Feeds

Iran boasts of Stuxnet 'nuclear spies' arrests

But astrologer-botanists fingered by security researchers

The essential guide to IT transformation

Iran claims to have arrested spies it blames for planting the infamous Stuxnet worm on its network and attempting to clobber its Bushehr nuclear power plant.

Heydar Moslehi, Iran's intelligence minister, told the semi-official Mehr news agency that the country had arrested an unspecified number of "nuclear spies" (nationality unknown). He claimed that Iran was right on top of the Stuxnet infection, implausibly adding his ministry had achieved “complete mastery” over government computer systems.

“All of the destructive activities perpetrated by the oppressors in cyberspace will be discovered quickly and means of combating these plans will be implemented,” Moslehi said, the New York Times reports.

The paper tellingly adds that the arrests could not be independently confirmed.

The Stuxnet worm, first confirmed in July, infects SCADA systems manufactured by Siemens, creating a stealthy rootkit capable of re-programming compromised industrial control systems. The malware can spread from infected USBs and by exploiting default passwords in weakly-secured networks.

The sophistication of the worm has prompted many cyber security experts to speculate that it must be the work of an intelligence agency bent on sabotage. Rather than imagining that some Jason Bourne-style cyberspy - or a Mossad team - parachuted into Iran bearing infected USB sticks, a more plausible theory is that Russian sub-contractors who worked on Bushehr nuclear power plant deliberately infected its systems.

However, work was done years ago, so the idea that any of these sub-contractors might still be in Iran seems implausible.

Moslehi claims that the Stuxnet infection is under control also take some believing, especially since anti-virus analysts have recently discovered that the malware can re-infect supposedly cleaned systems. The extent of the infection in Iran is unclear. Managers at Bushehr admit only that the worm has infected personal computers at the controversial facility.

Independent analysis by Kaspersky Labs suggests the worm is actually more active in Indian and Indonesia than in Iran.

The lack of solid evidence hasn't, of course, stopped security pundits from sounding off about with some describing it as a "cyber super-weapon". Much has been made of the hidden reference in the worm code to the date 19 May 1979, when a Israeli businessman was executed in Iran, and the use of the file path "marts" (b:\myrtus\src\objfre_w2k_x86\i386\guava.pdb). This is a supposed Old Testament biblical reference to Hadassah (which means Myrtle), a figure from the Book of Esther who warns of a plot against the Jews.

The Parallax View

An entertaining debunking of this conspiracy theory comes from Mary Landesman, an anti-virus expert at ScanSafe. She notes the myrtus is more commonly known as myrtle, a family of plants related to eucalyptus. She also repeats the observation that Stuxnet is more prevalent in Indonesia than Iran.

The Israeli-superworm conspiracy theory is, at best, based on isolated features of the worm and speculation rather than analysis, Landesman complains. A close look at the code itself reveals that Stuxnet has a "kill date" of 24 June, 2012. This date is significant in astrology because it "is the date that Pluto in Capricorn squares off against Uranus in Aries", a so-called grand cross.

Based on this, the date, and the arguable botanical reference, Landesman argues that that author of the worm could be a 31-year-old botany and astrology geek with a knowledge of SCADA-systems and an obsessive personality, rather than an Israeli cyber-saboteur working with a paid Russian stooge as per the conventional theory.

You can read Landesman's entertaining debunking here. ®

5 things you didn’t know about cloud backup

More from The Register

next story
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
KER-CHING! CryptoWall ransomware scam rakes in $1 MEEELLION
Anatomy of the net's most destructive ransomware threat
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
prev story

Whitepapers

Gartner critical capabilities for enterprise endpoint backup
Learn why inSync received the highest overall rating from Druva and is the top choice for the mobile workforce.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.