News / Middle East

    Saudi Cyber Attack Seen as Work of Amateur Hackers Backed by Iran

    Digital security experts say a major August cyber-attack at Saudi Arabia's top oil company appears to be the work of amateur hackers working on behalf of a nation state, and several signs point to Iran as their sponsor.

    The experts say the methods apparently used by the hackers to damage many of Saudi Aramco's computers pose new challenges to other companies based in the region, and to Western powers engaged in cyber warfare with Iran.

    Several hacker groups quickly claimed responsibility for the August 15 attack on Aramco, but their identities have remained a mystery and their online claims have not been verified.

    Iran Accused as Cyber Attacker

    The New York Times  reported Tuesday that unnamed U.S. intelligence officials believe the attack's real perpetrator was Iran. But it said the officials offered no specific evidence to support their claim.

    Earlier this month, Iran's National Center of Cyberspace dismissed the U.S. allegation as politically motivated. Saudi Aramco has not commented on the perpetrators of the cyber-attack, citing an ongoing investigation.

    Seculert, an Israel-based security company specializing in advanced threat detection, said the Aramco hackers may be affiliated with a government because the virus they deployed was designed to do more than just destroy hard drives.

    Spying for a Government?

    Seculert chief technology officer Aviv Raff said the affected computers sent data to a machine outside of the corporate network just before their hard drives were erased by the virus, dubbed "Shamoon" by researchers.

    "With Shamoon, [the hackers] basically [were] trying to erase evidence of other intentions, trying to cover their tracks," said Raff.

    He said those intentions may have included spying on Saudi Aramco for a government interested in the Saudi state-owned company's major energy infrastructure.

    Jeffrey Carr, chief executive officer of U.S. security firm Taia Global, said Shamoon appears to have been reverse-engineered from a sophisticated data-stealing virus that attacked Iranian oil ministry computers in April.

    Amateur Results

    But Carr, whose firm specializes in protecting data from espionage, said Shamoon failed to accomplish its data-stealing objectives.

    "The malware had some very basic coding errors in it," he said. "[It looks like] somebody in their basement doing some coding and reverse-engineering and then sending it out. It is unlikely that this was done by a professional team."

    Carr said several factors indicate that the Aramco hackers were working for the Iranian government. He said Iran had a motive to hire them.

    Circumstantial Evidence

    Tehran urged Riyadh in July not to boost Saudi oil exports while Iranian production was being cut back because of Western sanctions.

    "Iran wanted the West to feel the pressure [from a lower global oil supply and higher prices]," Carr said. "Of course, Aramco did [raise production]. So for me, [the virus] would be a standard shot across the bow by Iran, saying we warned you."

    Iran appears to have hacker groups capable of staging major cyber-attacks without exposing the government as the responsible party.

    A group calling itself the Iranian Cyber Army hijacked the home page of Baidu, China's largest search engine, in January 2010, leaving a message in Farsi saying the act was a protest against foreign meddling in Iran's domestic politics.

    Iran also has a record of reverse-engineering to acquire technology. In April, an Iranian commander said Tehran was building a copy of a U.S. drone that it captured last year and took apart. Washington has acknowledged losing the RQ-170 Sentinel.

    Iran Challenges its Cyber Enemies

    Iran has said it is improving its cyber warfare capabilities to defend government computers against periodic attacks that it blames on Israel and the West.

    Stephen Cobb, a security expert at ESET North America, said a country attacked by a virus is "highly likely" to examine the code and redeploy it.

    "Malicious code is entirely different from conventional weapons in that you are actually giving the weapon to the person you are attacking," he said.

    "It is extremely arrogant to think that the country you are attacking is not going to be able to figure out what the code does and reuse it, or write their own code and attack you back."

    Carr of Taia Global said Iran is capable of capturing Western-made cyber tools worth millions of dollars and re-engineering them at a much lower cost.

    A More Dangerous Insider Attack

    Cobb said the Aramco incident also shows that companies face an escalated threat of cyber-attack from insiders. Experts have said the Shamoon virus was triggered by someone who had privileged access to the Saudi company's computers.

    "Typically your insider threat in Western countries is to steal things or possibly exact revenge or hold the company hostage, whereas [the Aramco insider attack] was an act of destruction, and more expensive."

    Cobb said the virus probably cost Aramco millions of dollars in lost worker productivity and unanticipated expenses, such as security experts being flown in to repair the damaged computers.

    "You cannot assume that all the people working for a company agree with its aims and goals," Cobb said. "If someone with elevated system privileges turns against the company, there is pretty much no limit on what damage they can do."

    Michael Lipin

    Michael covers international news for VOA on the web, radio and TV, specializing in the Middle East and East Asia Pacific. Follow him on Twitter @Michael_Lipin

    You May Like

    Native Americans Ask: What About Our Water Supply?

    They say they have been facing a dangerous water contaminant for decades - uranium – but the problem has received far less attention than water contamination by lead in Flint, Michigan

    Pakistan's President Urges Nation Not to Celebrate Valentine's Day

    Mamnoon Hussain criticizes Valentine's Day, which falls on Sunday this year, as a Western import that threatens to undermine the Islamic values of Pakistan

    Mother of IS Supporter: Son Was Peaceful, 'Role Model'

    Somali-American Abdirizak Mohamed Warsame pleaded guilty Thursday to charges of conspiring to provide material support to Islamic State militants

    This forum has been closed.
    Comment Sorting
    Comments
         
    by: FALSE FLAG
    October 27, 2012 11:04 AM
    This is truly one of the most ridiculous attempts at inciting violence upon another that I have ever seen. I wish this worked in real0life, where I could go to my friends house and toss a rock through the window and then go out and blame it on my enemy. I throw the rock and my friend kills my enemy... that's a win-win.

    by: Richard Steven Hack from: San Francisco, CA
    October 27, 2012 7:07 AM
    Still ZERO evidence that Iran's government was behind any attacks. It's all speculation at this point - and most of the speculation appears politically motivated.

    by: Lolcast
    October 26, 2012 5:13 AM
    Interesting... I was just reading on some other website that Panetta had said: "Only few countries in the world are capable of orchestrating such sophisticated attacks". So someone tell me... was it sophisticated or amateurish?!
    In Response

    by: BP from: Michigan
    October 27, 2012 9:16 AM
    I agree there are conflicting messages in the article. I hope it is not the work of amatuers since they just took down many of the computers of the biggest oil company.

    by: Hundu from: Japan
    October 25, 2012 9:36 PM
    Iran... what a farce... used to be great... look what Islam has done to them... so sad...

    Featured Videos

    Your JavaScript is turned off or you have an old version of Adobe's Flash Player. Get the latest Flash player.
    Two-thirds of World Faces Water Shortagei
    X
    February 12, 2016 7:31 PM
    Four billion people — or two out of every three on the planet — do not have enough water to meet their basic needs. That is far greater than previously thought, according to a new study that presents a more accurate picture of the problem. As VOA's Rosanne Skirble reports, the findings will help policymakers and the public craft solutions to address the threat.
    Video

    Video Two-thirds of World Faces Water Shortage

    Four billion people — or two out of every three on the planet — do not have enough water to meet their basic needs. That is far greater than previously thought, according to a new study that presents a more accurate picture of the problem. As VOA's Rosanne Skirble reports, the findings will help policymakers and the public craft solutions to address the threat.
    Video

    Video Gateway to Mecca: Historical Old Jeddah

    Local leader Sami Nawar's family has been in the Old City of Jeddah for hundreds of years and takes us on a tour of this ancient route to Mecca, also believed to be the final resting place of Adam's wife, Eve.
    Video

    Video New Technology Aims to Bring Election Transparency to Uganda

    A team of recent graduates from Uganda’s Makerere University has created a mobile application designed to help monitor elections and expose possible rigging. The developers say the app, called E-Poll, will make Uganda's democratic process fairer. From Kampala, VOA's Serginho Roosblad reports.
    Video

    Video As Refugees Perish, Greek Graveyards Fill

    Aid workers on the Greek island of Lesbos say they are struggling to bury the increasing number of bodies of refugees that have been recovered or washed up ashore in recent months.  The graveyards are all full, they say, yet as tens of thousands of people clamor to get out of Syria, it is clear refugees will still be coming in record numbers. For VOA, Hamada Elrasam reports from Lesbos, Greece.
    Video

    Video Russia Bristles at NATO Expansion in E. Europe

    Russian Foreign Minister Sergei Lavrov is meeting Friday with the head of NATO after the Western military alliance and the United States announced plans for the biggest military build-up in Europe since the Cold War. Russia has called NATO's moves a threat to stability in Europe. But NATO says the troop rotations and equipment are aimed at reassuring allies concerned about Russia as VOA's Daniel Schearf reports from Moscow.
    Video

    Video To Fight Zika, Scientists Target Mosquitoes

    Mosquitoes strike again. The Zika virus outbreak is just the latest headline-grabbing epidemic carried by these biting pests, but researchers are fighting back with new ways to control them. VOA's Steve Baragona takes a look.
    Video

    Video Mosul Refugees Talk About Life Under IS

    A top U.S. intelligence official told Congress this week that a planned Iraqi-led operation to re-take the city of Mosul from Islamic State militants is unlikely to take place this year. IS took over the city in June 2014, and for the past year and a half, Mosul residents have been held captive under its rule. VOA's Zana Omar talked to some families who managed to escape. Bronwyn Benito narrates his report.
    Video

    Video Scientists Make Progress Toward Better Diabetes Treatment, Cure

    Scientists at two of the top U.S. universities say they have made significant advances in their quest to find a more efficient treatment for diabetes and eventually a cure. According to the International Diabetes Federation, the disease affects more than 370 million people worldwide. VOA’s George Putic reports.
    Video

    Video NATO to Target Migrant Smugglers

    NATO has announced plans to send warships to the Aegean Sea to target migrant smugglers in the alliance's most direct intervention so far since a wave of people began trying to reach European shores.
    Video

    Video Russia's Catholics, Orthodox Hopeful on Historic Pope-Patriarch Meeting

    Russia's Catholic minority has welcomed an historic first meeting Friday in Cuba between the Pope and the Patriarch of Russia's dominant Orthodox Church. The Orthodox Church split with Rome in 1054 and analysts say politics, both church and state, have been driving the relationship in the centuries since. VOA's Daniel Schearf reports from Moscow.
    Video

    Video Used Books Get a New Life on the Streets of Lagos

    Used booksellers are importing books from abroad and selling them on the streets of Africa's largest city. What‘s popular with readers may surprise you. Chris Stein reports from Lagos.
    Video

    Video After NH Primaries All Eyes on South Carolina

    After Tuesday's primary in New Hampshire, US presidential candidates swiftly turned to the next election coming up in South Carolina. The so-called “first-in-the-South” poll may help further narrow down the field of candidates. Zlatica Hoke reports.
    Video

    Video Smartphone Helps Grow Vegetables

    One day, you may be using your smartphone to grow your vegetables. A Taipei-based company has developed a farm cube — a small, enclosed ecosystem designed to grow plants indoors. The environment inside is automatically adjusted by the cube, but it can also be controlled through an app. VOA's Deborah Block has more on the gardening system.
    Video

    Video Exhibit Turns da Vinci’s Drawings Into Real Objects

    In addition to being a successful artist, Renaissance genius Leonardo da Vinci designed many practical machines, some of which are still in use today, although in different forms. But a number of his projects were never realized — until today. VOA’s George Putic reports.