Feeds

Iran boasts of Stuxnet 'nuclear spies' arrests

But astrologer-botanists fingered by security researchers

Beginner's guide to SSL certificates

Iran claims to have arrested spies it blames for planting the infamous Stuxnet worm on its network and attempting to clobber its Bushehr nuclear power plant.

Heydar Moslehi, Iran's intelligence minister, told the semi-official Mehr news agency that the country had arrested an unspecified number of "nuclear spies" (nationality unknown). He claimed that Iran was right on top of the Stuxnet infection, implausibly adding his ministry had achieved “complete mastery” over government computer systems.

“All of the destructive activities perpetrated by the oppressors in cyberspace will be discovered quickly and means of combating these plans will be implemented,” Moslehi said, the New York Times reports.

The paper tellingly adds that the arrests could not be independently confirmed.

The Stuxnet worm, first confirmed in July, infects SCADA systems manufactured by Siemens, creating a stealthy rootkit capable of re-programming compromised industrial control systems. The malware can spread from infected USBs and by exploiting default passwords in weakly-secured networks.

The sophistication of the worm has prompted many cyber security experts to speculate that it must be the work of an intelligence agency bent on sabotage. Rather than imagining that some Jason Bourne-style cyberspy - or a Mossad team - parachuted into Iran bearing infected USB sticks, a more plausible theory is that Russian sub-contractors who worked on Bushehr nuclear power plant deliberately infected its systems.

However, work was done years ago, so the idea that any of these sub-contractors might still be in Iran seems implausible.

Moslehi claims that the Stuxnet infection is under control also take some believing, especially since anti-virus analysts have recently discovered that the malware can re-infect supposedly cleaned systems. The extent of the infection in Iran is unclear. Managers at Bushehr admit only that the worm has infected personal computers at the controversial facility.

Independent analysis by Kaspersky Labs suggests the worm is actually more active in Indian and Indonesia than in Iran.

The lack of solid evidence hasn't, of course, stopped security pundits from sounding off about with some describing it as a "cyber super-weapon". Much has been made of the hidden reference in the worm code to the date 19 May 1979, when a Israeli businessman was executed in Iran, and the use of the file path "marts" (b:\myrtus\src\objfre_w2k_x86\i386\guava.pdb). This is a supposed Old Testament biblical reference to Hadassah (which means Myrtle), a figure from the Book of Esther who warns of a plot against the Jews.

The Parallax View

An entertaining debunking of this conspiracy theory comes from Mary Landesman, an anti-virus expert at ScanSafe. She notes the myrtus is more commonly known as myrtle, a family of plants related to eucalyptus. She also repeats the observation that Stuxnet is more prevalent in Indonesia than Iran.

The Israeli-superworm conspiracy theory is, at best, based on isolated features of the worm and speculation rather than analysis, Landesman complains. A close look at the code itself reveals that Stuxnet has a "kill date" of 24 June, 2012. This date is significant in astrology because it "is the date that Pluto in Capricorn squares off against Uranus in Aries", a so-called grand cross.

Based on this, the date, and the arguable botanical reference, Landesman argues that that author of the worm could be a 31-year-old botany and astrology geek with a knowledge of SCADA-systems and an obsessive personality, rather than an Israeli cyber-saboteur working with a paid Russian stooge as per the conventional theory.

You can read Landesman's entertaining debunking here. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
prev story

Whitepapers

Go beyond APM with real-time IT operations analytics
How IT operations teams can harness the wealth of wire data already flowing through their environment for real-time operational intelligence.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.