Stuxnet Worm: Iran Deny Nuclear Station Hit

Stuxnet Worm: Iran Deny Nuclear Station Hit


The first computer virus designed to damage targets in the real world has not hit Iran's nuclear power plant, the country's Government has claimed.


The Stuxnet worm is the first known malicious software of its kind unleashed by computer hackers and has opened the door to a new era of cyber-warfare.
Experts say it is designed to destroy or sabotage factories, power plants, refineries or other industrial installations.
But Iranian Foreign Ministry spokesman Ramin Mehmanparast denied widespread suggestions the nation's Busheher nuclear station had been badly affected.
He said at a weekly press conference that the reports were part of a "soft war" and "propaganda stratagem" against Iran.
"The Busheher plant is pursuing its activities based on a set timetable," he said.
We are used to Trojans and viruses roaming the internet harming computers and causing financial damage, but Stuxnet is in a league of its own.

This would require a lot of resources on the level of a nation state. Taking into account the intelligence required to attack a specific target it would be virtually impossible that this is a lone attacker sitting at home.

<cite> Gadi Evron, Israeli cybersecurity strategist

</cite>
The worm targets closed and highly secure industrial networks.
After being introduced with a USB key, Stuxnet slips past four previously unknown vulnerabilities in the Windows operating system, so-called "zero day" vulnerabilities.
It is rare for malicious software to exploit even two of them.
Each one can take months for hackers to identify and more time to write software to exploit.
The worm then hunts for specific types of computers made by German company Siemens.
Having found its host, it lies dormant, waiting for a certain moment to override the computer's control of industrial machinery, with potentially disastrous consequences.


http://news.sky.com/sky-news/content...3/15701269.jpg
Israel is known to be worried about Iran's nuclear capabilities


This new breed of malware could wreak the kind of damage only previously seen in Hollywood disaster films.
Imagine a nuclear power station's cooling system being overridden, for example.
Or a railway's signals system thrown into chaos.
Experts estimate developing the Stuxnet worm would have taken a highly specialised team between six months to a year.
Israeli cybersecurity strategist Gadi Evron says the worm is so advanced it is almost certainly state-sponsored.
"This would require a lot of resources on the level of a nation state.
"Taking into account the intelligence required to attack a specific target, it would be virtually impossible that this is a lone attacker sitting at home."


http://news.sky.com/sky-news/content...4/15747063.jpg
Gadi Evron believes the worm must have been developed by a state
Less impressive, though, is the spread of the worm's infection.


"The attack managed to infect, over several months, something like 30,000 to 50,000 PCs in many facilities and corporations worldwide," Uri Rivner from internet security company RSA told Sky News.
Such a wide dissemination has helped expose the worm's existence and helped efforts to neutralise it.
It also raises questions about the likely target for the worm.
Iran says computers at its nuclear plant in Bushehr have been compromised by the worm but will not reveal the extent of the damage.
Some figures suggest 60% of the Stuxnet infections are in Iran.
That has led to a highly speculative finger of blame being pointed at both Israel and the USA, although both country's governments have declined to comment on the claims.

http://news.sky.com/skynews/Home/Tec...on_Of_Its_Kind

Iran puts off Bushehr plant launch to early 2011


TEHRAN (Reuters) - Iran's first nuclear power plant will begin supplying energy in early 2011, a senior official said, signalling a delay of several months after the spread of a global computer virus believed to have affected mainly Iran.
Iranian officials said on Sunday the Stuxnet virus had hit staff computers at the Bushehr plant, a symbol of Iran's growing geopolitical sway and rejection of international efforts to curb its nuclear activity, but not affected major systems there.
When Iran began loading fuel into Bushehr in August, officials said it would take two to three months for the plant to start producing electricity and that it would generate 1,000 megawatts, about 2.5 percent of the country's power usage.
"We hope that the fuel will be transferred to the core of the Bushehr nuclear power plant next week and before the second half of the Iranian month of Mehr (October 7)," Ali Akbar Salehi, head of Iran's Atomic Energy Organisation, was quoted on Wednesday as saying by the semi-official news agency ISNA.
"The ground is being prepared in this regard and, God willing, the fuel will be loaded to the core of the reactor completely by early November and the heart of Bushehr power plant will start beating by then."
Salehi added: "Two to three months after that electricity will be added to the networks. "This would mean Bushehr generating electricity from January or February.
Security experts say the Stuxnet computer worm may have been a state-sponsored attack on Iran's nuclear programme and have originated in the United States or Israel, the Islamic Republic's arch-adversaries.
Iran's programme includes uranium enrichment -- separate from Bushehr -- that Western leaders suspect is geared towards developing atomic bombs. Iran says it is refining uranium only for a future network of nuclear power plants.
Diplomats and security sources say Western governments and Israel view sabotage as one way of slowing Iran's nuclear work.

Little information is available on how much damage, if any, Iran's nuclear and wider infrastructure has suffered from Stuxnet and Tehran will probably never disclose full details.
Some analysts believe Iran may be suffering wider sabotage aimed at slowing its nuclear advances, pointing to a series of unexplained technical glitches that have cut the number of working centrifuge machines at the Natanz enrichment plant.
Bushehr was begun by Germany's Siemens in the 1970s, before Iran's Islamic Revolution, but has been dogged by delays.
Russia designed and built the plant and will supply the fuel. To ease nuclear proliferation concerns, it will take back spent fuel rods that could otherwise be used to make weapons-grade plutonium. Bushehr is also being monitored by inspectors of the U.N. nuclear watchdog.
Washington has criticised Moscow for pushing ahead with Bushehr despite Iranian defiance over its nuclear programme.
(Reporting by Ramin Mostafavi; Writing by Andrew Hammond; Editing by Mark Heinrich)


http://af.reuters.com/article/worldN...68S2ZC20100929

Iran denies cyberattack hurt nuclear program -- but expert isn't sure


(CNN) -- Iran denied Wednesday that its nuclear systems had been infected with a virus, after days of reports that a new kind of malware had struck the Bushehr nuclear plant.
But the head of its nuclear program admitted that a virus had been found on the personal laptops of some staff at the reactor, the Iranian Students News Agency reported.
"We succeeded in preventing the enemy from achieving its objectives," IRNA quoted Ali Akbar Salehi as saying on Wednesday.
But a top computer security expert who analyzed a new kind of virus called Stuxnet says Iran is the most probable target of the malware, which he says could only have been designed by "the best of the best.
"We have never seen anything like this before," said Ralph Langner. "It's the most complex piece of malware in the history of computing.
"What the thing does, is actually it's designed to blow something up, it's as simple as that," he said. "The virus is a cyberwar weapon."
Langner, who was among the first to study the virus, presented his findings at a cyber security conference in Maryland last week.
The virus is designed to attack only a specific machine at a specific time, Langner told CNN Wednesday.
Langner has detected "the highest number of infections" in Iran, suggesting that Tehran's controversial nuclear program is the target.
"If you look at all the sophistication that went into Stuxnet, if you look at the fact that it's about sabotage, about destroying a specific piece of machinery, then the only target that makes sense given the target region... would be the Iranian nuclear power program," he said.
A government is almost certainly behind it, he said.
"You can take for granted that a hacker group is not able to create anything like Stuxnet, because the development requires much more resources than any such hacker group could afford," he said.
To use it as a weapon would require insider information, he said.
"You need to have very detailed and specific knowledge about the targeted application and process," he said.
"You will need to build up a lab model to test all that and if you take all that together into account, the only background that makes any sense is to assume that a nation-state is behind it."
It was probably delivered via infected USB sticks, he said, speculating that a Russian engineering firm that worked on the Iranian nuclear program had been infiltrated.
That would explain the pattern of infections around the world, he said -- anywhere the company worked would end up with the virus.
But only one specific target would be affected by it.
It's as if a virus were designed not only to target a computer running Microsoft Word, he said, but to search for a specific document created with Word.
And it's designed to hit industrial control systems, he said, activating itself only once its target reaches a certain state, like a designated temperature or pressure.
"When it finds a specific match, let's say in specific temperatures or pressures to reach certain thresholds, then the attack routine is executed," he said.
Stuxnet itself is no longer a cause for concern, he said.
"Don't worry about Stuxnet any longer," he said. "Obviously it hit its target. It is so specific it won't attack anything else."
But now that it's out there, other people will try to replicate it, he warned.
"Everybody will be able to study exactly what Stuxnet does and how it is done," he said. "So we must assume that Stuxnet will now act as a template for any kind of hackers, organized crime, terrorists in order to study how it can be done.
"Stuxnet is history," he said. "We need to work on what will come next."


http://edition.cnn.com/2010/WORLD/me...n.cyberattack/

An alarmed Iran asks for outside help to stop rampaging Stuxnet malworm

DEBKAfile Exclusive Report September 29, 2010, 10:07 AM (GMT+02:00)

Tehran this week secretly appealed to a number of computer security experts in West and East Europe with offers of handsome fees for consultations on ways to exorcize the Stuxnet worm spreading havoc through the computer networks and administrative software of its most important industrial complexes and military command centers. debkafile's intelligence and Iranian sources report Iran turned for outside help after local computer experts failed to remove the destructive virus.
None of the foreign experts has so far come forward because Tehran refuses to provide precise information on the sensitive centers and systems under attack and give the visiting specialists the locations where they would need to work. They were not told whether they would be called on to work outside Tehran or given access to affected sites to study how they function and how the malworm managed to disable them. Iran also refuses to give out data on the changes its engineers have made to imported SCADA (Supervisory Control and Data Acquisition) systems, mostly from Germany.
The impression debkafile sources gained Wednesday, Sept. 29 from talking to European computer experts approached for aid was that the Iranians are getting desperate. Not only have their own attempts to defeat the invading worm failed, but they made matters worse: The malworm became more aggressive and returned to the attack on parts of the systems damaged in the initial attack.
One expert said: "The Iranians have been forced to realize that they would be better off not 'irritating' the invader because it hits back with a bigger punch."
Looking beyond Iran's predicament, he wondered whether the people responsible for planting Stuxnet in Iran - and apparently continuing to offload information from its sensitive systems - have the technology for stopping its rampage. "My impression," he said, "is that somebody outside Iran has partial control at least on its spread. Can this body stop malworm in its tracks or kill it? We don't have that information at present, he said.
As it is, the Iranian officials who turned outside for help were described by another of the experts they approached as alarmed and frustrated. It has dawned on them that the trouble cannot be waved away overnight but is around for the long haul. Finding a credible specialist with the magic code for ridding them of the cyber enemy could take several months. After their own attempts to defeat Stuxnet backfired, all the Iranians can do now is to sit back and hope for the best, helpless to predict the worm's next target and which other of their strategic industries will go down or be robbed of its secrets next.
While Tehran has given out several conflicting figures on the systems and networks struck by the malworm - 30,000 to 45,000 industrial units - debkafile's sources cite security experts as putting the figure much higher, in the region of millions. If this is true, then this cyber weapon attack on Iran would be the greatest ever.



http://www.debka.com/article/9050/

Stuxnet Worm: Iran Deny Nuclear Station Hit

Iran puts off Bushehr plant launch to early 2011

Iran denies cyberattack hurt nuclear program -- but expert isn't sure

An alarmed Iran asks for outside help to stop rampaging Stuxnet malworm


Buhahaha!!!! Dicks!


DJ OD

Malwarebytes and Combofix. Job's a good'un.;)