Iran's Nuclear Agency Trying to Stop Computer Worm

TEHRAN, Iran — Iranian media reports say the country's nuclear agency is trying to combat a complex computer worm that has affected industrial sites in Iran and is capable of taking over power plants.

The semi-official ISNA news agency says Iranian nuclear experts met this week to discuss how to remove the malicious computer code, dubbed Stuxnet, which can take over systems that control the inner workings of industrial plants.

Experts in Germany discovered the worm in July. It has since shown up in attacks in Iran, Indonesia, India and the U.S.

Friday's report said the malware had spread throughout Iran, but did not elaborate. Foreign media reports have speculated the worm was aimed at disrupting Iran's first nuclear power plant, which is to go online in October.

Comments

[hotheaded]

10:01 PM on 09/26/2010

i know this is not very "high brow" but damn he looks like a sleazy b@stard.

[TeeSC]

12:57 PM on 10/01/2010

And probably not politically correct for me to agree either.  :-)

[bltmn]

08:35 PM on 09/26/2010

Even if 'we' are behind the creation of this worm, the fact that industrial control systems are now in play is a serious development. Over the past 10 years, industrial control systems, like everything else, have been increasingly utilizing Ethernet as a means of integrating components, workcells, and machines into enterprise-wide data systems, including the use of internet connectivity for remote diagnostics and data collection.

While most programmable controllers do not use Windows as an operating system, the software used to program control systems almost always runs on Windows, as do most software packages used for operator interface screens and data collection. All these programs have direct access to the data and logic that run inside control systems, and can therefore create havoc if tampered with.

A well-designed network will include the necessary security to protect itself, but industrial control networks are often implemented by engineers outside traditional IT departments. To make matters worse, industrial control software is notorious for crashing after Windows updates and patches are applied - so they're often ignored outright.

This is potentially a big problem, much more real than the hysterics over Y2K.

[PaxtontheMeek]

08:31 PM on 09/26/2010

I don't ever want to give these murderous theologian despots credit but...Stuxnet is a hell of a name for a virus that can destroy your country.

[Albert Amato]

08:23 PM on 09/26/2010

http://www.nypost.com/p/news/international/item_ix2gXkzh5VFshJUxxcb5HJ
An interesting take by Netanyahu in stark contrast to the lying Ahmadinejad.

[bulfinch]

06:42 PM on 09/26/2010

This was discussed at length on CBC One last week. The worm is a production of a nation
since it is so sophisticated that only a national effort would have the resources to pull it off. One can speculate that it was a cooperative effort b/w US and Israel. I would prefer to think it was totally a US effort, since Israel has been known in the past to strike out at its "friends".

[FTBUTAME]

05:11 PM on 09/26/2010

Hopefully, our friends Israel, will take the appropriate "diplomatic action" to help set back Iran's nuclear ambitions. I hear from dissident Iranian friends in Brit / USA that apart from the attacks in Tehran that have been covered in the world press, there's been many more that have been covered up by the authorities. Ahmadinejad is under substantial pressure at present & isn't flavor of the month with Supreme Leader who has dissed him publicly on quite a few occasions.
As per Obama, Ahmadinejad is merely a figurehead who goes through the motions.
Ali Khamenei calls the shots & even though he non a 12th Imam guy, he's still no friend of the West.
As said hopefully Israel will use it's unique "diplomatic" skills to draw the line in the sand.

[ThatsTheTheWayItIs]

07:31 PM on 09/26/2010

What do you mean, our "friends" in Israel? The ones that abuse our support, bring Arab terrorism on us, then build settlements in defiance of our wishes? Those who thumb their noses at us?

With friends like that, who needs enemies?

[2013 end of an error]

02:09 AM on 09/27/2010

I think he was completely wrong

He of course should have said "VERY GOOD FRIENDS"!!!!

Shalom

[End of an ERROR 2013]

09:59 PM on 09/27/2010

Best friends!

As my similarly named user said.

SHALOM.....

[TeeSC]

01:00 PM on 10/01/2010

nah... I don't think Israel need do anything either.  The regime is imploding... grab some popcorn and watch the fun.  :-)

[BadHaBritt]

12:05 PM on 09/26/2010

Time to stop the knee jerking and start intelligent analysis. The USA & Israel have carried out many atrocities in the name of the well being of their own country. Iran is looking after the interest of it's own people just as we do. We have enough nukes to destroy mos to the world, Israel has enough nukes to destroy the middle east. Iran is no more irresponsible than the US in Iraq & Afghanistan or Israel in the West Bank & Gaza. You can't treat people like cr@p and expect them to not take measures to look after their own interests, Stop the pathetic knee jerk reactions to complicated issues

[BungalowBill]

11:04 AM on 09/26/2010

Seems we have more than a few apologists for Iran and their psycho President. To quibble over whether he said that he wanted Israel wiped off the map or is it Zionism is a pointless exercise in obfuscation? His recent statements at the UN regarding 9-11 are not in dispute and Iran's attempt to obtain nuclear weapons shouldn't be either. Ever since the hostage crisis, which I remember very well, the Iranian mullahs have not only taken Americans Hostage, they blew up the Marine Corps barracks and US Embassy in Lebanon. (see Robert Baer)

http://www.pbs.org/wgbh/pages/frontline/shows/tehran/interviews/baer.html All three actions were a declaration of war aginst the US.

[TakeSake]

12:22 PM on 09/26/2010

If that's the case, then the CIA-assisted overthrow of the democratically elected Iranian government in 1953 certainly was an act of war - and also certainly amounts to an act of terrorism.

[BungalowBill]

12:59 PM on 09/26/2010

Well, that was 57 years ago, it was the Cold War and a different time. They were a casualty of the Cold War and the end of colonialism. If we have to say mea culpa then so be it, but that doesn't change Irans complicity it fomenting terrorism for the last 30 years which includes killing American soldiers in Iraq and Afghanistan. The Iranians have been at war with the US since 1979 and we are only now coming to realize that they mean what they say. The Iranians have to know that they will inevitably lose, and their country will be left in ruins. Israel, Saudi Arabia and Egypt have very good reason to oppose the Iranians and the US has the ability to stop them. Thats the way geopolitics is in this world of ours.

[TeeSC]

01:05 PM on 10/01/2010

takesake... and that deplorable fact has been exploited by Iran for over 50 years.  When does the tit-for-tat stop?  We were wrong.  Period.  But we didn't do anything without the help from Iranians themselves so I have to temper the "big bad US" somewhat.  If that was an act of war, then so was the hostage taking AND as Bill points out, the murder of American citizens.  Don't you think we need to move FORWARD instead of backwards????

[labman]

10:38 AM on 09/26/2010

John Bolton will go into a high pique if we can knock out Iran's power and nuclear plants without dropping a single bomb. Of course North Korea will still be bomb worthy.

[Parvaneh Ferhad]

09:59 AM on 09/26/2010

Where do the Iranians get their updates for Windows from? WindowsUpdate, I presume. It would be easy to smuggle in some special files, especially when you have the digital signing certificates of Microsoft and have access to a router - as the US does.
Divert traffic from specific IP addresses to a specially prepared Windows Update. No one will notice the additional software being delivered.

[concerned joe]

10:56 AM on 09/26/2010

Whatever prevents them from getting THE BOMB works for me.

This worm is very scary though. It will change our lives forever and maybe not for the better.

[havingalaugh]

08:39 AM on 09/26/2010

Looking at that picture of Ahmadinejad, I ask you...would a caricature be any funnier?

[KenClay]

08:28 AM on 09/26/2010

I'm Back!!!!!! Good Morning..

[UnJoe]

07:11 AM on 09/26/2010

According to Agence Presse France, "Stuxnet" has already infected 30,000 industrial computers in Iran. What do you experts here make of this report, or is it redundant information? Also am curious about what if anything relevant we may have learned from the Y2K scare that could further clear up current (and coming) rumors.

http://news.yahoo.com/s/afp/20100926/wl_mideast_afp/irangermanyitcomputersecurityenergystuxnet_20100926095534

[GaryNMaine]

10:34 AM on 09/26/2010

I'm not an expert, but Mahmoud Liayi, head of the information technology council at the Iranian ministry of industries, made an interesting statement.

"It is likely a (foreign) government project," given its complexity, Liayi added without giving further details.

He is either making a government storyline for Iran, or he is paranoid. And, further...

Liyai said industries were currently receiving systems to combat Stuxnet, while stressing that Iran had decided not to use anti-virus softwares developed by Siemens because "they could be carrying a new version of the malware."

Also, shows a bit of paranoia about the intentions of the West, and shows a lot of naivety about business and computer software. Businesses would not want such a story circulating about how they messed up a countries computer systems at the behest of another government.

"When Stuxnet is activated, the industrial automation systems start transmitting data about production lines to a main designated destination by the virus. There, the data is processed by the worm's architects and then engineer plots to attack the country," Liayi said.

Now, that is sheer paranoia, and clearly a man who does not understand tech stuff.

[Kache]

01:59 AM on 09/27/2010

The understanding of Stuxnet has dramatically changed in the last 2 days. They now believe that Stuxnet has no intention of transmitted off the machine it is on. Every 5 seconds Stuxnet is reading a particular database that Siemens's SCADA software is writing to, if it is even on the system. That frequency suggests that it is not transmitting any content - it knows the exact content it is looking for (a fingerprint), and that content would probably exist on only 1 computer one time and only for a few seconds. Stuxnet has been designed to find only that one computer at exactly the time when conditions are correct. At that point it does something, deprogrammers don't know what that "something" is yet (over 5,000 functions to decompile and decrypt). But it's probably something simple, like change the max RPM setting on an engine or centrifuge.

[GaryNMaine]

10:38 AM on 09/26/2010

Siemens claims its software has not been installed at the Russian-built plant, and no Iranian official has hinted that nuclear facilities may have been infected by the malware.

German computer security researcher Ralph Langner, who has been analysing the malicious software, or malware, suspected Stuxnet's target was the Bushehr nuclear facility in Iran, where unspecified problems have been blamed for getting the facility fully operational.

So, which is it?

[Manuel]

08:13 PM on 09/26/2010

Russia has it's hands full these days. There have even been recent reports that the original owners of the Kremlin want the Krem[in back.

[Kache]

02:15 AM on 09/27/2010

I tend to accept Langner's hypothesis, simply because the security firm VirusBlokAda that discovered Stuxnet has said they were under contract in Iran and that it was nuclear related. Iran has a medical reactor, but it's very likely it was at the Bushehr plant. But, Siemens surely knows where it's software is being used.....

On the other hand, this virus is programmed to find only one computer and at a particular instance, no other computers on this planet will be effected by it other than by being carriers for propagation. Suppose that Iran built it and it's targeted to something like Glen Canyon Dam. Breaching that dam would take out Hoover and cripple all of southern California, Nevada, & Arizona water and electricity. In a scenario like that, the best decoy would be to infect tens of thousands of computers in Iran first, since the infections would be harmless. One could just as easily suspect North Korea or China or New Zealand of using Iran as a decoy. The point is, until they decode what data fingerprint it is looking for, we have no idea of the target or the perpetrator - it's all guessing at this point.

[Marcel2010]

04:24 AM on 09/26/2010

conspiracy theory- It was a worm meant 4 the USA but backfired!

[Parvaneh Ferhad]

09:43 AM on 09/26/2010

Hardly. It was specifically written to affect a certain type of (Siemens) software. Is that type of industrial software in wide use in the US?

[Kenright]

08:50 PM on 09/26/2010

Ah, maybe not widespread, but we work with it regulary.

[Brane]

11:12 PM on 09/26/2010

Yes. I see systems that run on it every day.

[techcafe]

03:20 AM on 09/26/2010

Lost in translation
➥ http://www.guardian.co.uk/commentisfree/2006/jun/14/post155

"Experts confirm that Iran's president did NOT call for Israel to be 'wiped off the map'. False reports that he did only serve to strengthen the Zionist regime & Western hawks."

click link above to read more.

[GilGamish]

07:49 AM on 09/26/2010

Actually the Iranian gov't's website translated it as "wiped of the map". Mr. Cole was wrong.

http://www.nytimes.com/2006/06/11/weekinreview/11bronner.html”

[Parvaneh Ferhad]

09:40 AM on 09/26/2010

The NYT article links to a non-existing page as proof. Not very reliable.

[Parvaneh Ferhad]

09:51 AM on 09/26/2010

and here is the real thing, although from a 2008 article, not 2006 that one is no longer available, it seems (Emphasis mine):

President Mahmoud Ahmadinejad said here Monday that the Zionist Regime of Israel faces a deadend and will under God's grace be wiped off the map.

Context is important and you can clearly discern that he (and Khomeini) spoke of the Zionist Regime to be wiped off the map, not Israel itself.

http://www.president.ir/en/?search=progressive&querystring=zionist+regime+wipe+off+map&submit=+Search+&SearchType=1&MediaType=0&SearchInTitle=1&SearchInLead=1&SearchInBody=1&ResultsPerPage=10&Catagory=0

[TeeSC]

01:14 PM on 10/01/2010

techcafe.  It's a fact that AN was technically mistranslated.  Those weren't really his own words anyway. But there is no ambiguity about how he feels.  He has NEVER specifically answered a question on what he meant.  He twists and turns his words every single time.  These ARE specific and correctly translated quotes.  Anyone who denies that AN is anti-semitic is either naive or has an agenda.

“God willing, with the force of God behind it, we shall soon experience a world without the United States and Zionism.” — Mahmoud Ahmadinejad
“Today, the time for the fall of the satanic power of the United States has come, and the countdown to the annihilation of the emperor of power and wealth has started.” — Mahmoud Ahmadinejad

“Get ready for a world minus the U.S.” — Mahmoud Ahmadinejad

“It is the mission of the Islamic Republic of Iran to erase Israel from the map of the region.” — Supreme Leader Ayatollah Ali Khameini
“The end of the U.S. will begin in Iraq. As the Imam [Khomeini] said, ‘One day the U.S., too, would be history.” — Supreme Leader Khameini
“The American regime can expect a resounding slap and devastating fist-blow from the Muslim nation for its support of the Zionist crimes and criminals.” — Supreme Leader Khameini