|Iran 'targeted by new computer virus'|
Official says Stars - the second virus to attack country's network in eight months - is under investigation by experts.
Last Modified: 25 Apr 2011 17:47
Iran has been targeted by a new computer virus in a "cyber war" waged by its enemies, according to a senior military official of the Islamic republic.
Gholam Reza Jalali, commander of civil defence, told the semi-official Mehr news agency on Monday that the new virus, called Stars, was being investigated by experts.
"Certain characteristics about the Stars virus have been identified, including that it is compatible with the [targeted] system," he said.
He said that Iranian experts were still investigating the full scope of the malware's abilities.
Jalali played down the impact of Stars, but said it is "harmonious" with computer systems and "inflicts minor damage in the initial stage and might be mistaken for executive files of governmental organisations".
He did not say what equipment or facilities the virus targeted, or when experts first detected it.
Stars is the second serious computer worm to hit Iran in the past eight months.
Iran was hit with another computer worm, Stuxnet, last year, reportedly designed to hurt Iran's controversial nuclear programme.
The country has accused the US and Israel of launching Stuxnet, which was publicly identified last June and reportedly mutated and infected at least 30,000 computerised industrial equipment in the following months.
The existence of Stuxnet became public knowledge around the time that Iran began loading fuel into Bushehr, its first nuclear reactor, last August.
Iran said in September that staff computers at Bushehr had been hit but that the plant itself was unharmed.
Bushehr is still not operational, having missed several start-up deadlines. This has prompted speculation that Stuxnet damaged the plant.
But Iran said its scientists discovered and neutralised the malware before it could cause serious damage.
Iran's civil defense chief, Gholam Reza Jalali, said yesterday the country had been attacked by another computer virus called Stars. If correct it will be the second cyber attack in less than a year.
According to Jalili via RTT news, the virus specifically targeted Iran's governmental institutions and may have been cloaked as innocuous looking, official files.
Jalili said the virus could have been "mistaken for executive files of governmental organizations." However, he refused to speculate on identities of likely suspects.
Iran's Bushehr nuclear power plant was struck by the Stuxnet worm in September 2010. Due to the nature of the attack, President Mahmoud Ahmadinejad claimed the virus was created by the United States and Israel.
No evidence of the worms origin were discovered.
Iran Alleges Espionage Over Internet WormSenior government official says foreign governments are launching malware dubbed Stars at the country's nuclear facilities.
Brigadier general Gholam Reza Jalali, Iran's head of civil defense, on Monday told the Iranian Mehr news agency that the country has detected a new worm that targets government systems. "The damage is very low in the first phase," said Jalali. "The executable files may sometimes be confused with official state documents."
More Security Insights
- Virtualization's Phantom Menace: Security
- Preventing Enterprise Data Loss: Best Practices To Identify, Control And Manage Sensitive Data
He also warned that although the Stars malware had been discovered--he didn't specify how--researchers still didn't understand its purpose or how exactly it operates, meaning that it might still unleash some type of attack. Finally, he called for legal sanctions against whomever launched Stars.
According to security experts, Jalali's description of the worm makes it sound as if the attack employs malicious Word, Excel, or PDF files, and that echoes a recent series of targeted attacks that have exploited a vulnerability in Flash. But is a worm that targets a government network anything to write home about? In fact, wouldn't the absence of targeted attacks suggest that government agencies simply weren't spotting attacks that were sure to be underway?
Learn the security essentials of mobilityBusiness-Ready Mobile Infrastructure
"From my perspective, most governments will be running into and dealing with targeted attacks," said James Lyne, director of technology strategy at Sophos, in an email interview. "Targeted attacks are common today--even for medium-size enterprises."
"In many cases, we see targeted phishing attempts--though the volume is still 'spray and pray,' where an attacker may just be lucky and hit the right system," he said. "The quality of these attacks ranges from basic social engineering or Web threats--low tech can still be very successful--to quite coordinated and clever malicious code."
Of course, any apparent phishing attack against Iran raises the specter of Stuxnet, which apparently targeted five facilities related to an Iranian nuclear enrichment facility to then infect systems at the facility. Beginning in June 2009, the worm spread, ultimately infecting the facility's supervisory control and data acquisition (SCADA) software, which was supplied by Siemens. The malware then adjusted the speeds of the high-frequency converter drives used for enrichment, from very low to very high frequencies, while failing to report this activity via the user interface.
Ultimately, Stuxnet disrupted the refinement process and, according to some reports, disabled the drives. Iran, however, has denied that any equipment was damaged, or its nuclear program disrupted.
Earlier this month, Jalali told the Islamic Republic News Service, Iran's state news agency, that Siemens was partially to blame for Stuxnet. "Siemens should explain why and how it provided the enemies with the information about the codes of the SCADA software (which is used at some of Iran's major industrial sites) and prepared the ground for a cyber attack against us," he said, according to the Tehran Times.
Jalali also said that Iran's investigation traced the origin of the worm to the United States and Israel, and identified transmissions back to those countries from PCs infected by Stuxnet. On a similar note, earlier this year, a New York Times story quoted unnamed officials who said that that Stuxnet was a joint American and Israeli creation.
Jalali also called for legal action against the companies and countries that launched Stuxnet. "The attacking countries should be held legally responsible for the cyber attack," he said. "If we were not ready to tackle the crisis and their attack was successful, the attack could have created tragic incidents at the country's industrial sites and refineries."