Fredrick Dahl – Reuters February 1, 2011
Cyber attacks such as the Stuxnet computer worm could harm nuclear sites but Russia and Iran are paying “enough attention” to prevent any possible accident at Iran’s Bushehr reactor, the U.N. nuclear chief said on Tuesday.
Yukiya Amano, director general of the International Atomic Energy Agency (IAEA), told Reuters the U.N. watchdog was watching developments and gathering information about Stuxnet with interest.
Russia has urged NATO to investigate last year’s Stuxnet attack on the Russian-built Bushehr nuclear plant in Iran, saying it could have triggered a disaster on the scale of the Chernobyl reactor explosion in Ukraine in 1986.
“Stuxnet, or cyber attack as a whole, could be quite detrimental to the safety of nuclear facilities and operations,” Amano, a soft-spoken veteran Japanese diplomat, said in an interview in his 28th-floor office in Vienna.
He acknowledged the IAEA had only limited knowledge about the computer worm, which some experts have described as a first-of-its-kind guided cyber missile.
He noted that Bushehr, which Iran says will start operating soon, had been built by Russia and would be operated by Iran.
“I think they are giving enough attention to prevent possible accidents caused by cyber attacks,” Amano said.
For now, the IAEA was not calling for any delay in the reactor’s start-up of operations, he said. “Countries concerned are giving considerable attention to this issue.”
But Amano also said the IAEA was interested in holding a meeting of experts to discuss the issue of cyber attacks.
In Brussels last week, Dmitry Rogozin, Russia’s ambassador to the North Atlantic Treaty Organization, said the virus had hit the computer system at the Bushehr reactor on Iran’s Gulf coast.
Iran began fuelling Bushehr in August and officials have said the reactor will begin generating energy early this year, a delay of several months following the spread of the global computer virus, which is believed mainly to have affected Iran.
URANIUM STOCKPILE GROWING
Iranian officials have confirmed Stuxnet hit staff computers at Bushehr but said it had not affected major systems.
Security experts say it may well have been a state-sponsored attack on Iran’s nuclear program that originated in the United States or Israel, which suspect Iran is seeking to develop nuclear weapons.
Iran denies the charge and says Bushehr is the first in a planned network of nuclear reactors designed to meet growing electricity demand and help it export more of its oil and gas.
Some experts say Stuxnet may also have been a factor in slowing down Iran’s uranium enrichment activities at Natanz, which can have both civilian and military purposes.
Any delays in Iran’s enrichment campaign could buy more time for efforts to find a diplomatic solution to its stand-off with world powers, even though talks in Geneva in December and Istanbul last month failed to bridge the gap.
But Amano said Iran’s production of low-enriched uranium, potential bomb-making material if refined much further, was “continuing steadily” and its stockpile was growing.
A temporary halt in low-level enrichment in mid-November lasted only for a short period of time, he said.
He said the IAEA did not know whether Iran was seeking to develop nuclear weapons, but that it was concerned that some activities may have military links.
Refined uranium can be used as fuel for power plants but also provide material, if enriched further, for bombs.
“We have chosen our words very carefully and we have never said that Iran has nuclear weapon programs but we have expressed our concern over some activities that might have military dimension,” Amano said.
“Since 2008 our Iranian partners have not agreed with us to clarify this issue. It is very unfortunate,” he said.
(Editing by Paul Taylor)
Did the Stuxnet computer virus fail to disable its designated target but spread to other computer systems instead? Reports of the virus surfaced in China in late September 2010. Thereafter it appeared in Japan as the following article elaborates.
New cybervirus found in Japan / Stuxnet designed to attack off-line servers via USB memory sticks
The Yomiuri Shimbun – Daily Yomiuri Online October 5, 2010
Stuxnet, a computer virus designed to attack servers isolated from the Internet, such as at power plants, has been confirmed on 63 personal computers in Japan since July, according to major security firm Symantec Corp.
The virus does not cause any damage online, but once it enters an industrial system, it can send a certain program out of control.
Symantec says the virus reaches the servers via USB memory sticks, and warns against the careless use of such devices.
Systems at power plants, gas stations and water facilities are not connected to the Internet to protect them from cyber-attacks.
A Symantec engineer who has analyzed the virus said it was made using advanced technology, and it is highly likely a well-funded organization, not an individual, produced it. The virus has spread throughout the globe via the Internet.
After Stuxnet finds its way onto an ordinary computer via the Internet, it hides there, waiting for a USB memory stick to be connected to the computer, when it transfers itself to the memory stick. When the USB device is then connected to a computer linked to an isolated server, it can enter the system and take control of it.
As computers that harbor Stuxnet do not operate strangely, the virus can be transferred to a memory stick inadvertently.
According to the security company, the virus is designed to target a German-made program often used in systems managing water, gas and oil pipelines. The program is used at public utilities around the world, including in Japan.
The virus could cause such systems to act erratically, and it could take months to restore them to normal.
The 63 infected computers found in Japan were likely infected sometime after June.
According to the company, about 60 percent of the computers that have been infected with the virus were discovered in Iran. Since September, about 30,000 computers there have been found to be infected with the virus. The country’s Industry and Mines Ministry has called the virus an electronic act of war.
Some computers at the Iranian Bushehr nuclear power plant, which is scheduled to begin operation in October, have been infected with the virus.
A supervisor at the plant said the virus has not damaged the facility’s main computer system and would not affect its planned opening.
In Japan, no public utilities have been affected by the virus. Nevertheless, the Cabinet Office’s National Information Security Center has urged electric power companies to exercise extreme care when using USB devices, and to scan any programs that may have been tampered with.
Thanks to What Really Happened for the above references. Ed.