Holy Shit. Stuxnet Worm In Iran's Computers.

This could be huge. Massively huge. Game changer huge. The mullahs must be furious. Mahmud soiling himself to find out what happens next.

They can't be sure the data they get is real or right. They can't be sure the centrifuges are enriching instread of destroying the product.

One source says 30,000 computers infected. The other is 300,000. The percentage, though, remains at 60 % known to have serious problems.

If this is correct Iran may have just been knocked way back in their nuclear quest.

Their people are not going to be happy, either.

IF. . .

Be sure to go to the links themselves, too, to read many links embeded there.

Computer World

Iran confirms massive Stuxnet infection of industrial systems
Nation's atomic energy experts met last week to discuss ways to eradicate worm, say reports
By Gregg Keizer
September 25, 2010

Officials in Iran have confirmed that the Stuxnet worm infected at least 30,000 Windows PCs in the country, multiple Iranian news services reported on Saturday.

Experts from Iran's Atomic Energy Organization also reportedly met this week to discuss how to remove the malware.

Stuxnet, considered by many security researchers to be the most sophisticated malware ever, was first spotted in mid-June by VirusBlokAda, a little-known security firm based in Belarus. A month later Microsoft acknowledged that the worm targeted Windows PCs that managed large-scale industrial-control systems in manufacturing and utility companies.

Those control systems, called SCADA, for "supervisory control and data acquisition," operate everything from power plants and factory machinery to oil pipelines and military installations.

According to researchers with U.S.-based antivirus vendor Symantec, Iran was hardest hit by Stuxnet. Nearly 60% of all infected PCs in the earliest-known infection were located in that country.

Since then, experts have amassed evidence that Stuxnet has been attacking SCADA systems since at least January 2010. Meanwhile, others have speculated that Stuxnet was created by a state-sponsored team of programmers, and designed to cripple Iran's Bushehr nuclear reactor.

The reactor, located in southwestern Iran near the Persian Gulf, has been the focus of tension between Iran and the West, including the U.S., which believes that spent fuel from the reactor could be reprocessed into high-grade plutonium and used to build one or more nuclear weapons.

According to the Tehran-based Mehr News Agency, Mahmoud Alyaie, an IT official with Iran's industries and mines ministry, said that 30,000 IP addresses in the country had been infected with Stuxnet. Multiple computers can access the Internet via a single IP address, so the total number of infected Windows PCs may be considerably larger.

A working group composed of experts from several Iranian government ministries has been established to deal with the Stuxnet infection, Alyaie said. Other sources quoted by Mehr claimed that Iran has the capability to craft the necessary antivirus tools to detect and destroy the worm.

Also on Saturday, the Associated Press (AP) news service said that experts from Iran's nuclear energy agency met last Tuesday to plan how to remove Stuxnet from infected PCs. Citing the ISNA news agency, another Tehran-based organization, the AP said no victimized plants or facilities had been named.

Speculation about Stuxnet's likely target has focused on the Bushehr reactor. Saturday, the Web site of Iran's Atomic Energy Organization included a link to a lengthy Mehr story on Stuxnet.

That story noted that government officials said that "serious damage that caused damage and disablement" had been reported to officials.

Although Bushehr is not yet operational, workers began loading nuclear fuel into the reactor last month.

Stuxnet, called "groundbreaking" by one analyst who pulled apart its code, used multiple unpatched, or "zero-day" vulnerabilities in Windows, relied on stolen digital certificates to disguise the malware, hid its code by using a rootkit, and reprogrammed PLC (programmable logic control) software to give new instructions to the machinery that software managed.

Microsoft has patched two of the four zero-day vulnerabilities exploited by Stuxnet, and has promised to fix the remaining two flaws at some point.

Internet Anthropologist:

Iran's future Nuclear program. NOT

Ahmadinejad is done, total epic failure on every
front.

Iran's nuke program has been turned on its
head with the discovery of Stuxnet in 300,000
of its PC's and associated control mechanisms.

While they are scrambling for methods to dis-infect
these machines and digging to see just how deep this
infection goes and running damage assessments and
checking the depth of the Top Secret leaks they stopped
trusting their info/data comms. 60% of Iranian computers
are compromised. Expect to see another 20% over next
week.

This is a huge embarrassment for Ahmadinejad and
his Revolutionary Guard, MOIS and Qods.
It means their PC are compromised also.

Ahmadinejad actions has resulted in the exposure
of all of Iran's Secrets at least to NSA. This may be
enough to bring the Iranian President down.

In the mean time they have reverted to "Russian Rules".
Hard copy only and hand delivery. Which will slow the
entire Intelligence structure to almost a crawl.

The damage assessment will take years to complete,
heads will roll and numerous unexplained deaths from
regime assassinations for sloppy opsec.

Look for many more defections as key people try and
avoid the purge.

Iran's imported cyber engineers may be able to remove
the bug from PCs, but the control consuls is a different
matter, there are a myriad or places to hide code.
They can never be sure every one of the 300,000 are clean.

And then there is the matter of undisclosed methods of
infection, unknown vectors.

And then there is the risk of Iranian success in removing
the bug, If the world doesn't really know what Iran is doing
on its nuke program they are going to be attacked.
Nuke facilities and leadership taken out.
A suicide action for Ahmadinejad, a sure method of
changing Iranian presidents.

So Iran either lets the world look or get attacked.

But they haven't got to this paradigm yet, they
are still busy scrambling dealing with the BUG,
and their embarrassment and civilian retribution.

Iran Wins One Almost

It turns out Iran's paranoia is justified.

They search the world over for a cyber security
company, to run Computer security/forensics for its Nuclear
facilities.

NO American or European cos.
The old Russian KGB network recommends
VirusBlokAda experienced in cyber
security headquartered in Belarus.

The sell a anti-virus program that they say
is very good on Malware.

But Iran wants their top level engineers,
hackers to check their PCs in the Nuclear
facilities.

They had big problems with the previous
production from their program.
It was corrupted, impure, useless.
Running their product thru the centrifuges
destroyed them. And at the current level
the product isn't nuclear bomb material.

Iran took it out and effectively dumped it
and started all over.

Abberjonneys hench men couldn't pin
the problem on any thing or person.
It just seemed to have been contaminated
thru some unknown method.

They even killed some scientists,
tortured some and threatened every
one else.

Some ran for America's CIA.
And were welcomed.

They determined it wasn't any of their
own people, that sabotaged the material.
To late for the ones they assassinated.
And the finger pointed to hacking.

Eventually they went to the Russians
for cyber forensics as they don't have
this skill set at the level Iran needed in house.

For VirusBlokAda this was an important
but routine job. They have offices in 9 countries.
Mostly non-Western block.

They are trusted by the former Soviet block,
and do similar work on call for many of the
other countries. Important because
if they do find something in Iran it will
put them on the Security Vendor map.
And trigger some nice Iranian bonuses for
corp and individuals.

They didn't find much in the computers,
and then some how got an ok and payment
to check the programmable controls for the
nuclear reactors.

And they hit it big.
They watched the OS lie to them,
detract code from programs they read,
and add code to programs they were
reinstalling.

And they found Stuxnet:
Mahmoud Alyaie told Mehr that the Iranian industrial control systems are made by Siemens and the Stuxnet is designed to attack exactly these systems and transfer classified data abroad.
An IT official of Iran's mines and metals ministry told the Mehr news agency that 30,000 computers belonging to industrial units have already been infected by the virus.

These guys are good and are tenacious.
But can they remove it and be sure?
What surprises await them.
Note they just discovered it,
did not say they removed it.
ISNA news agency, however, reported that the Iranian Atomic Organization held a seminar this week to improve the organization's cyberdata, especially against Stuxnet, and 'explore ways to remove it.' THEY HAVE NOT BEEN ABLE TO REMOVE IT, g

On September 22, Russia’s President Dmitry Medvedev signed a decree which bans deliveries of S-300 missile systems to Iran. Called “On Measures to Implement Resolution 1929 of June 9, 2010 of the UN Security Council,” the document prohibits any transit across Russia and the transfer to Iran of all types of combat tanks, armored personnel carriers, large-caliber artillery systems, warplanes, helicopter gunships, warships, missiles or missile systems as defined in the UN Register of Conventional Arms.

But it didn't ban cyber security services.
Hmmm.

Iran is considering replacing all 30,000 infected units.
That is probably the best way to go.
The Nuke program would be on hold for 2 yrs
during the replacements.
Or they can continue with USA watching everything in their nuke program.
Iran's nuke program is an open book to NSA.
This is why US has had such patience in negotiating with Iran. And how US has
convinced Israel not to strike at Iran's
nuke reactors.
And note it took Ruskies to find it, the
regime couldn't do it.