Feeds

Iran boasts of Stuxnet 'nuclear spies' arrests

But astrologer-botanists fingered by security researchers

3 Big data security analytics techniques

Iran claims to have arrested spies it blames for planting the infamous Stuxnet worm on its network and attempting to clobber its Bushehr nuclear power plant.

Heydar Moslehi, Iran's intelligence minister, told the semi-official Mehr news agency that the country had arrested an unspecified number of "nuclear spies" (nationality unknown). He claimed that Iran was right on top of the Stuxnet infection, implausibly adding his ministry had achieved “complete mastery” over government computer systems.

“All of the destructive activities perpetrated by the oppressors in cyberspace will be discovered quickly and means of combating these plans will be implemented,” Moslehi said, the New York Times reports.

The paper tellingly adds that the arrests could not be independently confirmed.

The Stuxnet worm, first confirmed in July, infects SCADA systems manufactured by Siemens, creating a stealthy rootkit capable of re-programming compromised industrial control systems. The malware can spread from infected USBs and by exploiting default passwords in weakly-secured networks.

The sophistication of the worm has prompted many cyber security experts to speculate that it must be the work of an intelligence agency bent on sabotage. Rather than imagining that some Jason Bourne-style cyberspy - or a Mossad team - parachuted into Iran bearing infected USB sticks, a more plausible theory is that Russian sub-contractors who worked on Bushehr nuclear power plant deliberately infected its systems.

However, work was done years ago, so the idea that any of these sub-contractors might still be in Iran seems implausible.

Moslehi claims that the Stuxnet infection is under control also take some believing, especially since anti-virus analysts have recently discovered that the malware can re-infect supposedly cleaned systems. The extent of the infection in Iran is unclear. Managers at Bushehr admit only that the worm has infected personal computers at the controversial facility.

Independent analysis by Kaspersky Labs suggests the worm is actually more active in Indian and Indonesia than in Iran.

The lack of solid evidence hasn't, of course, stopped security pundits from sounding off about with some describing it as a "cyber super-weapon". Much has been made of the hidden reference in the worm code to the date 19 May 1979, when a Israeli businessman was executed in Iran, and the use of the file path "marts" (b:\myrtus\src\objfre_w2k_x86\i386\guava.pdb). This is a supposed Old Testament biblical reference to Hadassah (which means Myrtle), a figure from the Book of Esther who warns of a plot against the Jews.

The Parallax View

An entertaining debunking of this conspiracy theory comes from Mary Landesman, an anti-virus expert at ScanSafe. She notes the myrtus is more commonly known as myrtle, a family of plants related to eucalyptus. She also repeats the observation that Stuxnet is more prevalent in Indonesia than Iran.

The Israeli-superworm conspiracy theory is, at best, based on isolated features of the worm and speculation rather than analysis, Landesman complains. A close look at the code itself reveals that Stuxnet has a "kill date" of 24 June, 2012. This date is significant in astrology because it "is the date that Pluto in Capricorn squares off against Uranus in Aries", a so-called grand cross.

Based on this, the date, and the arguable botanical reference, Landesman argues that that author of the worm could be a 31-year-old botany and astrology geek with a knowledge of SCADA-systems and an obsessive personality, rather than an Israeli cyber-saboteur working with a paid Russian stooge as per the conventional theory.

You can read Landesman's entertaining debunking here. ®

3 Big data security analytics techniques

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.