Was There a Cyberattack on Iran's Nuclear Program?

(Sept. 22) -- The evidence may be scant and the claims seemingly far-fetched, but a cybersecurity expert is suggesting that a sophisticated new type of malicious software called Stuxnet may have been spread in the hope of bringing down Iran's nuclear program.

"At least one expert who has extensively studied the malicious software, or malware, suggests Stuxnet may have already attacked its target -- and that it may have been Iran's Bushehr nuclear power plant, which much of the world condemns as a nuclear weapons threat," The Christian Science Monitor reported today, based on comments made by Ralph Langner, a German cybersecurity researcher.

Stuxnet, the worm in question, has attracted widespread attention since being identified over the summer because of its level of sophistication, which Computerworld called "groundbreaking." The worm specifically targets systems known as SCADA, or supervisory control and data acquisition, that are used to run large facilities such as power plants.

The expertise and resources needed to created something like Stuxnet do suggest the involvement of a government, but there appears to be little evidence that Stuxnet was targeting Bushehr, according to other analysts.

Jeffrey Carr, a cybersecurity expert, said he found claims that Stuxnet was targeting Iran "odd," given the lack of specific evidence.

"The reality is that Iran, India and Indonesia all had big problems with this worm, based on three different information security companies," Carr, the founder of GreyLogic, told AOL News. "To take one possibility out of many and to claim that [is the explanation] is irresponsible."

Regardless of whether Stuxnet was targeting the Iranian nuclear program, it is possible to create malware designed to target a nuclear plant or some other part of a country's electricity grid, another cybersecurity expert told AOL News. A simulation run by the Pacific Northwest National Laboratory demonstrated that it was possible to hack a facility like a power plant, said Chris Bronk, a fellow in information technology policy at Rice University's Baker Institute.

Sponsored Links

Citing the new emphasis on cybersecurity, including the creation of the unified military U.S. Cyber Command, the idea of the United States deploying a cyberweapon is quite possible, according to Bronk.

"They have talked about having offensive and defensive cyber portfolios," Bronk said. "Defensive is easy; offensive is something no one is talking about."

Even if Langner's assertions about Iran are correct, there isn't any evidence to back up those claims, even by his own account.

"This will all eventually come out and Stuxnet's target will be known," Langner told The Christian Science Monitor. "If Bushehr wasn't the target and it starts up in a few months, well, I was wrong."