user name, which can be used to find the perpetrator,鈥� says Furneaux. Another giveaway is coding style, says O鈥橤orman: 鈥淵ou might find file-naming conventions or how data is passed between functions is characteristic of a known coder.鈥� Indeed, it was a coding mistake that revealed Stuxnet existed.

, a security researcher at BT鈥檚 lab in Ipswich, UK, hopes their emerging AI-based pattern recognition system, Saturn, will snare threats like Flame. It 鈥渨ill sense the subtle network disruptions and cyber footprints left by such attacks鈥�, instantly alerting security analysts, he says. This might help, says Bencs谩th: 鈥淚f the attackers are caught mid-attack, and they do not know about it, it becomes possible to track them down.鈥�

聯If the attackers are caught mid-attack, and they do not know about it, they can be tracked聰