Stuxnet: Cómo tomar el control de una Planta Nuclear

Terminology I Software that takes advantage of Exploit a bug in order to cause unintended behavior (getting inside) Malware that replicates itself within Worm the network (propagate) The actual malicious activity, Payload e.g., delete file, download file (create damage) ©2011 Check Point Software Technologies Ltd. [PROTECTED] — All rights reserved. |7

Terminology II A Programmable Logic Controller (PLC) — PLC control of machinery on factory assembly lines Typical Windows machines, Field PG used to program PLCs PLC Field PG ©2011 Check Point Software Technologies Ltd. [PROTECTED] — All rights reserved. |8

“Groundbreaking” Worm While We Are In This Room…More than 50,000 new worms are propagating on the Internet ~1000 of them are undetected by antivirus ~1–2 employ unknown vulnerabilities (0-day)So what is so special about Stuxnet? Why is it ―groundbreaking?‖ ©2011 Check Point Software Technologies Ltd. [PROTECTED] — All rights reserved. 10 |

Stuxnet Overview Architecture Exploits Techniques Single file  4 unknown  Antivirus evasion (Archive) Windows bugs  Peer-2-Peer  2 stolen network certificates  Command and  PLC pre-recorded control commands ©2011 Check Point Software Technologies Ltd. [PROTECTED] — All rights reserved. 11 |

Typical PLC Deployment (Goal) Water pipe Pipeline Gas centrifuge Internal Network Write Read Operator PC (Windows) PLC Field PG ©2011 Check Point Software Technologies Ltd. [PROTECTED] — All rights reserved. 15 |

Mission Objectives: Infiltrate the power plant Propagate inside the network Infect the operator computer GOAL:Reprogram the controller ©2011 Check Point Software Technologies Ltd. [PROTECTED] — All rights reserved. 16 |

The Infection  Infected a willing or unknowing third party – An insider – A contractor – A SCADA Conference USB give-away  The original infection was most likely introduced by a removable drive ©2011 Check Point Software Technologies Ltd. [PROTECTED] — All rights reserved. 18 |

Getting From the USB to the Computer Stuxnet Used Two Methods to Infect the Computer via USB Method #1 Method #2 Malformed Autorun shortcut file design flaw (.LNK) (.INI) ©2011 Check Point Software Technologies Ltd. [PROTECTED] — All rights reserved. 19 |

Method #1: The LNK Vulnerability Design-level flaw in Windows Desktop Explorer (not Internet Explorer) when viewing shortcuts Shortcut Properties In our scenario, File Name: Shortcut this file was the File Size: 1 KB Stuxnet worm ICON Location: c:icon d:bad_file ©2011 Check Point Software Technologies Ltd. [PROTECTED] — All rights reserved. 20 |

How Stuxnet Exploits ThisVulnerability Stuxnet Arrives on a  The Stuxnet worm Removable  Shortcut file that points at the worm Drive (USB) Once  Hides the files on the USB Viewed and  Hides itself from antivirus Exploited ©2011 Check Point Software Technologies Ltd. [PROTECTED] — All rights reserved. 21 |

Autorun.inf—“Cunning” Hack Filename: An Autorun.inf file is a configuration file placed on autorun.inf removable drives that instructs Windows to automatically execute a file when inserted Stuxnet STUXNET’s CODE [autorun] AutoRun OPEN = setup.exe ©2011 Check Point Software Technologies Ltd. [PROTECTED] — All rights reserved. 22 |

Autorun.inf—“Cunning” Hack Filename: An Autorun.inf file is a configuration file placed on autorun.inf removable drives that instructs Windows to automatically execute a file when inserted Stuxnet STUXNET’s CODE [autorun] AutoRun OPEN = setup.exe ©2011 Check Point Software Technologies Ltd. [PROTECTED] — All rights reserved. 23 |

Compromised Certificates These Kinds of Activities Require a Legitimate Certificate Signed and Trusted by Microsoft Both of these companies seem to have offices in the Hsinchu Science and Industrial Park (Taiwan), which could indicate an insider job ©2011 Check Point Software Technologies Ltd. [PROTECTED] — All rights reserved. 27 |

Stuxnet Communication Components  Communicate via Peer-2-Peer  Communicate with attackersInfected machine Infected machine Master?acting as Server acting as Client Attackers Get Version Send Version Do X Request Update Do Y Send Update Internet ©2011 Check Point Software Technologies Ltd. [PROTECTED] — All rights reserved. 32 |

Mission #3: Infecting The Target When Stuxnet Reaches a Field PG, It Installs a Trojan Horse That: Monitors PLC commands being written and read Infects a PLC by inserting bad commands Masks the fact the PLC is infectedThis is a rootkit – Software whichsubverts the operation system ©2011 Check Point Software Technologies Ltd. [PROTECTED] — All rights reserved. 35 |

Infected PLC Example (READ/WRITE)Operator (Field PG) Operation Controller 5 5 500 Change Speed Pre-recorded value Operation Infected with 5 5 500 Stuxnet Monitor Speed Show expected value ©2011 Check Point Software Technologies Ltd. [PROTECTED] — All rights reserved. 36 |

Mission Objectives: Infiltrate the power plant Mission network Propagate inside theAccomplished!! Infect the operator computer GOAL:Reprogram the controller ©2011 Check Point Software Technologies Ltd. [PROTECTED] — All rights reserved. 38 |

Summary Complex Stuxnet is a very sophisticated threat Quiet Built to stay ―under the radar‖ Dedicated Targeted Iranian nuclear plant Expensive Used 4 unknown vulnerabilities Blueprint Stuxnet is a template for criminalsProductivity Can target other companies ©2011 Check Point Software Technologies Ltd. [PROTECTED] — All rights reserved. 39 |

http://elventiluz.blogspot.com	119
http://blog.segu-info.com.ar	43
http://cxo-community.com	18
http://seguinfo.wordpress.com	14
http://www.cxo-community.com	7
url_unknown	1
http://webcache.googleusercontent.com	1

Stuxnet: Cómo tomar el control de una Planta Nuclear

by CXO Community on Jun 17, 2011

Accessibility

Categories

Tags

Upload Details

Usage Rights

7 Embeds 203

Statistics

Stuxnet: Cómo tomar el control de una Planta Nuclear — Presentation Transcript