Attacks/Breaches
4/27/2011
01:25 PM
50%
50%

Iran Alleges Espionage Over Internet Worm

Senior government official says foreign governments are launching malware dubbed Stars at the country's nuclear facilities.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
A senior official in Iran has alleged that foreign governments have been targeting the country's nuclear facilities using an Internet-borne worm, dubbed Stars.

Brigadier general Gholam Reza Jalali, Iran's head of civil defense, on Monday told the Iranian Mehr news agency that the country has detected a new worm that targets government systems. "The damage is very low in the first phase," said Jalali. "The executable files may sometimes be confused with official state documents."

He also warned that although the Stars malware had been discovered--he didn't specify how--researchers still didn't understand its purpose or how exactly it operates, meaning that it might still unleash some type of attack. Finally, he called for legal sanctions against whomever launched Stars.

According to security experts, Jalali's description of the worm makes it sound as if the attack employs malicious Word, Excel, or PDF files, and that echoes a recent series of targeted attacks that have exploited a vulnerability in Flash. But is a worm that targets a government network anything to write home about? In fact, wouldn't the absence of targeted attacks suggest that government agencies simply weren't spotting attacks that were sure to be underway?

"From my perspective, most governments will be running into and dealing with targeted attacks," said James Lyne, director of technology strategy at Sophos, in an email interview. "Targeted attacks are common today--even for medium-size enterprises."

"In many cases, we see targeted phishing attempts--though the volume is still 'spray and pray,' where an attacker may just be lucky and hit the right system," he said. "The quality of these attacks ranges from basic social engineering or Web threats--low tech can still be very successful--to quite coordinated and clever malicious code."

Of course, any apparent phishing attack against Iran raises the specter of Stuxnet, which apparently targeted five facilities related to an Iranian nuclear enrichment facility to then infect systems at the facility. Beginning in June 2009, the worm spread, ultimately infecting the facility's supervisory control and data acquisition (SCADA) software, which was supplied by Siemens. The malware then adjusted the speeds of the high-frequency converter drives used for enrichment, from very low to very high frequencies, while failing to report this activity via the user interface.

Ultimately, Stuxnet disrupted the refinement process and, according to some reports, disabled the drives. Iran, however, has denied that any equipment was damaged, or its nuclear program disrupted.

Earlier this month, Jalali told the Islamic Republic News Service, Iran's state news agency, that Siemens was partially to blame for Stuxnet. "Siemens should explain why and how it provided the enemies with the information about the codes of the SCADA software (which is used at some of Iran's major industrial sites) and prepared the ground for a cyber attack against us," he said, according to the Tehran Times.

Jalali also said that Iran's investigation traced the origin of the worm to the United States and Israel, and identified transmissions back to those countries from PCs infected by Stuxnet. On a similar note, earlier this year, a New York Times story quoted unnamed officials who said that that Stuxnet was a joint American and Israeli creation.

Jalali also called for legal action against the companies and countries that launched Stuxnet. "The attacking countries should be held legally responsible for the cyber attack," he said. "If we were not ready to tackle the crisis and their attack was successful, the attack could have created tragic incidents at the country's industrial sites and refineries."

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.