Attacks/Breaches
4/27/2011
01:25 PM
Connect Directly
RSS
E-Mail
50%
50%

Iran Alleges Espionage Over Internet Worm

Senior government official says foreign governments are launching malware dubbed Stars at the country's nuclear facilities.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
A senior official in Iran has alleged that foreign governments have been targeting the country's nuclear facilities using an Internet-borne worm, dubbed Stars.

Brigadier general Gholam Reza Jalali, Iran's head of civil defense, on Monday told the Iranian Mehr news agency that the country has detected a new worm that targets government systems. "The damage is very low in the first phase," said Jalali. "The executable files may sometimes be confused with official state documents."

He also warned that although the Stars malware had been discovered--he didn't specify how--researchers still didn't understand its purpose or how exactly it operates, meaning that it might still unleash some type of attack. Finally, he called for legal sanctions against whomever launched Stars.

According to security experts, Jalali's description of the worm makes it sound as if the attack employs malicious Word, Excel, or PDF files, and that echoes a recent series of targeted attacks that have exploited a vulnerability in Flash. But is a worm that targets a government network anything to write home about? In fact, wouldn't the absence of targeted attacks suggest that government agencies simply weren't spotting attacks that were sure to be underway?

"From my perspective, most governments will be running into and dealing with targeted attacks," said James Lyne, director of technology strategy at Sophos, in an email interview. "Targeted attacks are common today--even for medium-size enterprises."

"In many cases, we see targeted phishing attempts--though the volume is still 'spray and pray,' where an attacker may just be lucky and hit the right system," he said. "The quality of these attacks ranges from basic social engineering or Web threats--low tech can still be very successful--to quite coordinated and clever malicious code."

Of course, any apparent phishing attack against Iran raises the specter of Stuxnet, which apparently targeted five facilities related to an Iranian nuclear enrichment facility to then infect systems at the facility. Beginning in June 2009, the worm spread, ultimately infecting the facility's supervisory control and data acquisition (SCADA) software, which was supplied by Siemens. The malware then adjusted the speeds of the high-frequency converter drives used for enrichment, from very low to very high frequencies, while failing to report this activity via the user interface.

Ultimately, Stuxnet disrupted the refinement process and, according to some reports, disabled the drives. Iran, however, has denied that any equipment was damaged, or its nuclear program disrupted.

Earlier this month, Jalali told the Islamic Republic News Service, Iran's state news agency, that Siemens was partially to blame for Stuxnet. "Siemens should explain why and how it provided the enemies with the information about the codes of the SCADA software (which is used at some of Iran's major industrial sites) and prepared the ground for a cyber attack against us," he said, according to the Tehran Times.

Jalali also said that Iran's investigation traced the origin of the worm to the United States and Israel, and identified transmissions back to those countries from PCs infected by Stuxnet. On a similar note, earlier this year, a New York Times story quoted unnamed officials who said that that Stuxnet was a joint American and Israeli creation.

Jalali also called for legal action against the companies and countries that launched Stuxnet. "The attacking countries should be held legally responsible for the cyber attack," he said. "If we were not ready to tackle the crisis and their attack was successful, the attack could have created tragic incidents at the country's industrial sites and refineries."

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2003-1598
Published: 2014-10-01
SQL injection vulnerability in log.header.php in WordPress 0.7 and earlier allows remote attackers to execute arbitrary SQL commands via the posts variable.

CVE-2011-4624
Published: 2014-10-01
Cross-site scripting (XSS) vulnerability in facebook.php in the GRAND FlAGallery plugin (flash-album-gallery) before 1.57 for WordPress allows remote attackers to inject arbitrary web script or HTML via the i parameter.

CVE-2012-0811
Published: 2014-10-01
Multiple SQL injection vulnerabilities in Postfix Admin (aka postfixadmin) before 2.3.5 allow remote authenticated users to execute arbitrary SQL commands via (1) the pw parameter to the pacrypt function, when mysql_encrypt is configured, or (2) unspecified vectors that are used in backup files gene...

CVE-2012-5485
Published: 2014-09-30
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

CVE-2012-5486
Published: 2014-09-30
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Chris Hadnagy, who hosts the annual Social Engineering Capture the Flag Contest at DEF CON, will discuss the latest trends attackers are using.