Update: Iran says it was targeted with second worm, 'Stars'

IDG News Service - The general responsible for investigating the Stuxnet attack on Iran's nuclear program says the country was also hit by a second targeted attack, called Stars.

Few details on the reported attack are available, except that it appears to have been directed at specific computer systems within the country. "Certain characteristics about the Stars worm have been identified, including that it is compatible with the (targeted) system," said Brigadier General Gholam-Reza Jalali, director of Iran's Passive Defense Organization, in a report Monday by the country's Mehr News Agency.

Iran has been attempting to shore up its cyberdefenses since it was hit by the Stuxnet worm last year. Stuxnet is widely believed to have been written in order to sabotage the country's Natanz nuclear facility. Thought to be one of the most sophisticated cyber-attacks ever written, Stuxnet seeks out and sabotages specific industrial systems by making them operate in an unsafe way.

Just last week Jalali blamed Siemens, the company whose industrial systems were targeted by Stuxnet, saying that the German company should "explain why and how it provided the enemies with the information about the codes of the SCADA software and prepared the ground for a cyber attack against us."

Siemens responded to that accusation Monday.

"Siemens was not involved in the creation of Stuxnet. The accusation is unfounded," Siemens spokesman Michael Krampe said via e-mail. He added that Iran has not brought any legal action against Siemens.

Iranian computer experts are still studying the Stars malware, Mehr reported, and Western cyber-experts say they're not sure whether Iran has identified a new attack. "We don't know if Iran officials have just found some ordinary Windows worm and announced it to be a cyber war attack," wrote F-Secure researcher Mikko Hypponen in a Monday blog post.

"This one sounds more like cyber espionage than cyber sabotage," he said in an instant message interview. "We see cyber espionage all the time. We've only seen one attack like Stuxnet, ever."

Robert McMillan covers computer security and general technology breaking news for The IDG News Service. Follow Robert on Twitter at @bobmcmillan. Robert's e-mail address is robert_mcmillan@idg.com