Iran says it has detected second cyber attack

Son of Stuxnet meet the World, World, this is Son of Stuxnet..  From Reuters, via Fark.

Iran has been targeted by a second computer virus in a "cyber war" waged by its enemies, its commander of civil defense said on Monday.

Gholamreza Jalali told the semi-official Mehr news agency that the new virus, called "Stars," was being investigated by experts.

"Fortunately, our young experts have been able to discover this virus and the Stars virus is now in the laboratory for more investigations," Jalali was quoted as saying. He did not specify the target of Stars or its intended impact.

"The particular characteristics of the Stars virus have been discovered," Jalali said. "The virus is congruous and harmonious with the (computer) system and in the initial phase it does minor damage and might be mistaken for some executive files of government organisations."

An observation here..  If Iran continues to stay tight-lipped about what they know regarding Stars, it means either it's having a severe impact on their operating systems, and they're going to let the perpetrators expose themselves by tracking where the leaks originate.  The Cyber War is well underway..

Japan to Stuxnet: How Long Have You Been Standing There?

New cybervirus found in Japan / Stuxnet designed to attack off-line servers via USB memory sticks  From Daily Yomiuri Online.  Excerpts:

Stuxnet, a computer virus designed to attack servers isolated from the Internet, such as at power plants, has been confirmed on 63 personal computers in Japan since July, according to major security firm Symantec Corp.

The virus does not cause any damage online, but once it enters an industrial system, it can send a certain program out of control.

After Stuxnet finds its way onto an ordinary computer via the Internet, it hides there, waiting for a USB memory stick to be connected to the computer, when it transfers itself to the memory stick. When the USB device is then connected to a computer linked to an isolated server, it can enter the system and take control of it.
..
According to the security company, the virus is designed to target a German-made program often used in systems managing water, gas and oil pipelines. The program is used at public utilities around the world, including in Japan.

Was The Japanese Nuclear Crisis Compounded By The Stuxnet Worm?   Room Eight offers the Stuxnet virus as "crazy Pit Bull who didn't mean to attack" Japan, but did.  Horrible, but accidental.

Maybe. This one sounds more curious in a more conspiratorial light.. 10 Germans flee Japan's quake-hit nuclear plant.  Stuxnet targets Siemens equipment, which is German made..

Not to mention this little nugget from Slovenia.  Slovene nuclear plant fails to restart

I'm not sure if any of this can be combined or valid, but with Japan's opaque attitude towards public information, this theory, while thin at the moment, might not be later.  Consider this a bookmark.  If more evidence arises, we'll revisit.

Hi: Remember Me? I'm Stuxnet. We Met Back In July..

Flaws in Stuxnet Worm Deflect Suspicion From US, Israel. From The Epoch Times. Poorly thought out interpretation of events. Excerpts in italics:

The New York Times published an article on Jan. 16 shining more light onto the issue. It stated that Israel built nuclear centrifuges identical to those in the Bushehr plant to test a computer worm, and had cooperation from the United States. Although there is still no direct proof that the United States or Israel were behind Stuxnet, the two countries were the main suspects to begin with.

Despite accusations that Stuxnet was a U.S.-Israel project, there are flaws in the worm that suggest it was created elsewhere. Black Hat DC conference on digital exploits and cyberattacks on Jan. 18, security consultant Tom Parker analyzed Stuxnet’s code.

Parker “presented a compelling case that Stuxnet may be the product of a collaboration between two disparate groups, perhaps a talented group of programmers that produced most of the code and exploits and a less sophisticated group that may have adapted the tool for its eventual use,” states a report from Threat Post, the security news service of anti-virus company Kaspersky Lab.

"This was probably not a Western state. There were too many mistakes made. There's a lot that went wrong," Parker said, according to Threat Post. “There's too much technical inconsistency. But, the bugs were unlikely to fail. They were all logic flaws with high reliability." In simple terms, there were technical shortcomings, but the virus was still highly reliable.

Nate Lawson, a cybersecurity expert with Root Labs, analyzed Stuxnet in a Jan. 17 blog post, stating, “I really hope it wasn’t written by the USA because I’d like to think our elite cyberweapon developers at least know what Bulgarian teenagers did back in the early ’90s.”

Funny, but probably not. Here's a differing opinion:

The “Stuxnet” computer worm made international headlines in July, when security experts discovered that it was designed to exploit a previously unknown security hole in Microsoft Windows computers to steal industrial secrets and potentially disrupt operations of critical information networks. But new information about the worm shows that it leverages at least three other previously unknown security holes in Windows PCs, including a vulnerability that Redmond fixed in a software patch released today. (The article was last updated September 22, 2010)

..Experts say the worm was designed from the bottom up to attack so-called Supervisory Control and Data Acquisition (SCADA) systems, or those used to manage complex industrial networks, such as systems at power plants and chemical manufacturing facilities.

The worm was originally thought to spread mainly through the use of removable drives, such as USB sticks. But roughly two weeks after news of Stuxnet first surfaced, researchers at Moscow-based Kaspersky Lab discovered that the Stuxnet worm also could spread using an unknown security flaw in the way Windows shares printer resources. Microsoft fixed this vulnerability today(possibly September 22), with the release of MS10-061, which is rated critical for Windows XP systems and assigned a lesser “important” threat rating for Windows Vista and Windows 7 computers.

In a blog post today, Microsoft group manager Jerry Bryant said Stuxnet targeted two other previously unknown security vulnerabilities in Windows, including another one reported by Kaspersky. Microsoft has yet to address either of these two vulnerabilities – known as “privilege escalation” flaws because they let attackers elevate their user rights on computers where regular user accounts are blocked from making important system modifications.

Anti-virus researchers also discovered that Stuxnet leverages a Windows vulnerability that Microsoft patched back in 2008. Roel Schouwenberg, a senior anti-virus researcher at Kaspersky, said initially it wasn’t clear why the worm’s designers included such an antiquated vulnerability, which would almost certainly set off alarm bells inside of any organization using common intrusion detection and prevention tools.

But Schouwenberg said the inclusion of that 2008 vulnerability made more sense when he learned that most industrial control system networks do not employ these defensive tools or even basic network logging, as is common in most corporate networks. Consequently, he said, Stuxnet behaves differently depending on what type of network it thinks it is running on. Stuxnet performs some rudimentary checking to see whether it is on a corporate network or a control systems network: If it detects that it is running on a corporate network, it won’t invoke the older 2008 vulnerability, Schouwenberg said.

What can't Bulgarian teens from the 90's do? They must be amazing in person!

Returning to the first link for more.. Tenuous-ness..

Like Parker, Lawson states that the Stuxnet worm is full of holes. Among the shortcomings are “the Stuxnet developers seem to be unaware of more advanced techniques for hiding their target,” and “It does not use virtual machine-based obfuscation, novel techniques for anti-debugging, or anything else to make it different from the hundreds of malware samples found every day.” (Go back and re-read the previous link)

Giving it credit, Stuxnet was highly effective and accomplished at what it was likely set loose to do—destroy Iran’s nuclear centrifuges. It was also incredibly clean and was free of any digital fingerprints that could trace it back to its creator.

The worm has no potential for monetary gain, which made the United States and Israel prime suspects.

And:

The larger issue currently at hand is that the code behind Stuxnet is now freely available. A virus, which likely took millions of dollars to create, that can physically control moving parts of infrastructure, and can access systems even if they are not connected to the Internet, is on the loose. (With more variants TBA, ASAP..)

A quick Google search reveals that Stuxnet is readily available for anyone to download via file sharing websites and links on message boards. Stuxnet has the potential to cause massive damage, and the main risk is possible alterations that hackers, terrorists, or foreign governments could make to the virus.

Think of Stuxnet as the cyberweapon equivalent of an improvised explosive device (IED). It is easily attainable and can cause huge damage, but the world now knows how to spot it. (Except that targeted networks sometimes don't even use the software to identify the particular(and specific) entry, which could change locations with each new version..)Like an IED, the real potential is in the alterations that can be made to make it more damaging and harder to spot.

Stuxnet is Low-Tech sophisticated, effective in its mission, has/had two points of entry not immediately addressed by Microsoft, cost millions to produce, and is essentially "public domain," now available for upgrades and remixes by.. Just about anybody! This event, and all related consequential behavior sounds a lot more advanced and strategic than it portrays itself. Which is a reflection of Stuxnet's creators.

The first Sons of Stuxnet should be arriving anytime now..

So.. How about that Super Bowl?

Stuxnet: Imagine My Surprise

Israeli Test on Worm Called Crucial in Iran Nuclear Delay Excerpts:

The Dimona complex in the Negev desert is famous as the heavily guarded heart of Israel’s never-acknowledged nuclear arms program, where neat rows of factories make atomic fuel for the arsenal.

Over the past two years, according to intelligence and military experts familiar with its operations, Dimona has taken on a new, equally secret role — as a critical testing ground in a joint American and Israeli effort to undermine Iran’s efforts to make a bomb of its own.

Behind Dimona’s barbed wire, the experts say, Israel has spun nuclear centrifuges virtually identical to Iran’s at Natanz, where Iranian scientists are struggling to enrich uranium. They say Dimona tested the effectiveness of the Stuxnet computer worm, a destructive program that appears to have wiped out roughly a fifth of Iran’s nuclear centrifuges and helped delay, though not destroy, Tehran’s ability to make its first nuclear arms.

“To check out the worm, you have to know the machines,” said an American expert on nuclear intelligence. “The reason the worm has been effective is that the Israelis tried it out.”
Though American and Israeli officials refuse to talk publicly about what goes on at Dimona, the operations there, as well as related efforts in the United States, are among the newest and strongest clues suggesting that the virus was designed as an American-Israeli project to sabotage the Iranian program.

This comes as a total shock. Really. I won't admit otherwise until such time when everyone already knows and the point is irrelevant.

Here's A Doom Nugget Buried Under Charlie Sheen's Unconscious, Drunken Body..

Not literally, people; come on.. Failure Shuts Down Squadron of Nuclear Missiles. Excerpts/Italics:

President Obama was briefed this morning on an engineering power failure at F.E. Warren Air Force Base in Wyoming that took 50 nuclear intercontinental ballistic missiles (ICBMs), one-ninth of the U.S. missile stockpile, temporarily offline on Saturday.

The base is a main locus of the United States’ strategic nuclear forces. The 90th Missile Wing, headquartered there, controls 150 Minuteman III intercontinental ballistic nuclear missiles. They’re on full-time alert and are housed in a variety of bunkers across the base.
..
..engineers believe that a launch control center computer (LCC), responsible for a package of five missiles, began to “ping” out of sequence, resulting in a surge of “noise” through the system. The LCCs interrogate each missile in sequence, so if they begin to send signals out when they’re not supposed to, receivers on the missiles themselves will notice this and send out error codes.

Since LCCs ping out of sequence on occasion, missileers tried quick fixes. But as more and more missiles began to display error settings, they decided to take off-line all five LCCs that the malfunctioning center was connected to. That left 50 missiles in the dark. The missileers then restarted one of the LCCs, which began to normally interrogate the missile transceiver. Three other LCCs were successfully restarted. The suspect LCC remains off-line.
And:
The defense official said that there had not been a power failure, though the official acknowledged that that explanation had made its way through public affairs channels.

“We’ve never had something as big as this happen,” a military officer who was briefed on the incident said. Occasionally, one or two might blink out, the officer said, and several warheads are routinely out of service for maintenance. At an extreme, “[w]e can deal with maybe 5, 6, or 7 at a time, but we’ve never lost complete command and control and functionality of 50 ICBMs.”

The Military says this happened previously in 1998 to two bases in North Dakota and Montana, and the same piece of hardware is blamed, too(see article linked), but I find the timing and magnitude of this incident particularly disturbing. I can't imagine the same programming/system problem that happened twelve years ago happened again because they couldn't isolate the bugs. 1998 was the Stone Age in cybertime, so no progress finding a fix? Really? Rating: Highly Suspect to Unadulterated Bullshit.

So.. What caused it? How did the Military lose command and control of one ninth our ballistic missiles? Escalating tensions between North and South Korea, China and Japan, Israel and Iran, Russia and Georgia, stealth cyber warriors everywhere and nowhere at once, and something locks up our nukes? And what if something were to actually take control of those nukes and turn them inward?

Have you noticed no one's talking about Stuxnet anymore? It must have just dissolved and gone away overnight..

Hey! X Did Equal X!

Israeli cyber unit responsible for Iran computer worm – claim Excerpts in italics:
Computer experts have discovered a biblical reference embedded in the code of the computer worm that has pointed to Israel as the origin of the cyber attack.

The code contains the word "myrtus", which is the Latin biological term for the myrtle tree. The Hebrew word for myrtle, Hadassah, was the birth name of Esther, the Jewish queen of Persia.
In the Bible, The Book of Esther tells how the queen pre-empted an attack on the country's Jewish population and then persuaded her husband to launch an attack before being attacked themselves.

Israel has threatened to launch a pre-emptive attack on Iran's facilities to ensure that the Islamic state does not gain the ability to threaten its existence.
Ralf Langner, a German researcher, claims that Unit 8200, the signals intelligence arm of the Israeli defence forces, perpetrated the computer virus attack by infiltrating the software into the Bushehr nuclear power station
Mr Langer said: "If you read the Bible you can make a guess."

Israel threatened an attack, and an attack happened. Wouldn't it be more surprising if Israel didn't do it?

Let X=X

Iran's nuclear agency battles computer worm that can bring down power plants. Excerpts in italics:
Iranian media reports said Friday that the country's nuclear agency is trying to combat a complex computer worm that has affected industrial sites in Iran and is capable of taking over power plants.

The computer virus, which attacks a widely used industrial system, appears aimed mostly at Iran and its sophistication suggests a state may have been involved in creating it, Western cyber security companies said earlier in the day.

This is but the first of many super-cyberweapons. What might the future hold? Entire national infrastructures can all be attacked, all simultaneously. This utter and complete destruction can be mirrored in multiple countries. Battles will be waged along fiber optic tubes and via satellite. "Targeted Destruction" might be en vogue now, but what about the future? Will this different means of warfare lead to new and different tactics? And, lest we forget, each new variation will be more deadly and sophisticated than its predecessor. Global, long-duration chaos could happen almost instantly. And we as a planet may never return to the level of advancement achieved just prior to this technological annihilation, not in our lifetimes.

Welcome to the World of Tomorrow!