Symantec discovers Top-tier espionage tool 'REGIN' enables stealthy surveillance.

Symantec discovers Top-tier espionage tool 'REGIN' enables stealthy surveillance. (Symantic).

An advanced spying tool, Regin displays a degree of technical competence rarely seen and has been used in spying operations against governments, infrastructure operators, businesses, researchers, and private individuals.

An advanced piece of malware, known as Regin, has been used in systematic spying campaigns against a range of international targets since at least 2008. A back door-type Trojan, Regin is a complex piece of malware whose structure displays a degree of technical competence rarely seen.

Customizable with an extensive range of capabilities depending on the target, it provides its controllers with a powerful framework for mass surveillance and has been used in spying operations against government organizations, infrastructure operators, businesses, researchers, and private individuals.

It is likely that its development took months, if not years, to complete and its authors have gone to great lengths to cover its tracks. Its capabilities and the level of resources behind Regin indicate that it is one of the main cyberespionage tools used by a nation state.

As outlined in a new technical whitepaper from Symantec, Backdoor.Regin is a multi-staged threat and each stage is hidden and encrypted, with the exception of the first stage.

Executing the first stage starts a domino chain of decryption and loading of each subsequent stage for a total of five stages. Each individual stage provides little information on the complete package. Only by acquiring all five stages is it possible to analyze and understand the threat. Read the full story here.

Stuxnet-Like ‘Havex’ Malware Strikes European industrial SCADA Systems.

Stuxnet-Like ‘Havex’ Malware Strikes European industrial SCADA Systems.

Swati Khandelwal has an article on the website The Hacker News, today, June 26, 2014, with the title above. 

He writes that [cyber] security researchers have uncovered a new, Stuxnet-like malware, named as ‘Havex,’ which was used in a number of previous cyber attacks against organizations in Europe — the energy sector.”

“Just like the Famous Stuxnet Worm, which was specifically designed to sabotage the Iranian nuclear project, the new trojan Havex — is also programmed to infect industrial control system softwares of SCADA and ICS systems, — with the capability to possibly disable hydroelectric dams, overload nuclear power plants, and even shut down a country’s power grid –with a single keystroke.”

According to the [cyber] security firm F-Secure, who first discovered it as a Backdoor:W32/Havex.A, it is a generic remote access Trojan (RAT); and, has recently been used to carry out industrial espionage against a number of companies in Europe — that use or develop industrial applications and machines,” wrote Mr. Khandelwal.

Smarty Pants, Trojanized Installers

Mr. Khandelwal notes that “in order to accomplish this, besides the traditional infection methods such as explicit kits and spam emails, cyber criminals also used another effective method to spread Havex RAT, i.e., hacking the websites of software companies; and, waiting for targets to install trojanizd versions of legitimate apps.”

“During installation, the trojanized software setup drops a file called “mbcheck.dll, which is actually Havex malware, that attackers are using as a backdoor. “The C and C server will [then] instruct infected computers to download and execute further components,”

— “We gathered and analyzed 88 variants of the Havex RAT used to gain access to, and harvest data from, networks and machines of interest. This analysis included investigation of 146 command and control servers contacted by the variants, which in turn, — involved tracing around 1500 IP addresses in an attempt to identify victims,” F-Secure said.

F-Secure didn’t mention the names of the affected vendors, but an industrial machine producer and two educational organizations in France, with companies in Germany — were targeted.

Information Gathering.

“Havex RAT is equipped with a new component, whose purpose is to gather network and connected devices information — by leveraging the OPC (Open Platform Communications) standard,” wrote Mr. Khandelwal. “The malware scans the local network for the devices that respond to OPC requests to gather information about industrial control devices; and, then sends that information back to its command-and-control server.”
“Other than this, it also include information-harvesting tools that gather data from the infected systems,” adds Mr. Khandelwal, such as:
— Operating system related information;
— A credential-harvesting tool that stole passwords stored on open
web browsers;
— A component that communicates to different Command-And-Control
servers using custom protocols; and, execute tertiary payloads in
memory.
“So far, we have not seen any payloads that attempts to control the connected hardware.” F-Secure confirmed.

Motivation.

“While their motivation is unclear at this point, “We also identified an additional component used by the attackers that includes code to harvest data from infected machines used in ICS/SCADA systems in those organizations,” said F-Secure.

Havex Trojan From Russia?

“In January of this year, the cyber security firm CrowdStrike revealed about a cyber espionage campaign, dubbed “Energetic Bear,” where hackers possibly tied to Russian Federation penetrating the computer networks of energy companies in Europe, the United States, and Asia.

According to CrowdStrike, the malwares used in those cyber attacks were Havex RAT and SYSMain RAT, and both tools have been operated by the attackers since at least 2011. That means, it is possible that Havex RAT could somehow be linked to Russian hackers; or, state-sponsored Russian Government [entities].”

Unfortunately, what originates in Russia, or anywhere else for that matter — with respect to cyber malware/viruses, etc., doesn’t stay in Russia. I would expect other cyber malcontents to deconstruct and reverse-engineer this bug in order to see if it can be made even more “lethal,” and damaging that it may already be. V/R, RCP

Israel Sends Virus - Insect - Bugs - Critters Laced Letter to Iranian Mission in New York.

Israel Sends Virus - Insect - Bugs - Critters Laced Letter to Iranian Mission in New York.(Fars)

The Iranian embassy in New York received a virus-infected letter from Israel which threatened to make more biological attacks in the future.

The Iranian mission at the UN headquarters in New York received a suspicious letter sealed with an Israeli stamp which contained a number of dead insects.“Those who are enemies of Israel will be targeted by virus attacks,” the letter read.

The diplomats at the Iranian mission immediately informed the relevant US officials who dispatched a team of anti-virus experts to the embassy and they transferred the virus-laced letter under special care to prevent any possible infection.

Based on the latest information, no Iranian diplomat has been infected with the suspicious letter.

Israel, an arch foe of the Islamic Republic, is notorious for its terrorist efforts against Iran.

The regime in Tel Aviv has been a main accomplice in the assassination of Iranian scientists, and made strenuous attempts to disrupt Iran's nuclear program by Stuxnet malware.

In June 2012, the Iranian Intelligence Ministry announced that its intelligence forces have identified and arrested all terrorist elements behind the assassination of the country's nuclear scientists.

"A number of countries, whose territories and facilities had been misused by the Mossad-backed terrorist teams, have provided the Iranian officials with relevant information," the ministry said in a statement.

According to the statement, Iran's Intelligence Ministry had detected some of Mossad's bases within the territories of one of Iran's Western neighbors, which provided training and logistical support to the terrorist networks.Hmmmm.......Yup and they even put an Jewish stamp on it, to make sure they know who did it. Do they really think people able to develop 'Stuxnet' ....etc will go to this length??

"It's a Zionist plot" - Iran: 'Israel, Saudis plotting new computer worm to sabotage our nuclear program.'

"It's a Zionist plot" - Iran: 'Israel, Saudis plotting new computer worm to sabotage our nuclear program.'(Haaretz).

Israel and Saudi Arabia are reportedly collaborating to create a new destructive computer worm to “spy on and destroy the software structure” of Iran’s nuclear program, the semi-official Iranian news agency Fars said over the weekend.

Fars, the outlet of Iran’s Revolutionary Guards, quoted “an informed source” close to the Saudi secret service as saying that Saudi spy chief Prince Bandar bin Sultan and Mossad head Tamir Pardo each sent a representative to Vienna on November 24 with the purpose of increasing the “‘two sides’ cooperation in intelligence and sabotage operations against Iran’s nuclear program.”

“One of the proposals raised in the meeting was the production of a malware worse than the Stuxnet to spy on and destroy the software structure of Iran’s nuclear program,” the source was quoted by Fars, referring to a computer virus unleashed in 2010 targeting Iran’s uranium enrichment facility at Natanz. American whistleblower Edward Snowden told Der Spiegel this year that the U.S. and Israel cooperated to produce the virus.

Arab media reported last week that Prince Bandar took part in a meeting in Tel Aviv with Prime Minister Benjamin Netanyahu and French President Francois Hollande to discuss U.S. relations with Iran.Read the full 'story' here.

Rogue US-Israeli cyberwar weapon Stuxnet infected Russian nuclear plant.

Rogue US-Israeli cyberwar weapon Stuxnet infected Russian nuclear plant.HT: PhantomReport.

Stuxnet – the famous worm widely credited with crippling the Iranian nuclear weapons programme for several years – also infected the internal network of a Russian nuclear plant. Unspecified malware has even reached the International Space Station, according to the boss of Russian anti-virus firm Kaspersky Lab.

Eugene Kaspersky said he heard about the nuclear infection from a “friend of mine” at the unnamed nuclear plant. The unnamed staffer “sent a message their nuclear plant network which was disconnected from the internet … was badly infected by Stuxnet,” Kaspersky said, SC Magazine reports. The malware apparently got into the air-gapped network of the nuke plant on an infected USB stick.
Kaspersky told the anecdote during a recent presentation to the Canberra Press Club during which he spoke about cybercrime, cyber-espionage and attacks against infrastructure systems to members of the mainstream press in Australia.

The charismatic securityware businessman went on to claim that even machines on the International Space Station had been affected by malware, after – unnamed – cyber nasties were carried there on removable media by Russian astronauts.

“Scientists, from time to time, they are coming to space with USBs which are infected. I’m not kidding,” he insisted. “I was talking to Russian space guys and they said from time to time there are virus epidemics in the space station.”

The most famous Stuxnet infections occurred in Iran’s bombproof, deeply buried uranium enrichment facility at Natanz in 2009 and 2010, wrecking high-speed centrifuges after infecting computers connected to SCADA industrial control systems at the plant.

The Obama administration last year leaked its role in developing Stuxnet as part of a wider US-Israeli information warfare effort, codenamed Operation Olympic Games, that began under the presidency of George W Bush.

The worm was detected after it escaped onto the internet, and first described by Belarussian firm VirusBlokAda in June 2010.
According to Mr Kaspersky there are only two major infrastructure malware attacks a year worldwide, the only one this year having been targeted against banks and media organisations in South Korea.
The security-biz chieftain’s remarks on Stuxnet at the Canberra Press Club are at approximately 26 minutes into the video below.
Video: The Register

In classified cyberwar against Iran, trail of Stuxnet leak leads to White House.

In classified cyberwar against Iran, trail of Stuxnet leak leads to White House. Washington Times

The Obama administration provided a New York Times reporter exclusive access to a range of high-level national security officials for a book that divulged highly classified information on a U.S. cyberwar on Iran’s nuclear program, internal State Department emails show.

The information in the 2012 book by chief Washington correspondent David E. Sanger has been the subject of a yearlong Justice Department criminal investigation: The FBI is hunting for those who leaked details to Mr. Sanger about a U.S.-Israeli covert cyberoperation to infect Iran’s nuclear facilities with a debilitating computer worm known as Stuxnet.

A New York Times story adapted from the book, “Confront and Conceal: Obama’s Secret Wars and Surprising Use of American Power,” quotes participants in secret White House meetings discussing plans to unleash Stuxnet on Iran.
The scores of State Department emails from the fall of 2011 to the spring of 2012 do not reveal which officials told Mr. Sanger, but they do show an atmosphere of cooperation within the administration for a book generally favorable toward, but not uncritical of, President Obama.

“When you read the totality of those documents, it’s a super-close relationship they are furthering with Sanger,” Mr. Klayman said. “They were literally force-feeding him.”
He said State has yet to provide transcripts of the Sanger interviews.
“I think the thrust of this is this requires a significant investigation,” Mr. Klayman said, adding that he has provided the emails to the House Committee on Oversight and Government Reform.
A State Department spokesman did not respond to emails from The Washington Times requesting comment.Hmmm......Israel's 'Staunchest ally".Read the full story here.

Nukes are useless because nobody dare use them – Ahmadinejad to RT.

Nukes are useless because nobody dare use them – Ahmadinejad to RT.HT: Russia Today.

“This is something that I said many times before. It is not of any use to us to have nukes. Where can we use nuclear weapons? They are useless, nobody can use them. The US has most of the nukes in the world – where can it use them?” he said.

The Iranian President believes society is “well over this one”. “It is so 20th century, even the people of the US are not going to allow the government to make use of them,” the Iranian president suggested, because “It is the most brutal and inhumane weapon that can be used against others.”

Throughout its history Iran “has always been a defender and has always used conventional weapons only,” claimed President Ahmadinejad. 
“Iran has never used chemical weapons. Iran is still defending itself with mostly a political-cultural defense,” Ahmadinejad said.
However, the outgoing president whose term finishes on August 3 warned that “one cannot get away with bombarding” Iranian nuclear facilities. 
“[Nuclear facilities] are securely localized in the heads of our scientists,” he said, referring to American and Israeli threats to carry out unilateral strikes on Iran in recent years.

The west headed by the US has been putting pressure on Iran over the country’s controversial nuclear program. Though Tehran always stressed the program is peaceful, Washington as well as Tel Aviv have suspected Iran of building nuclear weapons, something Tehran has consistently denied.
While the US has frequently stated that “all options are on table” while dealing with Iran, Israel threatened a unilateral strike on the Iranian nuclear facilities.
“Iran’s territory is 1,873 million square kilometers, that’s a vastness, are they going to bomb them all?”
“This is a psychological war and of course we’re ready to defend ourselves,” Ahmadinejad concluded.
However, the Iranian leader remarked that a direct dialogue between Iran and the US would be possible – if Washington agrees to “equal circumstances” dialogue, not a dictate.
“If somebody comes to you and holds a hammer over your head and forces you to have a dialogue – that is not right. A dialogue is about gaining understanding and resolving differences. It should not be used as a method to impose on others,” President Ahmadinejad said.

‘Every country will be affected by economic recession’

The world is facing an economic recession, the current economic crisis is an international one and it affects every country, be it Iran, Russia, the US or the EU, Iranian leader said.
“Iran has been under unilateral, one-sided, unfair sanctions, but despite severe unprecedented sanctions the country develops economically – nothing short of a miracle. All economic indexes are improving, per capita income is going up, the human development index is on the rise,” he said.
In late 2011 - early 2012, the US and EU imposed sanctions on Tehran targeting its banks and oil industry effectively banning the oil trade between Europe and Iran, and putting significant barriers to trade. Iran is still exporting oil, it has also begun to export electricity, steel and cement and the total exports, excluding oil, has grown seven fold, Ahmadinejad revealed.
“In many fields related to technology we are among the top 10 in the world,” Ahmadinejad said adding that in terms of scientific progress the country rose from 32nd to 14th in eight years and scientific growth is 11 times higher than the world average.
Western countries started to ignore Iran after the Islamic Revolution in 1979 and continued to do so over the last 34 years, but they have not succeeded in halting Iran’s economic development, President Ahmadinejad stated.

‘Fighting cyber war has become Iran’s second nature’

During the interview with RT, Iranian President Mahmoud Ahmadinejad has also talked of Tehran having always been aware of the cyber warfare conducted against it.
In March, law and technology experts agreed that the Stuxnet worm used against Iran in 2009-2010 was a cyber-attack. Stuxnet was allegedly used to change the speeds of around 1,000 gas-spinning centrifuges without being detected, thus sabotaging Iran's nuclear research. The US and Israel have been accused of collaborating on the virus in a bid to damage Iran’s nuclear program.
“This is a world of communications. Once you get connected to the internet – there are going to be problems of a kind,” Ahmadinejad said.
“We’re talking to each other right now, right?” he told RT’s Sophie Shevardnadze. “Do you think that we’re being bugged? That this place is bugged? Maybe we’re bugged, it is not difficult to do,” laughed the problem off the president.


“Naturally, there is a software war going on in the virtual world, our agencies are doing this – if it is necessary,” Ahmadinejad said.
Iranian electronic communication networks, banking systems, nuclear research network, electricity networks have all been attacked, but Iranian specialists “diffused the threats and counter-attacked,” Iranian President said. “This is a routine for us. These are the harms and disadvantages of communication technology.”

‘No ruler should feel safe’

As for a possibility of an uprising similar to the Arab Spring, Mahmoud Ahmadinejad said that such revolutions were managed from the outside.
“No ruler should feel safe, nowhere in the world, not only Iran,” he concluded adding that saying there is no ideal place despite humanity’s constant strife for perfection.
The planet with about seven billion population is being ruled by maybe 1,000 people, while the governments just come and go, the Iranian President declared, so legislation is imperfect everywhere in the world and the rulers should think about ordinary people – or be overthrown.
“In the next five-six year the countries run in a limited way by narrow-minded rulers will witness revolutions – including the US,” Mahmoud Ahmadinejad predicted.
In this regard the Muslim Brotherhood in Egypt is a historical movement, a popular way of thinking that is going to stay in power unless something else of a comparable size and power emerges, Iranian President pointed out. “It cannot be eliminated completely.”
The same applies to the situation in Syria, where people should have a right “to choose elected rulers themselves,” Ahmadinejad said. Those who want to come to power militarily should be ready that the same rules of war would be applied to them.

“The westerners do not want the Syrian issue to come to an end,” he said, and the west would like to redraw the Middle East map through developing the Syrian crisis – even if it would last for 20 years, believes the Iranian President.

FBI intent on sniffing out those who leaked possible US Stuxnet role.

FBI intent on sniffing out those who leaked possible US Stuxnet role.(NakedSecurity).by Lisa Vaas.Federal investigators in the US are tightening the screws on former senior government officials who might have leaked info about the Stuxnet worm, according to The Washington Post.
Last June, Attorney General Eric H. Holder Jr. started the inquiry into loose lips.
As Naked Security recounts here, the Stuxnet virus was seemingly created by the US, under the regime of President George W. Bush, to target Iran's nuclear facility in Natanz.
The US pulled Israel into the cyber-espionage effort, with stunning results.
Those results included slowing down and speeding up a centrifuge's delicate parts, which resulted in damage so extreme that, according to The New York Times, debris from a damaged centrifuge was laid across the conference table at the White House's Situation Room to demonstrate the malware's potential power.
But the obligingly destructive Stuxnet spun out of control and escaped into the wider world, damaging systems well beyond Iran.
In spite of the virus going maverick, President Barack Obama secretly authorized continued attacks, according to the NYT.
 The code name for the Stuxnet operation was Olympic Games.
Olympic Games, indeed: The administration's efforts to find and punish those who informed the press about Stuxnet are reaching strenuous levels.
One person familiar with the investigation told the Washington Post that prosecutors are pursuing "everybody - at pretty high levels, too... There are many people who’ve been contacted from different agencies."

That includes several current and former senior government officials. The Washington Post reports that investigators are confronting these high-level officials with evidence of contact with journalists that's based on extensive analysis of their email accounts and phone records.
Six officials have already been prosecuted for disclosing classified information, and more senior-level officials may yet be implicated.
The FBI's manhunt has been aided by increasingly sophisticated data-crunching tools to sift through huge volumes of email.
Outside of its use in investigating Olympic Games leaks, such data-crunching technology has led to one recent prison term—that of John Kiriakou, a former CIA officer sentenced on Friday to 30 months in prison for disclosing to a journalist the identity of an undercover CIA officer - and the high-profile resignation of Gen. David H. Petraeus, who resigned as CIA director after the FBI discovered emails implicating him in an extramarital affair.
Glenn Greenwald at The Guardian has written an extensive and thoughtful post about how the Stuxnet leaks investigation demonstrates, in his opinion, the Obama administration's devotion to maintaining and increasing its secrecy power.
 It's not hard to come to the same conclusion that Mother Jones did: war has been declared against whistleblowers, and the administration is taking it to what some believe are troubling extremes.

The Guardian's Greenwald writes:

"Given how subservient the federal judiciary is to government secrecy claims, it is not hyperbole to describe unauthorized leaks as the only real avenue remaining for learning about what the US government does - particularly for discovering the bad acts it commits. That is why the Obama administration is waging an unprecedented war against it - a war that continually escalates - and it is why it is so threatening."

"Stuxnet going Rogue?" - Malware infects US power facilities through USB drives.

"Stuxnet going Rogue?" - Malware infects US power facilities through USB drives.(TW).By Grant Gross.Two U.S. power companies reported infections of malware during the past three months, with the bad software apparently brought in through tainted USB drives, according to the U.S. Department of Homeland Security's Industrial Control Systems Cyber Emergency Response Team (ICS-CERT).
In one case, the industrial control system at a power generation facility was infected with "common and sophisticated malware" apparently through an employee's USB drive, according to the ICS-CERT Monitor for October to December 2012.
The publication did not name the malware discovered.
The tainted USB drive came in contact with a "handful of machines" at the power generation facility and investigators found sophisticated malware on two engineering workstations critical to the operation of the control environment, ICS-CERT said.
Investigators didn't find malware on 11 other workstations examined, ICS-CERT said.
ICS-CERT recommended that the power facility adopt new USB use guidelines, including the cleaning of a USB device before each use.
In the second incident, a power company contacted ICS-CERT in early October to report a virus infection in a turbine control system. About 10 computers were affected, ICS-CERT said.
An outside technician used a USB drive to upload software updates during equipment upgrades, ICS-CERT said. The malware delayed the plant's reopening by three weeks, the organization said.Hmmm....Whodunit.....Stuxnet......China.....Iran?Read the full story here.

Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's e-mail address is grant_gross@idg.com.

Iran to unveil security oriented domestic supercomputer.

Iran to unveil security oriented domestic supercomputer.(TI).Iran will unveil the domestically made supercomputer named "ARA", which has been made mostly for security purposes, Mehr reported. The supercomputer will be unveiled in the early December, the director of Saman Communication Development Holding Company, Abbas Jam said. The supercomputer has been created entirely by Iranian scientists in Iran's Science and Technology Park in Mazandaran province. According to Abbas Jam, the supercomputer has already managed to identify security holes in some 6,000 UK and Israeli websites.
"ARA" supercomputer is able not only to identify and reveal security holes in websites, but also gain access to restricted data, according to Jam. Domestically, the supercomputer will be used to identify the holes and vulnerabilities in local scientific and educational websites, so they could be fixed as soon as possible. In February 2012, Iran's Vice president on science and technology Nasrin Soltanzadeh said that Iran will present nine domestically made supercomputers by late of this year (March 21). "Nine new supercomputers will be presented, and added to the National Grid," she said. It is planned to establish a National Grid network consisting of 11 supercomputers in total in Iran. Last year the country has already unveiled two domestically-designed and manufactured supercomputers in Tehran's Amirkabir University of Technology (AUT), and Esfahan University of Technology. Iran's first supercomputer was introduced about nine years ago with a power of 860 billion operations per second by AUT. The machines were introduced in Iran around 10 years by the AUT. Iranian engineers and technicians have been making efforts to increase the computational capacities of the devices ever since. Supercomputers are computers that are at the frontline of current processing capacity, particularly speed of calculation. They are used for highly calculation-intensive tasks such as problems involving quantum physics, weather forecasting, climate research, molecular modeling, physical simulations (such as simulation of airplanes in wind tunnels, etc.), and nuclear research.Read the full story here.

Iranian Minister of Communication and Information Technology: "Iran Faces 500 Daily Cyber Attacks."

Iranian Minister of Communication and Information Technology: "Iran Faces 500 Daily Cyber Attacks."(Fars)."In some cases, we are targeted by 500 cyber attacks against our internal networks on a daily basis," Taqipour told reporters after a cabinet meeting in Tehran on Wednesday. In relevant remarks on Monday, Iranian Intelligence Minister Heidar Moslehi announced that Iran is involved in massive and continued cyber war with the enemies who make constant attempts to harm the country's infrastructures, saying that Iran's highly skilled experts have deterred all enemy threats.
"These threats are posed every day and the intelligence apparatus counters and obviates enemy's actions in the cyber space every day," Moslehi said. He underlined Iran's capability of deterring cyber threats, and said, "The Islamic Republic is so powerful in the cyber space that (even) leaders of the arrogant powers admit and acknowledge our country's successes as well."
Iran announced in June that it had detected plans by the United States, Israel and Britain to launch a massive cyber strike only days after talks between senior Iranian and western negotiators in Moscow. In the last few years the United States and Israel have created several malware - including the Stuxnet worm, which is reportedly the most malefic piece of malware ever created, and its kin, Duqu, as well as the Flame malware - and used them to attack Iran's nuclear facilities.
But, Iran has successfully repelled all these cyber attacks as it has continued its nuclear progress all these years. Taqipour announced in July that Iran has successfully confronted sophisticated spy malwares and thwarted all cyber attacks against the country's infrastructures. Speaking to FNA, he divided viruses into two categories, first for public users and the second for spying purposes.
As regards the second category, the Iranian Minister said, "The second type (of viruses) has been developed by governments and are specifically sent via governments, and their mission is spying on infrastructures and the like. All of them have so far been confronted and our preparedness to do so (defusing cyber attacks) is growing on a daily basis." He said in some days, Iran was targeted by two million cyber attacks, but could confront and repel all these malware attacks. Read the full story here.

Iran: "If virus attacks on Iran continue, U.S. will get its teeth knocked out"

Iran: "If virus attacks on Iran continue, U.S. will get its teeth knocked out".(TA).If the U.S. continues to spread virus attacks on Iran, it will suffer a fatal blow and get its teeth knocked out, an official from Iran's General Defense Headquarters Cyber Security department said, IRNA reported. Commenting on the recent news about Iranian nuclear plants being attacked by the virus, the official noted that cyber-attacks against Iran are useless. Earlier today Bloomberg reported citing the F-Secure Security Labs website that Iran's nuclear facilities have suffered a cyber attack that shut down computers and played music from the rock band AC/DC. A new worm has targeted Iran's nuclear program, shutting down the "automation network" at the Natanz and Fordo facilities, the Internet security site reported, citing an e- mail it said was sent by a scientist inside Iran's Atomic Energy Organization. The virus also prompted several of the computers on site to play the song "Thunderstruck" by AC/DC at full volume in the middle of the night, according to the e-mail, part of which is published in English on the website. F-Secure Security Labs, which is linked to F-Secure Oyj (FSC1V), the Finnish maker of security and cloud software, said that while it was unable to verify the details of the attack described, it had confirmed that the scientist who reported them was sending and receiving the e-mails from within Iran's Atomic Energy Organization. Iranian official urged the U.S. to stop harassing Iran via cyber attacks, or it will get a proper response. Iran's nuclear program and oil facilities have been subject to a succession of cyber attacks that the Foreign Ministry said in May were launched by hostile governments as part of a broader "soft war." Iran accuses the U.S. and Israel of trying to sabotage its technological progress. Both countries say Iran's nuclear activities may have military intent, an allegation that Iran denies.Read the full story here.

Iran's nuclear program has been Thunderstruck.

Iran's nuclear program has been Thunderstruck.HT: IsraelMatzav.There may be yet another worm that's hit Iran's nuclear agency. This one takes over computers and causes them to play the song Thunderstruck.

I am writing you to inform you that our nuclear program has once again been compromised and attacked by a new worm with exploits which have shut down our automation network at Natanz and another facility Fordo near Qom.


According to the email our cyber experts sent to our teams, they believe a hacker tool Metasploit was used. The hackers had access to our VPN. The automation network and Siemens hardware were attacked and shut down. I only know very little about these cyber issues as I am scientist not a computer expert.


There was also some music playing randomly on several of the workstations during the middle of the night with the volume maxed out. I believe it was playing 'Thunderstruck' by AC/DC.

I'm not sure what to think about this. We can't confirm any of the details. However, we can confirm that the researcher was sending and receiving emails from within the AEOI.

Mikko.Hmm............"THOR?"Read the full story here.

Researcher: CIA, NSA may have infiltrated Microsoft to write malware

Researcher: CIA, NSA may have infiltrated Microsoft to write malware.(ITWorld).By Kevin Fogarty.Did spies posing as Microsofties write malware in Redmond? 
A leading security researcher has suggested Microsoft's core Windows and application development programming teams have been infiltrated by covert programmer/operatives from U.S. intelligence agencies. If it were true it would be another exciting twist to the stories of international espionage, sabotage and murder that surround Stuxnet, Duqu and Flame, the most successful cyberwar weapons deployed so far, with the possible exception of Windows itself.
Nevertheless, according to Mikko Hypponen, chief research officer of antivirus and security software vendor F-Secure, the scenario that would make it simplest for programmers employed by U.S. intelligence agencies to create the Stuxnet, Duqu and Flame viruses and compromise Microsoft protocols to the extent they could disguise downloads to Flame as patches through Windows Update is that Microsoft has been infiltrated by members of the U.S. intelligence community. 
After studying the code for Duqu, security researchers at Kaspersky Labs said the malware was most similar to the kind of work done by old-school programmers able to write code for more than one platform at a time, do good quality control to make sure the modules were able to install themselves and update in real time, and that the command-and-control components ahd been re-used from previous editions.
Having programmers, spies and spy-supervisors from the NSA, CIA or other secret government agencies infiltrate Microsoft in order to turn its technology to their own evil uses (rather than Microsoft's) is the kind of premise that would get any writer thrown out of a movie producer's office for pitching an idea that would put the audience to sleep halfway through the first act.
Not only is it unlikely, the "action" most likely to take place on the Microsoft campus would be the kind with lots of tense, acronymically dense debates in beige conference rooms and bland corporate offices.
Earlier this month the NYT ran a story detailing two years worth of investigations during which a range of U.S. officials, including, eventually, President Obama, confirmed the U.S. had been involved in writing the Stuxnet and Flame malware and siccing them on Iran.
That's far from conclusive proof that the NSA has moved its nonexistent offices to Redmond, Wash. It doesn't rule it out either, however.
Very few malware writers are able to write such clean code that can install on a variety of hardware systems, assess their new environments and download the modules they need to successfully compromise a new network, Kaspersky researchers said.
Stuxnet and Flame are able to do all these things and to get their own updates through Windows Update using a faked Windows Update security certificate. No other malware writer, hacker or end user has been able to do that before.
Knowing it happened this time makes it more apparent that the malware writers know what they are doing and know Microsoft code inside and out.
Even in his own blog, Hypponen makes fun of those who make fun of Flame as ineffective and unremarkable, but doesn't actually suggest moles at Microsoft are to In the end it doesn't really matter. The faked certificates and ride-along on Windows Update demonstrate the malware writers have compromised the core software development operations at Microsoft.
They don't have to live there to do it; virtual compromise on the code itself would do the job more effectively than putting warm bodied programmers in the middle of highly competitive, highly intelligent, socially awkward Microsofties with a habit of asking the wrong question and insisting on an answer.The risk of having any such infiltration discovered is far too high to expose the cyberwar version of Seal Team Six to the perils of Redmond. Still, the assumption seems to be true metaphorically, if not physically, so it's safer to assume Microsoft and its software have both been compromised. Given the track record of Stuxnet, Duqu and Flame for compromising everything they're aimed at, that assumption isn't even much of a stretch.Read the full story here.

'Stuxnet is so deeply embedded in Iran, their counterstrike plans are already known'

'Stuxnet is so deeply embedded in Iran, their counterstrike plans are already known'.HT: IsraelMatzav.Here's a blog that the 'anti-virus experts' at Symantec and Kaspersky (and others) ought to be reading. They claim - and back it up - to have known about Stuxnet and Flame (which they call Stuxnet 3.0) since 2009 (Hat Tip: Jawa Report).

If they are correct, Flame is not automatically uninstalling on every computer in Iran, but only on computers where the Iranians start to look for it. And just because it disappears doesn't meant it can't come back. Here's the key part:

Stuxnet/flame puts USA in same position
as when US was only one with atom bomb,
MAD NOT APPLICABLE, first strike
can take out everything, leaving enemy nothing
to retaliate WITH.

Stuxnet is so deeply embedded in Iran
their counterstrike plans are already known.

This powerful weapon is so comprehensive
it is a deterrent in and of its self,
You don't slap someone who has you
by the balls like stuxnet has Iran.

The flip side of the suicide function,
as the press calls it, isn't suicide at all.
Its artificial intelligence, if you start looking
for Flame it knows and disappears.
Flip side is its so easy to penetrate PCs
dumping all traces of its self isn't a problem
it will revisit later.

Read the full story here.It's fascinating.

'Flame' can Steal Data Even When Computers Are Not Connected to the Internet.

'Flame' can Steal Data Even When Computers Are Not Connected to the Internet.(AP).By Susanne Posel.Experts specializing in malware from Bitdefender have uncovered a special capability in Flame’s code that allows the virus to steal data from computers that are not connected to the Internet or networked machines.

Flame can move stolen data to a USB memory stick plugged into an infected harddrive. Bitdefender asserts that this ability has never been witnessed before.

This cyber-espionage virus will move stolen information to an USB outlet, then seemingly wait for the chance to upload it to the malware controllers once the infected computer links to the Internet.

Bogdan Botezatu, malware analyst from Bitdefeder, said:

It turns users into data mules. Chances are, at some point, a user with an infected flash drive will plug it into a secure computer in a contained environment, and Flame will carry the target’s information from the protected environment to the outside world…It uses its ability to infect to ensure an escape route for the data. This is is somewhat revolutionary for a piece of malware.

Eugene Kaspersky, of the Russian Kaspersky Lab, uncovered Flame under orders from the UN.

At the Global Media and Technology Summit, Kaspersky’s team made the connection between Flame and Stuxnet and the cyberattack on Iran by the US and Israel.

The US and Israel came together to attack Iran; along with the European Union and a wide range of employed experts to guarantee that the worm would perform as planned.

This virus attacked and damaged Iranian centrifuges used to enrich uranium at the Natanz facility.The Obama administration claims to be “launching an investigation into Flame, which is a highly classified project.

Independent researchers have long attributed Stuxnet and Flame to the same cyberattacks and even claimed they are the same virus. Kaspersky’s lab has hard evidence of this fact.

The Pentagon, through a report in 2011, assessed that the US is involved in cyberespionage, but claims it is a defense to the thefts of industrial and defense secrets of other cyberspies.

Roel Schouwenberg, a senior researcher at Kaspersky Lab, commented:

We are now 100 percent sure that the Flame and Stuxnet groups worked together. The fact that the Flame group shared their source code with the Stuxnet group shows they cooperated at least once.

These two viruses share the same pieces of code at their based developmental stage, making them virtually identical; and most likely created by the same entity.

Alexander Gostev, Kaspersky Lab’s Chief Security Expert, says: What we have found is very strong evidence that the Stuxnet/Duqu and Flame cyberweapons are connected.Read the full story here.

Mossad: "Stuxnet is our Baby" Pres Obama disclosed it for electoral reasons.

Mossad: "Stuxnet is our Baby" Pres Obama disclosed it for electoral reasons.(TA).Israel’s officials have a message for anyone praising the CIA for its sophisticated cyber attack on Iran: It was our baby. The Stuxnet computer worm, described by David Sanger in The New York Times last week as an invention by the Bush administration, was actually developed by Mossad, according to Israeli officials speaking with Haaretz journalist Yossi Melman on condition of anonymity:

The Israeli officials actually told me a different version. They said that it was Israeli intelligence that began, a few years earlier, a cyberspace campaign to damage and slow down Iran’s nuclear intentions. And only later they managed to convince the USA to consider a joint operation — which, at the time, was unheard of.

The irony of course is that both U.S. and Israeli officials spent years denying knowledge of who carried out the attacks, which reportedly destroyed thousands of Iran’s centrifuges, ever since it became public in 2010. Now that it’s out, it’s time to claim credit! Of course, if you read Sanger’s account, he certainly doesn’t diminish the expertise of Israel’s spies:

Israel’s Unit 8200, a part of its military, had technical expertise that rivaled the N.S.A.’s, and the Israelis had deep intelligence about operations at Natanz that would be vital to making the cyberattack a success.

Regardless, these Israeli officials say Sanger’s account was too generous to the CIA. Amusingly, one of the officials tries to play it cool, in his remark to Melman:

My Israeli sources understand the sensitivity and the timing of the issue and are not going to be dragged into a battle over taking credit. “We know that it is the presidential election season,” one Israeli added, ”and don’t want to spoil the party for President Obama and his officials, who shared in a twisted and manipulated way some of the behind-the-scenes secrets of the success of cyberwar.”

Translation: We don’t need to tell anyone we’re the ones responsible for Stuxnet, but just so you know, we’re responsible for Stuxnet.Read the full story here.

Iran detects new kind of Stuxnet virus

Iran detects new kind of Stuxnet virus.(Taz).Iran's National Computer Emergency Response Team has detected an attack of a new computer virus close to Stuxnet and Duqu malwares. CERT announced on Sunday that following the continuous research on the targeted attacks of Stuxnet and Duqu since 2010, it detected a new attack, codenamed "Flamer" and launched by a new malware. The virus features show that there is a close relation to the Stuxnet virus, it said. According to CERT, the research results show that the recent incidents of mass data loss in Iran could be the outcome of the new virus' attack. For the past couple of years, Iran has been targeted by Stuxnet and Duqu viruses. Iran claimed that country's network grid managed to withstand the attacks, however a lot of computers in the country, mainly the industrial ones, were infected or damaged. Recently Iranian oil and education ministries and banking system came under cyber-attacks.Read the full story here.more here @ Wired.

Stealth Backdoor key found in a US military China-made chip.

Stealth Backdoor key found in a US military China-made chip.(TNW).By Jon Russell.A team of researchers from Cambridge University say they have found evidence that a Chinese-manufactured chip used by US armed forces contains a secret access point that could leave it vulnerable to third party tampering.
The researchers tested an unspecified US military chip — used in weapons, nuclear power plants to public transport – and found that a previously unknown ‘backdoor’ access point had been added, making systems and hardware open to attack, the team says.
Cambridge University researcher, Sergei Skorobogatov, explains:

We scanned the silicon chip in an affordable time and found a previously unknown backdoor inserted by the manufacturer. This backdoor has a key, which we were able to extract. If you use this key you can disable the chip or reprogram it at will, even if locked by the user with their own key.
This particular chip is prevalent in many systems from weapons, nuclear power plants to public transport. In other words, this backdoor access could be turned into an advanced Stuxnet weapon to attack potentially millions of systems. The scale and range of possible attacks has huge implications for National Security and public infrastructure.

While the initial research is a concern, a number of question marks remain over the findings before further conclusions can be drawn.
It is unclear if the access point is isolated to the chip that was tested or whether Skorobogatov and his colleagues have stumbled upon a larger trend. Likewise, it remains possible that the modified back door access could have been created by the US armed forces themselves.
The news comes at a time when Chinese cyber-spying threats are a particular concern. Chinese telecom manufacturers ZTE and Huawei are already under investigation from the US government, which is assessing whether the duo’s telecom businesses pose a national security threat.
The Cambridge researchers did not name the company that developed the chip tested, nor did they provide more specific details of its usage. We’ve contacted Skorobogatov for further details and will provide any more information that we’re given.Read the full story here, more here.

"Halal E-Mail" - Iran curbs foreign – sourced email providers.

"Halal E-Mail" - Iran curbs foreign – sourced email providers.(AA).Iran’s telecommunications ministry has barred local banks, insurance firms and telephone operators from using foreign-sourced emails to communicate with clients, a specialist weekly said on Saturday. “The telecommunications minister has ordered the use of domain names ending with .ir” belonging to Iran, Asr Ertebatat reported. The order prohibits banks, insurance firms and telephone firms using foreign hosts for their sites or to inform their clients using foreign providers such as Yahoo, Gmail, Hotmail or MSN, it said. The weekly said that individuals seeking to communicate with such firms must now use email addresses ending with iran.ir, post.ir or chmail.ir. Entities linked to the Iranian government must use addresses ending in gov.ir or .ir, while universities should use emails ending in ac.ir or .ir, the report added. Iran has announced that as of May a national information network will be used to replace the Internet in the daily management of the administration of state entities, the banking system and public enterprises. 
Officially, the launch of the “Iranian Internet” aims to secure communications by making them independent from foreign Internet operators. Iranian authorities announced in December having repatriated 90% of official websites and encouraged Iranian companies to do the same. For the past two years, Tehran has been slapped with Western economic and financial sanctions due to its controversial nuclear program. The regime also regularly accuses the West of using the web for an “undeclared war” to destabilize it, and Telecommunications Minister Reza Taghipour has argued that Google and Yahoo posed a “threat to national security.” 
With over 36 million Internet users out of the population of 75 million, electronic media played a major role in the popular protests which rocked the country after the disputed re-election of President Mahmoud Ahmadinejad in 2009. The authorities have since cut off or reduced Internet connections and speed.U.S. President Barack Obama on March accused Iran of imposing an “electronic curtain” of censorship, announcing steps to use software and social media to help Iranians communicate online.Read the full story here.