Did you know that Microsoft’s Terminal Server Licensing Service (we’ll call it TSLS for convenience) generated certificates that could be used to sign code? No? Neither did Redmond. Flame leveraged a “0day” (zero day) within TSLS to sign its own code, allowing it to appear as if the code came from Microsoft. This allowed Flame to propagate itself in a network by fooling other machines into believing it was serving Windows Update packages, when in actuality, it was serving up Microsoft signed versions of Flame. More details follow… but first, here is some actionable intelligence:
What does this mean for you and your organization? Apply this fix (Bulletin, Patch) immediately. Unless the patch is applied, your machines may end up trusting malicious code. Retina provides detection for the vulnerable certificates via audit 16497 – Microsoft Revocation of Fraudulent Certificates (2718704).
Our original post (which goes into more detail) can be found at the eEye blog "Flame Malware Burns a Little Brighter".
Scott Lang, Sr. Director, Product Marketing at BeyondTrust
Scott Lang has nearly 20 years of experience in technology product marketing, currently guiding the product marketing strategy for BeyondTrust’s privileged account management solutions and vulnerability management solutions. Prior to joining BeyondTrust, Scott was director of security solution marketing at Dell, formerly Quest Software, where he was responsible for global security campaigns, product marketing for identity and access management and Windows server management.
