Iran claims to have been targeted by second worm
Posted on 26.04.2011
If a statement from Gholam-Reza Jalali - the head of Iranís Passive Defense Organization - is to be believed, it seems that Iran's computers have been targeted by a new computer worm dubbed "Stars".

According to him, the worm has been spotted and is currently being investigated by experts, and even though he doesn't say if it's tied in any way to the Stuxnet worm, he mentioned that they discovered it is compatible with the targeted system and that the damage is very slight in the initial stage of infection.

Tehran Times reports that he also said that the worm is "likely to be mistaken for executable files of the government," although I have noticed that many Western news sites report him saying that it might be "mistaken for some executive files of government organisations," spurring the speculation that it might be masquerading as a .pdf or .doc file.

But the lack of details and the failure of obtaining a sample of the malware make it impossible for Western computer security experts and companies to confirm Jalali's claim.

"We can't tie this case to any particular sample we might already have," says F-Secure's Mikko Hypponen. "We don't know if Iran[ian] officials have just found some ordinary Windows worm and announced it to be a cyber war attack."

"Outside of the published news reports, McAfee has no information on ďStarsĒ at this time. Thatís different from Stuxnet, where international cybersecurity companies knew of the malware and were able to investigate it through customary sharing of malware samples, says McAfee's Joris Evers. "We currently have no way of verifying the attack the Iranian government is reporting, nor do we have any way of identifying who might be behind the attack or what the target could be.

It is, of course, possible that security vendors do have a sample of the malware in their possession, but are unable to identify it because they lack crucial information about it. It's obvious that Iran will have to provide a sample of the worm to outside experts if it wants its claims to be taken seriously.


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Tue, Feb 9th