Iran claims to have been targeted by second worm
Posted on 26.04.2011
If a statement from Gholam-Reza Jalali - the head of Iranís Passive Defense Organization - is to be believed, it seems that Iran's computers have been targeted by a new computer worm dubbed "Stars".

According to him, the worm has been spotted and is currently being investigated by experts, and even though he doesn't say if it's tied in any way to the Stuxnet worm, he mentioned that they discovered it is compatible with the targeted system and that the damage is very slight in the initial stage of infection.

Tehran Times reports that he also said that the worm is "likely to be mistaken for executable files of the government," although I have noticed that many Western news sites report him saying that it might be "mistaken for some executive files of government organisations," spurring the speculation that it might be masquerading as a .pdf or .doc file.

But the lack of details and the failure of obtaining a sample of the malware make it impossible for Western computer security experts and companies to confirm Jalali's claim.

"We can't tie this case to any particular sample we might already have," says F-Secure's Mikko Hypponen. "We don't know if Iran[ian] officials have just found some ordinary Windows worm and announced it to be a cyber war attack."

"Outside of the published news reports, McAfee has no information on ďStarsĒ at this time. Thatís different from Stuxnet, where international cybersecurity companies knew of the malware and were able to investigate it through customary sharing of malware samples, says McAfee's Joris Evers. "We currently have no way of verifying the attack the Iranian government is reporting, nor do we have any way of identifying who might be behind the attack or what the target could be.

It is, of course, possible that security vendors do have a sample of the malware in their possession, but are unable to identify it because they lack crucial information about it. It's obvious that Iran will have to provide a sample of the worm to outside experts if it wants its claims to be taken seriously.






Spotlight

The synergy of hackers and tools at the Black Hat Arsenal

Posted on 27 August 2014.  |  Tucked away from the glamour of the vendor booths and the large presentation rooms filled with rockstar sessions, was the Arsenal - a place where developers were able to present their security tools and grow their community.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Fri, Aug 29th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //