(Adds graphic link)
* Crippling strikes hit two Aramco oil facilities at weekend
* Saudi defence systems mostly designed for high altitude strikes
* Kingdom vulnerable to lower flying drones, cruise missiles
* Iran's missile capabilities, and those of proxies, pose threat
* Graphic for attacks on Saudi oil: https://tmsnrt.rs/302z0Hm
By Stephen Kalin and Sylvia Westall
RIYADH/DUBAI, Sept 17 (Reuters) - Billions of dollars spent by Saudi Arabia on cutting edge Western military hardware mainly designed to deter high altitude attacks has proved no match for low-cost drones and cruise missiles used in a strike that crippled its giant oil industry.
Saturday's assault on Saudi oil facilities that halved production has exposed how ill-prepared the Gulf state is to defend itself despite repeated attacks on vital assets during its four-and-a-half year foray into the war in neighbouring Yemen.
Saudi Arabia and the United States have said they believe Iran, the kingdom's arch-enemy, was probably behind the strike. On Tuesday, a U.S. official said Washington believed the attack originated in southwestern Iran. Three U.S. officials said it involved both cruise missils and drones.
Tehran has denied such accusations, saying that Yemenis opposing Saudi-led forces carried it out. Yemen's Iran-aligned Houthi movement is alone in claiming responsibility.
Iran maintains the largest ballistic and cruise missile capabilities in the Middle East that could overwhelm virtually any Saudi missile defence system, according to think-tank CSIS, given the geographic proximity of Tehran and its regional proxy forces.
But even more limited strikes have proved too much for Saudi Arabia, including recent ones by Houthis who claimed successful attacks on a civilian airport, oil pumping stations and the Shaybah oilfield.
"We are open. Any real facility has no real coverage," a Saudi security source said.
The Sept. 14 assault on two plants belonging to state oil giant Saudi Aramco was the worst on regional oil facilities since Saddam Hussein torched Kuwait's oil wells during the 1990-91 Gulf crisis.
The company said on Tuesday that production would be back to normal quicker than initially feared, but the attack nonetheless shocked oil markets.
Riyadh said preliminary results indicated the weapons used were Iranian but the launch location was still undetermined.
Authorities initially specified drones, but three U.S. officials said the use of cruise missiles and drones indicated a higher degree of complexity and sophistication than initially thought.
"The attack is like Sept. 11th for Saudi Arabia, it is a game changer," said a Saudi security analyst who declined to be named.
"Where are the air defence systems and the U.S. weaponry for which we spent billions of dollars to protect the kingdom and its oil facilities? If they did this with such precision, they can also hit the desalination plants and more targets."
The main Saudi air defence system, positioned mainly to defend major cities and installations, has long been the U.S.-made long-range Patriot system.
It has successfully intercepted high-altitude ballistic missiles fired by the Houthis at Saudi cities, including the capital Riyadh, since a Saudi-led coalition intervened in Yemen against the group in March 2015.
But since drones and cruise missiles fly more slowly and at lower altitudes, they are difficult for Patriots to detect with adequate time to intercept.
"Drones are a huge challenge for Saudi Arabia because they often fly under the radar and given long borders with Yemen and Iraq, the kingdom is very vulnerable," said a senior Gulf official.
SPATE OF ATTACKS
Washington and Riyadh have blamed Iran and its proxies for a series of explosive blasts on tankers in Gulf waters, including two Saudi vessels in May, and attacks on Saudi oil assets.
Two oil pumping stations were hit that month. A transformer station near a desalination plant in Shuqaiq in the south was struck in June.
Those caused limited damage, unlike Saturday's strikes on Abqaiq and Khurais that damaged the world's biggest petroleum processing facility and knocked out 5.7 million barrels per day of production.
A Gulf source familiar with Aramco operations said the security system in place at Abqaiq is imperfect against drones. Authorities are investigating whether radar picked up the drones which struck in pre-dawn darkness, the source added.
An executive at a Western defence firm dealing with Saudi Arabia said that as of a year ago there were Patriots protecting Abqaiq.
Asked why Saudi defences did not intercept Saturday's attack, coalition spokesman Col. Turki al-Malki told reporters: "More than 230 ballistic missiles were intercepted by coalition forces...we have the operational capacity to counter all the threats and protect the national security of Saudi Arabia."
The government media office did not immediately respond to a request for comment.
It is unclear if U.S.-built short-range Avengers and medium-range I-Hawks and Swiss short-range Orelikons which the kingdom owns are currently operational.
SMALL BUT EFFECTIVE
The Saudi security source and two industry sources said Riyadh has been aware of the drone threat for several years and has been in discussions with consultants and vendors for possible solutions but has not installed anything new.
The security source said authorities moved a Patriot battery to the Shaybah oilfield after it was hit last month. There are Patriots at Aramco's Ras Tanura refinery.
"Most conventional air defence radar is designed for high- altitude threats like missiles," said Dave DesRoches at the National Defense University in Washington.
"Cruise missiles and drones operate close to the earth, so they aren't seen because of the earth's curvature. Drones are too small and don't have heat signature for most radar."
Intercepting drones possibly worth several hundred dollars with Patriots is also extremely expensive, with each missile costing around $3 million.
Jorg Lamprecht, CEO and co-founder of U.S. airspace security firm Dedrone, said there are more effective ways of dealing with drones, especially in swarms.
A combination of radio frequency detectors and radar detect them, high-powered cameras verify payloads and technologies like jamming demobilise them, he said.
But the latest technology presents its own challenges: frequency jamming could disrupt industrial activities and have negative health effects on people.
Armed drones are becoming more readily available, so the threat to vital infrastructure is rising disproportionately, according to U.S. intelligence consultancy Soufan Group.
Saudi policymakers have long dreaded a strike against a desalination plant in Jubail which serves central and eastern Saudi Arabia. A successful attack would deprive millions of people of water and could take a long time to repair, the Saudi source said.
"It's a very target-rich environment," said an industry source with knowledge of Saudi Arabia. "They've kicked them right where it hurts and there's plenty more of them around."
(Reporting by Stephen Kalin and Sylvia Westall, additional reporting by Rania El Gamal and Alexander Cornwell in Dubai and Samia Nakhoul in Beirut; Writing by Stephen Kalin; Editing by Ghaida Ghantous and Mike Collett-White)