Stuxnet, originally part of George Bush's Olympic Games program, but later endorsed by President Obama, was intended to be a targeted attack designed to slow down Iran's nuclear efforts. But it spread beyond Iran. "It is a fact that Stuxnet managed to infect many computer systems outside of its intended target in Iran," explains security researcher Graham Cluley. "Indeed, the very fact that it spread out of control, was what lead to its discovery by security firms."
Eugene Kaspersky, cofounder and head of Kaspersky Lab, said that a Russian friend told him the network of a Russian nuclear facility – not directly connected to the internet – had been infected by Stuxnet. Kaspersky had given a keynote speech at a Canberra Press Club seminar designed to give the Australian press an overview of the current state of cybersecurity and made the announcement during the subsequent Q&A session.
What he described was the law of unintended consequences at its most perverse – something that could, but thankfully hasn't yet, result in a major international diplomatic incident. There has been no official announcement on the incident from the Russian authorities, but Eugene Kaspersky is one of the most trusted names in security. He was arguing that intelligence agencies should be very careful about what they do in offensive security: "Everything you do is a boomerang," he said. "It will get back to you." It is likely, he added, "that other nations which are not in a conflict will be victims of cyber attacks on critical infrastructure.” He even suggested that malware has been carried to the Space Station on infected USB sticks.
The warning comes at a time when the Snowden leaks implicate Britain's GCHQ in hacking the Belgian telecommunications provider, Belgacom. This too might rebound on the perpetrators since Belgacom filed an official complaint with the Belgian federal prosecutor against an "unknown third party" – which now increasingly seems likely to be GCHQ.
Expanding on cyberwarfare, Kaspersky noted that more than 50% of all malware is written in Chinese, with 33% written in Spanish or Portuguese. Next comes Russian – but echoing Trend Micro's assertion last year that Peter the Great is more dangerous than Sun Tzu, he suggested that in general the sophistication of Russian malware makes it more dangerous than Chinese malware.