Stuxnet dc9723

Tomer Teller , DC9723, 18/1/11 Stuxnet: How to take over a (nuclear) power plant

[object Object],[object Object],[object Object],[object Object],Who Am I ?

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Why are we here ?

[object Object],[object Object],[object Object],[object Object],Terminology

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Threat Overview

This is not normal… Statistics ref: Symantec dossier paper

What’s going to happen? Here

What’s going to happen? Water Pipe Gas pipeline Nuclear Reactor

Mission Objectives Introduce Threat to Target Propagate inside the network Infect Field PG machines GOAL: Reprogram ICS machines

The First Infection ,[object Object],[object Object],[object Object],[object Object]

Removable Drive Propagation ,[object Object],[object Object],[object Object]

[object Object],[object Object],[object Object],[object Object],[object Object],LNK Auto-Execution (MS10-046)

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],LNK Binary Format (DIY)

[object Object],[object Object],[object Object],Autorun.inf Technique

EXE AutoRun Autorun.inf Technique cont.

[object Object],[object Object],[object Object],[object Object],[object Object],The LoadLibrary() Technique

[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],User/Kernel Space rootkits

[object Object],[object Object],Compromised Certificates

No Admin?! No Problem! (Vista+ Style) ,[object Object],[object Object],[object Object],[object Object]

No Admin?! No Problem! (XP Style) ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Demo(s) Time ,[object Object],[object Object],[object Object]

Recap Introduce Threat to Target Propagate inside the network Infect Field PG machines GOAL: Reprogram ICS machines

MS08-067 – Server Service Vulnerability ,[object Object],[object Object],[object Object],[object Object],[object Object],NetprPathCanonicalize() hareath1ath2/../../../../buff hareath1/../../../buff hare/../../buff /../buff Search For ‘ Search For ‘ Search For ‘ Search For ‘ Buffer Overflow

MS10-061 – Printer Spooler Vulnerability ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Network Shares Infection ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

P2P Communication Component ,[object Object],[object Object],Infected machine acting as Client Infected machine acting as Server Get Version (0) Send Version Request Update (4) Send Update RPC Server Routines: 0: Return Current Ver 1: Inject & Execute 2: Load module 3: Inject to lsass.exe 4: Send Current Version 5: Create Process 6: Read File ref: Symantec dossier paper

Command & Control Component ,[object Object],Infected Machine Command And Control Server GET 200 OK www.msn.com GET Index.php?data=[encrypted] Command X Command Y ref: Symantec dossier paper

Mission #2 Completed Here Ping Alive

PLC RootKit ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Infected PLC Example (READ/WRITE) Step7/WinCC New DLL PLC Original DLL Read () Data Modified Data Read() Original Data Write() Data New DLL Original DLL Write() Wrote Modified Data Field GP 5 5 500 500 5 5 ? ? ? 500 500 5

Who’s Behind It ? ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

kthxbye Tomer Teller [email_address]

Stuxnet dc9723

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Destaque

Destaque (19)

Semelhante a Stuxnet dc9723

Semelhante a Stuxnet dc9723 (20)

Mais de Iftach Ian Amit

Mais de Iftach Ian Amit (20)

Último

Último (20)

Stuxnet dc9723