First cyber war? Irish expert's test raises 'end of world' fears
Published 04/10/2010 | 05:00
On a stage in Vancouver last Thursday, a young Irish computing expert gave a filmed presentation showing how the world could end with the pop of a balloon.
The presentational qualities were, well, geek-like, the sound quality poor, and the whole experiment had the air of a Young Scientist project. Nevertheless, the YouTube video is spreading like wildfire from one software blog to the next.
In the past few days, the expert, Liam O Murchu, has become the new star of Geek Universe, quoted from 'PC World' to the 'Washington Post'.
But unlike most such young men, his impenetrable analyses of computer coding have a frightening relevance to physical realities. Hence his experiment, performed at the Virus Bulletin 2010 conference in Canada.
Mr O Murchu, a graduate of University College Dublin who now lives in Los Angeles, was demonstrating how a computer worm called Stuxnet had effects that went beyond blowing up your computer screen. It could blow up real things, too.
Stuxnet has infected operating systems on equipment manufactured by the German industrial giant Siemens and has, as he puts it, "real-world implications beyond any threat we have seen in the past". It could attack oil pipelines, power stations, even nuclear plants.
To prove the possibilities, Mr O Murchu set up a basic air pump, controlled by a Siemens system, on the stage in front of him. The pump delivered a timed burst of air into a balloon, which inflated moderately.
Mr O Murchu then infected the system with Stuxnet, pressed a button, and hey presto! The pump pumped, but did not stop. The balloon went on inflating till it burst.
Imagine if the balloon were, in fact, an Iranian nuclear power station. For that, in essence, is the possibility that has brought Mr O Murchu's name to public attention.
Stuxnet has been around since last year and its workings were first described four months ago. But such was the size and complexity of its coding that only more recently has its true nature become fully clear.
Mr O Murchu works for the anti-virus firm Symantec -- having started in 2003 as an anti-spam technician before taking on his current high-profile role as security response supervisor two years ago.
What scores of analysts like Mr O Murchu, who works for the anti-virus firm Symantec, have found is that it targets the industrial infrastructure that underlies our everyday lives.
They have also found that the country worst affected is Iran, which by last week had reported around three in every five infections worldwide. It has not taken long for the implications to be spelt out. Ralf Langner, a German analyst with detailed knowledge of Siemens systems, had this to say on his personal blog: "Can we think of any reasonable target that would match the scenario? Yes, we can. Look at the Iranian nuclear programme. Strange -- they are having some technical difficulties down there in Bushehr."
Bushehr is a nuclear power station which has been built by Russia for Iran and which, within a fortnight of Mr Langner's posting, confirmed that its opening had been delayed by two months, to January.
Mr Langner even found a photograph taken inside the plant showing a computer screen -- configured, he said, to run a Siemens operating system affected by Stuxnet and, moreover, configured wrongly so that it was vulnerable to bugs.
Iran has subsequently confirmed that computers run by Bushehr scientists have been infected, though it insists the plant itself is undamaged.
Another German analyst, Frank Rieger, went further. Bushehr is disliked by Iran's enemies, but not nearly as much as its separate uranium enrichment programme, which the West believes is part of a nuclear weapons programme.
Since last year, mystery has surrounded its main facility at a place called Natanz, where the number of working centrifuges, the main enrichment devices, suddenly fell by 15pc -- at the very time Stuxnet is first thought to have hit Iran.
As analysts reverse-engineering the code commented to Mr Rieger: "This is what nation states build, if their only other option would be to go to war."
But the odd thing is that Stuxnet -- so far -- hasn't actually been proved to have done anything. Stuxnet contains a "switch" believed to target one very specific, tailored Siemens system -- but no one knows which one, or what the switch is intended to do. Stuxnet "master controllers" have been traced to computer servers in Malaysia and Denmark, and the two security certificates that allowed the worm to infect systems were stolen from Taiwan. Thereafter the trail goes cold.
Israel has little to gain from denying or confirming anything. It cannot own up to what some see as a monumental act of irresponsibility -- the creation of a worm that could attack any sensitive system anywhere in the world. On the other hand, its struggle with Iran is also psychological, and it does it no harm to be thought capable of disarming a nuclear programme without launching a missile.
Truth is the first casualty of war, but in a real war, the battlefield can only be obscured for so long. In World War Two, prisoner-of-war camps, inmates traced on hand-drawn maps the overwhelming victories claimed by Japanese radio broadcasts and watched gleefully how the "victories" took place ever closer to the Japanese mainland.
In cold wars, the process of deduction runs in an opposite direction. Spy agencies reveal the failures -- the defecting Philbys -- and only when they become more insignificant do we know victory is approaching.
Who knows the names of the spies who triumphed? Iran will never admit, and Israel may never say, if it was Stuxnet that damaged Natanz. There is one further hint, though. When Stuxnet does triumph, it leaves a number imprinted on its new host: 19790509. That number, Mr O Murchu says, seems to be a date -- May 9, 1979.
Many things could have happened on May 9, 1979: it may just be someone's birthday. But newspaper archives also tell us it was the day Habib Elghanian died.
Who was Mr Elghanian? He was the first Iranian Jew to be hanged for spying by the new Islamic Republic. And as we all know, revenge is a dish best served cold.
'Nuclear spies' held in Iran Page 34