TEHRAN - The computers of high-ranking Iranian officials appear to have been penetrated by a data-mining virus called Flame, in what may be the most destructive cyberattack on Iran since the notorious Stuxnet virus, an Iranian cyberdefense organization confirmed Tuesday.
In a message posted on its website, Iran’s Computer Emergency Response Team Coordination Center warned that the virus is potentially more harmful than the 2010 Stuxnet virus, which destroyed several centrifuges used for Iran’s nuclear enrichment program. In contrast to Stuxnet, the newly identified virus is designed not to do damage but to secretly collect information from a wide variety of sources.
Flame, which specialists say could be as much as five years old, was discovered by Iranian cyberexperts. In a statement about Flame on its website, Kaspersky Lab, a Russian producer of antivirus software, said that “the complexity and functionality of the newly discovered malicious program exceed those of all other cyber menaces known to date.’’
The virus bears special encryption hallmarks that an Iranian cyberdefense official said bear strong similarities to previous Israeli malware.
“Its encryption has a special pattern which you only see coming from Israel,’’ said Kamran Napelian, an official with Iran’s Computer Emergency Response Team. “Unfortunately, they are very powerful in the field of IT.’’
While Israel never comments officially on such matters, its involvement was hinted at by top officials there.
“Anyone who sees the Iranian threat as a significant threat - it’s reasonable that he will take various steps, including these, to harm it,’’ said Moshe Yaalon, Israel’s vice prime minister and strategic affairs minister.
In a speech Tuesday night, Prime Minister Benjamin Netanyahu did not mention Flame specifically, but he did include cyberthreats as one of five critical types of threats Israel faces, saying, “We are investing a great deal of money in that, human capital and financial capital. I expect these investments to yield a great deal in the coming years.’’
Napelian said that Flame seems designed to mine data from personal computers and is distributed through USB sticks rather than the Internet, meaning that a USB stick has to be inserted manually into at least one computer in a network.
“This virus copies what you enter on your keyboard, it monitors what you see on your computer screen,’’ Napelian said in a telephone interview.
In his speech Tuesday, at the annual conference of Israel National Security Studies, Netanyahu made his first public comments about the talks last week in Baghdad on Iran’s nuclear program, expressing disappointment that the Western powers were not demanding more of Tehran.
“Not only should the sanctions be intensified, the demands should be intensified,’’ Netanyahu said. “I say sadly that this is not what’s being required of Iran today. In the previous round they were asked to stop the 3.5 percent enrichment and that’s not what’s happening now.’’
He added: “They have continued to enrich, undisturbed. In other words, they are moving ahead, constantly, with their nuclear program to build a nuclear bomb.’’