Iran Alleges Espionage Over Internet Worm

Senior government official says foreign governments are launching malware dubbed Stars at the countrys nuclear facilities.

(click image for larger view)
Slideshow: 10 Massive Security Breaches
A senior official in Iran has alleged that foreign governments have been targeting the countrys nuclear facilities using an Internet-borne worm, dubbed Stars.
Brigadier general Gholam Reza Jalali, Irans head of civil defense, on Monday told the Iranian Mehr news agency that the country has detected a new worm that targets government systems. The damage is very low in the first phase, said Jalali. The executable files may sometimes be confused with official state documents.
He also warned that although the Stars
malware
had been discovered--he didnt specify how--researchers still didnt understand its purpose or how exactly it operates, meaning that it might still unleash some type of attack. Finally, he called for legal sanctions against whomever launched Stars.
According to security experts, Jalalis description of the worm makes it sound as if the attack employs malicious Word, Excel, or PDF files, and that echoes a recent series of targeted attacks that have exploited a
vulnerability in Flash
. But is a worm that targets a government network anything to write home about? In fact, wouldnt the absence of targeted attacks suggest that government agencies simply werent spotting attacks that were sure to be underway?
From my perspective, most governments will be running into and dealing with targeted attacks, said James Lyne, director of technology strategy at Sophos, in an email interview. Targeted attacks are common today--even for medium-size enterprises.
In many cases, we see targeted phishing attempts--though the volume is still spray and pray, where an attacker may just be lucky and hit the right system, he said. The quality of these attacks ranges from basic social engineering or Web threats--low tech can still be very successful--to quite coordinated and clever malicious code.
Of course, any apparent phishing attack against Iran raises the specter of
Stuxnet
, which apparently targeted five facilities related to an Iranian nuclear enrichment facility to then infect systems at the facility. Beginning in June 2009, the worm spread, ultimately infecting the facilitys supervisory control and data acquisition (SCADA) software, which was supplied by Siemens. The malware then adjusted the speeds of the high-frequency converter drives used for enrichment, from very low to very high frequencies, while failing to report this activity via the user interface.
Ultimately, Stuxnet disrupted the refinement process and, according to some reports, disabled the drives. Iran, however, has denied that any equipment was damaged, or its nuclear program disrupted.
Earlier this month, Jalali told the Islamic Republic News Service, Irans state news agency, that Siemens was partially to blame for Stuxnet. Siemens should explain why and how it provided the enemies with the information about the codes of the SCADA software (which is used at some of Irans major industrial sites) and prepared the ground for a cyber attack against us, he said, according to the
Tehran Times
.
Jalali also said that Irans investigation traced the origin of the worm to the United States and Israel, and identified transmissions back to those countries from PCs infected by Stuxnet. On a similar note, earlier this year, a
New York Times

story
quoted unnamed officials who said that that Stuxnet was a joint American and Israeli creation.
Jalali also called for legal action against the companies and countries that launched Stuxnet. The attacking countries should be held legally responsible for the cyber attack, he said. If we were not ready to tackle the crisis and their attack was successful, the attack could have created tragic incidents at the countrys industrial sites and refineries.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Iran Alleges Espionage Over Internet Worm