Does computer worm "stuxnet" attack Iranian Nuclear Program?

[Jan Klimkowski]

A rather large company/multinational, at that: Siemens AG is a German engineering conglomerate that is the largest in Europe.[3] Siemens' international headquarters are located in Berlin, Munich and Erlangen, Germany. The company has three main business sectors: Industry, Energy, and Healthcare; with a total of 15 divisions. Worldwide Siemens and its subsidiaries employ approximately 420,800 people in nearly 190 countries and reported global revenue of 76.651 billion euros for the year of 2009. tickyman:

Peter - yup.

In addition, Siemens must have its own industrial espionage goons.

Indeed, I have zero sympathy for Siemens.

Like every big multinational, links to state and private spy networks have long been alleged.

In the C20th:

MI5 feared Siemens staff had Nazi spy links during WWII

By Kayte Rath

The file contained a diagram published in US magazine PM suggesting how companies could be linked to the Third Reich Employees of the German company Siemens were investigated for espionage by MI5, it has been revealed.

MI5 feared the company, which had branches all over the world, was assisting the Nazi regime in its foreign policy and war objectives.

The files, released by MI5, can be seen at the National Archives in Kew.

British intelligence feared German companies operating in the UK or abroad, particularly in the British Empire, could be used by the German government as part of its broader foreign policy and war effort.

By 1936 the Nazi regime had made it clear "every German man and woman must render service to the Fatherland in time of war and that Germans who live abroad, including those of dual nationality, are bound to serve when called up".

The files show a number of investigations were ordered into individual employees of Siemens, a German industrial conglomerate.

Some of these were requested by Lord Rothschild, who was head of the counter-sabotage unit at MI5 at the time.

'Rabid Nazi cell'

In the run up to World War II, MI5 was concerned about Siemens' operations in the UK.

One branch of the company, Siemens Schukert, which had factories in Ealing and Acton in west London, was described in the files as "a rabid Nazi cell".

There were suspicions that German employees of the firm were involved in intelligence work.

Engineers were said to continually travel around the UK but "no-one knew where they went".

The British branch of the firm was closed down following the start of the war under the 1939 Trading with the Enemy Act.

'Clandestine'

Siemens first came to the attention of MI5 during World War I following an anonymous letter from Chile.

It described how Britons living in Antofagasta in Chile believed the company had a "clandestine wireless installation".

Suspicious activity was also reported in Siemens branches in Georgia, Spain, Switzerland, Egypt, Panama and Argentina during World War I.

http://www.bbc.co.uk/news/uk-11081786

And in the C21st:

Siemens Worked With German Intelligence Agency
By Patrick Donahue, Bloomberg 12/4/08
Apr 14, 2008 - 9:14:32 AM

Germany's Federal Intelligence Service, or BND, had a representative on the management board, Spiegel cited unidentified former managers as saying. The BND used Siemens's communication technology for espionage purposes, while the Munich-based company became the spy agency's top supplier.


The BND's role in Siemens could mean it has knowledge of access codes the company uses to conduct maintenance work on communications systems, Spiegel said. Siemens engineers also gain exposure to construction sites that aren't visible by U.S. satellite photography, according to the magazine.

Siemens supplies surveillance and wiretap technology to countries such as Russia, Egypt and Oman. Intelligence specialists within Siemens worked at ICM Voice & Data Recording, on a site separate from the company's headquarters, Spiegel said.

Siemens spokesman Andreas Schwab declined to comment on the report. The BND didn't immediately respond to a message seeking comment that was left on the press department's answering machine. The government's main press department couldn't supply any additional phone numbers when contacted by Bloomberg.

http://www.ocnus.net/artman2/publish/Dar...ency.shtml

[Mark Stapleton]

Meanwhile, over at DEBKAfile, they can barely contain their glee.

"The first full scale cyber attack on a state" screams the headline.

DEBKA-Net-Weekly features an in depth article, containing all the juicy details of physical damage sustained by Iran's infrastructure--and that of their allies, mustn't forget that.

http://www.debka.com/article/9049/

er, you have to subscribe, though.

They always remember to make a buck as well.

[Peter Lemkin]

A rather large company/multinational, at that: Siemens AG is a German engineering conglomerate that is the largest in Europe.[3] Siemens' international headquarters are located in Berlin, Munich and Erlangen, Germany. The company has three main business sectors: Industry, Energy, and Healthcare; with a total of 15 divisions. Worldwide Siemens and its subsidiaries employ approximately 420,800 people in nearly 190 countries and reported global revenue of 76.651 billion euros for the year of 2009. tickyman:

Peter - yup.

In addition, Siemens must have its own industrial espionage goons.

Indeed, I have zero sympathy for Siemens.

Like every big multinational, links to state and private spy networks have long been alleged.

In the C20th:

MI5 feared Siemens staff had Nazi spy links during WWII

By Kayte Rath

The file contained a diagram published in US magazine PM suggesting how companies could be linked to the Third Reich Employees of the German company Siemens were investigated for espionage by MI5, it has been revealed.

MI5 feared the company, which had branches all over the world, was assisting the Nazi regime in its foreign policy and war objectives.

The files, released by MI5, can be seen at the National Archives in Kew.

British intelligence feared German companies operating in the UK or abroad, particularly in the British Empire, could be used by the German government as part of its broader foreign policy and war effort.

By 1936 the Nazi regime had made it clear "every German man and woman must render service to the Fatherland in time of war and that Germans who live abroad, including those of dual nationality, are bound to serve when called up".

The files show a number of investigations were ordered into individual employees of Siemens, a German industrial conglomerate.

Some of these were requested by Lord Rothschild, who was head of the counter-sabotage unit at MI5 at the time.

'Rabid Nazi cell'

In the run up to World War II, MI5 was concerned about Siemens' operations in the UK.

One branch of the company, Siemens Schukert, which had factories in Ealing and Acton in west London, was described in the files as "a rabid Nazi cell".

There were suspicions that German employees of the firm were involved in intelligence work.

Engineers were said to continually travel around the UK but "no-one knew where they went".

The British branch of the firm was closed down following the start of the war under the 1939 Trading with the Enemy Act.

'Clandestine'

Siemens first came to the attention of MI5 during World War I following an anonymous letter from Chile.

It described how Britons living in Antofagasta in Chile believed the company had a "clandestine wireless installation".

Suspicious activity was also reported in Siemens branches in Georgia, Spain, Switzerland, Egypt, Panama and Argentina during World War I.

http://www.bbc.co.uk/news/uk-11081786

And in the C21st:

Siemens Worked With German Intelligence Agency
By Patrick Donahue, Bloomberg 12/4/08
Apr 14, 2008 - 9:14:32 AM

Germany's Federal Intelligence Service, or BND, had a representative on the management board, Spiegel cited unidentified former managers as saying. The BND used Siemens's communication technology for espionage purposes, while the Munich-based company became the spy agency's top supplier.


The BND's role in Siemens could mean it has knowledge of access codes the company uses to conduct maintenance work on communications systems, Spiegel said. Siemens engineers also gain exposure to construction sites that aren't visible by U.S. satellite photography, according to the magazine.

Siemens supplies surveillance and wiretap technology to countries such as Russia, Egypt and Oman. Intelligence specialists within Siemens worked at ICM Voice & Data Recording, on a site separate from the company's headquarters, Spiegel said.

Siemens spokesman Andreas Schwab declined to comment on the report. The BND didn't immediately respond to a message seeking comment that was left on the press department's answering machine. The government's main press department couldn't supply any additional phone numbers when contacted by Bloomberg.

http://www.ocnus.net/artman2/publish/Dar...ency.shtml

No surprises there, but the reminder and details appreciated. Brings up the possibility of of internecine wars between multinationals v. states and/or other multinationals. BND/Germany might not take too kindly to their main supplier and a big bread-winner being hurt by this worm....Siemens for sure will not! The nastiness could spread.....likely will. The future of dirty intel tricks and ops seems rosy.

[Jan Klimkowski]

No surprises there, but the reminder and details appreciated. Brings up the possibility of of internecine wars between multinationals v. states and/or other multinationals. BND/Germany might not take too kindly to their main supplier and a big bread-winner being hurt by this worm....Siemens for sure will not! The nastiness could spread.....likely will. The future of dirty intel tricks and ops seems rosy.

I agree.

This multinational v state cyberspace warfare is in fact quite close to the future sketched, or perhaps narcotically channelled through a systematic derangement of the senses, by William Gibson in his 1980s Sprawl/cyberpunk trilogy.

[Ed Jewett]

In a Computer Worm, a Possible Biblical Clue


Published: Thursday, 30 Sep 2010 | 8:06 AM

By: John Markoff and David E. Sanger
The New York Times


Deep inside the computer worm that some specialists suspect is aimed at slowing Iran’s race for a nuclear weapon lies what could be a fleeting reference to the Book of Esther, the Old Testament tale in which the Jews pre-empt a Persian plot to destroy them.
That use of the word “Myrtus” — which can be read as an allusion to Esther — to name a file inside the code is one of several murky clues that have emerged as computer experts try to trace the origin and purpose of the rogue Stuxnet program, which seeks out a specific kind of command module for industrial equipment. Not surprisingly, the [B][B]Israelis are not saying[/B][/B] whether Stuxnet has any connection to the secretive cyberwar unit it has built inside Israel’s intelligence service. Nor is the Obama administration, which while talking about cyberdefenses has also rapidly ramped up a broad covert program, inherited from the Bush administration, to undermine Iran’s nuclear program. In interviews in several countries, experts in both cyberwar and nuclear enrichment technology say the [B][B]Stuxnet mystery[/B][/B] may never be solved.
There are many competing explanations for myrtus, which could simply signify myrtle, a plant important to many cultures in the region. But some security experts see the reference as a signature allusion to Esther, a clear warning in a mounting technological and psychological battle as Israel and its allies try to breach Tehran’s most heavily guarded project. Others doubt the Israelis were involved and say the word could have been inserted as deliberate misinformation, to implicate Israel.
“The Iranians are already paranoid about the fact that some of their scientists have defected and several of their secret nuclear sites have been revealed,” one former intelligence official who still works on Iran issues said recently. “Whatever the origin and purpose of Stuxnet, it ramps up the psychological pressure.”
So a calling card in the code could be part of a mind game, or sloppiness or whimsy from the coders.
The malicious code has appeared in many countries, notably China, India, Indonesia and Iran. But there are tantalizing hints that Iran’s nuclear program was the primary target. Officials in both the United States and Israel have made no secret of the fact that undermining the computer systems that control Iran’s huge enrichment plant at Natanz is a high priority. (The Iranians know it, too: They have never let international inspectors into the control room of the plant, the inspectors report, presumably to keep secret what kind of equipment they are using.)
The fact that Stuxnet appears designed to attack a certain type of Siemens industrial control computer, used widely to manage oil pipelines, electrical power grids and many kinds of nuclear plants, may be telling. Just last year officials in Dubai seized a large shipment of those controllers — known as the Simatic S-7 — after Western intelligence agencies warned that the shipment was bound for Iran and would likely be used in its nuclear program.
“What we were told by many sources,” said Olli Heinonen, who retired last month as the head of inspections at the International Atomic Energy Agency in Vienna, “was that the Iranian nuclear program was acquiring this kind of equipment.”


Also, starting in the summer of 2009, the Iranians began having tremendous difficulty running their centrifuges, the tall, silvery machines that spin at supersonic speed to enrich uranium — and which can explode spectacularly if they become unstable. In New York last week, Iran’s president, Mahmoud Ahmadinejad, shrugged off suggestions that the country was having trouble keeping its enrichment plants going. Yet something — perhaps the worm or some other form of sabotage, bad parts or a dearth of skilled technicians — is indeed slowing Iran’s advance.
The reports on Iran show a fairly steady drop in the number of centrifuges used to enrich uranium at the main Natanz plant. After reaching a peak of 4,920 machines in May 2009, the numbers declined to 3,772 centrifuges this past August, the most recent reporting period. That is a decline of 23 percent. (At the same time, production of low-enriched uranium has remained fairly constant, indicating the Iranians have learned how to make better use of fewer working machines.)
Computer experts say the first versions of the worm appeared as early as 2009 and that the sophisticated version contained an internal time stamp from January of this year.
These events add up to a mass of suspicions, not proof. Moreover, the difficulty experts have had in figuring out the origin of Stuxnet points to both the appeal and the danger of computer attacks in a new age of cyberwar.

Is Industrial System Worm Part of Israel's War Strategy?

Could Iran Retaliate in Cyber War?

Spying For Profits: The Satellite Image Indicator

For intelligence agencies they are an almost irresistible weapon, free of fingerprints. Israel has poured huge resources into Unit 8200, its secretive cyberwar operation, and the United States has built its capacity inside the National Security Agency and inside the military, which just opened a Cyber Command.
But the near impossibility of figuring out where they came from makes deterrence a huge problem — and explains why many have warned against the use of cyberweapons. No country, President Obama was warned even before he took office, is more vulnerable to cyberattack than the United States.
For now, it is hard to determine if the worm has infected centrifuge controllers at Natanz. While the S-7 industrial controller is used widely in Iran, and many other countries, even Siemens says it does not know where it is being used. Alexander Machowetz, a spokesman in Germany for Siemens, said the company did no business with Iran’s nuclear program. “It could be that there is equipment,” he said in a telephone interview. “But we never delivered it to Natanz.”
But Siemens industrial controllers are unregulated commodities that are sold and resold all over the world — the controllers intercepted in Dubai traveled through China, according to officials familiar with the seizure.
Ralph Langner, a German computer security consultant who was the first independent expert to assert that the malware had been “weaponized” and designed to attack the Iranian centrifuge array, argues that the Stuxnet worm could have been brought into the Iranian nuclear complex by Russian contractors.
“It would be an absolute no-brainer to leave an infected USB stick near one of these guys,” he said, “and there would be more than a 50 percent chance of having him pick it up and infect his computer.”
There are many reasons to suspect Israel’s involvement in Stuxnet. Intelligence is the single largest section of its military and the unit devoted to signal, electronic and computer network intelligence, known as Unit 8200, is the largest group within intelligence.
Yossi Melman, who covers intelligence for the newspaper Haaretz and is at work on a book about Israeli intelligence over the past decade, said in a telephone interview that he suspected that Israel was involved.
He noted that Meir Dagan, head of Mossad, had his term extended last year partly because he was said to be involved in important projects. He added that in the past year Israeli estimates of when Iran will have a nuclear weapon had been extended to 2014.
“They seem to know something, that they have more time than originally thought,” he said.
Then there is the allusion to myrtus — which may be telling, or may be a red herring.
Several of the teams of computer security researchers who have been dissecting the software found a text string that suggests that the attackers named their project Myrtus. The guava fruit is part of the Myrtus family, and one of the code modules is identified as Guava.
It was Mr. Langner who first noted that Myrtus is an allusion to the Hebrew word for Esther. The Book of Esther tells the story of a Persian plot against the Jews, who attacked their enemies pre-emptively.
“If you read the Bible you can make a guess,” said Mr. Langner, in a telephone interview from Germany on Wednesday.
Carol Newsom, an Old Testament scholar at Emory University, confirmed the linguistic connection between the plant family and the Old Testament figure, noting that Queen Esther’s original name in Hebrew was Hadassah, which is similar to the Hebrew word for myrtle. Perhaps, she said, “someone was making a learned cross-linguistic wordplay.”
But other Israeli experts said they doubted Israel’s involvement. Shai Blitzblau, the technical director and head of the computer warfare laboratory at Maglan, an Israeli company specializing in information security, said he was “convinced that Israel had nothing to do with Stuxnet.”
“We did a complete simulation of it and we sliced the code to its deepest level,” he said. “We have studied its protocols and functionality. Our two main suspects for this are high-level industrial espionage against Siemens and a kind of academic experiment.”
Mr. Blitzblau noted that the worm hit India, Indonesia and Russia before it hit Iran, though the worm has been found disproportionately in Iranian computers. He also noted that the Stuxnet worm has no code that reports back the results of the infection it creates. Presumably, a good intelligence agency would like to trace its work.
—Ethan Bronner contributed reporting from Israel, and William J. Broad from New York.

http://www.cnbc.com/id/39435594

[Ed Jewett]

Well, it didn't take long for some to disassemble what was an obvious piece of blech from the Grey Lady. Here from Cryptome:

1 October 2010

[B]Stuxnet Myrtus or MyRTUs? [/B]

A sends:
John Markoff in the New York Times has written an article which intimates that the Stuxnet worm may be the work of Israel's Unit 8200.
http://www.nytimes.com/2010/09/30/world/...0worm.html
According to Markoff,
"Several of the teams of computer security researchers who have been dissecting the software found a text string that suggests that the attackers named their project Myrtus... an allusion to the Hebrew word for Esther. The Book of Esther tells the story of a Persian plot against the Jews, who attacked their enemies pre-emptively."
Really? Personally I'd be surprised if a crack team of Israeli software engineers were so sloppy that they relied on outdated rootkit technology (e.g. hooking the Nt*() calls used by Kernel32.LoadLibrary() and using UPX to pack code). Most of the Israeli developers I've met are pretty sharp. Just ask Erez Metula.
[URL="http://www.blackhat.com/presentations/bh-usa-09/METULA/BHUSA09-Metula-ManagedCodeRootkits-PAPER.pdf"]http://www.blackhat.com/presentations/bh-usa-09/METULA/BHUSA09-Metula-ManagedCodeRootkits-
PAPER.pdf [/URL]
It may be that the "myrtus" string from the recovered Stuxnet file path
"b:\myrtus\src\objfre_w2k_x86\i386\guava.pdb" stands for "My-RTUs"
as in Remote Terminal Unit. See the following white paper from Motorola, it examines RTUs and PICs in SCADA systems. Who knows? The guava-myrtus connection may actually hold water.
[URL="http://www.motorola.com/web/Business/Products/SCADA%20Products/_Documents/Static%20Files/SCADA_Sys_Wht_Ppr-2a_New.pdf"]http://www.motorola.com/web/Business/Products/SCADA%20Products/_Documents/Static%20Files/SCADA_
Sys_Wht_Ppr-2a_New.pdf [/URL]
As you can see, the media's propaganda machine is alive and well.

[Ed Jewett]

Daily Mail


Iran arrests Stuxnet 'spies'

Jewish Telegraphic Agency - Ron Kampeas - ‎1 hour ago‎
(JTA) -- Iran announced arrests of people it linked to the Stuxnet malware, which has affected its nuclear facilities. Heydar Moslehi, the Iranian intelligence minister, did not say how many people had been arrested.
Iran holds 'nuclear spies' Aljazeera.net

Iran Says It Arrested Computer Worm Suspects New York Times

BBC News - Voice of America - Tehran Times - Ha'aretz - Wikipedia: Stuxnet
all 341 news articles »

[Peter Lemkin]

No surprises there, but the reminder and details appreciated. Brings up the possibility of of internecine wars between multinationals v. states and/or other multinationals. BND/Germany might not take too kindly to their main supplier and a big bread-winner being hurt by this worm....Siemens for sure will not! The nastiness could spread.....likely will. The future of dirty intel tricks and ops seems rosy.

I agree.

This multinational v state cyberspace warfare is in fact quite close to the future sketched, or perhaps narcotically channelled through a systematic derangement of the senses, by William Gibson in his 1980s Sprawl/cyberpunk trilogy.

As I'm sure most of the regulars on this Forum are well aware the distinction between Companies [especially, but not exclusively, large 'multinational' ones] and 'the Company' and other 15-odd intelligence (sic) agencies has always been a blurry one - or rather a marriage of convenience for the Oligarchy and a marriage of nightmares, assassinations, overthrows, dirty tricks, covert ops, et al. for the rest of the Planet. Coca-Cola and Hilton have LONG been used for intel work/cover. Nothing need be said about proprietaries or on-paper-only companies. Nugan Hand and BCCI and other banks were really intel run and run for intel. United Fruit in Honduras; Anaconda Copper and ITT in Chile; Oil companies in more overthrows, coups and wars than one has fingers and toes. Iraq in 1958 is a classic example, as are the current wars in Iraq (yet again) and Afghanistan. Drug Cartels are in bed with or run by [in some cases] intel services. Defense Contractors have their 'own' internal security/spies that hardly can be separated from the 'National' ones. Industrial spying within a country and country v. country is nothing new, but with the new technologies happening at warp speeds now. A once ugly game seems set to get only uglier as we move toward a Corporate fascism trying to 'unite' the world under their domination [top-down 'globalization']...while the People of world seek bottom-up globalization of a completely different kind!....and an end to wars, spying, overthrows, assassinations, bankster ops, etc. This battle of class warfare is as old as civilization, but seems to be at a deciding moment in human history. Personally, I think the next FEW decades will set the stage for the next millenia - Peace, or nothing but Pieces. Sadly, the resistance movement while more aware and armed with facts then ever before, seems immobilized and unorganized. May that change SOON! But, back to the original point....if companies like Siemans or others of that size take it upon themselves or their sponsors to carry out retaliatory actions [of which they are perfectly capable!] things are really going to get even crazier than they are now....and we now live in a very crazy and immoral world - most countries and larger companies/banks run by thieves and sociapaths. Enron bankrupted California to a large extent, and got away with it due to the Governator. The recent Bank 'bailout' was the largest transfer of money from the poor and middleclass to the ultra-rich in history; Dallas and 911, IMO, and all in between were just softening the world up for what a few have had in mind since the Enlightenment put a crimp in their 'style'....... We now have private armies; private spies with capabilities of national ones; private companies with assets and power greater than all but a few countries [and most interlocking via boards of directors et al.] - and the free movement of [and concentration of] capital; with growing restrictions on the free movement and freedoms of people, etc.

Neo-Feudalism anyone?! Serf's up!

[Carsten Wiethoff]

An interesting podcast with Ralph Langner, the person who analyzed stuxnet:
http://spectrum.ieee.org/podcast/telecom...m-playbook

Interesting tidbit:

The only sites with reported damage are as you mentioned Bushehr and Natanz,...

[Carsten Wiethoff]

For those interested in the technical details of stuxnet, there is a dossier published by symantec here: http://www.symantec.com/content/en/us/en...ossier.pdf

Together with the excellent analyses by Ralph Langner ( http://www.langner.com/english/?p=431 and others in this blog) it gives the clear picture that the targets of stuxnet were Natanz and Busher, like it was suspected early on.