"Star" computer virus joins "Stuxnet" attack on Iran’s nuclear program

[bananas]

http://nuclear-news.net/2011/04/26/star-computer-virus-joins-stuxnet-attack-on-irans-nuclear-program/

“Star” computer virus joins “Stuxnet” attack on Iran’s nuclear program

Iran: Country under attack by second computer virus, The Washington Post, By Thomas Erdbrink and Joby Warrick, , April 25,

TEHRAN —An Iranian military official revealed on Monday that the country had been attacked by a new computer virus apparently aimed at nuclear facilities, an acknowledgment that seemed to suggest a broader campaign by foreign saboteurs to undermine Iran’s atomic energy program.

The new computer worm has been dubbed “Stars” by the Iranians and described as an “espionage virus,” although few details were made public. In the same announcement, the military also confirmed continuing problems with an earlier virus, “Stuxnet,” which began wreaking havoc on Iran’s main uranium enrichment facility in 2009…………..

http://www.washingtonpost.com/world/iran-country-under-attack-by-second-computer-virus/2011/04/25/AFudkBjE_story.html

[madokie]

1. And you can about take to the bank who it is that is behind this

same as the last so goes the second one

[WatsonT]

2. Are their computers hooked to the internet?

Seems like they'd want to sever that connection if that's how these are getting in.

Or do they have to have people physically upload the virus in the plant?

[bananas]

3. The internet isn't needed to spread a virus.

They can be spread through USB devices, internal networks, etc.

http://drdobbs.com/windows/227100042

USB Drive Virus Attack Verified
By Adrian Bridgwater, August 26, 2010

Pentagon cyberstrategy brought into question

U.S. Deputy Secretary of Defense William J. Lynn has verified the occurrence of a 2008 security breach where a USB stick was used on a U.S. military laptop at a base in the Middle East. Saying that today more than 100 foreign intelligence organizations are trying to hack into American military digital networks, Lynn suggests that the Pentagon has finally recognized the disastrous threats posed by cyberwarfare.

According to Secretary Lynn, the attack was initiated when an infected flash drive was inserted into the military laptop during operations at an unspecified location in the Middle East. The malicious computer code, placed there by a foreign intelligence agency, then uploaded itself onto a network run by the U.S. Central Command.

"That code spread undetected on both classified and unclassified systems, establishing what amounted to a digital beachhead, from which data could be transferred to servers under foreign control. It was a network administrator's worst fear: a rogue program operating silently, poised to deliver operational plans into the hands of an unknown adversary," said Lynn.

Secretary Lynn described this previously classified incident as the most significant breach and wake-up call of U.S. military computer use ever. The Pentagon's operation to counter the attack, known as Operation Buckshot Yankee, is said to have marked a turning point in U.S. cyberdefense strategy.

<snip>

[bananas]

4. From 2008: Under worm attack, US Army bans USB drives

These things can get into digital cameras, cell phones, mp3 players, etc.

http://www.zdnet.com/blog/security/under-worm-attack-us-army-bans-usb-drives/2206

Under worm attack, US Army bans USB drives

By Ryan Naraine | November 20, 2008, 10:34am PST

Under sustained attack from what is described as a rapidly spreading network worm, the U.S. army has banned the use of USB sticks, CDs, flash media cards, and all other removable data storage devices, according to internal e-mail messages seen by Wired’s Noah Shachtman.

According to the article, service members have been ordered to “cease usage of all USB storage media until the USB devices are properly scanned and determined to be free of malware.” Eventually, some government-approved drives will be allowed back under certain “mission-critical,” but unclassified, circumstances. “Personally owned or non-authorized devices” are “prohibited” from here on out, according to the e-mails.

<snip>

[WatsonT]

5. So someone had to physically enter the facility and plug it in

that makes it even more interesting as it would take a greater investment of resources.