Russian firm: Iran victim of another cyberattack

[May 29, 2012]  JERUSALEM (AP) -- A Russian-based internet security firm says a powerful computer virus with unprecedented data-snatching capabilities has attacked machines in Iran and elsewhere in the Middle East.

Iran has not disclosed any damage done by the new spyware virus, dubbed "Flame." Its origin has not been identified, but Israel's vice premier fueled speculation that his country, known for its technological innovation and tireless campaign against Iran's suspect nuclear program, unleashed it.

Russian digital security provider Kaspersky Lab, which identified the virus, said in a release posted on its website late Monday that "the complexity and functionality of the newly discovered malicious program exceed those of all other cyber menaces known to date."

It said preliminary findings suggest the virus has been active since March 2010, but eluded detection because it of its "extreme complexity" and the fact that only selected computers are being targeted. Flame's primary purpose, it said, "appears to be cyber espionage, by stealing information from infected machines" and sending it to servers across the world.

According to Kaspersky, the virus collected information not only in Iran, but also in Israel and the Palestinian territories, Sudan, Syria, Lebanon, Saudi Arabia and Egypt. Iran, however, was far and away the country most affected, it said.

A unit of the Iranian communications and information technology ministry said only that it has produced an antivirus capable of identifying and removing the new malware. The Flame virus is the fourth known cyber attack on the Iranian nuclear program.

Comments Tuesday by Israel's vice premier did little to deflect suspicion about possible Israeli involvement in the latest attack.

"Whoever sees the Iranian threat as a significant threat is likely to take various steps, including these, to hobble it," Vice Premier Moshe Yaalon told Army Radio. "Israel is blessed with high technology, and we boast tools that open all sorts of opportunities for us."

Israel, like the West, rejects Tehran's claims that its nuclear program is designed to produce energy, not bombs. It considers Iran to be the greatest threat to its survival and repeatedly, if obliquely, threatened to attack Iran's nuclear facilities if Tehran doesn't abandon its uranium enrichment project, a key element of bombmaking.

Kaspersky said the cyber espionage worm came to its attention after the United Nations' International Telecommunication Union asked it for help in finding a piece of malware that was deleting sensitive information across the Middle East. The company stumbled across Flame when searching for that other code, it said.

Because Flame is so complex, was not designed to hack into bank accounts and doesn't have the hallmarks of amateur hackers, Kaspersky has concluded that the research that went into the code was government-sponsored.

The code offers no information that can tie Flame to any specific nation, Kaspersky said.

Udi Mokady, CEO of Cyber-Ark, an Israeli developer of information security, said he thought four countries, in no particular order, have the technological know-how to develop so sophisticated a cyber offensive: Israel, the U.S., China and Russia.

"It was 20 times more sophisticated than Stuxnet," with thousands of lines of code that took a large team, ample funding and months, if not years, to develop, he said.

"It's a live program that communicates back to its master. It asks, where should I go? What should I do now? It's really almost like a science fiction movie."

The first known cyber attack on the Iranian nuclear program dates back to 2010, when the Stuxnet virus disrupted controls of some nuclear centrifuges. Iran claims Stuxnet and other computer viruses have done no serious harm to Iran's nuclear or industrial facilities, and sees them as part of a campaign by Israel, the U.S. and their allies, which includes the assassination of Iranian nuclear scientists, to undermine the Iranian nuclear program.

In Baghdad last week, Iranian negotiators rejected proposals by six world powers to curb Tehran's nuclear ambitions. A new round of nuclear talks is expected to take place in Moscow next month.

Yaalon, the Israeli vice premier, told Army Radio on Tuesday that the talks in Iraq "yielded no significant achievement" except to let Iran buy time. He appeared to take a swipe at President Barack Obama by saying it might "even be in the interest of some players in the West to play for time."

Yaalon in the past expressed disappointment that the U.S. has delayed plans to expand sanctions against Iran, suggesting Washington was afraid the penalties would send oil prices soaring and hurt Obama's re-election chances.

[Associated Press; By AMY TEIBEL]

Diaa Hadid contributed to this report from Jerusalem.

Copyright 2012 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.