Iran identifies ‘hidden agenda’ behind oil terminal cyberattack

The apparent cyberattack that disrupted IT systems at Iran’s main oil terminal was serious enough to have wiped data from hard drives, news agencies in the country have claimed.

Since news of the attack that caused the disconnection from the Internet of the country’s major Kharg Island oil terminal first emerged on 23 April, the exact scale and significance of events the previous weekend has been hard to judge.

Variously described in translated reports as being a “virus” but also a “worm”, officials have now hinted at something more significant in reports posted on Iranian news sites.

“The nature of the attack and the identity of the attackers have been discovered, but we cannot publicize it since we are still working on the case,” Deputy Oil Minister Hamdollah Mohammadnejad told the pro-Government Fars News Agency.

“In general attack was carried out by virus penetration and was aimed at stealing and destroying data and information,” he said. “Those who design and develop such viruses are pursuing specific goals,” possibly a veiled reference to a string of possibly targeted attacks that have hit the country since news of the major Stuxnet malware first emerged in 2010.

Significantly, perhaps, a second official also commented on the attacks.

“Thanks God, at the time being the computer systems are running with a high level of safety and users are working normally,” Alireza Nikzad-Rahbar of the Iranian Iranian Oil Ministry was quoted as saying. “Whether essential or non-essential, the Oil Ministry’s data have a back up.”

The attack had affected several oil facilities and had damaged hard drive data, he said.

Iran has a history of talking up attacks that turn out to appear relatively minor but also of taking time to comment on more serious attacks, including Duqu, a piece of malware loosely linked to Stuxnet. Although far from explicit, the latest comments suggest that the oil terminal attack was, after all, malware based rather than a low-level assault on web servers as some have suspected.

Iran itself has also been blamed for attacks stretching back to the theft of SSL certificates from authority DigiNotar in 2011 as well as the more recent organised attack on the BBC, which drew veiled but pointed comments frmo director general, Mark Thompson.