(Reuters) - A cyber warfare expert claims he has linked the Stuxnet computer virus that attacked Iran’s nuclear program in 2010 to Conficker, a mysterious “worm” that surfaced in late 2008 and infected millions of PCs.
Conficker was used to open back doors into computers in Iran, then infect them with Stuxnet, according to research from John Bumgarner, a retired U.S. Army special-operations veteran and former intelligence officer.
While it is widely believed that the United States and Israel were behind Stuxnet, Bumgarner wouldn’t comment on whether he believes the Americans and Israelis also unleashed Conficker, one of the most virulent pieces of so-called malware ever detected. He wouldn’t name the attackers he believes were behind the two programs, saying the matter was too sensitive to discuss.
Prime Minister Benjamin Netanyahu’s office, which oversees Israel’s intelligence agencies, also declined comment.
If Bumgarner’s findings, which couldn’t immediately be independently confirmed, are correct then it shows that the United States and Israel may have a far more sophisticated cyber-warfare program than previously thought. It could also be a warning to countries other than Iran that they might be vulnerable to attacks.
His account leaves unresolved several mysteries. These include the severity of the damage that the program inflicted on Iran’s uranium enrichment facility, whether other facilities in Iran were targeted and the possibility that there were other as yet unidentified pieces of malware used in the same program.
Bumgarner - who wrote a highly praised analysis of Russia’s 2008 cyber assault on Republic of Georgia - says he identified Conficker’s link to Stuxnet only after spending more than a year researching the attack on Iran and dissecting hundreds of samples of malicious code.
He is well regarded by some in the security community. “He is a smart man,” said Tom Kellermann, an advisor to the Obama Administration on cyber security policy and the chief technology officer of a company called AirPatrol.
The worm’s latent state had been a mystery for some time. It appears never to have been activated in the computers it infected, and security experts have speculated that the program was abandoned by those who created it because they feared getting caught after Conficker was subjected to intense media scrutiny.
If confirmed, Bumgarner’s work could deepen understanding of how Stuxnet’s commanders ran the cyber operation that last year sabotaged an underground facility at Natanz, where Iranian scientists are enriching uranium using thousands of gas centrifuges.
The view that Stuxnet was built by the United States and Israel was laid out in a January 2011 New York Times report that said it came from a joint program begun around 2004 to undermine Iran’s efforts to build a bomb. That article said the program was originally authorized by U.S. President George W. Bush, and then accelerated by his successor, Barack Obama.
The first reports that the United States and Israel were behind Stuxnet were greeted skeptically. There are still a handful of prominent cyber security experts, including Jeffrey Carr, the author of the book “Inside Cyber Warfare: Mapping the Cyber Underworld,” who dispute the U.S.-Israel idea. He says that circumstantial evidence paints a convincing case that China was behind Stuxnet.
According to Bumgarner’s account, Stuxnet’s operators started doing reconnaissance in 2007, using Duqu, which spied on makers of components used in Iran’s nuclear and critical infrastructure facilities.
In November 2008, Conficker was let loose and it quickly spread, attacking millions of PCs around the world. Its initial task was to infect a machine and “phone home” with its location. If it was at a strategic facility in Iran, the attackers tagged that PC as a target. The release left millions of untagged machines infected with Conficker around the world, but no damage was done to them.
In March 2009, Bumgarner says, the attackers released a new, more powerful version of Conficker that started the next phase of the attack on April 1 by downloading Stuxnet onto the targeted PCs. After it completed that task, Conficker’s mission on those machines was complete.
He did more digging, comparing date and time stamps on different versions of Conficker and Stuxnet, and found a correlation — key dates related to their development and deployment overlapped. That helped him identify April Fool’s Day, April 1, 2009, as the launch date for the attack.
Bumgarner believes the attackers picked that date to send a message to Iran’s leaders. It marked the 30th anniversary of the declaration of an Islamic republic by Ayatollah Khomeini after a national referendum.
Once Conficker had pulled Stuxnet into computers in Iran there was still one big hurdle, he said. Those infected computers weren’t yet in the target - the underground uranium enrichment facility at Natanz.
Stuxnet was programmed to automatically jump from an infected PC to a USB drive as soon as it was put into a computer. That was the easy part. Getting somebody to be a human “mule” by bringing that USB drive to Natanz and plugging it into the right machine was a logistical nightmare.
That was probably delivered by somebody who regularly visited the facility and had reason to share information electronically - an academic affiliated with an engineering program at one of Iran’s universities or a worker at a company that provided technology to the facility, according to Bumgarner. He or she was almost certainly unaware of what was happening, he said.
“It blew their operation wide open,” says Bumgarner.