Dubai : Hackers have attacked networks in a number of countries including data centres in Iran where they left the image of a US flag on screens along with a warning: "Don't mess with our elections".

"The attack apparently affected 200,000 router switches across the world in a widespread attack, including 3500 switches in our country," Iran's Communication and Information Technology Ministry said in a statement on Saturday.

The statement said the attack, which hit internet service providers and cut off web access for subscribers, was made possible by a vulnerability in routers from Cisco which had earlier issued a warning and provided a patch that some firms had failed to install over the Iranian new year holiday.

A blog published on Thursday by Nick Biasini, a threat researcher at Cisco's Talos Security Intelligence and Research Group, said: "Several incidents in multiple countries, including some specifically targeting critical infrastructure, have involved the misuse of the Smart Install protocol ...

"As a result, we are taking an active stance, and are urging customers, again, of the elevated risk and available remediation paths." </s> DUBAI (Reuters) - Hackers have attacked networks in a number of countries including data centers in Iran where they left the image of a U.S. flag on screens along with a warning: “Don’t mess with our elections”, the Iranian IT ministry said on Saturday.

FILE PHOTO: A man types on a computer keyboard in front of the displayed cyber code in this illustration picture taken on March 1, 2017. REUTERS/Kacper Pempel/Illustration/File Photo

“The attack apparently affected 200,000 router switches across the world in a widespread attack, including 3,500 switches in our country,” the Communication and Information Technology Ministry said in a statement carried by Iran’s official news agency IRNA.

The statement said the attack, which hit internet service providers and cut off web access for subscribers, was made possible by a vulnerability in routers from Cisco which had earlier issued a warning and provided a patch that some firms had failed to install over the Iranian new year holiday.

A blog published on Thursday by Nick Biasini, a threat researcher at Cisco’s Talos Security Intelligence and Research Group, said: “Several incidents in multiple countries, including some specifically targeting critical infrastructure, have involved the misuse of the Smart Install protocol...

“As a result, we are taking an active stance, and are urging customers, again, of the elevated risk and available remediation paths.”

On Saturday evening, Cisco said those postings were a tool to help clients identify weaknesses and repel a cyber attack.

Iran’s IT Minister Mohammad Javad Azari-Jahromi posted a picture of a computer screen on Twitter with the image of the U.S. flag and the hackers’ message. He said it was not yet clear who had carried out the attack.

Azari-Jahromi said the attack mainly affected Europe, India and the United States, state television reported.

“Some 55,000 devices were affected in the United States and 14,000 in China, and Iran’s share of affected devices was 2 percent,” Azari-Jahromi was quoted as saying.

In a tweet, Azari-Jahromi said the state computer emergency response body MAHER had shown “weaknesses in providing information to (affected) companies” after the attack which was detected late on Friday in Iran.

Hadi Sajadi, deputy head of the state-run Information Technology Organisation of Iran, said the attack was neutralized within hours and no data was lost. </s> The attack apparently affected 200,000 router switches across the world in a widespread attack.

Hackers have attacked networks in a number of countries including data centres in Iran where they left the image of a US flag on screens along with a warning: ‘Don't mess with our elections’, the Iranian IT ministry said. (Photo: Twitter/ @azarijahromi)

Dubai: Hackers have attacked networks in a number of countries including data centres in Iran where they left the image of a US flag on screens along with a warning: "Don't mess with our elections", the Iranian IT ministry said on Saturday.

"The attack apparently affected 200,000 router switches across the world in a widespread attack, including 3,500 switches in our country," the Communication and Information Technology Ministry said in a statement carried by Iran's official news agency IRNA.

The statement said the attack, which hit internet service providers and cut off web access for subscribers, was made possible by a vulnerability in routers from Cisco which had earlier issued a warning and provided a patch that some firms had failed to install over the Iranian new year holiday.

A blog published on Thursday by Nick Biasini, a threat researcher at Cisco's Talos Security Intelligence and Research Group, said: "Several incidents in multiple countries, including some specifically targeting critical infrastructure, have involved the misuse of the Smart Install protocol...As a result, we are taking an active stance, and are urging customers, again, of the elevated risk and available remediation paths."

On Saturday evening, Cisco said those postings were a tool to help clients identify weaknesses and repel a cyber attack.

Iran's IT Minister Mohammad Javad Azari-Jahromi posted a picture of a computer screen on Twitter with the image of the US flag and the hackers' message. He said it was not yet clear who had carried out the attack.

Azari-Jahromi said the attack mainly affected Europe, India and the United States, state television reported.

"Some 55,000 devices were affected in the United States and 14,000 in China, and Iran's share of affected devices was 2 percent," Azari-Jahromi was quoted as saying.

In a tweet, Azari-Jahromi said the state computer emergency response body MAHER had shown "weaknesses in providing information to (affected) companies" after the attack which was detected late on Friday in Iran.

Hadi Sajadi, deputy head of the state-run Information Technology Organisation of Iran, said the attack was neutralised within hours and no data was lost. </s> DUBAI (Reuters) - Iran’s telecommunications minister accused Israel on Monday of a new cyber attack on its telecommunications infrastructure, and vowed to respond with legal action.

FILE PHOTO: Iran's Supreme Leader Ayatollah Ali Khamenei, is seen during a meeting with students at the Hussayniyeh of Imam Khomeini in Tehran, Iran, November 3, 2018. Official Khamenei website/Handout via REUTERS

This followed comments from another official last week that Iran had uncovered a new generation of Stuxnet, a virus which was used against the country’s nuclear program more than a decade ago.

“The Zionist regime (Israel), with its record of using cyber weapons such as Stuxnet computer virus, launched a cyber attack on Iran on Monday to harm Iran’s communication infrastructures,” Telecommunications Minister Mohammad Javad Azari-Jahromi said.

“Thanks to our vigilant technical teams, it failed,” he said on Twitter. Iran would take legal action against Israel at international bodies, he added, without giving details.

His deputy Hamid Fattahi said more details would be revealed in the coming days, the semi-official Tasnim news agency reported.

Stuxnet, which is widely believed to have been developed by the United States and Israel, was discovered in 2010 after it was used to attack a uranium enrichment facility at Iran’s Natanz underground nuclear site.

It was the first publicly known example of a virus being used to attack industrial machinery.

Last week, Gholamreza Jalali, head of Iran’s civil defense agency, said Iran had neutralized a version of Stuxnet.

“Recently we discovered a new generation of Stuxnet which consisted of several parts ... and was trying to enter our systems,” Jalali was quoted as saying by the semi-official ISNA news agency. He gave no further details.

In 2013, researchers at Symantec Corp uncovered a version of the Stuxnet that was used to attack the Iranian nuclear program in November 2007.

Tehran agreed under a 2015 deal with world powers to curb the program but President Donald Trump pulled the United States out of it in May, with Israel’s backing. Washington fully restored sanctions on Tehran on Monday.

Supreme Leader Ayatollah Ali Khamenei last week called for stepped up efforts to fight enemy “infiltration” in a speech to officials in charge of cyber defense, state television reported. </s> Iran’s telecommunications minister accused Israel on Monday of a new cyberattack on its telecom infrastructure, and vowed to respond with legal action.

This followed comments from another official last week that Iran had uncovered a new generation of Stuxnet, a virus which was used against the country’s nuclear program more than a decade ago.

“The Zionist regime (Israel), with its record of using cyberweapons such as Stuxnet computer virus, launched a cyberattack on Iran on Monday to harm Iran’s communication infrastructures,” Telecommunications Minister Mohammad Javad Azari-Jahromi said.

“Thanks to our vigilant technical teams, it failed,” he said on Twitter. Iran would take legal action against Israel at international bodies, he added, without giving details.

His deputy Hamid Fattahi said more details would be revealed in the coming days, the semi-official Tasnim news agency reported.

Stuxnet, which is widely believed to have been developed by the United States and Israel, was discovered in 2010 after it was used to attack a uranium enrichment facility at Iran’s Natanz underground nuclear site.

It was the first publicly known example of a virus being used to attack industrial machinery.

Last week, Gholamreza Jalali, head of Iran’s civil defense agency, said Iran had neutralized a version of Stuxnet.

“Recently we discovered a new generation of Stuxnet which consisted of several parts … and was trying to enter our systems,” Jalali was quoted as saying by the semi-official ISNA news agency. He gave no further details.

In 2013, researchers at Symantec Corp uncovered a version of the Stuxnet that was used to attack the Iranian nuclear program in November 2007.

Supreme Leader Ayatollah Ali Khamenei last week called for stepped-up efforts to fight enemy “infiltration” in a speech to officials in charge of cyber defense, state broadcasting reported. </s> DUBAI: Iran's telecommunications minister accused Israel on Monday (Nov 5) of a new cyber attack on its telecommunications infrastructure, and vowed to respond with legal action.

This followed comments from another official last week that Iran had uncovered a new generation of Stuxnet, a virus which was used against the country's nuclear programme more than a decade ago.

Advertisement

Advertisement

"The Zionist regime (Israel), with its record of using cyber weapons such as Stuxnet computer virus, launched a cyber attack on Iran on Monday to harm Iran's communication infrastructures," Telecommunications Minister Mohammad Javad Azari-Jahromi said.

"Thanks to our vigilant technical teams, it failed," he said on Twitter. Iran would take legal action against Israel at international bodies, he added, without giving details.

His deputy Hamid Fattahi said more details would be revealed in the coming days, the semi-official Tasnim news agency reported.

Stuxnet, which is widely believed to have been developed by the United States and Israel, was discovered in 2010 after it was used to attack a uranium enrichment facility at Iran's Natanz underground nuclear site.

Advertisement

Advertisement

It was the first publicly known example of a virus being used to attack industrial machinery.

Last week, Gholamreza Jalali, head of Iran's civil defence agency, said Iran had neutralised a version of Stuxnet.

"Recently we discovered a new generation of Stuxnet which consisted of several parts ... and was trying to enter our systems," Jalali was quoted as saying by the semi-official ISNA news agency. He gave no further details.

In 2013, researchers at Symantec Corp uncovered a version of the Stuxnet that was used to attack the Iranian nuclear programme in November 2007.

Tehran agreed under a 2015 deal with world powers to curb the programme but President Donald Trump pulled the United States out of it in May, with Israel's backing. Washington fully restored sanctions on Tehran on Monday.

Supreme Leader Ayatollah Ali Khamenei last week called for stepped up efforts to fight enemy "infiltration" in a speech to officials in charge of cyber defence, state television reported. </s> TEHRAN - Iran has successfully thwarted cyber attacks by Israel targeting the country’s communications infrastructure, said a report by the Press TV, quoting an Iranian official, on Monday.

The attack was an attempt by Israel to launch sporadic cyber assaults against the Islamic republic’s communications infrastructure, said Hamid Fatahi, CEO of Iran’s Telecommunications Company.

“The (Israeli) regime, with a notorious background in using cyber weapons in the cases such as Stuxnet, was this time attempting to harm Iran’s communications infrastructure,” Iranian Minister of Information and Communications Technology Mohammad-Javad Azari Jahromi said later on Monday.

However, “they had to go away empty-handed thanks to the vigilance of our technical teams,” Azari Jahromi said.

“We will pursue this hostile move through international tribunals,” he added. </s> WASHINGTON (Reuters) - The United States on Friday charged and sanctioned nine Iranians and an Iranian company for attempting to hack into hundreds of universities worldwide, dozens of firms and parts of the U.S. government, including its main energy regulator, on behalf of Tehran’s government.

The cyber attacks, beginning in at least 2013, pilfered more than 31 terabytes of academic data and intellectual property from 144 U.S. universities and 176 universities in 21 other countries, the U.S. Department of Justice said, describing the campaign as one of the largest state-sponsored hacks ever prosecuted.

The U.S. Treasury Department said it was placing sanctions on the nine people and the Mabna Institute, a company U.S. prosecutors characterized as designed to help Iranian research organizations steal information.

U.S. Deputy Attorney General Rod Rosenstein said the nine Iranians were considered fugitives who may face extradition in more than 100 countries if they travel outside Iran.

Authorities “will aggressively investigate and prosecute hostile actors who attempt to profit from America’s ideas by infiltrating our computer systems and stealing intellectual property,” Rosenstein told a news conference.

The case “will disrupt the defendants’ hacking operations and deter similar crimes,” he added.

The hackers were not accused of being directly employed by Iran’s government. They were instead charged with criminal conduct waged primarily through the Mabna Institute on behalf of the Islamic Revolutionary Guard Corps, the elite military force assigned to defend Iran’s Shi’ite theocracy from internal and external threats.

In Tehran, Iran’s foreign ministry spokesman Bahram Qasemi denounced the move as “provocative, illegitimate, and without any justifiable reason and another sign of the hostility of the (U.S.) ruling circles toward the Iranian nation”, state news agency IRNA said.

The targeting of the Federal Energy Regulatory Commission, or FERC, was a matter of special concern, U.S. Attorney Geoffrey Berman said, because it oversees the interstate regulation of energy and holds details of some of the country’s “most sensitive infrastructure.”

Hackers targeted email accounts of more than 100,000 professors worldwide, half in the United States, and compromised about 8,000, prosecutors said. Hackers also targeted the U.S. Labor Department, the United Nations and the computer systems of the U.S. states Hawaii and Indiana, prosecutors said.

Friday’s actions are part of an effort by senior cyber security officials at the White House and across the U.S. government to blame foreign countries for malicious hacks.

They were announced a day after U.S. President Donald Trump named John Bolton, a former U.S. ambassador to the United Nations who is deeply skeptical of the 2015 international nuclear accord with Iran, as his new national security adviser.

Trump himself has repeatedly cast doubt on the nuclear deal, in which the U.S. and other world powers eased sanctions in exchange for Tehran putting limits on its nuclear program.

INTERNET FIRMS ALERTED

The Department of Justice on Friday privately warned major internet infrastructure companies to expect attacks from Iran, an executive at one company who received the alert said.

The officials said the most likely retaliation would be denial of service attacks on websites, which are not destructive but disrupt commerce and communication.

U.S. Deputy Attorney General Rod Rosenstein speaks at a news conference with other law enforcement officials at the Justice Department to announce nine Iranians charged with conducting massive cyber theft campaign, in Washington, U.S., March 23, 2018. REUTERS/Yuri Gripas

Britain’s National Cyber Security Centre said on Twitter the Mabna Institute was “almost certainly responsible for cyber attacks targeting universities around the world.”

The sanctions and charges were the fourth time in the past few months the Trump administration has blamed a foreign government for major cyber attacks, a practice that was rare under the Obama administration.

Last week, the administration accused the Russian government of cyber attacks stretching back at least two years that targeted the U.S. power grid.

Washington imposed new sanctions on 19 Russians and five groups, including Moscow’s intelligence services, for meddling in the 2016 U.S. election and other cyber attacks.

Friday’s indictment in U.S. District Court in New York said the Iranian hackers did extensive background research of university professors before sending them “spearphishing” emails tailored to academic interests and scholarly publications.

The emails purported to be from professors at another university and indicated the sender had read an article written by them, prosecutors said.

The emails would then direct recipients to click on links to related articles directing them to a malicious internet domain that appeared similar to the victims’ actual university portal, where they would be prompted to enter their login credentials.

Once accounts were compromised, the hackers would steal reams of academic data and intellectual property related to science and technology, engineering, social sciences and medicine, the indictment said.

Stolen data was obtained to benefit Iran’s Revolutionary Guard and sold in Iran through the websites Megapaper and Gigapaper to universities there, prosecutors said.

‘PASSWORD SPRAYING’

Hackers targeted and compromised employee email accounts at 36 U.S.-based companies and 11 companies in countries including Britain, Germany and Italy, prosecutors said.

Victim companies in the United states included two media and entertainment companies, one law firm, 11 technology firms, and two bank and investment firms, among others.

Unlike the precise targeting of academics, companies were subjected to a broad technique known as “password spraying” that uncovers lists of company email accounts online and then tries to hack into them with common default passwords.

Once inside, the hackers would steal entire email mailboxes.

The Treasury Department also put sanctions on another Iranian, Behzad Mesri. Sometimes known as “Skote Vahshat,” Mesri was charged in 2017 with hacking cable TV network HBO to leak unaired episodes of the fantasy drama Game of Thrones.

Mesri is still at large, officials said.

Slideshow (6 Images)

The Obama administration in 2016 indicted seven Iranians for distributed-denial-of-service attacks on dozens of U.S. banks and for trying to shut down a New York dam. Those hackers were also accused of working on behalf of Iran’s government.

None of the Iranians indicted in 2016 have been arrested or extradited, a Justice Department spokesman said. </s> The US on Friday announced sanctions against nine Iranians and an Iranian company for attempting to hack into hundreds of universities worldwide, including in Ireland, on behalf of Tehran’s government.

The cyberattacks, beginning in at least 2013, pilfered more than 31 terabytes of academic data and intellectual property from 144 US universities and 176 universities in 21 other countries, the US Department of Justice said.

It described the conspiracy as one of the largest state-sponsored hacking sprees prosecuted.

The US Treasury Department said that it was placing sanctions on the nine accused individuals and the Mabna Institute, a company described by US prosecutors as designed to help Iranian research organisations steal information.

“These defendants are now fugitives of justice,” US deputy attorney general Rod Rosenstein said at a press conference. Mr Rosenstein said they may face extradition in more than 100 countries if they travel outside of Iran.

Hackers targeted email accounts of more than 100,000 professors worldwide and compromised about 8,000 of them, prosecutors said. Hackers also targeted the US Labor Department, the US Federal Energy Regulatory Commission, the United Nations and the computer systems of the US states Hawaii and Indiana, prosecutors said.

The UK government backed the action taken by Washington and revealed that British universities were among those targeted. Foreign office minister for cyber Lord Ahmad of Wimbledon said the hackers sought to steal intellectual property “to make money and gain technological advantage at our expense”.

The hackers were not accused of being directly employed by Iran’s government. They were instead charged with criminal conduct waged primarily through the Mabna Institute on behalf of the Islamic Revolutionary Guard Corps, the elite military force assigned to defend Iran’s Shia theocracy from internal and external threats.

There was no immediate response to the charges and sanctions in Iran’s state-run media.

Friday’s actions are part of an effort by senior cybersecurity officials at the White House and across the US government to blame foreign countries for malicious hacks.

They were announced a day after US president Donald Trump named John Bolton, a former US ambassador to the UN who is deeply sceptical of the 2015 international nuclear accord with Iran, as his new national security adviser. The Department of Justice on Friday privately warned major internet infrastructure companies to expect attacks from Iran, an executive at one company who received the alert said. The officials said the most likely retaliation would be denial of service attacks on websites, which are not destructive but disrupt commerce and communication.

The sanctions and charges were the fourth time in the past few months that the Trump administration has blamed a foreign government for major cyber attacks, a practice that was relatively rare under the Obama administration.

The Treasury Department also placed sanctions on another Iranian, Behzad Mesri. Sometimes known as “Skote Vahshat,” Mr Mesri was charged in 2017 with hacking cable TV network HBO to leak unaired episodes of the fantasy drama Game of Thrones. Mr Mesri is still at large, officials said.

The Obama administration in 2016 indicted seven Iranians for distributed-denial-of-service attacks on dozens of US banks and for trying to shut down a New York dam. Those hackers were also accused of working on behalf of Iran’s government.

None of the Iranians indicted in 2016 have been arrested or extradited, a justice department spokesman said. – Reuters/PA
The Ministry of Information and Communications Technology of Iran says hackers attacked its networks, leaving an image of US flags on screens. A researcher at Cisco's Talos security group acknowledges "several incidents in multiple countries" involving the use of their Smart Install protocol.