[LINK] "How the Stuxnet Worm Formed Its Attacks—and Who Might Have It Now"

[rfmcdonald]

80 Beats writes about the apparent Stuxnet computer virus attack against Iranian nuclear installations (covered here: 1, 2, 3). The evidence does seem to suggest a targeted attack.

The security group Symantec has been trying to analyze and understand the waves of Stuxnet attacks against Iran, and now its researchers have found the base of the attacks, according to Symantec’s Orla Cox.

The new research, which analysed 12,000 infections collected by various anti-virus firms, shows that the worm targeted five “industrial processing” organisations in Iran. “These were the seeds of all other infections,” said Ms Cox. The firm was able to identify the targets because Stuxnet collected information about each computer it infected, including its name, location and a time stamp of when it was compromised.

Though Symantec isn’t naming the five targets in Iran, another security expert studying Stuxnet’s code, Ralph Langner, told CNET the likely target of the whole attack was the Natanz nuclear enrichment plant.

“My bet is that one of the infected sites is Kalaye Electric,” he wrote… “Again, we don’t have evidence for this, but this is how we would launch the attack – infecting a handful of key contractors with access to Natanz.”

The question. as the Financial Times article this Saturday on Stuxnet and the wider campaign against the Iranian nuclear program (assassinations and the like) concluded, is what happens next. How will this be escalated?

Go, read.