One of the most sophisticated pieces of malware ever detected has infected tens of thousands of computers in Indonesia, India, the United States, Australia, Britain, Malaysia and Pakistan. The biggest target, however, has been Iran.
The computer virus, known as Stuxnet, is a "working and fearsome prototype of a cyber-weapon that could lead to the creation of a new arms race," Kaspersky Labs, an Internet security firm based in Moscow, warned in a statement.
The German engineering conglomerate Siemens, which developed the systems attacked by Stuxnet, said the malware spreads via infected USB thumb drive memory sticks, exploiting vulnerabilities in the Microsoft Windows operating system.
The super-virus attacks software programs that run on Supervisory Control and Data Acquisition, or SCADA, systems, a product developed by Siemens and sold around the world, including to Iran. SCADA is used to manage water supplies, oil rigs, power plants and other industrial facilities.
Once the worm infects a system, it quickly sets up communications with a remote server computer that can be used to steal proprietary information or take control of the SCADA system.
Stuxnet source unknown
Computer security experts have said the attackers may have chosen to spread the malicious software via thumb drives because many SCADA systems control sensitive operations and are therefore not connected to the Internet, but do have USB ports.
Ralf Langner, a German cyber security specialist, said the attack was launched by an as yet unknown software expert, very possibly a nation state.
"This is not some hacker sitting in the basement of his parents' house," he said.
Stuxnet is able to recognize a specific facility's control network and then destroy it, said Langner. He said he suspects that the virus' target was the Bushehr nuclear reactor facility in Iran.
Since June, Tehran has blamed unspecified problems for a delay in getting the facility fully operational. Iran's ISNA news agency reported that the country's nuclear agency met to determine a way to combat the computer worm.
A Siemens spokesperson, however, said the Iranian nuclear power plant was built with help from a Russian contractor and that Siemens was not involved. The spokesperson added that the company would not speculation the virus' target.
A study of the Stuxnet virus conducted by the US technology company Symantec showed that the country most affected by the virus was Iran with nearly 63,000 infected computers or more than two-thirds of all cases worldwide.
So far, neither Siemens nor cyber security experts in Europe, Russia or the United States, have discovered who is behind the Stuxnet attacks, but Langner said investigations would eventually point to the attackers.
"The attackers must know this," he said. "My conclusion is they don't care. They don't fear going to jail."
Author: Gregg Benzow (dpa/AFP/Reuters)
Editor: Sean Sinico
Programu mbaya ya kipekee ya kompyuta imeharibu maelfu ya kompyuta nchini Indonesia, India, Marekani, Australia, Uingereza, Malaysia na Pakistan. Hata hivyo, shabaha kubwa zaidi imekuwa Iran. "Kama ilivyoelezwa, ""Stuxnet"" ni ""mfano wa silaha ya mtandao ambayo inaweza kusababisha mbio mpya za silaha,"" Kaspersky Labs, kampuni ya usalama wa mtandao iliyoko Moscow, ilionya katika taarifa." Kampuni ya uhandisi ya Ujerumani Siemens, ambayo ilitengeneza mfumo ulioshambuliwa na Stuxnet, imesema programu hasidi hiyo inaenea kupitia USB-D na kuitumia udhaifu katika mfumo wa uendeshaji wa Microsoft Windows. Virusi hivyo vinaathiri programu za SCADA (Supervisory Control and Data Acquisition) ambazo zimetengenezwa na kampuni ya Siemens na kuuzwa duniani kote. SCADA hutumiwa kusimamia usambazaji wa maji, rigs za mafuta, mitambo ya umeme na vifaa vingine vya viwanda. Mara baada ya worm kuambukiza mfumo, ni haraka kuanzisha mawasiliano na kompyuta server ya mbali ambayo inaweza kutumika kuiba habari ya wamiliki au kuchukua udhibiti wa mfumo SCADA. Wataalamu wa usalama wa kompyuta wanasema washambuliaji wanaweza kuwa wamechagua kueneza programu hasidi kupitia diski za kidole kwa sababu mifumo mingi ya SCADA inadhibiti shughuli nyeti na kwa hivyo haijaunganishwa na mtandao, lakini ina bandari za USB. "Ralf Langner, mtaalamu wa usalama wa mtandao wa Ujerumani, alisema: ""Hatua hii ya kushambulia ilitokana na programu isiyojulikana, ambayo inaweza kuwa na uwezo wa kuathiri usalama wa mtandao.""" "Huyu si hacker fulani anayeketi katika chumba cha chini cha nyumba ya wazazi wake", akasema. Stuxnet ina uwezo wa kutambua mtandao wa udhibiti wa kituo maalum na kisha kuiharibu, alisema Langner. "Maafisa wa serikali ya Iran wanasema ""tamaa ya virusi hivyo ni kuathiri kituo cha nyuklia cha Bushehr nchini Iran.""" Tangu Juni, Tehran imesababisha matatizo yasiyojulikana kwa kuchelewesha kupata kituo hicho kikamilifu kufanya kazi. Shirika la habari la Iran la ISNA limeripoti kuwa shirika la nyuklia la nchi hiyo limekutana kuamua njia ya kupambana na mdudu huyo wa kompyuta. "Msimamizi wa Siemens amesema kituo cha nyuklia cha Iran kilijengwa kwa msaada wa kampuni ya Urusi na kwamba ""si sehemu ya mradi huo.""" Msemaji huyo aliongeza kwamba kampuni hiyo haitafikiria lengo la virusi. Utafiti uliofanywa na kampuni ya teknolojia ya Marekani Symantec, ulionyesha kuwa nchi iliyoathiriwa zaidi na virusi hivyo ni Iran, ambapo kompyuta 63,000 zimeambukizwa, zaidi ya theluthi mbili ya visa vyote duniani. Hata hivyo, Siemens na wataalamu wa usalama wa mtandao wa Ulaya, Urusi na Marekani bado hawajajua ni nani aliyesababisha mashambulizi ya Stuxnet, lakini Langner amesema uchunguzi utaonyesha ni nani aliyeshambulia. "Ni lazima washambuliaji wajue hili", akasema. "Mafikiro yangu ni kwamba hawajali. Hawaogopi kufungwa gerezani". Mhariri: Gregg Benzow (dpa)