Researchers: Flame's Windows Update Hack Necessitated World-Class Cryptanalysis

Researchers: Flame's Windows Update Hack Necessitated World-Class Cryptanalysis
Flame's authors used a previously unknown MD5 collision attack variant, cryptanalysts say
By Lucian Constantin
News Jun 11th 2012

The Flame cyber-espionage malware makes use of a previously unknown cryptographic attack variant that required world-class cryptanalysis to develop, experts from the Dutch national research center for mathematics and computer science (CWI) said on Thursday.

The cryptographic attack, known as an MD5 chosen prefix collision, was used by Flame's creators to generate a rogue Microsoft digital code-signing certificate that allowed them to distribute the malware to Windows computers as an update from Microsoft.

Microsoft's security engineers explained how the MD5 collision attack worked in a blog post on Wednesday. In their article, they referenced older chosen prefix collision research by cryptanalysts Marc Stevens, Arjen Lenstra, and Benne de Weger.

Stevens, Lenstra and de Weger were part of a larger international team of researchers who, in 2008, demonstrated a practical MD5 collision attack which allowed them to create a rogue SSL certificate trusted by all browsers.

Stevens, who is a scientific staff member in the cryptology group at CWI, analyzed the rogue Microsoft certificate used by Flame's authors and determined that they used a different MD5 collision attack than the one devised by him and his colleagues in 2008. "The design of this new variant required world-class cryptanalysis," Stevens said in a blog post on Thursday.

Ronald Cramer, the head of the cryptology research group at CWI and professor at the Mathematical Institute of Leiden University in the Netherlands agreed with Stevens' assessment. "This is not a job done by amateurs," he said.