worm

Further to my blog below titled “Iran Rocks to ACDC”, further investigation suggests that this may not be the case at all!

An inspection of the available documents and with the use of on-line translation programs, this author can find no evidence to support the story.

A web search reveals the story was only reported from the F-Secure site.
Only part of the email is displayed on the site F-Secure site. It is displayed in Arabic.
The email shows a web address http://www.aeoi.org.ir. When this address is followed , it does appear to call up the legitimate web site for the Atomic Energy Organisation of Iran.
The Arabic text from this site was cut and paste, and run through a translation program. The translated text (although incomplete) makes no mention of virus, worms or ACDC.
However, the email on the F-Secure site looks like a screen capture of the home page of the AEOI site, rather than a traditional email. It is noted that today’s AEOI front page is slightly different but it does contain the same references as seen on on the F-Secure site.
Lastly, and perhaps more importantly, passage of emails in and out of Iran, passing details that might embarass the regime, would no doubt have severe repercussions on the author of those emails, assuming that a scientist could be found with western sympathies and willing to take the risk.

MINA reported Wednesday that Iran’s nuclear facilities have suffered a cyber attack that diabled their computers and played music from the rock band AC/DC.

A new worm targeted Iran’s nuclear program, closing down the “automation network” at the Natanz and Fordo nuclear facilities. MINA cites the story was reported on the F-Secure Security Labs web site.

The substance of the text appears to be thus:

“I am writing you to inform you that our nuclear program has once again been compromised and attacked by a new worm with exploits which have shut down our automation network at Natanz and another facility Fordo near Qom.

According to the email our cyber experts sent to our teams, they believe a hacker tool Metasploit was used. The hackers had access to our VPN. The automation network and Siemens hardware were attacked and shut down. I only know very little about these cyber issues as I am scientist not a computer expert.

There was also some music playing randomly on several of the workstations during the middle of the night with the volume maxed out. I believe it was playing ‘Thunderstruck’ by AC/DC”.

The virus also prompted several of the computers on site to play the song “Thunderstruck” by AC/DC at full volume in the middle of the night, according to the e-mail, part of which is published in English on the website.

F-Secure Security Labs, which is linked to F-Secure Oyj (FSC1V), the Finnish maker of security and cloud software, said that while it was unable to verify the details of the attack described, it had confirmed that the scientist who reported them was sending and receiving the e-mails from within Iran’s Atomic Energy Organization.

Iran’s nuclear program and oil facilities have been subject to a succession of cyber attacks that the Foreign Ministry said in May were launched by hostile governments as part of a broader “soft war.” Iran accuses the U.S. and Israel of trying to sabotage its technological progress. Both countries say Iran’s nuclear activities may have military intent, an allegation that Iran denies.

Call me a cynic if you will, but I suspect that this is one story that cannot, or will not be confirmed or denied. One has to question the authenticity of the emails purportedly originating from a “scientist” the AEOI.