News / Middle East

Saudi Cyber Attack Seen as Work of Amateur Hackers Backed by Iran

Digital security experts say a major August cyber-attack at Saudi Arabia's top oil company appears to be the work of amateur hackers working on behalf of a nation state, and several signs point to Iran as their sponsor.

The experts say the methods apparently used by the hackers to damage many of Saudi Aramco's computers pose new challenges to other companies based in the region, and to Western powers engaged in cyber warfare with Iran.

Several hacker groups quickly claimed responsibility for the August 15 attack on Aramco, but their identities have remained a mystery and their online claims have not been verified.

Iran Accused as Cyber Attacker

The New York Times  reported Tuesday that unnamed U.S. intelligence officials believe the attack's real perpetrator was Iran. But it said the officials offered no specific evidence to support their claim.

Earlier this month, Iran's National Center of Cyberspace dismissed the U.S. allegation as politically motivated. Saudi Aramco has not commented on the perpetrators of the cyber-attack, citing an ongoing investigation.

Seculert, an Israel-based security company specializing in advanced threat detection, said the Aramco hackers may be affiliated with a government because the virus they deployed was designed to do more than just destroy hard drives.

Spying for a Government?

Seculert chief technology officer Aviv Raff said the affected computers sent data to a machine outside of the corporate network just before their hard drives were erased by the virus, dubbed "Shamoon" by researchers.

"With Shamoon, [the hackers] basically [were] trying to erase evidence of other intentions, trying to cover their tracks," said Raff.

He said those intentions may have included spying on Saudi Aramco for a government interested in the Saudi state-owned company's major energy infrastructure.

Jeffrey Carr, chief executive officer of U.S. security firm Taia Global, said Shamoon appears to have been reverse-engineered from a sophisticated data-stealing virus that attacked Iranian oil ministry computers in April.

Amateur Results

But Carr, whose firm specializes in protecting data from espionage, said Shamoon failed to accomplish its data-stealing objectives.

"The malware had some very basic coding errors in it," he said. "[It looks like] somebody in their basement doing some coding and reverse-engineering and then sending it out. It is unlikely that this was done by a professional team."

Carr said several factors indicate that the Aramco hackers were working for the Iranian government. He said Iran had a motive to hire them.

Circumstantial Evidence

Tehran urged Riyadh in July not to boost Saudi oil exports while Iranian production was being cut back because of Western sanctions.

"Iran wanted the West to feel the pressure [from a lower global oil supply and higher prices]," Carr said. "Of course, Aramco did [raise production]. So for me, [the virus] would be a standard shot across the bow by Iran, saying we warned you."

Iran appears to have hacker groups capable of staging major cyber-attacks without exposing the government as the responsible party.

A group calling itself the Iranian Cyber Army hijacked the home page of Baidu, China's largest search engine, in January 2010, leaving a message in Farsi saying the act was a protest against foreign meddling in Iran's domestic politics.

Iran also has a record of reverse-engineering to acquire technology. In April, an Iranian commander said Tehran was building a copy of a U.S. drone that it captured last year and took apart. Washington has acknowledged losing the RQ-170 Sentinel.

Iran Challenges its Cyber Enemies

Iran has said it is improving its cyber warfare capabilities to defend government computers against periodic attacks that it blames on Israel and the West.

Stephen Cobb, a security expert at ESET North America, said a country attacked by a virus is "highly likely" to examine the code and redeploy it.

"Malicious code is entirely different from conventional weapons in that you are actually giving the weapon to the person you are attacking," he said.

"It is extremely arrogant to think that the country you are attacking is not going to be able to figure out what the code does and reuse it, or write their own code and attack you back."

Carr of Taia Global said Iran is capable of capturing Western-made cyber tools worth millions of dollars and re-engineering them at a much lower cost.

A More Dangerous Insider Attack

Cobb said the Aramco incident also shows that companies face an escalated threat of cyber-attack from insiders. Experts have said the Shamoon virus was triggered by someone who had privileged access to the Saudi company's computers.

"Typically your insider threat in Western countries is to steal things or possibly exact revenge or hold the company hostage, whereas [the Aramco insider attack] was an act of destruction, and more expensive."

Cobb said the virus probably cost Aramco millions of dollars in lost worker productivity and unanticipated expenses, such as security experts being flown in to repair the damaged computers.

"You cannot assume that all the people working for a company agree with its aims and goals," Cobb said. "If someone with elevated system privileges turns against the company, there is pretty much no limit on what damage they can do."

Michael Lipin

Michael covers international news for VOA on the web, radio and TV, specializing in the Middle East and East Asia Pacific. Follow him on Twitter @Michael_Lipin

You May Like

Turkey: No Ransom Paid for Release of Hostages Held by IS Militants

President Erdogan hails release of hostages as diplomatic success but declines to be drawn on whether their release freed Ankara's hand to take more active stance against insurgents More

Audio Sierra Leone Ends Ebola Lockdown

Health ministry says it has reached 75 percent of its target of visiting 1.5 million homes to locate infected, educate population about virus More

US Pivot to Asia Demands Delicate Balancing Act

As the tumult in the Middle East distracts Obama, shifting American focus eastward appears threatened More

This forum has been closed.
Comment Sorting
Comments
     
by: FALSE FLAG
October 27, 2012 11:04 AM
This is truly one of the most ridiculous attempts at inciting violence upon another that I have ever seen. I wish this worked in real0life, where I could go to my friends house and toss a rock through the window and then go out and blame it on my enemy. I throw the rock and my friend kills my enemy... that's a win-win.


by: Richard Steven Hack from: San Francisco, CA
October 27, 2012 7:07 AM
Still ZERO evidence that Iran's government was behind any attacks. It's all speculation at this point - and most of the speculation appears politically motivated.


by: Lolcast
October 26, 2012 5:13 AM
Interesting... I was just reading on some other website that Panetta had said: "Only few countries in the world are capable of orchestrating such sophisticated attacks". So someone tell me... was it sophisticated or amateurish?!

In Response

by: BP from: Michigan
October 27, 2012 9:16 AM
I agree there are conflicting messages in the article. I hope it is not the work of amatuers since they just took down many of the computers of the biggest oil company.


by: Hundu from: Japan
October 25, 2012 9:36 PM
Iran... what a farce... used to be great... look what Islam has done to them... so sad...

Featured Videos

Your JavaScript is turned off or you have an old version of Adobe's Flash Player. Get the latest Flash player.
Natural Gas Export Plan Divides Maryland Towni
X
Deborah Block
September 21, 2014 2:12 PM
A U.S. power company that has been importing natural gas now wants to export it. If approved, its plant in Lusby, Maryland, would likely be the first terminal on the United States East Coast to export liquefied natural gas from American pipelines. While some residents welcome the move because it will create jobs, others oppose it, saying the expansion could be a safety and environmental hazard. VOA’s Deborah Block examines the controversy.
Video

Video Natural Gas Export Plan Divides Maryland Town

A U.S. power company that has been importing natural gas now wants to export it. If approved, its plant in Lusby, Maryland, would likely be the first terminal on the United States East Coast to export liquefied natural gas from American pipelines. While some residents welcome the move because it will create jobs, others oppose it, saying the expansion could be a safety and environmental hazard. VOA’s Deborah Block examines the controversy.
Video

Video Fears Ebola Outbreak ‘Beyond Our Capability to Contain’

Each day brings with it new warnings about the deadly Ebola outbreak already blamed for killing more than 2,600 people across West Africa. And while countries and international organizations like the United Nations are starting to come through on promises of help for those most affected, the unprecedented speed with which the virus has spread is raising questions about the international response. VOA's Jeff Seldin has more from Washington.
Video

Video Difficult Tactical Battle Ahead Against IS Militants in Syria

The U.S. president has ordered the military to intensify its fight against the Islamic State, including in Syria. But how does the military conduct air strikes in a country that is not a U.S. ally? VOA correspondent Carla Babb reports from the Pentagon.
Video

Video Iran, World Powers Seek Progress in Nuclear Talks

Iran and the five permanent members of the U.N. Security Council plus Germany, known as the P5 + 1, have started a new round of talks on Iran's nuclear program. VOA State Department correspondent Pam Dockins reports that as the negotiations take place in New York, a U.S. envoy is questioning Iran's commitment to peaceful nuclear activity.
Video

Video Alibaba Shares Soar in First Day of Trading

China's biggest online retailer hit the market Friday -- with its share price soaring on the New York Stock Exchange. The shares were priced at $68, but trading stalled at the opening, as sellers held onto their shares, waiting for buyers to bid up the price. More on the world's biggest initial public offering from VOA’s Bernard Shusman in New York.
Video

Video Obama Goes to UN With Islamic State, Ebola on Agenda

President Obama goes to the United Nations General Assembly to rally nations to support a coalition against Islamic State militants in Iraq and Syria. He also will look for nations to back his plan to fight the Ebola virus in West Africa. As VOA White House correspondent Luis Ramirez reports, Obama’s efforts reflect new moves by the U.S. administration to take a leading role in addressing world crises.
Video

Video Migrants Caught in No-Man's Land Called Calais

The deaths of hundreds of migrants in the Mediterranean this week has only recast the spotlight on the perils of reaching Europe. And for those forunate enough to reach a place like Calais, France, only find that their problems aren't over. Lisa Bryant has the story.
Video

Video Westgate Siege Anniversary Brings Back Painful Memories

One year after it happened, the survivors of the terror attack on Nairobi's Westgate Shopping Mall still cannot shake the images of that tragic incident. For VOA, Mohammed Yusuf tells the story of victims still waiting for the answer to the question 'how could this happen?'
Video

Video Militant Assault in Syria Displaces Thousands of Kurds

A major assault by Islamic State militants on Kurds in Syria has sent a wave of new refugees to the Turkish border, where they were stopped by Turkish border security. Turkey is already hosting about 700,000 Syrian refugees who fled the civil war between the government and the opposition. But the government in Ankara has a history of strained relations with Turkey's Kurdish minority. Zlatica Hoke reports Turkey is asking for international help.
Video

Video Whaling Summit Votes to Uphold Ban on Japan Whale Hunt

The International Whaling Commission, meeting in Slovenia, has voted to uphold a court ruling banning Japan from hunting whales in the Antarctic Ocean. Conservationists hailed the ruling as a victory, but Tokyo says it will submit revised plans for a whale hunt in 2015. Henry Ridgwell reports from London.
Video

Video A Dinosaur Fit for Land and Water

Residents and tourists in Washington D.C. can now examine a life-size replica of an unusual dinosaur that lived almost a hundred million years ago in northern Africa. Scientists say studying the behemoth named Spinosaurus helps them better understand how some prehistoric animals adapted to life on land and in water. The Spinosaurus replica is on display at the National Geographic museum. VOA’s George Putic has more.
Video

Video Iraqi Kurdistan Church Helps Christian Children Cope find shelter in churches in the Kurdish capital, Irbil

In the past six weeks, tens of thousands of Iraqi Christians have been forced to flee their homes by Islamic State militants and find shelter in churches in the Kurdish capital, Irbil. Despite U.S. airstrikes in the region, the prospect of people returning home is still very low and concerns are starting to grow over the impact this is having on the displaced youth. Sebastian Meyer reports from Irbil on how one church is coping.


Carnage and mayhem are part of daily life in northern Nigeria, the result of a terror campaign by the Islamist group Boko Haram. Fears are growing that Nigeria’s government may not know how to counter it, and may be making things worse. More

AppleAndroid