Monday, October 04, 2010

Stuxnet conspiracy theories getting ridiculous

Whoever invented the Stuxnet virus, which is supposedly targeted at the Iranian nuclear programme, must be rolling around laughing at the increasingly far-fetched speculation over who created it. Most of the "proof", of course, points to Israel. Now, I'm not saying that the Israelis didn't do it - they certainly have the motive and the capability - but the so-called "evidence" is really moving into the realms of the ridiculous.

The piece that has everyone in a tizzy is the file path b:\myrtus\src\objfre_w2k_x86\i386\guava.pdb, which appears in the virus's code. This is, according to alleged experts, an allusion to the biblical Queen Esther, who saved the Jewish people from a genocidal Persian. Myrtus is the Latin word for myrtle, and Esther's other name is Hadassah, or myrtle, you see....

Of course, the myrtle is (partially) native to Europe so it might be a link to the Brits. It is also used by aromatherapists, so perhaps the programmers were just trying to kick up a stink? Or, if you are absolutely set on some Jewish symbolism, according to Wiki, "In Jewish mysticism, the myrtle represents the phallic, masculine force at work in the universe." Bibi the alpha male is really showing Ahmadinejad who's in charge....

But seriously, there is also a clue at the end of the file name: guava, which - guess what - is a member of the myrtle family.

Myrtus could also easily be construed as My RTUs. In SCADA environments, RTU is a commonly used term for remote terminal unit. Isn't it more plausible that the Stuxnet author named the folder myrtus (meaning My RTUs) then realized it also read myrtus, the botanical term, and hence named his file guava? [source]

Then again, there are guava orchards in the Gaza Strip. Perhaps the programmers were against disengagement?

The other piece of "evidence" being thrown about is the string 19790509, which is being interpreted as the date May 9, 1979 - the same day on which Iran executed Habib Elghanian, a prominent Jewish businessman. Unless the programmers are themselves Persian Jews, it is unlikely they are familiar with this episode. But wait:

Perhaps what we really have here is someone born on May 9, 1979

This does sound more likely - although, if the virus was constructed in England (or by a British expat), perhaps we're talking about someone born on September 5, 1979. Who the hell knows? None of this is serious proof for anything other than that we all love a good conspiracy theory.

No comments: