If this is illegal, and a more traditional attack with bombs and soldiers and guns is not, then I think we have our priorities backwards. I don't necessarily see this cyber attack as okay... just more okay than the alternative. It was specifically targeted at Iran's means of making weapons, right? Not at their water supply, not at their hospitals, schools, or roads.
This illustrates the difference pretty clearly, to me. This attack did not kill anyone, did not damage the ability of otherwise innocent Iranian people to live their lives. There will be no dead children in the streets. How could this not be better than what we've done in Iraq or Afghanistan? Or in war for thousands of years? The less bloodshed, the better, and this has, as far as I know, shed no blood.