A Misuse Pattern for Flame

Flame is a computer worm that is being used for targeted cyber espionage in Middle Eastern countries. It is considered one of the most complex malware ever found. Flame can record audio, screenshots, keyboard activity and network traffic. It also has a kill switch to erase itself. Its program modules are encrypted. We are writing a misuse pattern to describe its architecture. A pattern is a solution to a recurrent problem in a given context. A pattern embodies the knowledge and experience of software developers and can be reused in new applications. A security pattern describes a mechanism or procedure to defend against an attack. A misuse pattern describes how a misuse is performed from the point of view of the attacker. It defines the environment where the attack is performed, countermeasures to stop it, and provides forensic information in order to trace the attack once it happens.