Stuxnet Cyber attack suspected on Iranian N-plans

[Andrew49]

A computer virus that has infected more than 60,000 machines in Iran may be a sophisticated cyber-warfare attack on Iran's clandestine nuclear arms program, according to software experts. The "Stuxnet Worm" was detected in July but has since evolved through a number of refinements. This virus is distinct because it is designed to attack the software that controls machinery in a specific industrial installation. Industry experts have speculated that the target could be the Natanz facility, where Iran conducts its nuclear enrichment program. Western computer software engineers have spent months examining the virus, which remains focused on Iran, although smaller outbreaks have occurred in Indonesia, India and Pakistan. Link (http://www.theaustralian.com.au/news/world/cyber-attack-suspected-on-iranian-n-plans/story-e6frg6so-1225929300797)

A complex computer worm has infected the personal computers of staff at Iran's first nuclear power station, the official IRNA news agency reported.
The BBC (http://www.bbc.co.uk/news/world-middle-east-11414483)

- - - - - -

Stuxnet is a Windows-specific computer worm first discovered in June 2010 by VirusBlokAda, a security firm based in Belarus. It is notable because it is the first discovered worm that spies on and reprograms industrial systems. It was specifically written to attack SCADA systems which are used to control and monitor industrial processes. Stuxnet includes the capability to reprogram the programmable logic controllers (PLCs) and hide the changes.

Stuxnet attacks Windows systems using four zero-day attacks (including the CPLINK vulnerability and a vulnerability used by the Conficker worm) and targets systems using Siemens' WinCC/PCS 7 SCADA software. A Siemens spokesperson said that the worm was found on 15 systems with five of the infected systems being process manufacturing plants in Germany. Siemens claims that no active infections have been found and there were no reports of damages caused by the worm. Symantec claims that the majority of infected systems were in Iran.

Has World War III already started?

[Mick Tully]

A computer virus that has infected more than 60,000 machines in Iran may be a sophisticated cyber-warfare attack on Iran's clandestine nuclear arms program, according to software experts. The "Stuxnet Worm" was detected in July but has since evolved through a number of refinements. This virus is distinct because it is designed to attack the software that controls machinery in a specific industrial installation. Industry experts have speculated that the target could be the Natanz facility, where Iran conducts its nuclear enrichment program. Western computer software engineers have spent months examining the virus, which remains focused on Iran, although smaller outbreaks have occurred in Indonesia, India and Pakistan. Link (http://www.theaustralian.com.au/news/world/cyber-attack-suspected-on-iranian-n-plans/story-e6frg6so-1225929300797)

A complex computer worm has infected the personal computers of staff at Iran's first nuclear power station, the official IRNA news agency reported.
The BBC (http://www.bbc.co.uk/news/world-middle-east-11414483)

- - - - - -

Stuxnet is a Windows-specific computer worm first discovered in June 2010 by VirusBlokAda, a security firm based in Belarus. It is notable because it is the first discovered worm that spies on and reprograms industrial systems. It was specifically written to attack SCADA systems which are used to control and monitor industrial processes. Stuxnet includes the capability to reprogram the programmable logic controllers (PLCs) and hide the changes.

Stuxnet attacks Windows systems using four zero-day attacks (including the CPLINK vulnerability and a vulnerability used by the Conficker worm) and targets systems using Siemens' WinCC/PCS 7 SCADA software. A Siemens spokesperson said that the worm was found on 15 systems with five of the infected systems being process manufacturing plants in Germany. Siemens claims that no active infections have been found and there were no reports of damages caused by the worm. Symantec claims that the majority of infected systems were in Iran.

Has World War III already started?

I think the biggest threat thats out there is Pakistan. The first start of world war 3 will start there. Iran is only a side show to keep the yanks at home happy.

[C. Flower]

There was the mosts peculiar report last week about US nuclear installations being attacked by little UFOs. So bizarre that I didn't post it for fear of the consequences for reputation etc.

I'll see if I can dig it out.

[C. Flower]

There you go - Reuters ran with it and only UFO sites picked it up.

http://www.reuters.com/article/idUS166901+15-Sep-2010+PRN20100915

These guys say they saw small flying objects at the bases they worked on, up to 2003. This doesn't explain why they thought they were UFOs, or why they have waited until 2010 to talk about them. Book coming out, maybe?

Sorry this is not directly on topic, but in a way it's surprising how little weaponry appears to have changed in the last fifty years.

Obama widely publicised a move into Cyberwar preparations within months of coming to power.

[TotalMayhem]

Stuxnet is a Windows-specific computer worm

The stupidity of government agencies using computers with a NSA backdoor (in Windows) boggles the mind. :D

[Andrew49]

There you go - Reuters ran with it and only UFO sites picked it up.

http://www.reuters.com/article/idUS166901+15-Sep-2010+PRN20100915

These guys say they saw small flying objects at the bases they worked on, up to 2003. This doesn't explain why they thought they were UFOs, or why they have waited until 2010 to talk about them. Book coming out, maybe?

Sorry this is not directly on topic, but in a way it's surprising how little weaponry appears to have changed in the last fifty years.

Obama widely publicised a move into Cyberwar preparations within months of coming to power.


The stupidity of government agencies using computers with a NSA backdoor (in Windows) boggles the mind. :D

It's 1976, at an airport in Japan an aircraft never seen before in Japan drops undetected onto the runway. One Victor Belenko had just delivered a MIG 25 Foxbat to the Japanese and inevitably to the CIA. This one aircraft had caused consternation in the west for 15 years as it was faster and higher flying than any other combat aircraft. And here the CIA had one on a plate. The thing was then stripped and examined and there followed a report that whilst accepting it's performance, concluded it was crude and primitive - made of steel rather than titanium and far inferior to western aircraft in terms of technology.

Strangely this crude aircraft, then nearly 30 years old, proved invulnerable to interception during the Gulf war despite F16's, F15's et al busting a gut to get near enough to shoot one down. One of the things the CIA sneered at was the fact that the Foxbat used valves in its radar. This was due to the embargo on hi-tech export to the USSR according to the CIA, but the fact that the valves were less vulnerable to the "flash" of RF produced by the nuclear air-to-air missiles the US possessed had something to do with it.

[Kev Bar]

**** man - it's a way more enlightened way to attack what you don't like than using a real virus or disputing atoms.

[Lapsedmethodist]

From today's Indo :-

http://www.independent.ie/national-news/first-cyber-war-irish-experts-test-raises-end-of-world-fears-2363474.html

YouTube of the experiment described in the piece.
YouTube - Stuxnet demo in Virus Bulletin 2010 conference

[StewieG]

Alex jones was making a big deal about this stunt . He made the rather valid point imo , that Iranian nukes are unlikley to be found and infected on 'the world wide web' .
More 'fear mongering' methinks . By an internet security company too . Now thats a surprise !

[C. Flower]

Alex jones was making a big deal about this stunt . He made the rather valid point imo , that Iranian nukes are unlikley to be found and infected on 'the world wide web' .
More 'fear mongering' methinks . By an internet security company too . Now thats a surprise !

Not nukes I don't think, but there must be a lot of basic systems that are used in their work.

The virus exists. No one can anticipate exactly what effects it will have world wide.


They have also found that the country worst affected is Iran, which by last week had reported around three in every five infections worldwide. It has not taken long for the implications to be spelt out. Ralf Langner, a German analyst with detailed knowledge of Siemens systems, had this to say on his personal blog: "Can we think of any reasonable target that would match the scenario? Yes, we can. Look at the Iranian nuclear programme. Strange -- they are having some technical difficulties down there in Bushehr."

Bushehr is a nuclear power station which has been built by Russia for Iran and which, within a fortnight of Mr Langner's posting, confirmed that its opening had been delayed by two months, to January.

Mr Langner even found a photograph taken inside the plant showing a computer screen -- configured, he said, to run a Siemens operating system affected by Stuxnet and, moreover, configured wrongly so that it was vulnerable to bugs.

Iran has subsequently confirmed that computers run by Bushehr scientists have been infected, though it insists the plant itself is undamaged.

Another German analyst, Frank Rieger, went further. Bushehr is disliked by Iran's enemies, but not nearly as much as its separate uranium enrichment programme, which the West believes is part of a nuclear weapons programme.

Since last year, mystery has surrounded its main facility at a place called Natanz, where the number of working centrifuges, the main enrichment devices, suddenly fell by 15pc -- at the very time Stuxnet is first thought to have hit Iran

[StewieG]

Im sorry to go off topic but does anyone here experience 'slowness' on certain Irish political sites ? I mean tecnically,internet wise , not 'intellectually' !

I find I can skip about the net most times , yet when I go to certain sites (and login) . Things slow down . Anyone else find that ?
This site works fine though .

[jmcc]

Im sorry to go off topic but does anyone here experience 'slowness' on certain Irish political sites ? I mean tecnically,internet wise , not 'intellectually' ! I wouldn't be jumping to conclusions just yet. The reason is probably all that extra crap that some sites use (analytics, facebook/twitter widgets from social media sites). Depending on where in the page these javascript inclusions are placed, a slow serving site can slow down the entire rendering of a webpage. The effect of most of this slowly served junk is that the page will begin to load, freeze, load some more and freeze again and then finally load.

Regards...jmcc

[Baron von Biffo]

Computer virus causes computer problem - Who'd have seen that one coming?

It's amazing that 10 years after the great Y2K scam we're still disposed to believe tales of mayhem and catastrophe from the IT sector.

[jmcc]

It's amazing that 10 years after the great Y2K scam we're still disposed to believe tales of mayhem and catastrophe from the IT sector.Well the Y2K problem was real and there was a lot of genuine work involved in sorting out the problems. There were cowboys and snakeoil salesmen who exploited it. The most idiotic stuff about Y2K was written by "technology" journalists who hadn't a clue about computers or technology claiming that the problem didn't exist.

Regards...jmcc

[Baron von Biffo]

Well the Y2K problem was real and there was a lot of genuine work involved in sorting out the problems. There were cowboys and snakeoil salesmen who exploited it. The most idiotic stuff about Y2K was written by "technology" journalists who hadn't a clue about computers or technology claiming that the problem didn't exist.

Regards...jmcc

Russia, Africa and, I think, China ignored the whole thing yet on the 1st of January 2000 they weren't devastated by planes falling from the sky, hospitals shutting down or toasters burning the bread.

[Cáthasaigh]

I can't wait til the 2012 related mania kicks in. I wonder how many expectant rapturees will sign over all the goods and property, that they will no longer need, to the leftbehind.

[jmcc]

Russia, Africa and, I think, China ignored the whole thing yet on the 1st of January 2000 they weren't devastated by planes falling from the sky, hospitals shutting down or toasters burning the bread.The problem with Y2K was that its effects were somewhat more subtle than those extreme examples. The happy-clappies who masquerade as "technology journalists" dealt with such extreme examples because understanding the software and the effects that the Y2K errors could cause was somewhat beyond their limited capabilities. There was a more visible effect on the web when as the clocks ticked over, many Javascript scripts on websites showing the current date tipped over and started displaying 1900 as the new year. But since aircraft didn't fall out of the sky and toast burned in the same old way, a few of these happy-clappies penned pieces wondering if the Y2K problem even existed.

Regards...jmcc

[jmcc]

I can't wait til the 2012 related mania kicks in. I wonder how many expectant rapturees will sign over all the goods and property, that they will no longer need, to the leftbehind.Time for the "But you are the Messiah" clip from the "Life Of Brian". :)

Regards...jmcc

[Baron von Biffo]

The problem with Y2K was that its effects were somewhat more subtle than those extreme examples. The happy-clappies who masquerade as "technology journalists" dealt with such extreme examples because understanding the software and the effects that the Y2K errors could cause was somewhat beyond their limited capabilities. There was a more visible effect on the web when as the clocks ticked over, many Javascript scripts on websites showing the current date tipped over and started displaying 1900 as the new year. But since aircraft didn't fall out of the sky and toast burned in the same old way, a few of these happy-clappies penned pieces wondering if the Y2K problem even existed.

Regards...jmcc

Journalists may have created the hype but IT companies were more than willing to ride it. I was working for a very large company at the time and we paid a 7 figure fee to a company founded by a tiger poster boy to make us Y2K safe. Burning the money as a publicity stunt would have brought greater benefits. We even lost a few people from our own IT department because they saw the easy money that could be made from it.

[C. Flower]

Amhadinejad confirms that centrifuges were affected by Stuxnet.

http://www.breakingnews.ie/world/ahmadinejad-computer-worm-hit-nuclear-work-483770.html

[musashi]

Discovering zero-day vulnerabilities rarely happens by chance. It requires a very specific type of expertise. Compiling a worm to utilize several zero-days as part of its attack vector suggests an organisation, not an individual as the source of the Stuxnet worm.

now...which organisation will benefit most by attacking Irans's nuclear program.

[C. Flower]

Discovering zero-day vulnerabilities rarely happens by chance. It requires a very specific type of expertise. Compiling a worm to utilize several zero-days as part of its attack vector suggests an organisation, not an individual as the source of the Stuxnet worm.

now...which organisation will benefit most by attacking Irans's nuclear program.

Obama has been focusing intelligence on Cyberwar and channelling funds into it since the beginning of his administration.

[musashi]

Obama has been focusing intelligence on Cyberwar and channelling funds into it since the beginning of his administration.

An organisation that could develop such an asset, would likely be financed by a post-industrial nation-state...


Given the sophistication of the Stuxnet worm, some experts believe that only a nation-state could be behind the malware. The United States and Israel (http://www.voanews.com/english/news/usa/The-First-Strike-in-Cyber-War-104784244.html) have been named as two countries that have such capability and political motive for carrying out such an attack.

With its discoverey, the malware's threat has probably passed, though it represents a significant developement in cyber-security. "I believe that it's not a threat right now," says Robert McMillan. "Whoever it was designed to hit, has been hit. The thing that's important about Stuxnet is that ... this is the first piece of malware that was designed to go after critical infrastructure."

[Captain Con O'Sullivan]

'Israel has tested a computer worm believed to have sabotaged Iran's nuclear centrifuges and slowed its ability to develop an atomic weapon, The New York Times reported on Saturday.

In what the Times described as a joint Israeli-U.S. effort to undermine Iran's nuclear ambitions, it said the tests of the destructive Stuxnet worm had occurred over the past two years at the heavily guarded Dimona complex in the Negev desert.

The newspaper cited unidentified intelligence and military experts familiar with Dimona who said Israel had spun centrifuges virtually identical to those at Iran's Natanz facility, where Iranian scientists are struggling to enrich uranium.

"To check out the worm, you have to know the machines," an American expert on nuclear intelligence told the newspaper". The reason the worm has been effective is that the Israelis
tried it out." '

http://www.haaretz.com/news/diplomacy-defense/report-israel-tested-iran-bound-stuxnet-worm-in-dimona-nuclear-plant-1.337276

[Andrew49]

Cyber warfare has been taken to a new, hard rockin' level. According to one security expert, a computer virus has attacked computer systems in Iran and forced them to play heavy metal, at full volume, during the middle of the night. The computer worm reportedly compromises the machines, and makes them repeat the track 'Thunderstruck' by AC/DC, ad nauseum. The unconfirmed report, picked up by Gawker, comes from Mikko Hypponen, who is a researcher at the Finnish security company F-Secure.

Is a Computer Worm Causing Iranian Nuclear Facilities to Blast AC/DC’s ‘Thunderstruck’ At Night? (http://gawker.com/5928425/is-a-computer-worm-causing-iranian-nuclear-facilities-to-blast-acdcs-thunderstruck-at-night)

News From the Lab (http://www.f-secure.com/weblog/archives/00002403.html?tduid=832f9c39fa4a9af7d63e71bdafce2e 8c)

[jmcc]

Cyber warfare has been taken to a new, hard rockin' level. According to one security expert, a computer virus has attacked computer systems in Iran and forced them to play heavy metal, at full volume, during the middle of the night. The computer worm reportedly compromises the machines, and makes them repeat the track 'Thunderstruck' by AC/DC, ad nauseum. The unconfirmed report, picked up by Gawker, comes from Mikko Hypponen, who is a researcher at the Finnish security company F-Secure.

Guess the are saving "Rock The Casbah" for when they mean business. :)

Regards...jmcc

[Andrew49]

Guess the are saving "Rock The Casbah" for when they mean business. :)

Regards...jmcc

When dictator Manuel Antonio Noriega took refuge in the Vatican Embassy in Panama in December 1989, the US Army used Van Halen to force him out. Reportedly the song “Panama” by Van Halen was played repeatedly, as was “I Fought The Law” by The Clash.

I think it's time for the Mullahs to get acquainted with the Torture Playlist (http://rateyourmusic.com/list/ByteMe/the_torture_playlist/)!

[Andrew49]

Cyberattack on Saudi firm, U.S. Sees Iran firing back.

The hackers picked the one day of the year they knew they could inflict the most damage on the world’s most valuable company, Saudi Aramco, Lailat al Qadr, or the Night of Power — celebrating the revelation of the Koran to Muhammad.

That morning, at 11:08, a person with privileged access to the Saudi state-owned oil company’s computers, unleashed a computer virus to initiate what is regarded as among the most destructive acts of computer sabotage on a company to date. The virus erased data on three-quarters of Aramco’s corporate PCs — documents, spreadsheets, e-mails, files — replacing all of it with an image of a burning American flag.

Source (http://www.nytimes.com/2012/10/24/business/global/cyberattack-on-saudi-oil-firm-disquiets-us.html?ref=global-home&_r=1&)

Needless to say Iran is being blamed for this but it's obvious when you read more on the story that it was more likely an employee/employees inside the company that is responsible: a bragging list of all PCs that became infected was forwarded to a computer within the network under attack!

[musashi]

fascinating


Shamoon’s code included a so-called kill switch, a timer set to attack at 11:08 a.m., the exact time that Aramco’s computers were wiped of memory. Shamoon’s creators even gave the erasing mechanism a name: Wiper.

Computer security researchers noted that the same name, Wiper, had been given to an erasing component of Flame, a computer virus that attacked Iranian oil companies and came to light in May. Iranian oil ministry officials have claimed that the Wiper software code forced them to cut Internet connections to their oil ministry, oil rigs and the Kharg Island oil terminal, a conduit for 80 percent of Iran’s oil exports.

It raised suspicions that the Aramco hacking was retaliation. The United States fired one of the first shots in the computer war and has long maintained the upper hand. The New York Times reported in June that the United States, together with Israel, was responsible for Stuxnet, the computer virus used to destroy centrifuges in an Iranian nuclear facility in 2010.

Last May, researchers discovered that Flame had been siphoning data from computers, mainly in Iran, for several years. Security researchers believe Flame and Stuxnet were written by different programmers, but commissioned by the same two nations.

If American officials are correct that Shamoon was designed by Iran, then clues in its code may have been intended to misdirect blame. Shamoon’s programmers inserted the word “Arabian Gulf” into its code. But Iranians refer to that body of water as the Persian Gulf and are very protective of the name. (This year, Iran threatened to sue Google for removing the name Persian Gulf from its online maps.)