Speaker 1: Brought to you by the reinvented two thousand twelve Camray.
Speaker 1: It's ready. Are you get in touch with technology? With
Speaker 1: tech Stuff from how stuff works dot com. Hello everyone,
Speaker 1: and welcome to tech Stuff. My name is Chris Poulette,
Speaker 1: and I'm an editor at how stuff works dot com.
Speaker 1: Sitting across from me as usual as senior writer Jonathan Strickland.
Speaker 1: Hey there, all right, then, so we're going to talk
Speaker 1: about the latest except it's not malware to make headlines
Speaker 1: all over the world and and and cause international incidents
Speaker 1: and all of that. As of the recording of this podcast. Anyway,
Speaker 1: by the time this podcast goes live, there may be
Speaker 1: even worse news. It's it's funny because we were talking
Speaker 1: about what we wanted to call this and and uh
Speaker 1: we we thought of all of our flame metaphors and
Speaker 1: jokes and puns and puns um and I was going
Speaker 1: to make the joke about it being our old flame
Speaker 1: even like except it's new. Except it, as it turns out,
Speaker 1: it's not this. This malware has been making headlines over
Speaker 1: the past few weeks as of the date of recording
Speaker 1: on June one and two thousand twelve. But as it
Speaker 1: turns out um this brand new, latest um Um malware.
Speaker 1: I was going to call it a virus, but let's
Speaker 1: just call it malware. UM isn't new at all, and
Speaker 1: that's one of the fascinating things about it. But there
Speaker 1: are many fascinating things. Yeah. The the component file name,
Speaker 1: the main part the foundation of this malware made date
Speaker 1: back as early as two thousand seven, possibly even earlier.
Speaker 1: And one of the reasons why this is a really
Speaker 1: fascinating uh, well, there's so many reasons why this is
Speaker 1: fascinating malware. One is that it was able to escape
Speaker 1: attention for so long. Yes, because you're talking about a
Speaker 1: file that is capable of doing lots and lots of
Speaker 1: stuff depending upon what you add to it, which is
Speaker 1: brings us to fascinating thing number two. It's a modular
Speaker 1: kind of malware. Now, in general, when someone creates some malware,
Speaker 1: there is there tends to be a specific goal in
Speaker 1: mind of the person who's designing it. Right, They're thinking,
Speaker 1: I want to design this malware because what it'll do
Speaker 1: is it allow me to get backdoor access to another
Speaker 1: person's computer, and I'll be able to get administrative control
Speaker 1: over that machine, and then I can create a button
Speaker 1: net that that would be one example. Or I want
Speaker 1: to record key strokes so that I can get user
Speaker 1: names and passwords for people's accounts and maybe commit identity
Speaker 1: theft right, Or I want to create a piece of
Speaker 1: code that will propagate itself across a network, which you know,
Speaker 1: on its own is just one thing like so you
Speaker 1: might want to add more to it. And and historically
Speaker 1: hackers and malware programmers have been doing that. They've been
Speaker 1: creating malware that either complements some other piece of code
Speaker 1: or it acts as the first step to another piece
Speaker 1: of code that can, in combination create whatever the effect
Speaker 1: is that the hacker wants. So there might be one
Speaker 1: part of the code that is designed to help get
Speaker 1: access to a network, or perhaps it's designed to UH
Speaker 1: to copy itself once it gets on a network. It
Speaker 1: might even be to copy itself multiple times on the
Speaker 1: same machine in order to fill up that machine's memory
Speaker 1: and and hard drive space so that you brick the machine.
Speaker 1: It all depends on what the goal is for the hacker, UH,
Speaker 1: and then there might be some other component that does
Speaker 1: something else on top of it. Well. What makes flames
Speaker 1: so interesting is that it takes this concept to a
Speaker 1: new level. It's a modular kind of malware, meaning that
Speaker 1: the basis of Flame is so that you can infect
Speaker 1: a machine and then you can send a modular tweak
Speaker 1: to that malware that's now living on the victims machine
Speaker 1: and give its specific abilities. So think of it in
Speaker 1: a way as kind of a very very much scaled
Speaker 1: down operating system. Kind of it's a platform. Yeah, So
Speaker 1: it's not not a full operating system in the traditional sense.
Speaker 1: It's not like it's uh, taking over your operating system
Speaker 1: and and interacting with your computer's hardware. It's just sort
Speaker 1: of on a on a high level, the same basic concept.
Speaker 1: It's acting as a platform that other applications can operate
Speaker 1: on top of and affect how your computer behaves. And
Speaker 1: it all depends on which modules you send to the
Speaker 1: Flame foundation that will allow it to do whatever it
Speaker 1: is he wanted to do. Right right. Um. When we
Speaker 1: talked about hackers before on the show, we've we've discussed
Speaker 1: people who are known as script kitties, and that that's
Speaker 1: what they sort of, uh that it's sort of a
Speaker 1: derogatory term for people who are very very basic, um
Speaker 1: hackers who you are intent on causing mischief and the
Speaker 1: reason they're called that is not UM. Well, the reason
Speaker 1: I want to talk about why they're called that is
Speaker 1: because in order to create malware, it doesn't take a
Speaker 1: whole lot of code. To do this. UM you could
Speaker 1: basically say write a script that says, look, I want
Speaker 1: you to erase you know, I want you to copy
Speaker 1: all the the addresses in the address book, email a
Speaker 1: copy of this script to everybody in the address book,
Speaker 1: and then wipe the hard drive clean. Ha ha. It
Speaker 1: really doesn't have to be that complex. And and one
Speaker 1: of the things that uh uh is also interesting about
Speaker 1: flame is that, as Jonathan said, it's modular, but it
Speaker 1: takes up twenty megabytes of space now and and our
Speaker 1: terms today, that's not a particularly large file. A lot
Speaker 1: of people have broadband, it's not an an issue to
Speaker 1: download a twenty megabyte file. But you really don't need
Speaker 1: that much code to have a basic virus or trojan. UM.
Speaker 1: This is extensively written code. It's very sophisticated code to
Speaker 1: allow additional modules to operate on the main system. And
Speaker 1: that's why organizations that have been affected by it believe
Speaker 1: that it might be state sponsored. We we should point
Speaker 1: out to that this is not something that you're likely
Speaker 1: to get on your PC. This is aimed at very
Speaker 1: high level government run systems. Apparently, Yeah, if you're a
Speaker 1: high level government official, then maybe your PC would be
Speaker 1: at risk if you're and to be more specific, if
Speaker 1: you're a high level government official in a country in
Speaker 1: the Middle East, because that tends to be the possibly Hungary,
Speaker 1: because those that those tend to be the countries that
Speaker 1: have been targeted. Specifically, Iran and Israel have had the
Speaker 1: largest number of infected computers, but there are other countries
Speaker 1: that also seem to have it, or at least those
Speaker 1: are the the countries that have computers running this software.
Speaker 1: I'm sorry, go ahead, go ahead, I was gonna say.
Speaker 1: Also the West Bank, Palestinian West Bank and uh Lebanon
Speaker 1: are are known to be places, and then oddly enough
Speaker 1: in Hungary, although I you know that's I was about
Speaker 1: to go into a Renaissance festival speak. I've managed to
Speaker 1: avoid it this entire season, and I almost said, I
Speaker 1: know not why that is so? Austria, Russia, Hong Kong. Yeah, Now,
Speaker 1: some of these may be unintentional targets, right, they may
Speaker 1: not be the targeted computers because you would The conclusion
Speaker 1: we draw is whichever countries seem to have the highest
Speaker 1: rates of infection are more likely to be the targeted countries.
Speaker 1: Of course, we can't know that for sure. It may
Speaker 1: be based upon just the behaviors of the people who
Speaker 1: work within that that that country, but it's a it's
Speaker 1: a fair indicator. Now, let's talk a little bit about
Speaker 1: what this malware can actually do and then why someone
Speaker 1: might use it to target those particular countries. Well, some
Speaker 1: people feel that it's a relative of stocks net or
Speaker 1: or Dooku, both of which have been known to circulate
Speaker 1: in the same part of the world. Um stucks net
Speaker 1: was aimed apparently at power plants and other structure stuff.
Speaker 1: I think it's safe to say stocks net was specifically
Speaker 1: engineered to target Iranian nuclear power facilities. That that's the way.
Speaker 1: That's that's the way it's presented. Yet because I didn't
Speaker 1: write it, so I don't know. One of the functions
Speaker 1: of stocks net was to change the the rate of
Speaker 1: revolutions per per minute for centrifuges, and the whole idea
Speaker 1: was that by changing that, that speed at which the
Speaker 1: centrifugure turns within a nuclear power facility you could cause
Speaker 1: a failure of that part of the facility, thus effectively
Speaker 1: shutting it down out um. Presumably if you could get
Speaker 1: it to spin uh erratically enough, you could cause more
Speaker 1: of a catastrophic failure than just you know, slowing down
Speaker 1: the program. But that appears to be what stucks net
Speaker 1: was all about. Now now we still don't have official
Speaker 1: news of who was behind it, although of course there
Speaker 1: are a lot of um, there are a lot of
Speaker 1: likely candidates. But but along those lines, Flame is a
Speaker 1: little different. Stucks Now, of course, was was looking at,
Speaker 1: at least from what we understand, physically, sabotaging a power facility.
Speaker 1: Flame looks like it's more about spying upon various targets.
Speaker 1: That's that's true. Um it is uh. It is also written,
Speaker 1: like those other two pieces of malware, using a h
Speaker 1: scripting language called Lua. I haven't ever heard that pronounced
Speaker 1: l u a, which is often used actually for in
Speaker 1: the gaming industry. Yeah, and Lua is an obscure enough
Speaker 1: language that it might actually be. One of the reasons
Speaker 1: why the hackers may have chosen Lua as one of
Speaker 1: the languages they worked in is because it was obscure
Speaker 1: enough to not raise red flags immediately. It wouldn't look
Speaker 1: like other kinds of malware just at first glance, and
Speaker 1: so that might be a reason why the hackers chose it,
Speaker 1: or may just be that the hackers were really really
Speaker 1: familiar with that particular language and it could do what
Speaker 1: they needed it to do. But Uh, a lot of
Speaker 1: the analysis I've read suggests that perhaps the reason for
Speaker 1: picking it was because it was less recognizable. But it does.
Speaker 1: Flame does record system information about the systems that it's on.
Speaker 1: Boy howdy does it. It's it's kind of an uh
Speaker 1: catch all when and again a lot of this depends
Speaker 1: on what modules are installed on top of Flame. You know,
Speaker 1: think about think about Flame in a way like uh,
Speaker 1: you would and operating system like iOS, and that you know,
Speaker 1: iOS can do lots of stuff, but it can do
Speaker 1: more stuff when you add apps to it. The apps
Speaker 1: give you very specific features. It's the basically the way
Speaker 1: that computers work exactly. So so, uh, Chris and I
Speaker 1: both happen to have an Android phone, different Android phones,
Speaker 1: and that I would wager that many of the apps
Speaker 1: that Chris has I do not have, and vice versa,
Speaker 1: and there are a few that we might have in common.
Speaker 1: And that that's because Chris wants this phone to do
Speaker 1: a certain set of things, and I want my phone
Speaker 1: to do a certain set of things. Hackers are the
Speaker 1: same way. They may want their their malware to do
Speaker 1: certain things in certain situations, and they don't necessarily need everything.
Speaker 1: It doesn't have to be a kitchen sink approach. So
Speaker 1: that's kind of the idea behind Flame. So some of
Speaker 1: the things that can do as far as cyber espionage go. Uh.
Speaker 1: It can do keyboard activities, So a key logger function,
Speaker 1: like Chris was talking about earlier, This is what tracks
Speaker 1: what keys are being pressed. Usually you use this so
Speaker 1: that you can find out things like passwords and that
Speaker 1: sort of stuff. It can monitor network traffic, so we
Speaker 1: can actually see what computers the infect the computer is
Speaker 1: communicating with and possibly even sniff out those that data.
Speaker 1: It can take screenshots, so the person on the other
Speaker 1: end of this uh, this connection can get a look
Speaker 1: at what the user is is looking at whenever they're
Speaker 1: using the computer. Also very important if that particular computer
Speaker 1: is used in a high security environment. It can even
Speaker 1: record audio. It can use a computer's microphone and record audio.
Speaker 1: So just imagine it's like bugging a a an office,
Speaker 1: except you don't have to put a bug in there,
Speaker 1: which is amazing how you think about it. There are
Speaker 1: you know, there are offices that are in such high
Speaker 1: security areas that there are frequent bug sweeps where the
Speaker 1: company or government agency will have someone come through and
Speaker 1: search for any electronic bugs that might have been planted
Speaker 1: there in order to record conversations. Well, this gets around
Speaker 1: that it turns the person's own computer into that recording instrument.
Speaker 1: It can even do things like a record Skype conversations.
Speaker 1: And the one I saw that I thought was particularly
Speaker 1: clever was there's apparently a module that will allow if
Speaker 1: the computer has Bluetooth capability, it will become a beacon,
Speaker 1: a Bluetooth beacon, and we'll try to connect with Bluetooth
Speaker 1: devices that are within range and download information from them. Interesting,
Speaker 1: So if you have a smartphone, you're a government official,
Speaker 1: and you've got a smartphone, you've got Bluetooth enabled so
Speaker 1: that you can use your cyborg earpiece that everyone tends
Speaker 1: to use, then that your computer might try to do
Speaker 1: a Bluetooth handshake with your device and pull information from
Speaker 1: your device into the computer so it can send it
Speaker 1: off to the hacker so it's all about gathering information.
Speaker 1: There's also been some some uh suggestions that perhaps this
Speaker 1: is related as well to another kind of malware. In fact,
Speaker 1: that malware may just be a module on top of
Speaker 1: Flame called Wiper, which does exactly what you would think
Speaker 1: it does. It wipes data from a device. So it
Speaker 1: may also not just be about data collection, but also
Speaker 1: destroying data. And in fact, it does look like there's
Speaker 1: been some some data loss, uh, particularly in Iran that
Speaker 1: may be due to this particular malware. UM. It is
Speaker 1: important to note too that this is not the only
Speaker 1: piece of modular mountainware out there. UM. It is just
Speaker 1: it is especially unusual in the size of this malware
Speaker 1: sophification and sophistication. UM. But yeah, it uh this is
Speaker 1: sort of an indication that, uh, the game might be
Speaker 1: afoot if you will, basically exactly what what what what's
Speaker 1: going on is And I think this is part of
Speaker 1: the reason that people are so if you if you
Speaker 1: follow the tech press or the tech media, let's say, um,
Speaker 1: you've probably seen a lot about this in the past
Speaker 1: few weeks. And I think the reason for that is
Speaker 1: because it's captured our imagination and it's it's made us
Speaker 1: all realize that, uh, electronic espionage is here. People are
Speaker 1: using it, and it's and it's not uh, it's not
Speaker 1: the exception anymore. I have the feeling that uh, and
Speaker 1: basically I am certainly not the only one from my
Speaker 1: my reading that uh, people seem to feel that this
Speaker 1: is state sponsored espionage and that this kind of thing
Speaker 1: is going to become more and more more common as
Speaker 1: the years go on, because this is the way the
Speaker 1: world does business um, and I mean all kinds of business. Um. Personally,
Speaker 1: I think the reason that it's designed to capture webcam
Speaker 1: stuff is so that they can postum videos on YouTube
Speaker 1: of high level officials dancing to Lady Gaga, videos in
Speaker 1: their closed offices that they've had swept for bugs so
Speaker 1: that they won't get caught doing it. That's ridiculous. That's
Speaker 1: Taylor Swift videos. But now the the the other thing
Speaker 1: about this is that I think it's interesting if you
Speaker 1: think that this this malware may have been around since
Speaker 1: two thousand seven, it shows that hackers were of the
Speaker 1: same mindset as Steve Jobs because they saw that apps
Speaker 1: were the next big thing. No really, seriously, when you
Speaker 1: think about it, it it is kind of amazing because they
Speaker 1: were thinking, well, let's make this a very flexible, adaptable
Speaker 1: malware system so that we can use it in multiple
Speaker 1: uh use cases and we don't have to again, we
Speaker 1: don't have to send the whole thing to everyone. Um
Speaker 1: it did you know? Just like other malware, it attempts
Speaker 1: to cover its tracks as much as possible, so that
Speaker 1: way you know that it can stay on an infected
Speaker 1: computer as long as possible. And it's very good at
Speaker 1: it if it's been around for years um and just
Speaker 1: now we're talking about it. Uh. And also it's it
Speaker 1: spreads kind of in a way similar to other types
Speaker 1: of malware. You might think, well, how does how do
Speaker 1: they get How is that initial entry into a system?
Speaker 1: How is that accomplished? Well, there are a couple of
Speaker 1: different ways you could do it. Um. There's some suggestion
Speaker 1: that perhaps it was a spear fishing attempt, which is
Speaker 1: where you have a specific target in mind and you know,
Speaker 1: you know, you have enough information about that target to
Speaker 1: be able to create an email that could tempt that
Speaker 1: target into executing a file that they probably shouldn't have done. Right.
Speaker 1: Phishing is uh with a pH is a social engineering
Speaker 1: tool to gather information you've probably just about everybody I'm
Speaker 1: sure who is listening to this has had a phishing
Speaker 1: email show up in their spam box where it says, hey,
Speaker 1: you've uh, your bank account has been compromised and we
Speaker 1: need you to send us your information. Um, and you go,
Speaker 1: you know, I haven't. I don't have an account at
Speaker 1: this bank and I've never had an account at this bank.
Speaker 1: I always chuckle at those because I think, nice try, um,
Speaker 1: but that that but that isn't what what fishing is
Speaker 1: known for. If you if you were to click on
Speaker 1: that link and go further and um enter your private
Speaker 1: information in there, they would be able to use that
Speaker 1: in identity theft um operation. But spear fishing is specifically
Speaker 1: targeted um as Jonathan said to a certain person. So
Speaker 1: it is especially effective because it says, hey, Jonathan in Strickland,
Speaker 1: we know that you have an account here. Uh and uh,
Speaker 1: this is a problem with your account. You need to
Speaker 1: enter your information stuff. There's been some unusual activity on
Speaker 1: your account. Which is even better because the unusual activity
Speaker 1: comes true. Yeah, because you go and you check your
Speaker 1: account and the next thing you know, you have actually
Speaker 1: given over the information to the people who will generate
Speaker 1: the unusual activity on your account. Don't ever follow those links. Yeah, no, no,
Speaker 1: it's better to it's better to go to those those
Speaker 1: sites directly through your your browser. Uh, as long as
Speaker 1: you don't have um the DNS changer now where on
Speaker 1: your computer, which leads you to the wrong browser anyway
Speaker 1: around wrong site rather anyway. So anyway, getting back to this,
Speaker 1: spear fishing is a very very possible way that this
Speaker 1: initially got out into the wild. However, it can also
Speaker 1: be spread through USB thumbsticks, which means getting physical access
Speaker 1: to someone's computer. Not always the easiest method, no, but
Speaker 1: that's that's exactly what they did with stucks Neat apparently,
Speaker 1: was they snuck it into nuclear power facilities on a
Speaker 1: USB flash drive, which you know it's not necessarily the
Speaker 1: easiest way, but it is. I mean, I guess it
Speaker 1: all depends on your target, because you could either do
Speaker 1: it yourself where you are. You know, you pose as
Speaker 1: say a technician saying I have to install this new
Speaker 1: software onto your computer so that we can maintain security,
Speaker 1: perhaps your Klaus Hergersheimer checking radiation shields, or you could
Speaker 1: uh actually mail thumbstick to a person and say here
Speaker 1: is the file you wanted and have them install it themselves.
Speaker 1: Sometimes it's that easy. Yeah, sometimes it sometimes that that works.
Speaker 1: I mean, because you know, people don't necessarily think, oh,
Speaker 1: there could be something bad on this thumb drive. By
Speaker 1: the way, there could be something bad on that thumb drive. Um,
Speaker 1: so you know that's another possibility. And also once it
Speaker 1: gets in the network, there were other ways of leveraging
Speaker 1: the network to help infect other computers. One of which
Speaker 1: I saw was using a printer spooling UH protocol where
Speaker 1: certain printers, you know, you could send the malware through
Speaker 1: the printer queue, and other computers as they connect to
Speaker 1: the printer queue could be infected that way, which is
Speaker 1: kind of interesting. But that means that you already have
Speaker 1: to get into the network initially in order to take
Speaker 1: advantage of something like that. So in other words, you
Speaker 1: can't just necessarily attack straight through the printer, although I
Speaker 1: suppose you could if it was a printer that had
Speaker 1: Internet connectivity and you had the password to get into that.
Speaker 1: But at any rate, it propagates through those ways, and
Speaker 1: apparently it will only do so under the direction of
Speaker 1: the hackers, So this is not the kind of malware
Speaker 1: that will just copy itself an infinite number of times
Speaker 1: and just send it to every single contact within a
Speaker 1: computers database. Instead, it's a very controlled attack, which is
Speaker 1: again another another reason why UH the analysts think this
Speaker 1: could be state sponsored, because typically if you have someone
Speaker 1: who's just interested in either creating as much trouble as
Speaker 1: possible or just trying to make a profit off whatever
Speaker 1: that is they're doing, they're probably less likely to have
Speaker 1: this sort of controlled approach where they're targeting specific computers,
Speaker 1: because why do that when you could go with a
Speaker 1: blanket bomb approach and just infect everyone you possibly can. UH.
Speaker 1: This appears to be much more of a precision attack,
Speaker 1: so that tends to suggest a state sponsored approach. Now
Speaker 1: by that we mean that some government has gone out
Speaker 1: and hired programmers to create this malware with the intent
Speaker 1: of using it on some other nations computers, possibly possibly
Speaker 1: computers within the own their own nation. I mean, it
Speaker 1: all depends on what the government's UH motives are, and
Speaker 1: then they're going to gather information and analyze it and
Speaker 1: make their own plans based upon what they see. So
Speaker 1: typical spy stuff as opposed to say a group of
Speaker 1: of you know, just just a group of hackers that
Speaker 1: just want to get as much information as possible in
Speaker 1: order to make as much money or as much trouble
Speaker 1: as they can. Yeah. The the country that has asserted
Speaker 1: the state sponsored claim more than any that I've seen
Speaker 1: is Iran, who blames Israel and the United States for
Speaker 1: the attack. And there was a statement from an Israeli
Speaker 1: government official that I think inadvertently kind of gave the
Speaker 1: the implication that Israel was directly involved. But I don't
Speaker 1: think that was the intention of the statement. Well, one
Speaker 1: way or the other. I'm sure it wasn't right, but
Speaker 1: the but the government official essentially said, we would you know,
Speaker 1: this is this is sort of that I'm paraphrasing here,
Speaker 1: this is the world we're in, and if if we
Speaker 1: think these tactics are going to work, we're going to
Speaker 1: use them, which essentially sounded like an admission. But the
Speaker 1: Israeli government very quickly said, no, no, no, we deny
Speaker 1: that we have anything to do with this. However, we
Speaker 1: could write a much more sophisticated program than that. Now
Speaker 1: I'm I'm kidding um, but yeah, I mean he they're
Speaker 1: saying that they they wouldn't uh, just because they did
Speaker 1: or did not launch this. This is the kind of
Speaker 1: thing that we're going to see more of, which is
Speaker 1: which is what the analysts have been saying too. Um.
Speaker 1: It was very unusual too, because the the organization known
Speaker 1: as f Secure, which is a h an anti known
Speaker 1: anti virus organization in Europe, was contacted by the Iranian
Speaker 1: Computer Emergency Response Team UH for assistance with that, but
Speaker 1: apparently it never never went through. But they did contact them,
Speaker 1: which is kind of unusual because usually they uh, Iran
Speaker 1: is kind of uh tight lipped about these kinds of
Speaker 1: things until you know, they can they can say something
Speaker 1: about it. But they were asking for help initially. Um.
Speaker 1: But yeah, as Jonathan was saying a minute ago, UM,
Speaker 1: that the attacks have been very targeted, and there we're
Speaker 1: not talking about hundreds of thousands or millions of computers
Speaker 1: that are infected like other malware has. We're talking about
Speaker 1: a few thousand at most now. There may be fewer
Speaker 1: than a thousand in fact, across the entire world, with
Speaker 1: the greatest concentration, like we said, being in the Middle East.
Speaker 1: And uh yeah, so it's you know, it's very possible
Speaker 1: that um that this is uh, this is not necessarily
Speaker 1: one of those global things that everyone should freak out about.
Speaker 1: What they should freak out about, rather than the nature
Speaker 1: of the threat that flame poses, is the nature of
Speaker 1: the threat that the type of malware flame is poses. So,
Speaker 1: in other words, in other words, it's not flame we
Speaker 1: need to worry about. It's the fact that now we
Speaker 1: know actually I guess it's better than we know. But
Speaker 1: right there's a proof of concept here. There's this malware
Speaker 1: that can exist, that can be incredibly effective at gathering information.
Speaker 1: And who's to say that the next version of this
Speaker 1: isn't already out there. In fact, it very well maybe
Speaker 1: out there right now. I'd be amazed if it weren't
Speaker 1: out there right now, to tell you the truth. And
Speaker 1: it's possible that it could be spying on more than
Speaker 1: just government or or infrastructure type of agencies. And also,
Speaker 1: even though this particular kind of malware it's all about
Speaker 1: gathering information that would be you know, espionage type stuff,
Speaker 1: there's nothing stopping any and else from taking that same
Speaker 1: model and applying it for things like stealing identities, stealing
Speaker 1: bank account information. You know that you could you could
Speaker 1: easily take the same approach and apply it to the
Speaker 1: very uh stereotypical means of you know what malware tends
Speaker 1: to do, and it could wreak a lot of havoc.
Speaker 1: And I think, I think when it comes to gathering
Speaker 1: information like all that information like listening into phone calls
Speaker 1: and stuff, I think that's probably not something that the
Speaker 1: average person needs to worry about, simply because if you're
Speaker 1: using a typical virus attack where you're trying to hit
Speaker 1: as wide a an audience as possible, it doesn't make
Speaker 1: a whole lot of sense to be filtering through that
Speaker 1: much information. You would have so much information hitting you
Speaker 1: that it would be the signal to noise ratio would
Speaker 1: be out of control, right, So you don't have Well,
Speaker 1: I was really hoping to get something I could use
Speaker 1: as blackmail for this guy, but I have to first
Speaker 1: sit through this three hour conversation he had with his
Speaker 1: grandmother about the sweater she knitted for him, And uh,
Speaker 1: that really is not giving me the juicy details I
Speaker 1: need in order to put the screws to this guy.
Speaker 1: So I mean, it's a it's a very real problem. Now. Granted,
Speaker 1: when you're talking about state sponsored you've got an entire
Speaker 1: departments again stuff through that, not to mention access to
Speaker 1: possible computers that can filter through data much more effectively
Speaker 1: than people can. But when you're talking about like hackers
Speaker 1: who are just trying to get data, you know, about
Speaker 1: a person, it's a different story. Now what they could
Speaker 1: do is if they wanted to infect a lot of
Speaker 1: computers and just cause mischief, then you're talking about some
Speaker 1: pretty serious issues too, Like you could talk about, you know,
Speaker 1: having computers have failures, talking about botton nets, that kind
Speaker 1: of thing. Um, Now do we need to worry that
Speaker 1: our computers are all infected? Well, what you need to
Speaker 1: do is do the same thing that we recommend in
Speaker 1: every podcast we ever talk about when it comes to malware.
Speaker 1: Back up your hard drive and use virus protection, virus
Speaker 1: protection software, use a firewall, anti virus protection, protect those viruses. Wait, no,
Speaker 1: that's not what I meant protect yourself from viruses. Yes,
Speaker 1: you want anti virus software, reliable antivirus software. You want
Speaker 1: to keep it up to date. You want to keep
Speaker 1: your operatings system up to date, because as you patch
Speaker 1: your operating system, it plugs up vulnerabilities that get discovered
Speaker 1: over time. Because that's that's what they're doing, really, Um,
Speaker 1: a hacker is not necessarily somebody who's evil, but it's
Speaker 1: somebody who takes something apart two uh re engineer it,
Speaker 1: or or to find a different use for it, or
Speaker 1: to find something that's wrong with it. Um And in
Speaker 1: this case, what the computer hackers are doing is finding
Speaker 1: flaws in an operating system, and it can be any
Speaker 1: operating system in the case of Flame. And we should
Speaker 1: point out these are Windows based machines that are being
Speaker 1: attacked by Flame. We didn't talk about that in your
Speaker 1: first of all the podcast A Windows based machines, but yes,
Speaker 1: there are Any upbring system has vulnerabilities because operating systems
Speaker 1: are built by humans, and humans don't always think of
Speaker 1: every contingency. It's just impossible to do. And while you
Speaker 1: are building an operating system, or building any system, you're
Speaker 1: looking at it from one perspective. You're thinking, how can
Speaker 1: I make this as secure as possible? The hackers looking
Speaker 1: at thinking how can I get into that system? And
Speaker 1: they're going to start looking at ways that you could
Speaker 1: not have thought of, because they're going to see what
Speaker 1: you have thought of and go beyond that. It's it's
Speaker 1: just that's the way the game works. But then as
Speaker 1: vulnerabilities are are discovered, then you have the flip flop.
Speaker 1: You know, you've got the reaction to it where you
Speaker 1: plug that vulnerability. Now that might create other vulnerabilities, or
Speaker 1: maybe that other vulnerabilities exist that you have not yet discovered.
Speaker 1: That's why it's important for you to make sure that
Speaker 1: you update your operating system as updates become available. Yes,
Speaker 1: I know it can be irritating, especially if you're on
Speaker 1: a slower connection, to have to update your operating system
Speaker 1: every week and you're shutting down your computer and it
Speaker 1: says installing update one of thirty three, I wanted to
Speaker 1: go home. Um, But still it's better to do it
Speaker 1: and to maintain as high a level of security as
Speaker 1: you can. And ultimately, the most important thing I think,
Speaker 1: besides the antivirus software and plugging the operating system, is
Speaker 1: engage in good behavior in the sense of don't open
Speaker 1: strange links, don't execute files that are sent to you
Speaker 1: from people you don't know. If it's sent to you
Speaker 1: by someone who does you do know, make sure that
Speaker 1: you contact that person first and say, hey, I got
Speaker 1: this email from you and had this file in it.
Speaker 1: Is this what I think it is? Is it cool?
Speaker 1: Because it may be that your friends computer has been
Speaker 1: infected and that you're getting a file that is automatically
Speaker 1: generated because it's gone through that friends contact list and
Speaker 1: you have to be on it. You know, think of
Speaker 1: the think the way hackers think, and make sure you
Speaker 1: don't engage in those high risk behaviors that hackers target
Speaker 1: because they're they've proven to be effective tools. And if
Speaker 1: you managed to do that, if you avoid the high
Speaker 1: risk behaviors and you keep your antivirus software up to date,
Speaker 1: and you keep your oberating system out to date, you
Speaker 1: have done as much as you can to prevent this
Speaker 1: sort of stuff from infecting your computer. Doesn't mean that
Speaker 1: it's full proof, but it it dramatically decreases those chances. Yes,
Speaker 1: as Jonathan was was saying, there there could be uh contingencies.
Speaker 1: Flame actually looks for anti virus software, especially the more
Speaker 1: common manufacturers software, and it looks for things that are
Speaker 1: going to report unusual activity online activity their applications for
Speaker 1: I think pretty much every operating system that will say, hey, uh,
Speaker 1: this program is sending message out? Is it supposed to
Speaker 1: be sending a message out? UM? And I've seen malware
Speaker 1: for for multiple operating systems be able to detect that.
Speaker 1: So it's looking for anything that's going to report on
Speaker 1: its activity or or try to eliminate it UM. And
Speaker 1: of course, if it's something as sophisticated as Flame UM,
Speaker 1: the software can be updated by the hackers to get
Speaker 1: around virus detection software UM. So the vulnerabilities UM that
Speaker 1: that initially allowed Flame to operate apparently been patched and
Speaker 1: more some time ago. Again, if if if the people
Speaker 1: who UM had been using those operating systems had patched
Speaker 1: their software would have made it a lot more difficult. Now,
Speaker 1: if if the hacker has a backdoor into that software,
Speaker 1: then he or she can say, okay, uh, this vulnerability
Speaker 1: has been patched, but this one is still open from
Speaker 1: now on, use this door out into the internet instead
Speaker 1: of the one that you were using before and stay.
Speaker 1: And that allows them to stay one step ahead. But again,
Speaker 1: if you if you take those steps UH to keep
Speaker 1: your anti virus in your operating system patched as often
Speaker 1: as you can, as as it's done regularly, then you
Speaker 1: you stand a much better chance at at preventing something
Speaker 1: like this from happening. Yeah, again, not full proof, but
Speaker 1: at least it decreases that percentage. It's fascinating to to
Speaker 1: look at these modules because you it's it's such an
Speaker 1: amazing architecture. UM. It's it's obvious that the people who
Speaker 1: wrote the software UH intended to set up shop and
Speaker 1: the operating systems of the people whose infect whose computers
Speaker 1: were infected by the software by this malware, and and
Speaker 1: UH they intended to stay there for as long as
Speaker 1: they could and record as much information as they could
Speaker 1: about the operating system, about anything that they can connect to. UM.
Speaker 1: So they they were playing for real. Yeah. The only
Speaker 1: thing I think, the only indicator that shows that they
Speaker 1: were not completely fully baked when when it rolled out
Speaker 1: is that it does not let you play angry Birds.
Speaker 1: Otherwise I think it was a pretty strong modular system.
Speaker 1: But until the system has Angry Birds on it, I
Speaker 1: considered incomplete all right then all right, So that kind
Speaker 1: of that kind of sums up the the knowledge we
Speaker 1: have as the recording of this podcast about Flame. Of course,
Speaker 1: by the time this publishes, we may have more information,
Speaker 1: such as a stronger indicator of who might be responsible.
Speaker 1: Although I don't know what's duck set. It's been out
Speaker 1: for so long and people still don't know. Although yeah,
Speaker 1: both with stucks neet and with flame. The the most
Speaker 1: of the fingers are pointing towards Israel. In the United States, again,
Speaker 1: no smoking gun, and there's lots of flame, but no
Speaker 1: smoking gun. Well and uh, of course, as we know, um,
Speaker 1: internet hackers have been known to find ways to point
Speaker 1: the finger at someone else. Um. They're very good at
Speaker 1: hiding their tracks and making somebody Well. The names of
Speaker 1: these modules are all in uh, in English and somewhat slangy.
Speaker 1: Some of them are are slang terms, so uh, you
Speaker 1: know it kind of says, oh, well, somebody who's very
Speaker 1: familiar with English probably wrote this software. Um. Yeah, so
Speaker 1: that's why I would want to I want to get
Speaker 1: like if I were to write some malware, I'd want
Speaker 1: to get slang and something like Romanian. Yeah. Well, the
Speaker 1: penguins in Australia who wrote this software very sophisticated and
Speaker 1: and and nobody's going to point a flipper at them.
Speaker 1: So now you're suggesting it's lenox. I see what you're saying. Yeah,
Speaker 1: Tucks and his buddies down there. So well, I think
Speaker 1: that wraps up our discussion here now. Granted, what'll be
Speaker 1: interesting to see is if we see future outbreaks of
Speaker 1: malware that follow in flames smoking footsteps. Uh, because it is.
Speaker 1: It has proven to be a pretty effective tactic. And
Speaker 1: of course, you know, we would expect any future form
Speaker 1: of this sort of attack to take to be different
Speaker 1: enough so that it would not immediately trigger suspicion once
Speaker 1: someone downloaded it. Uh, tony megabyte file is like you said,
Speaker 1: that's significant for malware. It's not still not significant compared
Speaker 1: to say a good music file, but uh, yeah, you
Speaker 1: never know. So guys, be careful out there again. Don't
Speaker 1: need to worry about flame unless you are a high
Speaker 1: ranking government official or you run some sort of important
Speaker 1: facility in the Middle East. And but you know, being
Speaker 1: careful is always good no matter no matter what area
Speaker 1: of life you might fall in. And let us know
Speaker 1: what you would like us to talk about in future episodes.
Speaker 1: You can untacked us via email our addressed as tech
Speaker 1: stuff at Discovery dot com or less know on Facebook
Speaker 1: or Twitter are handled There is tech stuff hs W
Speaker 1: and Chris and I will talk to you again really soon. Hey. Uh,
Speaker 1: you know when we were recorded this podcast initially, yes,
Speaker 1: we talked about things like who was responsible for the
Speaker 1: flame virus, saying that it could literally be anyone. It
Speaker 1: could literally be anyone and one in the world. And
Speaker 1: it was very similar to stucks net. No no connection
Speaker 1: to stucks net at all. Yeah, but it was awfully
Speaker 1: similar in boy, isn't that weird? Okay? Yeah. So, as
Speaker 1: it turns out, since we recorded that podcast, almost broke
Speaker 1: almost I'm sorry not to interrupt, almost literally right after
Speaker 1: we recorded this, it went like a day, Yeah, exactly
Speaker 1: like it was. By the next week, the news had
Speaker 1: broken that that Flame, the code for Flame resembled to
Speaker 1: the point of identity part of the code or an
Speaker 1: early iteration of stucks net, which is an incredibly strong
Speaker 1: indicator that those responsible for the creation of Flame were
Speaker 1: also involved in creating stucks net. So that narrows down
Speaker 1: that field dramatically. And as Chris said, when we recorded
Speaker 1: the podcast, that information had not become public. But now
Speaker 1: we know that stucks net and Flame share enough similar
Speaker 1: code to give us the confidence in saying the same
Speaker 1: parties were involved in the creation of both, So that
Speaker 1: also limits who could have been behind it in other ways.
Speaker 1: Right now, it the accusations have pretty much centered and
Speaker 1: they have since ducks net became public. They've centered on
Speaker 1: the United States and Israel. Yes, and although neither country
Speaker 1: has officially confirmed anything, the evidence, I can't imagine that
Speaker 1: they would. No, I can't either, but uh, the evidence
Speaker 1: has has pointed even more strongly since then. So I mean,
Speaker 1: I would say it's safe that neither Jonathan nor I
Speaker 1: can confirm or deny any you know, any involvement by
Speaker 1: any government anywhere. I can. I can deny that I
Speaker 1: had any involvement. Yes, that's about that. But as far
Speaker 1: as I can, the evidence is is stronger now to
Speaker 1: suggest that based on based on the information that we've
Speaker 1: received in the media. So, and there was also an
Speaker 1: interesting discussion that popped up, and I think it's one
Speaker 1: that we can have a kind of a quick version
Speaker 1: of it here on our show about stuckx net and
Speaker 1: Flame both existed on computers for years before anyone else
Speaker 1: outside of the operations knew anything was going on. Yeah,
Speaker 1: and it's amazing because it seems very fresh to us,
Speaker 1: but it has been out there for quite some time.
Speaker 1: So right, it remained under tected for years. And in
Speaker 1: the case of Flame, you're talking about a significant file size.
Speaker 1: It's a small piece of code. Uh. The argument I've
Speaker 1: seen says that the era of anti virus software is
Speaker 1: over because if anti virus software can't protect you from
Speaker 1: these things that they can remain hidden for years, then
Speaker 1: it is useless. Now yeah, I think I think that's
Speaker 1: I think that's extremist. Now, I do agree that if
Speaker 1: code goes undetected, anti virus software is of little help
Speaker 1: in that case for something of that variety. Now, uh,
Speaker 1: we're when we're talking about the victims of flame and
Speaker 1: stuck s net. These are not you know, people sitting
Speaker 1: at home, uh, you know, checking the web in their email.
Speaker 1: The targets, yes, these are These are are targeted organizations
Speaker 1: and governments. Um. And it is more likely that you
Speaker 1: or I would be targeted by uh script kitties sending
Speaker 1: virus is by email or by phishing or even spear
Speaker 1: fishing for that matter. So yes, I think for everyday folks,
Speaker 1: protecting their computers is still a very very good idea
Speaker 1: backing them up and using virus protection software. Yes, yes,
Speaker 1: and please and remember I mean these these security firms,
Speaker 1: as soon as they identify malware, they are at work
Speaker 1: to try and incorporate that into the anti virus software
Speaker 1: so that you can detect it. And prevent it from
Speaker 1: infecting your computer. Because just because something has become known
Speaker 1: doesn't mean it's no longer dangerous. It's still dangerous. Uh.
Speaker 1: If it's unknown, then it's extra dangerous because your software
Speaker 1: may not be able to protect you against it. But yeah,
Speaker 1: I agree, Chris. I don't think that anti virus software
Speaker 1: is useless. I think it's still has a place. I
Speaker 1: think you have to couple antivirus software with smart computing
Speaker 1: practices and that will help protect you from malware. Yes,
Speaker 1: all right, Well that wraps up our PostScript, so uh,
Speaker 1: please don't write us telling us that we missed out
Speaker 1: on that fact. We did, but we we fixed it.
Speaker 1: For more on this and thousands of other topics. Is
Speaker 1: it how staff works dot com? Brought to you by
Speaker 1: the reinvented two thousand twelve camera. It's ready, are you