Stuxnet is a computer worm discovered in 2010 that targets industrial software and equipment. It is believed to have been designed to damage Iran's nuclear facilities. Stuxnet spreads through infected USB drives and seeks out specific models of programmable logic controllers used to automate industrial processes. It communicates with command and control servers to carry out its infection routine and propagate further through networks. Mitigation techniques for Stuxnet and other threats to industrial control systems include security information and event management systems, intrusion monitoring, and passive vulnerability scanning of control system networks.

1. STUXNET – THE FORMIDABLE CYBER WEAPONSathish KumarRajeev Chaubey

2. AGENDA Stuxnet Background

3. Introduction to SCADA systems

4. Stuxnet Architecture

5. Installation procedure

6. Injection technique

7. Infection routine flow

8. Command and Control server communication

9. Stuxnet propagation methods

10. Security issues and mitigation techniques SCADA SYSTEMS – GLOBAL INCIDENTS Sewage Hacker - SCADA system of Maroochy Water Services in Australia beginning in January 2000, which saw millions of gallons of sewage spill into waterways, hotel grounds and canals around the Sunshine Coast suburb Trans-Siberian Pipeline USSR - spectacular trans-Siberian pipeline disaster in 1982 Nuclear Power Plant, US - California, The vulnerability was demonstrated by a January event at the shutdown Davis-Besse nuclear power plant. The worm infection increased data traffic in the site’s network, resulting in the plant’s Safety Parameter Display System and plant process computer being unavailable for several hours Power Grid, US - California, hackers broke into computer systems owned by California's primary electric power grid operator and remained undetected for 17 days Airport Hacker, US - Massachusetts, a computer hacker who disabled a key telephone company computer servicing the Worcester airport. As a result of a series of commands sent from the hacker's personal computer, vital services to the FAA control tower were disabled for six hours in March of 1997. In the course of his hacking, the defendant also electronically broke into a pharmacy computer and copied patient records.

11. STUXNET BACKGROUND Stuxnet is a Windows computer worm discovered in July 2010. Targets industrial software and equipment. Its speculated that stuxnet was specifically designed to damageIran nuclear facilities and widely believed stuxnet introduced delay in Iran's Bushehr Nuclear Power Plant startup The first to include a programmable logic controller (PLC) rootkit.

12. STUXNET DAY BY DAY EVOLUTION

13. SUPERVISORY CONTROL AND DATA ACQUISITION

14. PLC – PROGRAMMABLE LOGIC CONTROLLERSTUXNET SEEKS SPECIFIC MODELS S7-300 S7-400

15. PLC – SCAN CYCLERead InputExecute programDiagnostics and communicationsUpdate output

16. STUXNET ARCHITECTURE

17. STUXNET – INSTALLATION PROCEDURE

18. STUXNET – INFECTION ROUTINE FLOW

19. Stuxnet – C & C Server Communication

20. STUXNET PROPAGATION METHODS

21. Security issues and mitigation techniques Security Information and Event Management systems Intrusion monitoring systems integrated with SIEM Implement “Extrusion Detection” Implement passive vulnerability scanners (PVS) on the control systems network

22. JUNIPER IDP SCADA SIGNATURESSCADA:DNP3:DISABLE-RESP - This signature detects attempts to stop unsolicited responses from devices. Attackers can prevent devices from sending alarmsSCADA:DNP3:READ - This signature detects attempts by clients to read information from a Programmable Logic Controller (PLC). Attackers can use this information to plan future, more targeted attacksSCADA:DNP3:STOP - This signature detects attempts to stop a DNP3 serverSCADA:DNP3:WARM-RESTART- This signature detects attempts to reinitialize a PLC or DNP3 serverSCADA:MODBUS:LISTEN-ONLY -This signature detects attempts to force a Programmable Logic Controller (PLC) into listen-only mode, in which the PLC does not respond to request packetsSCADA:MODBUS:DOS - This signature detects attempts to force a Programmable Logic Controller (PLC) to restart. The PLC is unavailable while powering on

23. STUXNET – THE FORMIDABLE CYBER WEAPONQ&A

24. STUXNET – THE FORMIDABLE CYBER WEAPONThank you!