Is the Stuxnet Worm a State-Directed Cyber-Attack on Iran? 
Sunday, September 26, 2010 at 9:52
Scott Lucas in EA Iran, Stuxnet

A few weeks ago we noticed a report on Stuxnet, "a worm that targets critical infrastructure companies doesn't just steal data, it leaves a back door that could be used to remotely and secretly control plant operations". While the report on a threat to hijack refineries and power plants mentioned Iran and India as targets but it also raised the possibility of US energy companies.

In following weeks, however, chatter arose that the worm had been developed by a state --- given its complexity, it was considered to be beyond an individual or even private group --- to cripple Iran's nuclear programme, whether through the Bushehr energy plant or the Natanz uranium enrichment complex.

We refrained from coverage, primarily because we thought the story of Tehran as the target for Stuxnet might be a psychological operation rather than a statement of fact --- after all, Iran's worry that it could be the focus of cyber-warfare might be as damaging as an actual operation.

Yesterday, however the scene changed. For the first time, Iranian officials said that Iran's industries had been infected by the worm; one minister gave a figure of 30,000.

David Sanger summarises for the New York Times this morning. We're still careful --- note the expert who says, “It is easy to look at what we know about Stuxnet and jump to the conclusion that it is of American origin and Iran is the target, but there is no proof of that" --- but this story has moved from speculation to established and significant development:

The Iranian government agency that runs the country’s nuclear facilities, including those the West suspects are part of a weapons program, has reported that its engineers are trying to protect their facilities from a sophisticated computer worm that has infected industrial plants across Iran.

 The agency, the Atomic Energy Organization, did not specify whether the worm had already infected any of its nuclear facilities, including Natanz, the underground enrichment site that for several years has been a main target of American and Israeli covert programs.

But the announcement raised suspicions, and new questions, about the origins and target of the worm, Stuxnet, which computer experts say is a far cry from common computer malware that has affected the Internet for years. A worm is a self-replicating malware computer program. A virus is malware that infects its target by attaching itself to programs or documents.

Stuxnet, which was first publicly identified several months ago, is aimed solely at industrial equipment made by Siemens that controls oil pipelines, electric utilities, nuclear facilities and other large industrial sites. While it is not clear that Iran was the main target — the infection has also been reported in Indonesia, Pakistan, India and elsewhere — a disproportionate number of computers inside Iran appear to have been struck, according to reports by computer security monitors.

Given the sophistication of the worm and its aim at specific industrial systems, many experts believe it is most probably the work of a state, rather than independent hackers. The worm is able to attack computers that are disconnected from the Internet, usually to protect them; in those cases an infected USB drive is plugged into a computer. The worm can then spread itself within a computer network, and possibly to other networks.

The semiofficial Mehr news agency in Iran on Saturday quoted Reza Taghipour, a top official of the Ministry of Communications and Information Technology, as saying that “the effect and damage of this spy worm in government systems is not serious” and that it had been “more or less” halted.

But another Iranian official, Mahmud Liai of the Ministry of Industry and Mines, was quoted as saying that 30,000 computers had been affected, and that the worm was “part of the electronic warfare against Iran.”

ISNA, another Iranian news agency, had reported Friday that officials from Iran’s atomic energy agency had been meeting in recent days to discuss how to remove the Stuxnet worm, which exploits some previously unknown weaknesses in Microsoft's Windows software. Microsoft has said in recent days that it is fixing those vulnerabilities.

Read full article....

Article originally appeared on EA WorldView (http://www.enduringamerica.com/).
See website for complete article licensing information.