Computer virus briefly hits Iran’s oil industry

Data-snatching Flame malware hit Iran's oil sector; breach has been contained, official says

Associated Press |Published: 05.30.12 , 19:51

Iran’s key oil industry was briefly affected by the powerful computer virus known as “Flame” that has unprecedented data-snatching capabilities and can eavesdrop on computer users, a senior Iranian military official said Wednesday.

The comment is the first direct link between the emergence of the new malware and an attack inside a highly sensitive computer system in Iran, which counts on oil revenue for 80% of its income. The full extent of last month’s disruptions has not been given, but Iran was forced to cut Internet links to the country’s main oil export terminal presumably to try to contain the virus.

It would be the latest high-profile virus to penetrate Iran’s computer defenses in the past two years, boosting speculation that Israeli programmers could have struck again.

Experts see technological links between Flame and the highly focused Stuxnet virus, which was tailored to disrupt Iran’s nuclear centrifuges in 2010. Many suspect Stuxnet was the work of Israeli intelligence.

Breach contained

Gholam Reza Jalali, who heads an Iranian military unit in charge of fighting sabotage, claimed that Iranian experts had detected and defeated the “Flame” virus. He told state radio that the oil industry was the only governmental body seriously affected and that all data that had been lost were retrieved.

“This virus penetrated some fields. One of them was the oil sector. Fortunately, we detected and controlled this single incident,” Jalali said. “We could also retrieve the information that was lost.”

Jalali said there has been no report of any other governmental agency being affected by the virus.

Iran’s government-run Computer Emergency Response Team Coordination Center has said the highly sophisticated Flame virus appeared linked to espionage, but cited no specific country or source. The Islamic Republic blamed Israel for the cyberattack.

Israel’s Vice Premier Moshe Yaalon did little to deflect suspicion about the country’s possible involvement.

“Whoever sees the Iranian threat as a significant threat is likely to take various steps, including these, to hobble it,” Yaalon told Army Radio when asked about Flame on Tuesday. “Israel is blessed with high technology, and we boast tools that open all sorts of opportunities for us.”

'Anti-virus already produced'

Ali Hakim Javadi, Iran’s deputy Minister of Communications and Information Technology, was quoted by the official IRNA news agency as saying Wednesday that Iranian experts have already produced an anti-virus capable of identifying and removing Flame from computers.

The Computer Center “has produced an anti-virus capable of detecting and removing the Flame for the first time in the world,” IRNA quoted Javadi as saying. “The anti-virus software was delivered to selected organizations in early May.”

The Russian Internet security firm Kaspersky Lab ZAO said the Flame virus is unprecedented in size and complexity.

Kaspersky’s conclusion that the virus was crafted at the behest of a national government has fueled speculation it could be part of an Israeli-backed campaign of electronic sabotage against the Jewish state’s archenemy.

The virus can activate a computer’s audio systems to listen in on Skype calls or office chatter. It can also take screenshots, log keystrokes and – in one of its more novel functions – steal data from Bluetooth-enabled cell phones.