Feeds

Iran boasts of Stuxnet 'nuclear spies' arrests

But astrologer-botanists fingered by security researchers

Using blade systems to cut costs and sharpen efficiencies

Iran claims to have arrested spies it blames for planting the infamous Stuxnet worm on its network and attempting to clobber its Bushehr nuclear power plant.

Heydar Moslehi, Iran's intelligence minister, told the semi-official Mehr news agency that the country had arrested an unspecified number of "nuclear spies" (nationality unknown). He claimed that Iran was right on top of the Stuxnet infection, implausibly adding his ministry had achieved “complete mastery” over government computer systems.

“All of the destructive activities perpetrated by the oppressors in cyberspace will be discovered quickly and means of combating these plans will be implemented,” Moslehi said, the New York Times reports.

The paper tellingly adds that the arrests could not be independently confirmed.

The Stuxnet worm, first confirmed in July, infects SCADA systems manufactured by Siemens, creating a stealthy rootkit capable of re-programming compromised industrial control systems. The malware can spread from infected USBs and by exploiting default passwords in weakly-secured networks.

The sophistication of the worm has prompted many cyber security experts to speculate that it must be the work of an intelligence agency bent on sabotage. Rather than imagining that some Jason Bourne-style cyberspy - or a Mossad team - parachuted into Iran bearing infected USB sticks, a more plausible theory is that Russian sub-contractors who worked on Bushehr nuclear power plant deliberately infected its systems.

However, work was done years ago, so the idea that any of these sub-contractors might still be in Iran seems implausible.

Moslehi claims that the Stuxnet infection is under control also take some believing, especially since anti-virus analysts have recently discovered that the malware can re-infect supposedly cleaned systems. The extent of the infection in Iran is unclear. Managers at Bushehr admit only that the worm has infected personal computers at the controversial facility.

Independent analysis by Kaspersky Labs suggests the worm is actually more active in Indian and Indonesia than in Iran.

The lack of solid evidence hasn't, of course, stopped security pundits from sounding off about with some describing it as a "cyber super-weapon". Much has been made of the hidden reference in the worm code to the date 19 May 1979, when a Israeli businessman was executed in Iran, and the use of the file path "marts" (b:\myrtus\src\objfre_w2k_x86\i386\guava.pdb). This is a supposed Old Testament biblical reference to Hadassah (which means Myrtle), a figure from the Book of Esther who warns of a plot against the Jews.

The Parallax View

An entertaining debunking of this conspiracy theory comes from Mary Landesman, an anti-virus expert at ScanSafe. She notes the myrtus is more commonly known as myrtle, a family of plants related to eucalyptus. She also repeats the observation that Stuxnet is more prevalent in Indonesia than Iran.

The Israeli-superworm conspiracy theory is, at best, based on isolated features of the worm and speculation rather than analysis, Landesman complains. A close look at the code itself reveals that Stuxnet has a "kill date" of 24 June, 2012. This date is significant in astrology because it "is the date that Pluto in Capricorn squares off against Uranus in Aries", a so-called grand cross.

Based on this, the date, and the arguable botanical reference, Landesman argues that that author of the worm could be a 31-year-old botany and astrology geek with a knowledge of SCADA-systems and an obsessive personality, rather than an Israeli cyber-saboteur working with a paid Russian stooge as per the conventional theory.

You can read Landesman's entertaining debunking here. ®

Boost IT visibility and business value

More from The Register

next story
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Securing Web Applications Made Simple and Scalable
Learn how automated security testing can provide a simple and scalable way to protect your web applications.