A cyber-attack that targeted Iran's oil ministry and main export terminal was caused by the most sophisticated computer worm yet developed, experts have warned.
The virus appears to have been directed primarily at a small number of organisations and individuals in Iran, the West Bank, Lebanon and the United Arab Emirates. This will inevitably raise suspicions that Israel or the US were involved in some way.
Analysts who have been decoding the computer worm, which is called W32.Flamer, have been unable to identify the source. But they say only a professional team working for several months could have been behind it.
The CrySys Laboratory, in Hungary, said: "The results of our technical analysis supports the hypothesis that [the worm] was developed by a government agency of a nation state with significant budget and effort, and it may be related to cyberwarfare activities."It is certainly the most sophisticated malware we [have] encountered. Arguably, it is the most complex malware ever found."
Orla Cox, a senior analyst at Symantec, the international computer security firm, said: "I would say that this is the most sophisticated threat we have ever seen."
Symantec undertook a detailed analysis of the groundbreaking Stuxnet virus, which targeted Iran's nuclear enrichment facilities two years ago, sending some of their centrifuges spinning out of control. Cox said W32.Flamer appeared to be even more complex than Stuxnet, and that it was an incredibly clever, comprehensive "spying programme".
"It is a backdoor worm that goes looking for very specific information. It scrapes a mass of information from any infected machines and then sends it, without the user having any idea what is going on. The amount of information it can send is huge."
Symantec first started working on the code over the weekend after it was discovered by specialists at the Laboratory of Cryptography and System Security, at the University of Budapest.
Analysis now shows that the worm has been around, undetected, for at least two years, and experts are confident it was responsible for the disruption to Iran's oil industry last month.
According to reports, the cyber-attack forced Iran to convene a "crisis committee" that ordered the disconnection of six of its main oil terminals from the internet, to stop the worm spreading.
One of these, on Kharg island, 16 miles off the north-western coast of Iran, processes 90% of the country's crude oil exports.
The Iranian Students' News Agency said that the virus had successfully erased information on hard disks at the oil ministry's headquarters.
Though the oil ministry insisted that the worm had been contained and that no significant data had been erased, the likelihood is that W32.Flamer had been inside the network for many months and may already have completed its primary mission. Cox said the worm was designed to gather and send information covertly unlike Stuxnet, which was built to identify and destroy equipment.
"Once the attacker has that level of access, then all bets are off," she said. "Once the worm has infected a system, it would be possible to add new commands over time, to add an element of disruption."
Though Symantec said it was impossible to say whether the team behind W32.Flamer was also behind Stuxnet. Cox said the two were similar in some ways, and shared some features.
"To the casual observer, the worm looks like any piece of software," she said. "To get that level of sophistication would take a team of 10 several months. It's very professional."
The worm was able to take screenshots of users' desktops, to spread via USB drives, and to disable security systems. It was also able to find security vulnerabilities in Microsoft Windows to help it spread from network to network. As well as major networks, the worm appears to have infected personal computers being used at home, she said.
Symantec said it believed at least 100 organisations and individuals had been targeted by the worm, and that these were "primarily located in the Middle East". The worm appeared to have transferred to Hungary, Russia, Austria and Hong Kong, though these may have been hit accidentally.
The use of so-called cyberwarfare was taken to new levels by Stuxnet, which disabled some of the centrifuges inside the Natanz enrichment plant, south-west of Tehran.
Though nobody has been able to say confidently who was responsible for building the virus, only certain countries are thought to have the necessary capability, or intent.
Israel and the US are thought to be world leaders in the development of such technology. Last year an investigation by the New York Times claimed Stuxnet was a joint US/Israeli operation designed to undermine Iran's efforts to make a bomb of its own.
and Iran keep developing and moving forward - even with this hinderence they will continue moving forward with their mission.... whats next boys? - bring it on!
Computer worm that hit Iran oil terminals 'is most complex yet' | World news | guardian.co.uk
The virus appears to have been directed primarily at a small number of organisations and individuals in Iran, the West Bank, Lebanon and the United Arab Emirates. This will inevitably raise suspicions that Israel or the US were involved in some way.
Analysts who have been decoding the computer worm, which is called W32.Flamer, have been unable to identify the source. But they say only a professional team working for several months could have been behind it.
The CrySys Laboratory, in Hungary, said: "The results of our technical analysis supports the hypothesis that [the worm] was developed by a government agency of a nation state with significant budget and effort, and it may be related to cyberwarfare activities."It is certainly the most sophisticated malware we [have] encountered. Arguably, it is the most complex malware ever found."
Orla Cox, a senior analyst at Symantec, the international computer security firm, said: "I would say that this is the most sophisticated threat we have ever seen."
Symantec undertook a detailed analysis of the groundbreaking Stuxnet virus, which targeted Iran's nuclear enrichment facilities two years ago, sending some of their centrifuges spinning out of control. Cox said W32.Flamer appeared to be even more complex than Stuxnet, and that it was an incredibly clever, comprehensive "spying programme".
"It is a backdoor worm that goes looking for very specific information. It scrapes a mass of information from any infected machines and then sends it, without the user having any idea what is going on. The amount of information it can send is huge."
Symantec first started working on the code over the weekend after it was discovered by specialists at the Laboratory of Cryptography and System Security, at the University of Budapest.
Analysis now shows that the worm has been around, undetected, for at least two years, and experts are confident it was responsible for the disruption to Iran's oil industry last month.
According to reports, the cyber-attack forced Iran to convene a "crisis committee" that ordered the disconnection of six of its main oil terminals from the internet, to stop the worm spreading.
One of these, on Kharg island, 16 miles off the north-western coast of Iran, processes 90% of the country's crude oil exports.
The Iranian Students' News Agency said that the virus had successfully erased information on hard disks at the oil ministry's headquarters.
Though the oil ministry insisted that the worm had been contained and that no significant data had been erased, the likelihood is that W32.Flamer had been inside the network for many months and may already have completed its primary mission. Cox said the worm was designed to gather and send information covertly unlike Stuxnet, which was built to identify and destroy equipment.
"Once the attacker has that level of access, then all bets are off," she said. "Once the worm has infected a system, it would be possible to add new commands over time, to add an element of disruption."
Though Symantec said it was impossible to say whether the team behind W32.Flamer was also behind Stuxnet. Cox said the two were similar in some ways, and shared some features.
"To the casual observer, the worm looks like any piece of software," she said. "To get that level of sophistication would take a team of 10 several months. It's very professional."
The worm was able to take screenshots of users' desktops, to spread via USB drives, and to disable security systems. It was also able to find security vulnerabilities in Microsoft Windows to help it spread from network to network. As well as major networks, the worm appears to have infected personal computers being used at home, she said.
Symantec said it believed at least 100 organisations and individuals had been targeted by the worm, and that these were "primarily located in the Middle East". The worm appeared to have transferred to Hungary, Russia, Austria and Hong Kong, though these may have been hit accidentally.
The use of so-called cyberwarfare was taken to new levels by Stuxnet, which disabled some of the centrifuges inside the Natanz enrichment plant, south-west of Tehran.
Though nobody has been able to say confidently who was responsible for building the virus, only certain countries are thought to have the necessary capability, or intent.
Israel and the US are thought to be world leaders in the development of such technology. Last year an investigation by the New York Times claimed Stuxnet was a joint US/Israeli operation designed to undermine Iran's efforts to make a bomb of its own.
and Iran keep developing and moving forward - even with this hinderence they will continue moving forward with their mission.... whats next boys? - bring it on!
Computer worm that hit Iran oil terminals 'is most complex yet' | World news | guardian.co.uk
