log in

Natanz ‘sabotage’ highlights Iran’s vulnerability to cyber-attacks

The Guardian - Mon Apr 12 14:59

The apparent attack by Israel on Iran’s nuclear enrichment facility appears to be the latest episode in an increasing tit-for-tat cyberwar. Both sides have already targeted so-called industrial control systems [ICS], which have emerged as a key weakness for countries across the globe.

While Iran described the latest attack as “sabotage”, Israeli media called it a cyber-attack.

The vulnerability of ICS systems, and similar so-called “operating technology” used in industrial processes and large infrastructure plants – from electrical grids, to steel, chemical and water treatment plants – was demonstrated more than a decade ago by revelation of the US-Israeli Stuxnet malware attack on the Natanz plant.

Since the emergence of the Stuxnet virus, attempts to hack and exploit ICS systems have emerged as one of the most dangerous and contested frontlines in cyberwarfare around the world, with officials in the Biden administration last week revealing a planned executive order to beef up US defences.

The appeal of cyber-attacks via operational technology is that – unlike more conventional hacking to steal data – they are aimed at a physical impact, whether a power blackout, water contamination or causing systems to overrun and become damaged, even explode.

Iran, whose nuclear efforts have historically relied on Siemens industrial control technology, one of the gateways attacked by Stuxnet, is particularly vulnerable to these kinds of attack because of embargos on the transfer of technology that could be used in the programme to protect control systems.

In 2010, Stuxnet was among the most sophisticated malware ever detected, reportedly damaging as many as one-fifth of the nuclear centrifuges in Iran.

That attack, however, led Iran to develop its own ability for cyber-attacks on critical infrastructure led by a group of hackers known as APT33, which has recently shifted its interest from IT networks to ICS.

Last year, Israeli media blamed Iranian hackers for two attacks on water treatment plants in the country.

While attacks like the latest at Natanz have inevitably grabbed the headlines, they are only the most obvious evidence of a continuing cyber conflict.

Last autumn, an Iranian news agency reported cyber-attacks had hit the electronic infrastructure of the country’s ports. An official said: “Sworn enemies have been trying for some time to carry out cyber-attacks.”

While a report by researchers at Tenable two years ago suggested that countries had become better at protecting infrastructure against the threat of attacks similar to Stuxnet, they still found numerous vulnerabilities in ICS systems.