Iran has given little detail on the latest cyberattack they found crawling through their systems—malware they dubbed the “Stars” virus, with claims it was meant to spy on government networks. Vague details on the virus, however, have cast both doubt and fear over its legitimacy.
The April 25 announcement was made by the head of Iran’s civil defense organization, Gholamreza Jalali, on the organization’s website. Jalali stated the virus has caused little damage and is currently being analyzed. He noted that it was “coordinated and compatible with the system” it was discovered on, yet it was not stated where the virus was found.
India is already on the alert following the announcement. The last major computer virus to hit Iran, Stuxnet, ended up impacting India as well. Iran’s state-run media announced on Sept. 26, 2010, that Stuxnet infected computer systems of its nuclear power plant.
The virus was designed to attack supervisory control and data acquisition (SCADA) computer systems used to control systems including electrical power grids and chemical processing plants. Although little was said of its impact outside Iran, Stuxnet spread to SCADA systems all over the world—including in the United States, Canada, Japan, and Australia.
India’s Diligent Media Corporation stated a rumor in an Apr. 29 report that the virus “can cause damage to our country’s critical cyber infrastructure,” and added that Stars “is suspected to be a variant of the Stuxnet worm that had infected Iran’s nuclear capabilities.”
At this point, however, any statements on the intent or capabilities of the Stars virus are mere speculation.
Stars has joined the heaps of malware floating around the Web, and its origins could be the same as any of them. In 2010, more than 286 million new malware variants were discovered, according to a Symantec Internet Security Threat Report. This was along with a 93 percent increase in Web-based attacks.
“Conspiracy theories will run amok” until samples of the Stars virus emerge from Iran, according to a Tweet from John Bumgarner, chief technology officer of the U.S. Cyber Consequences Unit, an independent research institute that studies cyber conflicts.
Bumgarner pointed out there are currently three main scenarios. The common belief is that the virus targeted Iran’s nuclear facility, similar to the last major virus targeting Iran, Stuxnet. It could also be an attempt of another country, such as the United States, gathering intelligence to determine Iran’s current support to Syria.
The virus could also be a simple Iranian disinformation campaign meant to draw attention away from the brewing revolution in the country.
Also, contrary to reports of Stars being the second major cyberattack against Iran, it is actually the third, as Stuxnet was used on two different targets. "Stuxnet caused severe damage to critical components associated with the Iranian nuclear program at least twice. The first was the gas centrifuges and the second was the coolant pumps,” Bumgarner said.
In the latest case, even without studies or details on the Stars virus, Iran was quick to blame the U.S. and Israel for the attack, as they did with the previous virus, Stuxnet. The creator and origin of Stuxnet remains a mystery.
Iran’s state-run Mehr New Agency quoted Jalali saying Iran’s “diplomatic apparatus should pay attention to legally pursuing cyber attacks,” against the country, noting that Russia regards “any cyber attack as an official (act of) war.”
It adds Jalali’s Apr. 16 statement that the blame for Stuxnet should fall on German security company Siemens and again blames the U.S. and Israel for involvement.
