Is a Cyber Attack Targeting Iran's Nuclear Plant?

Published September 23, 2010 | FoxNews.com


A destructive cyber worm designed to bring down industrial complexes has Iran's new nuclear power plant in its sights. And a nation such as Israel or China -- or even the United States -- could be behind it, experts say.

The "Stuxnet" worm sparked both awe and alarm among digital security experts when first identified in June. Far more advanced than the mainstream malware often used for identity theft, Stuxnet is reportedly able to take over a computing system via nothing more than a USB memory stick, without any user intervention.

"This is the first direct example of weaponized software, highly customized and designed to find a particular target," said Michael Assante, former chief of industrial control systems cyber security research at the U.S. Department of Energy's Idaho National Laboratory.

Stuxnet targets industrial control systems, such as those that power Iran's Bushehr nuclear plant. And some experts speculate that it was written by a nation explicitly to take out Bushehr. But Sanjay Bavisi, president of the international cybersecurity research group EC-Council, thinks it's too early to be certain.

"It's too soon to rule out the power of the hacking underground" or terrorists, Bavisi told FoxNews.com. "Yes, the first impression is nation-states, organized states, and it points back to the U.S. and Israel," two of the most cyber-savvy countries. "But organized criminals have the power, and hackers for hire are very common too," he said.

Other experts disagree, noting that the worm has infected over 45,000 industrial networks throughout the world without causing major damage. Stuxnet is a "key for a very specific lock. In fact, there is only one lock in the world that it will open," said Ralph Langner, a German cyber security researcher in an interview with The Christian Science Monitor.

"The whole attack is not at all about stealing data but about manipulation of a specific industrial process at a specific moment in time," he explained. Once resident inside a system, Stuxnet simply waits, checking every five seconds to see if its target parameters are met. Once they are, it triggers a sequence -- the code DEADF007 -- that forces the network's industrial process to self-destruct.

But if it was designed just to attack nuclear power plants, why has it hit so many other systems, Bavisi asked. When security firm Symantec first uncovered the worm, it found that only 60 percent of the systems compromised were in Iran, and the worm has already spread to India as well. "If you're going to blow up a target, you blow up a target," he said.

Bavisi nevertheless agrees with other experts that a country was probably behind the attack -- and while scary, its the implications for the future that startle him more. Bavisi frets about a future where anyone with the funds will be able to buy an attack like this on the black market.

"That is now a valid concern," Langer agreed.

"Anyone with the right amount of money and connections could buy " such a cyber weapon, Bavisi said. His concern: Nation-states have a certain degree of responsibility only to use these weapons in times of war -- with responsibility in other words. "If this kind of knowledge and sophistication were in in the hands of organized criminals …."

"We're looking at a new era of weaponized cyberattacks. This is only the beginning of this thing," Bavisi said.

NewsCore contributed to this report.FoxNews.com's SciTech

Rumor is that NSA is recruiting qualified hackers out of high school. See, college IS overrated!

Let's just say that have their eyes on DefCon. As does the CIA.

It is poetic to use Russian computers to infect the Iranian systems.

(09-25-2010 09:12 PM)ccs178 Wrote:  It is poetic to use Russian computers to infect the Iranian systems.

That's the easiest way to infect an Iranian system... let a Russian Contractor bring in the virus on THEIR laptop.

And while its been kept under the radar pretty well, a couple of months ago the Chinese were able to insert a back door into DoD secure networks via a USB drive plugged into the network at a base in Iraq.

Computer Worm Affects Computers at Iran's First Nuclear Power Station

Published September 26, 2010 | Associated Press

TEHRAN, Iran -- A complex computer worm capable of seizing control of industrial plants has affected the personal computers of staff working at Iran's first nuclear power station weeks before the facility is to go online, the official news agency reported Sunday.

The project manager at the Bushehr nuclear plant, Mahmoud Jafari, said a team is trying to remove the malware from several affected computers, though it "has not caused any damage to major systems of the plant," the IRNA news agency reported.

It was the first sign that the malicious computer code, dubbed Stuxnet, which has spread to many industries in Iran, has also affected equipment linked to the country's nuclear program, which is at the core of the dispute between Tehran and Western powers like the United States.

Experts in Germany discovered the worm in July, and it has since shown up in a number of attacks -- primarily in Iran, Indonesia, India and the U.S.

The malware is capable of taking over systems that control the inner workings of industrial plants.

In a sign of the high-level concern in Iran, experts from the country's nuclear agency met last week to discuss ways of fighting the worm.

The infection of several computers belonging to workers at Bushehr will not affect plans to bring the plant online in October, Jafari was quoted as saying.

The Russian-built plant will be internationally supervised, but world powers are concerned that Iran wants to use other aspects of its civil nuclear power program as a cover for making weapons. Of highest concern to world powers is Iran's main uranium enrichment facility in the city of Natanz.

Iran, which denies having any nuclear weapons ambitions, says it only wants to enrich uranium to the lower levels needed for producing fuel for power plants. At higher levels of processing, the material can also be used in nuclear warheads.

The destructive Stuxnet worm has surprised experts because it is the first one specifically created to take over industrial control systems, rather than just steal or manipulate data.

The United States is also tracking the worm, and the Department of Homeland Security is building specialized teams that can respond quickly to cyber emergencies at industrial facilities across the country.

On Saturday, Iran's semi-official ISNA news agency reported that the malware had spread throughout Iran, but did not name specific sites affected.

I saw this today. Decent primer for those of us that are not computer engineers or IT professionals.

Stuxnet in Pictures: The Cyber-weapon Said to Target Iran's Nuclear Infrastructure

I've always wondered why super important networks weren't closed networks.

Why would anyone want to bring harm to Iran's PEACEFUL power generation project? Their intentions are purely honorable... Seems to be it would be a whole lot more efficient to use some of Israel's drone bomber fleet and eliminate the problem permanently.

Maybe Stuxnet can infect the hell out of the Federal Government.

(09-27-2010 09:10 PM)smn1256 Wrote:  I've always wondered why super important networks weren't closed networks.

This could be a closed network ... all it takes is a usb key to infect it. My guess is that is unlikely in most facilities that they would have sufficient security and discipline to keep out all portable devices (you're more likely to see it in US Govt/DOD or financial services or another agency that is either mandated or highly motivated to have strong, enforced security standards).

(09-29-2010 03:50 PM)I45owl Wrote:  

(09-27-2010 09:10 PM)smn1256 Wrote:  I've always wondered why super important networks weren't closed networks.

This could be a closed network ... all it takes is a usb key to infect it. My guess is that is unlikely in most facilities that they would have sufficient security and discipline to keep out all portable devices (you're more likely to see it in US Govt/DOD or financial services or another agency that is either mandated or highly motivated to have strong, enforced security standards).

It was a USB drive that compromised the DoD Networks earlier this year.