“The Flame malware used a cryptographic collision attack in combination with the terminal server licensing service certificates to sign code as if it came from Microsoft,” Mike Reavey, senior director of Microsoft’s Security Response Center, wrote. “However, code-signing without performing a collision is also possible. This is an avenue for compromise that may be used by additional attackers on customers not originally the focus of the Flame malware.”

The statement that a collision attack was used but wasn’t necessary to sign the Flame malware sent cryptographers scrambling to figure out exactly what it meant. Reavey didn’t elaborate.

One possible theory—advanced by Nate Lawson, a cryptographer and principal of security consultancy Root Labs—is that the weaknesses in Terminal Server allowed the attackers to mint the counterfeit Microsoft certificates while the collision attack gave them the ability to hide their identity.

“They could get a cert signed with one identity, then apply the signature to another cert,” Lawson explained. “Especially if Microsoft didn’t log every cert signing request, this would make it hard to determine exactly which customer was used to compromise them.”

To carry out such a feat, the Flame attackers would first have Microsoft sign some innocuous-looking certificate containing data that was known to create a collision. They would then use that data in the malicious certificate.

“Since the collision caused the hashes of both to be equal, the Microsoft signature can be ‘lifted’ from one cert and applied to the other,” Lawson said.

Whatever the motive, practical collision attacks are extremely rare. Microsoft’s claim that Flame was able to pull one off is one more reason to believe that whoever was behind the malware had unlimited resources and some exceptional talent.

Story updated to add the words “almost always” in the third paragraph.