Iran claims to have been targeted by second worm

If a statement from Gholam-Reza Jalali – the head of Iran’s Passive Defense Organization – is to be believed, it seems that Iran’s computers have been targeted by a new computer worm dubbed “Stars”.

According to him, the worm has been spotted and is currently being investigated by experts, and even though he doesn’t say if it’s tied in any way to the Stuxnet worm, he mentioned that they discovered it is compatible with the targeted system and that the damage is very slight in the initial stage of infection.

Tehran Times reports that he also said that the worm is “likely to be mistaken for executable files of the government,” although I have noticed that many Western news sites report him saying that it might be “mistaken for some executive files of government organisations,” spurring the speculation that it might be masquerading as a .pdf or .doc file.

But the lack of details and the failure of obtaining a sample of the malware make it impossible for Western computer security experts and companies to confirm Jalali’s claim.

“We can’t tie this case to any particular sample we might already have,” says F-Secure’s Mikko Hypponen. “We don’t know if Iran[ian] officials have just found some ordinary Windows worm and announced it to be a cyber war attack.”

“Outside of the published news reports, McAfee has no information on “Stars” at this time. That’s different from Stuxnet, where international cybersecurity companies knew of the malware and were able to investigate it through customary sharing of malware samples, says McAfee’s Joris Evers. “We currently have no way of verifying the attack the Iranian government is reporting, nor do we have any way of identifying who might be behind the attack or what the target could be.

It is, of course, possible that security vendors do have a sample of the malware in their possession, but are unable to identify it because they lack crucial information about it. It’s obvious that Iran will have to provide a sample of the worm to outside experts if it wants its claims to be taken seriously.