Stuxnet struck five targets in Iran, say researchers
Attacks started in June 2009, ended in May 2010, a month before anyone noticed, says Symantec
Computerworld - Researchers at Symantec today said that the notorious Stuxnet worm targeted five separate organizations, and that attacks against those objectives -- all with a presence in Iran -- started in June 2009, more than a year before independent experts raised the alarm.
In a post on Symantec's security blog, the company said that further analysis of Stuxnet samples showed that the worm was aimed at five different organizations. "All targeted organizations have a presence in Iran," said Ben Nahorney, a senior information developer with the U.S.-based security company.
Speculation on Stuxnet's targets has centered on a pair of Iranian locations crucial to its nuclear program: the underground uranium enrichment facility at Natanz in the central part of the country, and the nuclear reactor at Bushehr, in southern Iran.
Both Natanz and Bushehr have been under the scrutiny of the International Atomic Energy Agency (IAEA), the United Nations' nuclear watchdog.
According to Nahorney, the first Stuxnet attack was launched in June 2009, with another following that July. Additional attacks were conducted in March, April and May 2010.
Although experts had previously traced the worm's development roots as far back as June 2009, there was little proof that actual attacks had begun at that time.
The worm was first publicly reported in June 2010 by VirusBlokAda, a little-known security firm based in Belarus, but only garnered attention a month later when Microsoft and Siemens -- the German electronics firm sells widely-used SCADA hardware and software -- said the worm was actively targeting Windows PCs that managed large-scale industrial-control systems in manufacturing and utility firms.
SCADA, for "supervisory control and data acquisition," are systems that run everything from power plants and factory machinery to oil pipelines and military installations.
Researchers have called Stuxnet "groundbreaking" for its sophistication, use of multiple Windows zero-day vulnerabilities and reconnaissance and testing requirements.
"Three organizations were targeted once, one was targeted twice, and another was targeted three times," said Nahorney today. Symantec has not identified the organizations or disclosed information on which of the five -- the one struck three times -- was attacked most aggressively.
Based on Symantec's earlier analysis -- and that of other experts, including Ralph Langner of Langner Communications GmbH -- most researchers have concluded that Stuxnet was crafted by a nation-backed team, and designed to cripple Iran's nuclear program.
Iran has confirmed that the worm infected at least 30,000 PCs in the country, and has admitted that Stuxnet affected the operation of some of the centrifuges used to enrich uranium. The country has blamed Israel and the U.S. for the attacks.
Last month the New York Times, citing confidential sources, said that the worm was a joint American-Israeli project, and had been tested on Iranian-style centrifuges at the latter's Dimona covert nuclear facility.
Symantec mapped Stuxnet's targets and timeline by analyzing more than 3,200 samples of the worm that had caused approximately 12,000 infections in the five organizations that had been attacked.
The company will publish an updated version of its "W32.Stuxnet Dossier" report on its Web site later today.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer or subscribe to Gregg's RSS feed . His e-mail address is firstname.lastname@example.org.
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts