WarSclerotic

DEBKAfile, Political Analysis, Espionage, Terrorism, Security.

DEBKAfile Exclusive Report January 17, 2011, 10:43 AM (GMT+02:00)

Majid the terminator and champion kick boxer

The young Iranian man who “admitted” on Iranian TV last Tuesday, Jan. 11 that he had acted for the Israeli Mossad in the murder of Iranian nuclear scientist Massoud Ali-Mohammadi is revealed in real life by debkafile‘s Iranian sources as a member of the Iranian Revolutionary Guards’ secret reserve death squad of brawny sportsmen used to cut down opponents of the regime and break up protest rallies.

debkafile‘s Iranian sources had uncovered the real Majid Jamali Fashi – a champion kick boxer, a professional terminator and an ardent fan of President Mahmoud Ahmadinejad. As a sportsman, his face is familiar to people in Iran from the media and the Internet. Until late 2009, he represented his country in international kick-boxing contests.

Iranian intelligence minister Heidar Moslehi must have realized that putting him on national TV as a Mossad spy to support his boast that Iranian agents had penetrated the Mossad networks he claimed were spread across the country would open more than one can of worms.

If Majid had really been recruited by Mossad, this would have been a feather in the cap of the Israeli spy service – not Tehran. It would have told the television audience that Mossad’s tentacles had not only reached into Iran’s nuclear program but also the elite clandestine ranks of the Revolutionary Guards, the IRGC. So why make it the subject of a boast?
Majid Jamali Fash’s real persona is disclosed here by our Iranian sources: He was born in Tehran in 1978 and after completing his military service with the IRGC, took up kick boxing while continuing to serve the Guards as a reservist. He and hundreds of his fellow champion sportsmen belong to a unit which is regularly called up for undercover work such as liquidating enemies of the regime and breaking the heads, arms and legs of regime opponents.

In the summer of 2009, the young sportsman was employed in the brutal break-up of the mass street rallies protesting the rigged election which gave Ahmadinejad his second term.

Tehran’s practice of employing national sporting talent as IRGC hatchet men in “crowd control” has drawn angry protests from the international federations of Taekwondo, Judo, Karate, Kung fu and other martial arts.

Because of his fame, Iranian audiences found it hard to revise their view of Jamali-Fashi as a Mossad agent.

Many decided his performance was faked by Iranian intelligence. However, opposition circles did believe in his role as assassin of Prof. Mohammadi, though not in the service of Israel but his IRGC masters because the late professor supported the opposition’s cause.

In the second half of 2009, the leading Iranian nuclear scientist attended meetings of opposition leaders and signed petitions against the regime.

His destruction was ruled because Prof, Mohammadi was seen as betraying the elite class of academics and intelligentzia, the nuclear science corps, on whose loyalty the regime counts heavily. They could not afford to let him be identified as crossing over to the opposition.

The secret Guards unit specializing in these missions was therefore assigned with his liquidation. The young kick boxer Majid was enlisted.
So why did the intelligence minister lift the veil from this episode?

As usual the Islamic Republic of Iran’s rulers’ motives are mixed and enigmatic.

The word in Tehran is that the intelligence ministry will have to go through with the performance to its logical conclusion and announce the execution of Majid the Mossad spy. He will then be given a new identity and his face remodeled by plastic surgery before dropping out of sight.

The other theory is more elaborate: Majid fell prey to the real power struggle waged between the intelligence ministry and the IRGC commanders for some months. The latter decided to use the kick boxer as a scapegoat for Prof. Mohammadi’s assassination by claiming he committed the murder at the behest of a rogue Guards unit without receiving a formal order.
Majid’s future is therefore uncertain.

After admitting that the scientist’s death caused extreme damage to Iran’s nuclear program, Moslehi must find someone to punish. Iran’s supreme leader Ayatollah Ali Khamenei will no doubt be called upon to settle the dispute within the country’s intelligence community – along with the fate of Majid. The champion terminator’s.  TV performance as a Mossad agent may have been his last.

The New York Times Fails To Deliver Stuxnet’s Creators – Jeffrey Carr – Digital Dao – Forbes.

Jeffrey Carr

Yesterday the New York Times published a major story by William J. Broad, John Markoff and David E. Sanger which named the U.S. and Israel as co-developers of the Stuxnet worm. Unfortunately for their millions of readers, they provided almost no verifiable evidence to back up their claims, and even worse, excluded evidence that didn’t support their theory.

The Dimona Complex

The article’s entire hook is built upon claims made for the Dimona Complex by un-named sources:

Over the past two years, according to intelligence and military experts familiar with its operations, Dimona has taken on a new, equally secret role — as a critical testing ground in a joint American and Israeli effort to undermine Iran’s efforts to make a bomb of its own.”

And the proof? The journalists give none, because no one wants to go on the record. Fair enough, but with such a sensational claim I’d expect, at the very least, to read some additional supporting evidence. And here it is – “Israeli officials grin widely when asked about its effects.” That’s it. That’s all they’ve got. Some officials grinned.

So how likely is it that an Israeli official who has direct knowledge of Stuxnet testing at Dimona is going to speak to a reporter about it? Based upon the experience of Mordechai Vanunu, who’s considered a traitor to Israel and has spent most of his life in prison after he revealed his knowledge of the top secret facility to the British press in 1986, I’m guessing the answer has something to do with snowballs and hell. To put it mildly, the Mossad was very unhappy with Mr. Vanunu. And everyone in Israel knows it.

As far as Mossad chief Meir Dagan telling the Israeli Knesset on the day before his retirement that Iran’s capabilities to develop a nuclear warhead have been pushed back until 2015, I have no idea where that figure came from or what Mr. Dagan’s motivations would be for saying that but the Israeli Prime Minister, the founder of Israel’s Computer Emergency Response Team (CERT) and at least two respected Israeli experts disagree with Mr. Dagan. One of them spent 40 years working in precisely this area.

Efrayim Asculai, a 40 year veteran of Israel’s Atomic Energy Commission and an expert on Iran’s nuclear weapons development wrote a recent article (01 Dec 2010) warning about nuclear proliferation in 2011 in general and Iran’s still robust capabilities in particular:

Take the case of Iran. Even prior to the November 23 distribution by the IAEA to its member states of its periodic report on Iran, much was heard heralding the fact that the Iranians were grappling with complications in operating their gas centrifuge uranium enrichment plant at Natanz. Some blamed the delays on the potent Stuxnet computer virus that was apparently very effective in disrupting electrical inverters, a vital component in the centrifuge operations. Others, however, attributed the difficulty to the inherent challenges in operating the almost obsolete P-1 model machines. This opinion was bolstered by a statement in the report (in a footnote) that feeding the centrifuge cascades with its input uranium hexafluoride was stopped on November 16. Yet the next statement in the footnote was far less reassuring when it noted that the feed was resumed six days later.

On the same day the report was published, the Institute for Science and Security (ISIS) published an analysis of the IAEA report, showing that in the reporting period Iran increased its operational efficiency in almost every parameter. The number of centrifuges enriching uranium is almost at its peak; the flow of the feed material into the enrichment cascades is at its peak, and so is the rate of production of the 3.5% enriched uranium. The rate of the enrichment process from 3.5% to 20% is quite steady, in spite of the old centrifuge model. Although this is a small scale operation, the Iranians could turn it into a large scale one in a very short time. Since this is a stone’s throw away from weapons-grade uranium, this situation cannot be a source of optimism.”

Shai Blitzblau, head of the computer warfare laboratory at Israel-based Maglan Information Defense Technologies, Ltd was quoted in John Markoff’s first article about Stuxnet in the New York Times last September:

Israel had nothing to do with Stuxnet. We did a complete simulation of it and we sliced the code to its deepest level. We have studied its protocols and functionality. Our two main suspects for this are high-level industrial espionage against Siemens and a kind of academic experiment.”

In a different interview for Defense-Update, Blitzblau said

Stuxnet is definitely not a military code, at least not a Western one” said Shai Blitzblau, Head of Maglan-Computer Warfare and Network Intelligence Labs, interviewed by Defense Update. “Stuxnet is a sophisticated and highly advanced code, but it lacks certain elements commonly associated with military operations” Blitzblau explains that the broad, indiscriminate attack on industrial computers launched by Stuxnet is not characteristic to a military operation, where the nation launching the attack tries to minimize collateral damage and focus on a specific target.”

Gadi Evron, an Israeli security expert and founder of Israel’s CERT, wrote “Stuxnet: An Amateur’s Weapon” for Dark Reading on why Stuxnet was most likely not an Israeli operation, referring to it as “sloppy” and “amateurish”:

For such an operation, Stuxnet must not fail. There has to be clear intelligence about how the systems it attacks are built. Also, given the nature of these systems (industrial software that controls power plants, like SCADA systems), it would have to be developed in a replication of the target environment — an immense cost to reconstruct and an effort in intelligence collection. Such a tool would be used carefully to avoid the risk of discovery — not just the specific operation, but of methods used, the technology developed, and past targets.

How then could a target-specific weapon such as Stuxnet be found in tens of thousands of computers worldwide, as vendors such as Microsoft report? It makes no operational sense to attack random computers, which would increase the likeliness of discovery and compromise the operation.

A Questionable Timeline

Furthermore, Sanger, Markoff and Broad have mis-stated the facts of the Stuxnet timeline. After writing about a leaked State Dept cable that discusses how the United Arab Emirates (UAE) stopped a shipment of Siemens Step 7 controllers from entering Iran in April, 2009, the reporters then wrote “Only months later, in June, Stuxnet began to pop up around the globe”. Except that that didn’t happen in June, 2009. It happened about 15 months later in July, 2010, several weeks after VirusBlokAda broke the news about the Windows shortcut exploit (.LNK). Here’s Symantec’s timeline as documented in their final report:

June, 2009: Earliest Stuxnet sample seen. Does not exploit MS10-046. Does not have signed driver files.

January 25, 2010: Stuxnet driver signed with a valid certificate belonging to Realtek Semiconductor Corps.

March, 2010: First Stuxnet variant to exploit MS10-046.

June 17, 2010: Virusblokada reports W32.Stuxnet (named RootkitTmphider). Reports that it’s using a vulnerability in the processing of shortcuts/.lnk files in order to propagate (later identified as MS10-046).

In other words, the Stuxnet worm that amazed so many security researchers with its 4 zero day exploits and two genuine digital certificates didn’t exist in June 2009. Only the most rudimentary version of it did, which begs the question – why was it so effective in its stripped-down form in 2009 and why would the developers keep pushing more sophisticated versions out in 2010?

The other problem not addressed in the NYT piece is what happened to the P1 centrifuges in 2008 and early 2009, before Stuxnet had been released? According to the IAEA as reported by ISIS (.pdf), an unknown event occurred in 2008 which impacted centrifuge performance and from which Natanz had not recovered as late as February 2010.

On December 22, 2010, ISIS released another report “Did Stuxnet Take Out 1,000 Centrifuges at the Natanz Enrichment Plant? (.pdf)”. Rather than addressing the earlier performance problems from 2008, the ISIS authors looked at centrifuge replacement numbers at Natanz:

In late 2009 or early 2010, Iran decommissioned and replaced about 1,000 IR-1 centrifuges in the Fuel Enrichment Plant (FEP) at Natanz, implying that these centrifuges broke. Iran’s IR-1 centrifuges often break, yet this level of breakage exceeded expectations and occurred during an extended period of relatively poor centrifuge performance.

Although mechanical failures or operational problems have often been discussed as causing problems in the IR-1 centrifuges, the crashing of such a large number of centrifuges over a relatively short period of time could have resulted from an infection of the Stuxnet malware.

David Albright and his co-researchers at ISIS concluded that the Stuxnet worm most likely was designed to destroy a limited number of centrifuges and temporarily set back Iran’s fuel enrichment program.  Does that sound like a strategy that Israel would agree to? Not to Benjamin Netanyahu, Israel’s PM. After expressly stating his disagreement with Dagan’s 2015 date, he said that “sanctions should be strictly enforced and materially strengthened…, and that if they don’t achieve their goal, they would be followed by a credible military option.”

CONCLUSION

Broad, Markoff, and Sangar failed to provide any verifiable evidence to support their claims that Israel tested the U.S. developed Stuxnet worm at Dimona.

Broad, et al failed to establish an accurate timeline of events which, had they done so, would have raised several un-answered questions about when the Natanz centrifuges were crashing versus when Stuxnet was fully developed.

Broad, et al provided no expert analysis on the state of Iran’s fuel enrichment program, opting for a disputed comment by Mr. Dagan and Hilary Clinton, who tried to credit U.N. sanctions for Iran’s Fuel Enrichment Program (FEP) delays.

When I wrote “Stuxnet’s Finnish-Chinese Connection“, I supported my theory that the People’s Republic of China developed the Stuxnet worm with five pieces of verifiable evidence that were unique to China. Not a single one of those 5 was because a senior official in the Chinese government “smiled”.

Israel has already struck Iran – Haaretz Daily Newspaper | Israel News.

It is gradually becoming clear that Israeli intelligence, in cooperation with its American counterparts, has made a military strike on Iran’s nuclear facilities redundant.

By Yossi Melman

Stuxnet damage in Iran: Iran’s nuclear program and a new era of cyber war – latimes.com.

Stuxnet, the game-changing computer worm that is believed to have significantly set back Tehran’s progress in nuclear enrichment, may herald a new era of shadowy digital combat

Just a few months ago, U.S. and Israeli officials were warning that Iran was a year away from having the capability to rapidly build a nuclear weapon. Speculation was intensifying that Israel would launch airstrikes to prevent that from happening.

But as the new year dawned, Western officials, with little fanfare, significantly revamped their estimates of Iran’s nuclear progress.
Israel’s strategic affairs minister, Moshe Yaalon, said Dec. 29 that the Islamic Republic was at least three years away from a bomb. This month, the retiring head of Israel’s intelligence service, Meir Dagan, went further, saying Iran wouldn’t be able to develop a nuclear warhead before 2015 at the earliest.

A few days later, Secretary of State Hillary Rodham Clinton also downplayed Tehran’s progress, saying, “Their program, from our best estimate, has been slowed down” because of “technological problems.”

People who study computer warfare for a living have no doubt about what’s behind these reappraisals: Stuxnet, a game-changing computer worm that may herald a new era of shadowy digital combat.

Identified in June, Stuxnet is being called the most sophisticated cyber weapon ever unleashed, because of the insidious way in which it is believed to have secretly targeted specific equipment used in Iran’s nuclear program.

Computer experts have examined the worm for months, and many believe Stuxnet was created by Israel or the United States as part of a covert effort to hamper Iran’s alleged drive for an atomic weapon. But the extent to which the operation succeeded had remained unclear.

In recent weeks, however, a rough consensus has emerged that Stuxnet has had a measurable effect. In addition to the remarks from U.S. and Israeli officials, the Institute for Science and International Security, an independent think tank, judged in late December that Stuxnet appears to have “set back Iran’s progress.”

Stuxnet “will undoubtedly reshape international security and foreign policy forever,” said John Bumgarner, chief technology officer of the U.S. Cyber Consequences Unit, a nonprofit research organization that studies cyber conflict. “It’s a tipping point that will usher in a cyber-defense revolution in military affairs.”

By wreaking havoc on gas centrifuges — spinning machines that separate isotopes to produce enriched uranium, which at higher levels can be used for nuclear bombs — the Stuxnet worm seems to have inflicted significant damage on Iran’s nuclear program, cyber experts say, with none of the dangerous repercussions of a U.S. or Israeli airstrike, at least so far.

“This is a really good example of what cyber war looks like,” said former White House terrorism advisor Richard Clarke, author of “Cyber War: The Next Threat to National Security and What to Do About It.” “It’s a precision-guided munition.”

The worm’s slow-motion trajectory, its ability to secretly seize control of machinery and the fact that its authors remain unknown offer lessons for the future of high-tech warfare.

Stuxnet is not the first apparent state-sponsored cyber attack: Other examples include a massive disruption of websites in Estonia in 2007 after a dispute with Russia, and the use of digital trickery to fool Syria’s air defenses when Israel bombed an alleged nuclear facility there in 2007.

But in those cases, it became fairly clear who was responsible. Stuxnet is the most significant development yet in the realm of cyber conflict, Bumgarner said, because of the lack of attribution. Although Iran would have been expected to respond ferociously to an Israeli or U.S. airstrike, no response has been forthcoming to Stuxnet, perhaps because Tehran can’t be sure of the culprit.

“Stuxnet takes it to a different level because … Iran doesn’t know who to retaliate against,” he said.

Stuxnet also proves it is possible to use malware to seize control of equipment that runs all sorts of features of a modern economy, from power grids to chemical plants. The U.S. and its allies have that capability, but so do Russia and China, experts say.

And Stuxnet may remain a persistent thorn in Iran’s side, said German expert Ralph Langner, who first disclosed that Stuxnet had targeted Siemens equipment used in Iran’s nuclear program.

In an e-mail, Langner said the Iranians would have to replace all the computer systems in their nuclear program to be sure they were rid of the worm, a tall order for a country under trade sanctions.

Unique virus

The full extent of the damage to Iran’s nuclear equipment wrought by Stuxnet is a matter of speculation. Other than limited international inspections, the outside world has almost no access to information about Iran’s nuclear program. Iran, which says its nuclear program is intended for peaceful purposes, has refused to comply with a U.N. Security Council order that it stop its uranium enrichment program.

Iranian officials acknowledge that the complex malware snaked its way into industrial software used to operate centrifuges in the Natanz nuclear facility and went undetected for a year. As of Sept. 29, after which Iran took action that made further assessment impossible, Stuxnet had infected 100,000 hosts worldwide, 60,000 of which were in Iran, according to a detailed report on the worm by Symantec, a computer security company.

According to the Institute for Science and International Security, 1,000 of about 8,000 centrifuges at Natanz had to be replaced in late 2009 and early 2010. In mid-November, Iran temporarily halted enrichment at Natanz because of technical problems with its centrifuges, according to the International Atomic Energy Agency, the U.N.’s nuclear watchdog.

Experts aren’t sure why the malware seems to have caused damage to some, but not all, of the centrifuges at Natanz, allowing Iran to continue to enrich uranium, albeit at a slower pace. Some experts have speculated that the worm’s creators intentionally limited its effect to avoid detection. Other theorize that it was designed to send a message as much as to destroy centrifuges.

Iranian leaders downplay the worm’s damage. President Mahmoud Ahmadinejad said Nov. 29 that outside powers had “succeeded in creating problems for a limited number of our centrifuges with the software they had installed in electronic parts.”

Israeli and U.S. media reports since 2009 have quoted intelligence officials alluding to covert sabotage programs by both countries against Iran’s nuclear program. But neither country acknowledges creating Stuxnet, and not every expert believes either of them did.

One prominent cyber war authority, Jeffrey Carr, has written a white paper suggesting China may have been behind it. Nor can Russia be ruled out, said Joel Brenner, a former senior counsel at the National Security Agency, which is deeply involved in offensive and defensive U.S. cyber operations.

One thing is clear, experts say: The worm is far too sophisticated to have been cooked up by basement hackers.

Stuxnet made use of four “zero day” vulnerabilities, openings in Microsoft Windows operating systems that were not previously known. Criminal hackers, the usual suspects when it comes to malware, could have used such vulnerabilities to generate millions of dollars in illicit revenue by stealing banking and credit card information, which is one reason experts believe Stuxnet was the work of an intelligence service. Instead of making money, as some malware does, it cost money.

“This was written for one purpose,” Bumgarner said. “Sabotage of national critical infrastructure.”

Now that Stuxnet is in the public domain, experts are deeply concerned that hackers, criminals or terrorist groups could use some of the vulnerabilities it reveals to attack systems that control power grids, chemical plants and air traffic control.

“The attackers created a weapon that they used in a very specific way, but you can copy the attack technology and use it in a very generic way,” said Sebastian Linko, spokesman for Finland’s Vacon, whose power control units, which are used in Iran’s nuclear program, are sought out by the worm. “This is the most scary part about Stuxnet.”

ken.dilanian@latimes.com

Stuxnet virus attack: Russia warns of ‘Iranian Chernobyl’ – Telegraph.

Russian nuclear officials have warned of another Chernobyl-style nuclear disaster at Iran’s controversial Bushehr reactor because of the damage caused by the Stuxnet virus, according to the latest Western intelligence reports.

Russian nuclear scientists have raised serious concerns about the extensive damage caused to Bushehr’s computer systems by the mysterious Stuxnet virus Photo: REX

By Con Coughlin 5:23PM GMT 16 Jan 2011