topic Re: Detecting Flame exploit in General Topics

Detecting Flame exploit

grant_sturgis — Tue, 29 May 2012 22:00:21 GMT

It looks like the Snort folks have a signature for Flame, does PAN? If not, when is it coming? The CTOs will be asking if we are safe...

http://vrt-blog.snort.org/2012/05/flame-malware-targeted-attacks-and-you.html

Re: Detecting Flame exploit

apackard — Wed, 30 May 2012 12:30:16 GMT

My answer to that question is currently - "Unless we have offices in the Middle East I'm unaware of, are politically active in Middle Eastern politics, or could otherwise be the target for 3 letter acronym Western intelligence agencies, I do not believe Flame is a present threat - unless/until the code is re-worked by cyber-criminals and deployed for other means"...!

Re: Detecting Flame exploit

grant_sturgis — Wed, 30 May 2012 14:36:55 GMT

You prefer to wait until a threat is eminent before protecting yourself? That seems less than prudent.

Re: Detecting Flame exploit

mikand — Wed, 30 May 2012 19:50:28 GMT

Isnt that much more fun? Like using Microsoft products in your network - every day is a suprise when it comes to security 😉

I agree with thread starter - since snort have announced a bunch of ips-rules (which I assume also means that their commercial sourcefire IPS can already detect this) hopefully PA could do the same...

I tried threat vault to search for both flame and skywiper but no hits, hopefully someone from PA could inform the community whats going on (like which db update and date will have ips-rules to detect this)?

And dont say "contact your SE" ffs 😃

Re: Detecting Flame exploit

rmonvon — Wed, 30 May 2012 19:57:04 GMT

Hi...We will have an AV update for the flame exploits later today. Thanks.

Re: Detecting Flame exploit

sandro — Thu, 30 Aug 2012 05:45:27 GMT

Thanks for this, specially we have now a variant Shamoon.

IS AV now also updated for Shamoon?

Re: Detecting Flame exploit

mikand — Thu, 30 Aug 2012 08:53:58 GMT

I cant find anything right now about shamoon in https://threatvault.paloaltonetworks.com/ searching for vuln, spyware and virus (dont forget to change that dropdown to the right).

However plenty of flame variants when searching for flame in the virus container along with two generic signatures in spyware. Perhaps shamoon is already covered by one of the flame variants?

Tricky part of all these names is that the AV community tends to create their own name for each virus which means something that Kaspersky has named could be the very same thing but different name when looking in Symantec db's and so on.