Symantec undertook a detailed analysis of the groundbreaking Stuxnet virus, which targeted Iran's nuclear enrichment facilities two years ago, sending some of their centrifuges spinning out of control. Cox said W32.Flamer appeared to be even more complex than Stuxnet, and that it was an incredibly clever, comprehensive "spying program".
"It is a backdoor worm that goes looking for very specific information. It scrapes a mass of information from any infected machines and then sends it, without the user having any idea what is going on. The amount of information it can send is huge."
Symantec first started working on the code over the weekend after it was discovered by specialists at the Labortory of Cryptography and System Security, at the University of Budapest.
Analysis now shows that the worm has been around, undetected, for at least two years, and experts are confident it was responsible for the disruption to Iran's oil industry last month.
According to reports, the cyber-attack forced Iran to convene a "crisis committee" that ordered the disconnection of six of its main oil terminals from the internet, to stop the worm spreading.
One of these, on Kharg island, 16 miles off the north-western coast of Iran, processes 90% of the country's crude oil exports.
The Iranian Students' News Agency said that the virus had successfully erased information on hard disks at the oil ministry's headquarters.
Though the oil ministry insisted that the worm had been contained and that no significant data had been erased, the likelihood is that W32.Flamer had been inside the network for many months and may already have completed its primary mission. Cox said the worm was designed to gather and send information covertly – unlike Stuxnet, which was built to identify and destroy equipment.
"Once the attacker has that level of access, then all bets are off," she said. "Once the worm has infected a system, it would be possible to add new commands over time, to add an element of disruption."
Though Symantec said it was impossible to say whether the team behind W32.Flamer was also behind Stuxnet. Cox said the two were similar in some ways, and shared some features.
"To the casual observer, the worm looks like any piece of software," she said. "To get that level of sophistication would take a team of 10 several months. It's very professional."
The worm was able to take screenshots of users' desktops, to spread via USB drives, and to disable security systems. It was also able to find security vulnerabilities in Microsoft Windows to help it spread from network to network. As well as major networks, the worm appears to have infected personal computers being used at home, she said.
Symantec said it believed at least 100 organizations and individuals had been targeted by the worm, and that these were "primarily located in the Middle East". The worm appeared to have transferred to Hungary, Russia, Austria and Hong Kong, though these may have been hit accidentally.
The use of so-called cyber-warfare was taken to new levels by Stuxnet, which disabled some of the centrifuges inside the Natanz enrichment plant, southwest of Tehran.
Though nobody has been able to say confidently who was responsible for building the virus, only certain countries are thought to have the necessary capability, or intent.
Israel and the U.S. are thought to be world leaders in the development of such technology. Last year an investigation by the New York Times claimed Stuxnet was a joint U.S./Israeli operation designed to undermine Iran's efforts to make a bomb of its own.
Intellpuke: You can read this article by Guardian Defense and Security correspondent Nick Hopkins in context here: www.guardian.co.uk/world/2012/may/28/computer-worm-iran-oil-w32flamer