SlideShare uma empresa Scribd logo

Blackhat USA 2016 - What's the DFIRence for ICS?

•Transferir como PPTX, PDF•
•
Chris Sistrunk
Chris Sistrunk

Digital Forensics and Incident Response (DFIR) for IT systems has been around quite a while, but what about Industrial Control Systems (ICS)? This talk will explore the basics of DFIR for embedded devices used in critical infrastructure such as Programmable Logic Controllers (PLCs), Remote Terminal Units (RTUs), and controllers. If these are compromised or even have a misoperation, we will show what files, firmware, memory dumps, physical conditions, and other data can be analyzed in embedded systems to determine the root cause. This talk will show examples of what and how to collect forensics data from two popular RTUs that are used in Electric Substations: the General Electric D20MX and the Schweitzer Engineering Labs SEL-3530 RTAC. This talk will not cover Windows or *nixbased devices such as Human Machine Interfaces (HMIs) or gateways.

Educação
1 de 38
What’s the DFIRence for ICS? Chris Sistrunk, PE Senior Consultant, FireEye @chrissistrunk Josh Triplett Senior Reverse Engineer, FireEye 1
Agenda • Digital Forensics and Incident Response Overview • DFIR for ICS • What’s the DFIRence? • Embedded Devices • What to Collect • What to Analyze • RTU Examples • GE D20MX • VxWorks DFIR Tool • SEL-3530 RTAC 2
Incident Response Overview “Find Evil” • Assess the situation • Define objectives • Collect evidence • Perform analysis • Communicate • Develop remediation plan • Document findings http://www.cumbriafire.gov.uk/about/photo/engines/incident-response.asp 3
Digital Forensics Overview • Data Collection • Data Files • OS (volatile and non-volatile) • Network Traffic • Applications • Examination • Analysis • Reporting NIST SP 800-86 4
Traditional DFIR tools Mature • Tools • Redline • Volatility • Websites • Cheatsheets • Books 5
What’s the DFIRence for ICS? 6
ICS anomaly  incident? • An anomaly of some kind has occurred • Increased network activity, strange behavior, failure • Now we need to investigate the anomaly • Is it known bad? • Is it unknown bad? • Do we escalate this to a security incident? • Who do we call? • Engineers, Admins, PR, Safety • Vendors 7
Don’t! 8
ICS forensics collection tools • No ICS-specific DFIR tools…especially embedded devices • But, we can collect data manually using other tools 9
Embedded devices: What to collect? Physical data • Exact location of device • Device description • Identifying info (manufacturer, S/N, P/N, name) • Connections (serial, ethernet, USB) • Front/back panel LED status • Power consumption • Temperature (if running hot) • Evidence of tampering Digital data • Running configuration (including user accounts) • Last-known good configuration • Running firmware, approved firmware • CPU usage %, Memory usage % (RAM, Storage) • Running processes • Active ports (serial, ethernet, USB, etc) • Logs (security, events) • Memory dump (if possible) 10
Embedded devices: What to analyze? Find Evil…or ways for evil to do evil First Responders: ICS Engineer or Technician, Network Engineer, Vendor • What do the user and event logs reveal? (these need to be viewed first as they may rollover) • Does the configuration match the firmware? Is the firmware approved from FAT/SAT? • Running config / last known good config / standard config • Is the configuration and logic correct for the process? • Are communications (serial, ethernet, USB, wireless) normal as compared with known good? Vendor, Digital Forensics Specialist, Embedded Systems Analyst • Analyze embedded OS files, captured data at rest, captured data in transit • Volatile memory if possible (to look for code injection and potential rootkits) Fast Slower Time 11
Let’s do DFIR on two substation RTUs 12
Time to…RTFM 13
Data Collection: D20MX Specs • 667 MHz embedded PowerQUICC II Pro • 1024 MB of 266 MHz DDR2 RAM with ECC • 16 MB NVRAM for persistent event storage • 8 MB boot flash, 256 MB firmware flash • VxWorks RTOS Tools to use • D20MX Product Documentation Binder.pdf • GE SGconfig software • Terminal (Tera Term, PuTTY) • WinSCP 14
Data Collection: D20MX You will need three manuals from the binder pdf: 1. 994-0140 D20MX Substation Controller Instruction Manual • Chapter 11: Troubleshooting 2. B014-1NUG Westmaint II+ for D20MX User’s Guide • Shows how to use the D20 console interface, menus, error and user logs 3. SWM0080 D20MX Shells User’s Guide 15
Data Collection: D20MX Error Log and User Log The error log tells what’s wrong with the configuration. The user log shows logins, logouts, and all user activity. Can be exported to CSV. This data also gets put into the syslog. 16
The power of the 3 Shells • You can access the shell remotely with SSH, but the most powerful access is through the front serial port. • Some of these commands require assistance from GE unless you really know what you are doing. 17
The main shell • D20M Shell is the main shell • Very similar to 68k monitor shell in older D20s • Incident Responders will want to collect data from this shell • All of the commands are explained in detail in the D20MX Shells UG 18
Data Collection: D20MX • Running configuration  Use SGConfig, ConfigPro, or TeraTerm  Very common task • Last-known good configuration  Look in email, config database, engineer’s laptop, or it may be on a USB in the cabinet • Running firmware - img • CPU usage %, Memory usage %  pr – performance monitor  qr – query ram (volatile and nvram) • Running processes - qp 19
Data Collection: D20MX Serial analyzer • Very popular shell command (what’s Wireshark?) • In the D20M shell, use  sa com# where # is the port number  Turn on logging in TeraTerm beforehand to save the traffic  This example is DNP3 20
Data Collection: D20MX • Dump memory  si – shows system information including the memory base addresses  d – dumps memory, but you have to tell it where to start and stop (only available over serial connection) • Hand the output to someone who understands VxWorks for analysis • Look for strings, injected code, or rootkits 21
Data Collection: D20MX VxWorks C Shell • OS level shell only accessible from the RS-232 port (access is denied from SSH) • Mainly used by GE customer support for troubleshooting VxWorks CMD Shell • OS 2nd level shell, accessed by typing cmd • VxWorks Kernel Shell Command Reference 6.9 • We can use some commands for forensics  d (dump), netstat, ipf (firewall), syslog, show devices, show drivers, show history, ifconfig, route, and even pcap! 22
Example of live memory code injection & mem dump on the D20MX • Inject code via VxWorks C shell memory edit command m to simulate a rootkit [SCREENSHOTS OR VIDEO RECORDING HERE] • Collect volatile memory using the dump memory command d [SCREENSHOTS OR VIDEO RECORDING HERE] 23
Data Collection: VxWorks DFIR Tool – Problem 24 • We need tools that enable us to perform DFIR on ICS and embedded devices.
Data Collection: VxWorks DFIR Tool - Solution A collection of utilities that enable us to: • Read (and write) to memory on the device programmatically • We don’t want to have do dump memory manually • Cache the live memory locally • We shouldn’t need to fetch the same memory twice to check for different issues. • Compare the system image • Knowing the image is good is the first step toward looking somewhere else. • Provide the ability to read/write and cache device data to other tools • Tools can be written more generically when they don’t need to worry about how to get the data 25
Data Collection: VxWorks DFIR Tool - Cool Features • Can easily accommodate different transport mechanisms • Serial • TCP/Serial bridges • Protocols specific to other dumping utilities • Supports caching • Allows resuming if connectivity is lost • Sparse memory dumping • Comparative analysis works on • Anything that looks like a seek-able Python File Object • Cache Files • Memory Dumps • Sparse Memory Maps • Special Objects that request live memory 26
Data Collection: VxWorks DFIR Tool – Validating the host image 27
Data Collection: VxWorks DFIR Tool - Cool Projects We Used • CLE Loads Everything – (angr/CLE) • Loads our system image and provides an abstraction to a process memory space • Identifies architecture, endianness, etc. • Will soon support relocatable images (important for modules like appl.out) • Capstone - Nguyen Anh Quynh • Easy access to disassemble exactly what we needed 28
Data Collection: VxWorks DFIR Tool – Plans for the Future • Documentation • Expand the tool to work on other devices • Refine the scripts into easy-to-use modules • Moving the code to GitHub • Allow for feedback / feature requests / bug submissions 29
Data Collection: SEL-3530 RTAC Specs • 533 MHz Power PC • 1024 MB DDR2 ECC RAM • 2GB Storage • Embedded SEL Linux Tools to use • SEL-3530 RTAC Instruction Manual • SEL-5033 Instruction Manual • SEL-5033 software • Web Browser (Chrome, FireFox, etc) • Terminal for SSH (Tera Term, PuTTY) 30
Data Collection: SEL-3530 Digital data • Running configuration • User Accounts • Running firmware • CPU usage % • Memory usage % • POST checks • Reports (several) Physical Data • Password jumper 31
Data Collection: SEL-3530 These are the screenshots from when I sent a malformed DNP3 message that caused the RTAC to lose the configuration. https://ics-cert.us-cert.gov/advisories/ICSA-13-219-01 32
Data Collection: SEL-3530 • Section 3: Testing and Troubleshooting • Section 5: Web HMI and Logging • Section 6: Security • There are tags in the RTAC database that are assigned to help troubleshoot but are also useful for forensics as well. • Several log types • SOE report • IED report • syslog 33
Data Collection: SEL-3530 • Example of IED Report • Can be accessed via web or ODBC (MS Access) • No Linux Shell • Pros & cons • No SSH Interface with RTAC • SSH used for engineering remote access to relays 34
Data Collection: SEL-3530 • The RTAC can capture ethernet and serial traffic  SEL-5033 software and the Comm Monitor • AG2012-15 Using Wireshark® to Troubleshoot Protocol Communications Issues on an RTAC  DNP3 example • AG2015-15 Using Wireshark® to Decode RTAC Serial Line Messages and SEL Protocols  SEL Fast Messaging example • SEL published several serial Wireshark dissectors  SELFM, Telegyr 8979 35
For Further Reading… • HD Moore’s blogpost on VxWorks from 2010. • https://community.rapid7.com/community/metasploit/blog/2010/08/02/shiny-old-vxworks- vulnerabilities • Metasploit module for VxWorks remote memory dump (wdbrpc_memory_dump) • David Odell’s blogpost on QNX from 2012. • https://www.optiv.com/blog/pentesting-qnx-neutrino-rtos • ICS-CERT recommended practices for ICS forensics • https://ics-cert.us-cert.gov/sites/default/files/recommended_practices/Forensics_RP.pdf 36
For Further Reading… • Travis Goodspeed’s embedded device work on the MSP430 family • http://travisgoodspeed.blogspot.com/2007/11/ti-ez430-in-linux-with-iar-kickstart.html • http://travisgoodspeed.blogspot.com/2008/08/repurposing-ti-ez430u-part-3.html • Ralph Langner’s forensics work on Stuxnet payloads for Siemens PLCs • http://www.langner.com/en/wp-content/uploads/2013/11/To-kill-a-centrifuge.pdf • The Dec 23, 2015 Ukrainian Power Grid attack included writing over firmware of embedded Ethernet-serial converters. • https://ics.sans.org/media/E-ISAC_SANS_Ukraine_DUC_5.pdf 37
QUESTIONS? 38

Recomendados

S4x20 - Tuning ICS Security Alerts: An Alarm Management Approach
S4x20 - Tuning ICS Security Alerts: An Alarm Management ApproachS4x20 - Tuning ICS Security Alerts: An Alarm Management Approach
S4x20 - Tuning ICS Security Alerts: An Alarm Management ApproachChris Sistrunk
 
Proactive Approach to OT incident response - HOUSECCON 2023
Proactive Approach to OT incident response - HOUSECCON 2023Proactive Approach to OT incident response - HOUSECCON 2023
Proactive Approach to OT incident response - HOUSECCON 2023Chris Sistrunk
 
BSidesAugusta 2022 - The Power of the OT Security Playbook
BSidesAugusta 2022 - The Power of the OT Security PlaybookBSidesAugusta 2022 - The Power of the OT Security Playbook
BSidesAugusta 2022 - The Power of the OT Security PlaybookChris Sistrunk
 
VAPT Services by prime
VAPT Services by primeVAPT Services by prime
VAPT Services by primePrime Infoserv
 
Soc
SocSoc
SocMukesh Chaudhari
 
Cyber Threat Hunting with Phirelight
Cyber Threat Hunting with PhirelightCyber Threat Hunting with Phirelight
Cyber Threat Hunting with PhirelightHostway|HOSTING
 
SANS Purple Team Summit 2021: Active Directory Purple Team Playbooks
SANS Purple Team Summit 2021: Active Directory Purple Team PlaybooksSANS Purple Team Summit 2021: Active Directory Purple Team Playbooks
SANS Purple Team Summit 2021: Active Directory Purple Team PlaybooksMauricio Velazco
 
Guide ANSSI : 40 règles d'hygiène informatique en 13 images de questions dig...
Guide ANSSI : 40 règles d'hygiène informatique en 13 images de questions dig...Guide ANSSI : 40 règles d'hygiène informatique en 13 images de questions dig...
Guide ANSSI : 40 règles d'hygiène informatique en 13 images de questions dig...Eric DUPUIS
 

Recomendados

S4x20 - Tuning ICS Security Alerts: An Alarm Management Approach
S4x20 - Tuning ICS Security Alerts: An Alarm Management ApproachS4x20 - Tuning ICS Security Alerts: An Alarm Management Approach
S4x20 - Tuning ICS Security Alerts: An Alarm Management ApproachChris Sistrunk
 
Proactive Approach to OT incident response - HOUSECCON 2023
Proactive Approach to OT incident response - HOUSECCON 2023Proactive Approach to OT incident response - HOUSECCON 2023
Proactive Approach to OT incident response - HOUSECCON 2023Chris Sistrunk
 
BSidesAugusta 2022 - The Power of the OT Security Playbook
BSidesAugusta 2022 - The Power of the OT Security PlaybookBSidesAugusta 2022 - The Power of the OT Security Playbook
BSidesAugusta 2022 - The Power of the OT Security PlaybookChris Sistrunk
 
VAPT Services by prime
VAPT Services by primeVAPT Services by prime
VAPT Services by primePrime Infoserv
 
Soc
SocSoc
SocMukesh Chaudhari
 
Cyber Threat Hunting with Phirelight
Cyber Threat Hunting with PhirelightCyber Threat Hunting with Phirelight
Cyber Threat Hunting with PhirelightHostway|HOSTING
 
SANS Purple Team Summit 2021: Active Directory Purple Team Playbooks
SANS Purple Team Summit 2021: Active Directory Purple Team PlaybooksSANS Purple Team Summit 2021: Active Directory Purple Team Playbooks
SANS Purple Team Summit 2021: Active Directory Purple Team PlaybooksMauricio Velazco
 
Guide ANSSI : 40 règles d'hygiène informatique en 13 images de questions dig...
Guide ANSSI : 40 règles d'hygiène informatique en 13 images de questions dig...Guide ANSSI : 40 règles d'hygiène informatique en 13 images de questions dig...
Guide ANSSI : 40 règles d'hygiène informatique en 13 images de questions dig...Eric DUPUIS
 
Purple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEFPurple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEFJorge Orchilles
 
Dressing up the ICS Kill Chain
Dressing up the ICS Kill ChainDressing up the ICS Kill Chain
Dressing up the ICS Kill ChainDragos, Inc.
 
ICS Security 101 by Sandeep Singh
ICS Security 101 by Sandeep SinghICS Security 101 by Sandeep Singh
ICS Security 101 by Sandeep SinghOWASP Delhi
 
Internet Week 2018：D2-3 丸ごと分かるペネトレーションテストの今
Internet Week 2018：D2-3 丸ごと分かるペネトレーションテストの今Internet Week 2018：D2-3 丸ごと分かるペネトレーションテストの今
Internet Week 2018：D2-3 丸ごと分かるペネトレーションテストの今Tomohisa Ishikawa, CISSP, CSSLP, CISA, CISM, CFE
 
Secure Systems Security and ISA99- IEC62443
Secure Systems Security and ISA99- IEC62443Secure Systems Security and ISA99- IEC62443
Secure Systems Security and ISA99- IEC62443Yokogawa1
 
Critical Capabilities for MDR Services - What to Know Before You Buy
Critical Capabilities for MDR Services - What to Know Before You BuyCritical Capabilities for MDR Services - What to Know Before You Buy
Critical Capabilities for MDR Services - What to Know Before You BuyFidelis Cybersecurity
 
SCYTHE Purple Team Workshop with Tim Schulz
SCYTHE Purple Team Workshop with Tim SchulzSCYTHE Purple Team Workshop with Tim Schulz
SCYTHE Purple Team Workshop with Tim SchulzJorge Orchilles
 
Hacker Halted 2016 - How to get into ICS security
Hacker Halted 2016 - How to get into ICS securityHacker Halted 2016 - How to get into ICS security
Hacker Halted 2016 - How to get into ICS securityChris Sistrunk
 
Introduction to red team operations
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operationsSunny Neo
 
Blaze Information Security: The cost of fixing security vulnerabilities in ea...
Blaze Information Security: The cost of fixing security vulnerabilities in ea...Blaze Information Security: The cost of fixing security vulnerabilities in ea...
Blaze Information Security: The cost of fixing security vulnerabilities in ea...Blaze Information Security
 
Security operation center
Security operation centerSecurity operation center
Security operation centerMuthuKumaran267
 
Bulding Soc In Changing Threat Landscapefinal
Bulding Soc In Changing Threat LandscapefinalBulding Soc In Changing Threat Landscapefinal
Bulding Soc In Changing Threat LandscapefinalMahmoud Yassin
 
CNIT 123: Ch 3: Network and Computer Attacks
CNIT 123: Ch 3: Network and Computer AttacksCNIT 123: Ch 3: Network and Computer Attacks
CNIT 123: Ch 3: Network and Computer AttacksSam Bowne
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red TeamWhat is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red TeamMITRE ATT&CK
 
Transforming Adversary Emulation Into a Data Analysis Question
Transforming Adversary Emulation Into a Data Analysis QuestionTransforming Adversary Emulation Into a Data Analysis Question
Transforming Adversary Emulation Into a Data Analysis QuestionMITRE - ATT&CKcon
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CKTracking Noisy Behavior and Risk-Based Alerting with ATT&CK
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CKMITRE ATT&CK
 
Outpost24 webinar - Mapping Vulnerabilities with the MITRE ATT&CK Framework
Outpost24 webinar - Mapping Vulnerabilities with the MITRE ATT&CK FrameworkOutpost24 webinar - Mapping Vulnerabilities with the MITRE ATT&CK Framework
Outpost24 webinar - Mapping Vulnerabilities with the MITRE ATT&CK FrameworkOutpost24
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework👀 Joe Gray
 
Security operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتSecurity operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتReZa AdineH
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...MITRE ATT&CK
 
Dolla Dolla Bump Key
Dolla Dolla Bump KeyDolla Dolla Bump Key
Dolla Dolla Bump KeyChris Sistrunk
 
DEF CON 23 - NSM 101 for ICS
DEF CON 23 - NSM 101 for ICSDEF CON 23 - NSM 101 for ICS
DEF CON 23 - NSM 101 for ICSChris Sistrunk
 

Mais conteúdo relacionado

Mais procurados

Purple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEFPurple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEFJorge Orchilles
 
Dressing up the ICS Kill Chain
Dressing up the ICS Kill ChainDressing up the ICS Kill Chain
Dressing up the ICS Kill ChainDragos, Inc.
 
ICS Security 101 by Sandeep Singh
ICS Security 101 by Sandeep SinghICS Security 101 by Sandeep Singh
ICS Security 101 by Sandeep SinghOWASP Delhi
 
Secure Systems Security and ISA99- IEC62443
Secure Systems Security and ISA99- IEC62443Secure Systems Security and ISA99- IEC62443
Secure Systems Security and ISA99- IEC62443Yokogawa1
 
Critical Capabilities for MDR Services - What to Know Before You Buy
Critical Capabilities for MDR Services - What to Know Before You BuyCritical Capabilities for MDR Services - What to Know Before You Buy
Critical Capabilities for MDR Services - What to Know Before You BuyFidelis Cybersecurity
 
SCYTHE Purple Team Workshop with Tim Schulz
SCYTHE Purple Team Workshop with Tim SchulzSCYTHE Purple Team Workshop with Tim Schulz
SCYTHE Purple Team Workshop with Tim SchulzJorge Orchilles
 
Hacker Halted 2016 - How to get into ICS security
Hacker Halted 2016 - How to get into ICS securityHacker Halted 2016 - How to get into ICS security
Hacker Halted 2016 - How to get into ICS securityChris Sistrunk
 
Introduction to red team operations
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operationsSunny Neo
 
Blaze Information Security: The cost of fixing security vulnerabilities in ea...
Blaze Information Security: The cost of fixing security vulnerabilities in ea...Blaze Information Security: The cost of fixing security vulnerabilities in ea...
Blaze Information Security: The cost of fixing security vulnerabilities in ea...Blaze Information Security
 
Security operation center
Security operation centerSecurity operation center
Security operation centerMuthuKumaran267
 
Bulding Soc In Changing Threat Landscapefinal
Bulding Soc In Changing Threat LandscapefinalBulding Soc In Changing Threat Landscapefinal
Bulding Soc In Changing Threat LandscapefinalMahmoud Yassin
 
CNIT 123: Ch 3: Network and Computer Attacks
CNIT 123: Ch 3: Network and Computer AttacksCNIT 123: Ch 3: Network and Computer Attacks
CNIT 123: Ch 3: Network and Computer AttacksSam Bowne
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red TeamWhat is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red TeamMITRE ATT&CK
 
Transforming Adversary Emulation Into a Data Analysis Question
Transforming Adversary Emulation Into a Data Analysis QuestionTransforming Adversary Emulation Into a Data Analysis Question
Transforming Adversary Emulation Into a Data Analysis QuestionMITRE - ATT&CKcon
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CKTracking Noisy Behavior and Risk-Based Alerting with ATT&CK
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CKMITRE ATT&CK
 
Outpost24 webinar - Mapping Vulnerabilities with the MITRE ATT&CK Framework
Outpost24 webinar - Mapping Vulnerabilities with the MITRE ATT&CK FrameworkOutpost24 webinar - Mapping Vulnerabilities with the MITRE ATT&CK Framework
Outpost24 webinar - Mapping Vulnerabilities with the MITRE ATT&CK FrameworkOutpost24
 
Security operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتSecurity operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتReZa AdineH
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...MITRE ATT&CK
 

Mais procurados (20)

Purple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEFPurple Team Exercise Framework Workshop #PTEF
Purple Team Exercise Framework Workshop #PTEF
 
Dressing up the ICS Kill Chain
Dressing up the ICS Kill ChainDressing up the ICS Kill Chain
Dressing up the ICS Kill Chain
 
ICS Security 101 by Sandeep Singh
ICS Security 101 by Sandeep SinghICS Security 101 by Sandeep Singh
ICS Security 101 by Sandeep Singh
 
Internet Week 2018：D2-3 丸ごと分かるペネトレーションテストの今
Internet Week 2018：D2-3 丸ごと分かるペネトレーションテストの今Internet Week 2018：D2-3 丸ごと分かるペネトレーションテストの今
Internet Week 2018：D2-3 丸ごと分かるペネトレーションテストの今
 
Secure Systems Security and ISA99- IEC62443
Secure Systems Security and ISA99- IEC62443Secure Systems Security and ISA99- IEC62443
Secure Systems Security and ISA99- IEC62443
 
Critical Capabilities for MDR Services - What to Know Before You Buy
Critical Capabilities for MDR Services - What to Know Before You BuyCritical Capabilities for MDR Services - What to Know Before You Buy
Critical Capabilities for MDR Services - What to Know Before You Buy
 
SCYTHE Purple Team Workshop with Tim Schulz
SCYTHE Purple Team Workshop with Tim SchulzSCYTHE Purple Team Workshop with Tim Schulz
SCYTHE Purple Team Workshop with Tim Schulz
 
Hacker Halted 2016 - How to get into ICS security
Hacker Halted 2016 - How to get into ICS securityHacker Halted 2016 - How to get into ICS security
Hacker Halted 2016 - How to get into ICS security
 
Introduction to red team operations
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operations
 
Blaze Information Security: The cost of fixing security vulnerabilities in ea...
Blaze Information Security: The cost of fixing security vulnerabilities in ea...Blaze Information Security: The cost of fixing security vulnerabilities in ea...
Blaze Information Security: The cost of fixing security vulnerabilities in ea...
 
Security operation center
Security operation centerSecurity operation center
Security operation center
 
Bulding Soc In Changing Threat Landscapefinal
Bulding Soc In Changing Threat LandscapefinalBulding Soc In Changing Threat Landscapefinal
Bulding Soc In Changing Threat Landscapefinal
 
CNIT 123: Ch 3: Network and Computer Attacks
CNIT 123: Ch 3: Network and Computer AttacksCNIT 123: Ch 3: Network and Computer Attacks
CNIT 123: Ch 3: Network and Computer Attacks
 
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red TeamWhat is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
What is ATT&CK coverage, anyway? Breadth and depth analysis with Atomic Red Team
 
Transforming Adversary Emulation Into a Data Analysis Question
Transforming Adversary Emulation Into a Data Analysis QuestionTransforming Adversary Emulation Into a Data Analysis Question
Transforming Adversary Emulation Into a Data Analysis Question
 
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CKTracking Noisy Behavior and Risk-Based Alerting with ATT&CK
Tracking Noisy Behavior and Risk-Based Alerting with ATT&CK
 
Outpost24 webinar - Mapping Vulnerabilities with the MITRE ATT&CK Framework
Outpost24 webinar - Mapping Vulnerabilities with the MITRE ATT&CK FrameworkOutpost24 webinar - Mapping Vulnerabilities with the MITRE ATT&CK Framework
Outpost24 webinar - Mapping Vulnerabilities with the MITRE ATT&CK Framework
 
Red Team Framework
Red Team FrameworkRed Team Framework
Red Team Framework
 
Security operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیتSecurity operations center-SOC Presentation-مرکز عملیات امنیت
Security operations center-SOC Presentation-مرکز عملیات امنیت
 
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
Mapping to MITRE ATT&CK: Enhancing Operations Through the Tracking of Interac...
 

Destaque

DEF CON 23 - NSM 101 for ICS
DEF CON 23 - NSM 101 for ICSDEF CON 23 - NSM 101 for ICS
DEF CON 23 - NSM 101 for ICSChris Sistrunk
 
BSidesAugusta ICS SCADA Defense
BSidesAugusta ICS SCADA DefenseBSidesAugusta ICS SCADA Defense
BSidesAugusta ICS SCADA DefenseChris Sistrunk
 
Using Canary Honeypots for Network Security Monitoring
Using Canary Honeypots for Network Security MonitoringUsing Canary Honeypots for Network Security Monitoring
Using Canary Honeypots for Network Security Monitoringchrissanders88
 
Applied Detection and Analysis Using Flow Data - MIRCon 2014
Applied Detection and Analysis Using Flow Data - MIRCon 2014Applied Detection and Analysis Using Flow Data - MIRCon 2014
Applied Detection and Analysis Using Flow Data - MIRCon 2014chrissanders88
 
Developing Analytic Technique and Defeating Cognitive Bias in Security
Developing Analytic Technique and Defeating Cognitive Bias in SecurityDeveloping Analytic Technique and Defeating Cognitive Bias in Security
Developing Analytic Technique and Defeating Cognitive Bias in Securitychrissanders88
 

Destaque (6)

Dolla Dolla Bump Key
Dolla Dolla Bump KeyDolla Dolla Bump Key
Dolla Dolla Bump Key
 
DEF CON 23 - NSM 101 for ICS
DEF CON 23 - NSM 101 for ICSDEF CON 23 - NSM 101 for ICS
DEF CON 23 - NSM 101 for ICS
 
BSidesAugusta ICS SCADA Defense
BSidesAugusta ICS SCADA DefenseBSidesAugusta ICS SCADA Defense
BSidesAugusta ICS SCADA Defense
 
Using Canary Honeypots for Network Security Monitoring
Using Canary Honeypots for Network Security MonitoringUsing Canary Honeypots for Network Security Monitoring
Using Canary Honeypots for Network Security Monitoring
 
Applied Detection and Analysis Using Flow Data - MIRCon 2014
Applied Detection and Analysis Using Flow Data - MIRCon 2014Applied Detection and Analysis Using Flow Data - MIRCon 2014
Applied Detection and Analysis Using Flow Data - MIRCon 2014
 
Developing Analytic Technique and Defeating Cognitive Bias in Security
Developing Analytic Technique and Defeating Cognitive Bias in SecurityDeveloping Analytic Technique and Defeating Cognitive Bias in Security
Developing Analytic Technique and Defeating Cognitive Bias in Security
 

Semelhante a Blackhat USA 2016 - What's the DFIRence for ICS?

Intro to sysdig in 15 minutes
Intro to sysdig in 15 minutesIntro to sysdig in 15 minutes
Intro to sysdig in 15 minutesSysdig
 
Live Memory Forensics on Android devices
Live Memory Forensics on Android devicesLive Memory Forensics on Android devices
Live Memory Forensics on Android devicesNikos Gkogkos
 
amrapali builders @@ hacking challenges.pdf
amrapali builders @@ hacking challenges.pdfamrapali builders @@ hacking challenges.pdf
amrapali builders @@ hacking challenges.pdfamrapalibuildersreviews
 
Software is Eating The Data center
Software is Eating The Data centerSoftware is Eating The Data center
Software is Eating The Data centerMatthias Grawinkel
 
10 Tips for AIX Security
10 Tips for AIX Security10 Tips for AIX Security
10 Tips for AIX SecurityHelpSystems
 
Easily emulating full systems on amazon fpg as
Easily emulating full systems on amazon fpg asEasily emulating full systems on amazon fpg as
Easily emulating full systems on amazon fpg asRISC-V International
 
Jaime Blasco - Fighting Advanced Persistent Threat (APT) with Open Source Too...
Jaime Blasco - Fighting Advanced Persistent Threat (APT) with Open Source Too...Jaime Blasco - Fighting Advanced Persistent Threat (APT) with Open Source Too...
Jaime Blasco - Fighting Advanced Persistent Threat (APT) with Open Source Too...RootedCON
 
.NET Cloud-Native Bootcamp Minneapolis
.NET Cloud-Native Bootcamp Minneapolis.NET Cloud-Native Bootcamp Minneapolis
.NET Cloud-Native Bootcamp MinneapolisVMware Tanzu
 
Unmasking Careto through Memory Forensics (video in description)
Unmasking Careto through Memory Forensics (video in description)Unmasking Careto through Memory Forensics (video in description)
Unmasking Careto through Memory Forensics (video in description)Andrew Case
 
Performance analysis and troubleshooting using DTrace
Performance analysis and troubleshooting using DTracePerformance analysis and troubleshooting using DTrace
Performance analysis and troubleshooting using DTraceGraeme Jenkinson
 
Attacking Embedded Devices (No Axe Required)
Attacking Embedded Devices (No Axe Required)Attacking Embedded Devices (No Axe Required)
Attacking Embedded Devices (No Axe Required)Security Weekly
 
The power of linux advanced tracer [POUG18]
The power of linux advanced tracer [POUG18]The power of linux advanced tracer [POUG18]
The power of linux advanced tracer [POUG18]Mahmoud Hatem
 
Securing Applications and Pipelines on a Container Platform
Securing Applications and Pipelines on a Container PlatformSecuring Applications and Pipelines on a Container Platform
Securing Applications and Pipelines on a Container PlatformAll Things Open
 
Security research over Windows #defcon china
Security research over Windows #defcon chinaSecurity research over Windows #defcon china
Security research over Windows #defcon chinaPeter Hlavaty
 
Using VPP and SRIO-V with Clear Containers
Using VPP and SRIO-V with Clear ContainersUsing VPP and SRIO-V with Clear Containers
Using VPP and SRIO-V with Clear ContainersMichelle Holley
 
Lec 10-linux-review
Lec 10-linux-reviewLec 10-linux-review
Lec 10-linux-reviewabinaya m
 
2017 - LISA - LinkedIn's Distributed Firewall (DFW)
2017 - LISA - LinkedIn's Distributed Firewall (DFW)2017 - LISA - LinkedIn's Distributed Firewall (DFW)
2017 - LISA - LinkedIn's Distributed Firewall (DFW)Mike Svoboda
 
CNIT 152: 9 Network Evidence
CNIT 152: 9 Network Evidence CNIT 152: 9 Network Evidence
CNIT 152: 9 Network Evidence Sam Bowne
 
CNIT 121: 9 Network Evidence
CNIT 121: 9 Network EvidenceCNIT 121: 9 Network Evidence
CNIT 121: 9 Network EvidenceSam Bowne
 

Semelhante a Blackhat USA 2016 - What's the DFIRence for ICS? (20)

Intro to sysdig in 15 minutes
Intro to sysdig in 15 minutesIntro to sysdig in 15 minutes
Intro to sysdig in 15 minutes
 
Live Memory Forensics on Android devices
Live Memory Forensics on Android devicesLive Memory Forensics on Android devices
Live Memory Forensics on Android devices
 
amrapali builders @@ hacking challenges.pdf
amrapali builders @@ hacking challenges.pdfamrapali builders @@ hacking challenges.pdf
amrapali builders @@ hacking challenges.pdf
 
Software is Eating The Data center
Software is Eating The Data centerSoftware is Eating The Data center
Software is Eating The Data center
 
10 Tips for AIX Security
10 Tips for AIX Security10 Tips for AIX Security
10 Tips for AIX Security
 
Easily emulating full systems on amazon fpg as
Easily emulating full systems on amazon fpg asEasily emulating full systems on amazon fpg as
Easily emulating full systems on amazon fpg as
 
Database Firewall with Snort
Database Firewall with SnortDatabase Firewall with Snort
Database Firewall with Snort
 
Jaime Blasco - Fighting Advanced Persistent Threat (APT) with Open Source Too...
Jaime Blasco - Fighting Advanced Persistent Threat (APT) with Open Source Too...Jaime Blasco - Fighting Advanced Persistent Threat (APT) with Open Source Too...
Jaime Blasco - Fighting Advanced Persistent Threat (APT) with Open Source Too...
 
.NET Cloud-Native Bootcamp Minneapolis
.NET Cloud-Native Bootcamp Minneapolis.NET Cloud-Native Bootcamp Minneapolis
.NET Cloud-Native Bootcamp Minneapolis
 
Unmasking Careto through Memory Forensics (video in description)
Unmasking Careto through Memory Forensics (video in description)Unmasking Careto through Memory Forensics (video in description)
Unmasking Careto through Memory Forensics (video in description)
 
Performance analysis and troubleshooting using DTrace
Performance analysis and troubleshooting using DTracePerformance analysis and troubleshooting using DTrace
Performance analysis and troubleshooting using DTrace
 
Attacking Embedded Devices (No Axe Required)
Attacking Embedded Devices (No Axe Required)Attacking Embedded Devices (No Axe Required)
Attacking Embedded Devices (No Axe Required)
 
The power of linux advanced tracer [POUG18]
The power of linux advanced tracer [POUG18]The power of linux advanced tracer [POUG18]
The power of linux advanced tracer [POUG18]
 
Securing Applications and Pipelines on a Container Platform
Securing Applications and Pipelines on a Container PlatformSecuring Applications and Pipelines on a Container Platform
Securing Applications and Pipelines on a Container Platform
 
Security research over Windows #defcon china
Security research over Windows #defcon chinaSecurity research over Windows #defcon china
Security research over Windows #defcon china
 
Using VPP and SRIO-V with Clear Containers
Using VPP and SRIO-V with Clear ContainersUsing VPP and SRIO-V with Clear Containers
Using VPP and SRIO-V with Clear Containers
 
Lec 10-linux-review
Lec 10-linux-reviewLec 10-linux-review
Lec 10-linux-review
 
2017 - LISA - LinkedIn's Distributed Firewall (DFW)
2017 - LISA - LinkedIn's Distributed Firewall (DFW)2017 - LISA - LinkedIn's Distributed Firewall (DFW)
2017 - LISA - LinkedIn's Distributed Firewall (DFW)
 
CNIT 152: 9 Network Evidence
CNIT 152: 9 Network Evidence CNIT 152: 9 Network Evidence
CNIT 152: 9 Network Evidence
 
CNIT 121: 9 Network Evidence
CNIT 121: 9 Network EvidenceCNIT 121: 9 Network Evidence
CNIT 121: 9 Network Evidence
 

Mais de Chris Sistrunk

Black Hat USA 2022 - Arsenal Labs - Vehicle Control Systems - Red vs Blue
Black Hat USA 2022 - Arsenal Labs - Vehicle Control Systems - Red vs BlueBlack Hat USA 2022 - Arsenal Labs - Vehicle Control Systems - Red vs Blue
Black Hat USA 2022 - Arsenal Labs - Vehicle Control Systems - Red vs BlueChris Sistrunk
 
BSidesHSV 2020 - Keynote - 2030: The Next Decade
BSidesHSV 2020 - Keynote - 2030: The Next DecadeBSidesHSV 2020 - Keynote - 2030: The Next Decade
BSidesHSV 2020 - Keynote - 2030: The Next DecadeChris Sistrunk
 
Derbycon 8 - We Are the Artillery: Using Google Fu to Take Down the Grid
Derbycon 8 - We Are the Artillery: Using Google Fu to Take Down the GridDerbycon 8 - We Are the Artillery: Using Google Fu to Take Down the Grid
Derbycon 8 - We Are the Artillery: Using Google Fu to Take Down the GridChris Sistrunk
 
BSidesJackson 2017 - Chris Sistrunk - Keynote
BSidesJackson 2017 - Chris Sistrunk - KeynoteBSidesJackson 2017 - Chris Sistrunk - Keynote
BSidesJackson 2017 - Chris Sistrunk - KeynoteChris Sistrunk
 
Advanced Persistent Dads - Threat Analysis
Advanced Persistent Dads - Threat AnalysisAdvanced Persistent Dads - Threat Analysis
Advanced Persistent Dads - Threat AnalysisChris Sistrunk
 
RSAC 2016: How to Get into ICS Security
RSAC 2016: How to Get into ICS SecurityRSAC 2016: How to Get into ICS Security
RSAC 2016: How to Get into ICS SecurityChris Sistrunk
 
BSidesAugusta 2015 - How to get into ICS security
BSidesAugusta 2015 - How to get into ICS securityBSidesAugusta 2015 - How to get into ICS security
BSidesAugusta 2015 - How to get into ICS securityChris Sistrunk
 
Master Serial Killer - DEF CON 22 - ICS Village
Master Serial Killer - DEF CON 22 - ICS VillageMaster Serial Killer - DEF CON 22 - ICS Village
Master Serial Killer - DEF CON 22 - ICS VillageChris Sistrunk
 
Protecting Your DNP3 Networks
Protecting Your DNP3 NetworksProtecting Your DNP3 Networks
Protecting Your DNP3 NetworksChris Sistrunk
 

Mais de Chris Sistrunk (9)

Black Hat USA 2022 - Arsenal Labs - Vehicle Control Systems - Red vs Blue
Black Hat USA 2022 - Arsenal Labs - Vehicle Control Systems - Red vs BlueBlack Hat USA 2022 - Arsenal Labs - Vehicle Control Systems - Red vs Blue
Black Hat USA 2022 - Arsenal Labs - Vehicle Control Systems - Red vs Blue
 
BSidesHSV 2020 - Keynote - 2030: The Next Decade
BSidesHSV 2020 - Keynote - 2030: The Next DecadeBSidesHSV 2020 - Keynote - 2030: The Next Decade
BSidesHSV 2020 - Keynote - 2030: The Next Decade
 
Derbycon 8 - We Are the Artillery: Using Google Fu to Take Down the Grid
Derbycon 8 - We Are the Artillery: Using Google Fu to Take Down the GridDerbycon 8 - We Are the Artillery: Using Google Fu to Take Down the Grid
Derbycon 8 - We Are the Artillery: Using Google Fu to Take Down the Grid
 
BSidesJackson 2017 - Chris Sistrunk - Keynote
BSidesJackson 2017 - Chris Sistrunk - KeynoteBSidesJackson 2017 - Chris Sistrunk - Keynote
BSidesJackson 2017 - Chris Sistrunk - Keynote
 
Advanced Persistent Dads - Threat Analysis
Advanced Persistent Dads - Threat AnalysisAdvanced Persistent Dads - Threat Analysis
Advanced Persistent Dads - Threat Analysis
 
RSAC 2016: How to Get into ICS Security
RSAC 2016: How to Get into ICS SecurityRSAC 2016: How to Get into ICS Security
RSAC 2016: How to Get into ICS Security
 
BSidesAugusta 2015 - How to get into ICS security
BSidesAugusta 2015 - How to get into ICS securityBSidesAugusta 2015 - How to get into ICS security
BSidesAugusta 2015 - How to get into ICS security
 
Master Serial Killer - DEF CON 22 - ICS Village
Master Serial Killer - DEF CON 22 - ICS VillageMaster Serial Killer - DEF CON 22 - ICS Village
Master Serial Killer - DEF CON 22 - ICS Village
 
Protecting Your DNP3 Networks
Protecting Your DNP3 NetworksProtecting Your DNP3 Networks
Protecting Your DNP3 Networks
 

Último

Advanced Views - Calendar View in Odoo 17
Advanced Views - Calendar View in Odoo 17Advanced Views - Calendar View in Odoo 17
Advanced Views - Calendar View in Odoo 17Celine George
 
Beyond the EU: DORA and NIS 2 Directive's Global Impact
Beyond the EU: DORA and NIS 2 Directive's Global ImpactBeyond the EU: DORA and NIS 2 Directive's Global Impact
Beyond the EU: DORA and NIS 2 Directive's Global ImpactPECB
 
Introduction to Nonprofit Accounting: The Basics
Introduction to Nonprofit Accounting: The BasicsIntroduction to Nonprofit Accounting: The Basics
Introduction to Nonprofit Accounting: The BasicsTechSoup
 
BAG TECHNIQUE Bag technique-a tool making use of public health bag through wh...
BAG TECHNIQUE Bag technique-a tool making use of public health bag through wh...BAG TECHNIQUE Bag technique-a tool making use of public health bag through wh...
BAG TECHNIQUE Bag technique-a tool making use of public health bag through wh...Sapna Thakur
 
The basics of sentences session 2pptx copy.pptx
The basics of sentences session 2pptx copy.pptxThe basics of sentences session 2pptx copy.pptx
The basics of sentences session 2pptx copy.pptxheathfieldcps1
 
mini mental status format.docx
mini mental status format.docxmini mental status format.docx
mini mental status format.docxPoojaSen20
 
Measures of Dispersion and Variability: Range, QD, AD and SD
Measures of Dispersion and Variability: Range, QD, AD and SDMeasures of Dispersion and Variability: Range, QD, AD and SD
Measures of Dispersion and Variability: Range, QD, AD and SDThiyagu K
 
Accessible design: Minimum effort, maximum impact
Accessible design: Minimum effort, maximum impactAccessible design: Minimum effort, maximum impact
Accessible design: Minimum effort, maximum impactdawncurless
 
Sports & Fitness Value Added Course FY..
Sports & Fitness Value Added Course FY..Sports & Fitness Value Added Course FY..
Sports & Fitness Value Added Course FY..Disha Kariya
 
Presentation by Andreas Schleicher Tackling the School Absenteeism Crisis 30 ...
Presentation by Andreas Schleicher Tackling the School Absenteeism Crisis 30 ...Presentation by Andreas Schleicher Tackling the School Absenteeism Crisis 30 ...
Presentation by Andreas Schleicher Tackling the School Absenteeism Crisis 30 ...EduSkills OECD
 
9548086042 for call girls in Indira Nagar with room service
9548086042 for call girls in Indira Nagar with room service9548086042 for call girls in Indira Nagar with room service
9548086042 for call girls in Indira Nagar with room servicediscovermytutordmt
 
Mastering the Unannounced Regulatory Inspection
Mastering the Unannounced Regulatory InspectionMastering the Unannounced Regulatory Inspection
Mastering the Unannounced Regulatory InspectionSafetyChain Software
 
Paris 2024 Olympic Geographies - an activity
Paris 2024 Olympic Geographies - an activityParis 2024 Olympic Geographies - an activity
Paris 2024 Olympic Geographies - an activityGeoBlogs
 
The byproduct of sericulture in different industries.pptx
The byproduct of sericulture in different industries.pptxThe byproduct of sericulture in different industries.pptx
The byproduct of sericulture in different industries.pptxShobhayan Kirtania
 
Z Score,T Score, Percential Rank and Box Plot Graph
Z Score,T Score, Percential Rank and Box Plot GraphZ Score,T Score, Percential Rank and Box Plot Graph
Z Score,T Score, Percential Rank and Box Plot GraphThiyagu K
 
Sanyam Choudhary Chemistry practical.pdf
Sanyam Choudhary Chemistry practical.pdfSanyam Choudhary Chemistry practical.pdf
Sanyam Choudhary Chemistry practical.pdfsanyamsingh5019
 
Separation of Lanthanides/ Lanthanides and Actinides
Separation of Lanthanides/ Lanthanides and ActinidesSeparation of Lanthanides/ Lanthanides and Actinides
Separation of Lanthanides/ Lanthanides and ActinidesFatimaKhan178732
 
Activity 01 - Artificial Culture (1).pdf
Activity 01 - Artificial Culture (1).pdfActivity 01 - Artificial Culture (1).pdf
Activity 01 - Artificial Culture (1).pdfciinovamais
 

Último (20)

Advanced Views - Calendar View in Odoo 17
Advanced Views - Calendar View in Odoo 17Advanced Views - Calendar View in Odoo 17
Advanced Views - Calendar View in Odoo 17
 
Beyond the EU: DORA and NIS 2 Directive's Global Impact
Beyond the EU: DORA and NIS 2 Directive's Global ImpactBeyond the EU: DORA and NIS 2 Directive's Global Impact
Beyond the EU: DORA and NIS 2 Directive's Global Impact
 
Mattingly "AI & Prompt Design: The Basics of Prompt Design"
Mattingly "AI & Prompt Design: The Basics of Prompt Design"Mattingly "AI & Prompt Design: The Basics of Prompt Design"
Mattingly "AI & Prompt Design: The Basics of Prompt Design"
 
Introduction to Nonprofit Accounting: The Basics
Introduction to Nonprofit Accounting: The BasicsIntroduction to Nonprofit Accounting: The Basics
Introduction to Nonprofit Accounting: The Basics
 
BAG TECHNIQUE Bag technique-a tool making use of public health bag through wh...
BAG TECHNIQUE Bag technique-a tool making use of public health bag through wh...BAG TECHNIQUE Bag technique-a tool making use of public health bag through wh...
BAG TECHNIQUE Bag technique-a tool making use of public health bag through wh...
 
The basics of sentences session 2pptx copy.pptx
The basics of sentences session 2pptx copy.pptxThe basics of sentences session 2pptx copy.pptx
The basics of sentences session 2pptx copy.pptx
 
mini mental status format.docx
mini mental status format.docxmini mental status format.docx
mini mental status format.docx
 
Measures of Dispersion and Variability: Range, QD, AD and SD
Measures of Dispersion and Variability: Range, QD, AD and SDMeasures of Dispersion and Variability: Range, QD, AD and SD
Measures of Dispersion and Variability: Range, QD, AD and SD
 
Accessible design: Minimum effort, maximum impact
Accessible design: Minimum effort, maximum impactAccessible design: Minimum effort, maximum impact
Accessible design: Minimum effort, maximum impact
 
INDIA QUIZ 2024 RLAC DELHI UNIVERSITY.pptx
INDIA QUIZ 2024 RLAC DELHI UNIVERSITY.pptxINDIA QUIZ 2024 RLAC DELHI UNIVERSITY.pptx
INDIA QUIZ 2024 RLAC DELHI UNIVERSITY.pptx
 
Sports & Fitness Value Added Course FY..
Sports & Fitness Value Added Course FY..Sports & Fitness Value Added Course FY..
Sports & Fitness Value Added Course FY..
 
Presentation by Andreas Schleicher Tackling the School Absenteeism Crisis 30 ...
Presentation by Andreas Schleicher Tackling the School Absenteeism Crisis 30 ...Presentation by Andreas Schleicher Tackling the School Absenteeism Crisis 30 ...
Presentation by Andreas Schleicher Tackling the School Absenteeism Crisis 30 ...
 
9548086042 for call girls in Indira Nagar with room service
9548086042 for call girls in Indira Nagar with room service9548086042 for call girls in Indira Nagar with room service
9548086042 for call girls in Indira Nagar with room service
 
Mastering the Unannounced Regulatory Inspection
Mastering the Unannounced Regulatory InspectionMastering the Unannounced Regulatory Inspection
Mastering the Unannounced Regulatory Inspection
 
Paris 2024 Olympic Geographies - an activity
Paris 2024 Olympic Geographies - an activityParis 2024 Olympic Geographies - an activity
Paris 2024 Olympic Geographies - an activity
 
The byproduct of sericulture in different industries.pptx
The byproduct of sericulture in different industries.pptxThe byproduct of sericulture in different industries.pptx
The byproduct of sericulture in different industries.pptx
 
Z Score,T Score, Percential Rank and Box Plot Graph
Z Score,T Score, Percential Rank and Box Plot GraphZ Score,T Score, Percential Rank and Box Plot Graph
Z Score,T Score, Percential Rank and Box Plot Graph
 
Sanyam Choudhary Chemistry practical.pdf
Sanyam Choudhary Chemistry practical.pdfSanyam Choudhary Chemistry practical.pdf
Sanyam Choudhary Chemistry practical.pdf
 
Separation of Lanthanides/ Lanthanides and Actinides
Separation of Lanthanides/ Lanthanides and ActinidesSeparation of Lanthanides/ Lanthanides and Actinides
Separation of Lanthanides/ Lanthanides and Actinides
 
Activity 01 - Artificial Culture (1).pdf
Activity 01 - Artificial Culture (1).pdfActivity 01 - Artificial Culture (1).pdf
Activity 01 - Artificial Culture (1).pdf
 

Blackhat USA 2016 - What's the DFIRence for ICS?

  • 1. What’s the DFIRence for ICS? Chris Sistrunk, PE Senior Consultant, FireEye @chrissistrunk Josh Triplett Senior Reverse Engineer, FireEye 1
  • 2. Agenda • Digital Forensics and Incident Response Overview • DFIR for ICS • What’s the DFIRence? • Embedded Devices • What to Collect • What to Analyze • RTU Examples • GE D20MX • VxWorks DFIR Tool • SEL-3530 RTAC 2
  • 3. Incident Response Overview “Find Evil” • Assess the situation • Define objectives • Collect evidence • Perform analysis • Communicate • Develop remediation plan • Document findings http://www.cumbriafire.gov.uk/about/photo/engines/incident-response.asp 3
  • 4. Digital Forensics Overview • Data Collection • Data Files • OS (volatile and non-volatile) • Network Traffic • Applications • Examination • Analysis • Reporting NIST SP 800-86 4
  • 5. Traditional DFIR tools Mature • Tools • Redline • Volatility • Websites • Cheatsheets • Books 5
  • 7. ICS anomaly  incident? • An anomaly of some kind has occurred • Increased network activity, strange behavior, failure • Now we need to investigate the anomaly • Is it known bad? • Is it unknown bad? • Do we escalate this to a security incident? • Who do we call? • Engineers, Admins, PR, Safety • Vendors 7
  • 9. ICS forensics collection tools • No ICS-specific DFIR tools…especially embedded devices • But, we can collect data manually using other tools 9
  • 10. Embedded devices: What to collect? Physical data • Exact location of device • Device description • Identifying info (manufacturer, S/N, P/N, name) • Connections (serial, ethernet, USB) • Front/back panel LED status • Power consumption • Temperature (if running hot) • Evidence of tampering Digital data • Running configuration (including user accounts) • Last-known good configuration • Running firmware, approved firmware • CPU usage %, Memory usage % (RAM, Storage) • Running processes • Active ports (serial, ethernet, USB, etc) • Logs (security, events) • Memory dump (if possible) 10
  • 11. Embedded devices: What to analyze? Find Evil…or ways for evil to do evil First Responders: ICS Engineer or Technician, Network Engineer, Vendor • What do the user and event logs reveal? (these need to be viewed first as they may rollover) • Does the configuration match the firmware? Is the firmware approved from FAT/SAT? • Running config / last known good config / standard config • Is the configuration and logic correct for the process? • Are communications (serial, ethernet, USB, wireless) normal as compared with known good? Vendor, Digital Forensics Specialist, Embedded Systems Analyst • Analyze embedded OS files, captured data at rest, captured data in transit • Volatile memory if possible (to look for code injection and potential rootkits) Fast Slower Time 11
  • 12. Let’s do DFIR on two substation RTUs 12
  • 14. Data Collection: D20MX Specs • 667 MHz embedded PowerQUICC II Pro • 1024 MB of 266 MHz DDR2 RAM with ECC • 16 MB NVRAM for persistent event storage • 8 MB boot flash, 256 MB firmware flash • VxWorks RTOS Tools to use • D20MX Product Documentation Binder.pdf • GE SGconfig software • Terminal (Tera Term, PuTTY) • WinSCP 14
  • 15. Data Collection: D20MX You will need three manuals from the binder pdf: 1. 994-0140 D20MX Substation Controller Instruction Manual • Chapter 11: Troubleshooting 2. B014-1NUG Westmaint II+ for D20MX User’s Guide • Shows how to use the D20 console interface, menus, error and user logs 3. SWM0080 D20MX Shells User’s Guide 15
  • 16. Data Collection: D20MX Error Log and User Log The error log tells what’s wrong with the configuration. The user log shows logins, logouts, and all user activity. Can be exported to CSV. This data also gets put into the syslog. 16
  • 17. The power of the 3 Shells • You can access the shell remotely with SSH, but the most powerful access is through the front serial port. • Some of these commands require assistance from GE unless you really know what you are doing. 17
  • 18. The main shell • D20M Shell is the main shell • Very similar to 68k monitor shell in older D20s • Incident Responders will want to collect data from this shell • All of the commands are explained in detail in the D20MX Shells UG 18
  • 19. Data Collection: D20MX • Running configuration  Use SGConfig, ConfigPro, or TeraTerm  Very common task • Last-known good configuration  Look in email, config database, engineer’s laptop, or it may be on a USB in the cabinet • Running firmware - img • CPU usage %, Memory usage %  pr – performance monitor  qr – query ram (volatile and nvram) • Running processes - qp 19
  • 20. Data Collection: D20MX Serial analyzer • Very popular shell command (what’s Wireshark?) • In the D20M shell, use  sa com# where # is the port number  Turn on logging in TeraTerm beforehand to save the traffic  This example is DNP3 20
  • 21. Data Collection: D20MX • Dump memory  si – shows system information including the memory base addresses  d – dumps memory, but you have to tell it where to start and stop (only available over serial connection) • Hand the output to someone who understands VxWorks for analysis • Look for strings, injected code, or rootkits 21
  • 22. Data Collection: D20MX VxWorks C Shell • OS level shell only accessible from the RS-232 port (access is denied from SSH) • Mainly used by GE customer support for troubleshooting VxWorks CMD Shell • OS 2nd level shell, accessed by typing cmd • VxWorks Kernel Shell Command Reference 6.9 • We can use some commands for forensics  d (dump), netstat, ipf (firewall), syslog, show devices, show drivers, show history, ifconfig, route, and even pcap! 22
  • 23. Example of live memory code injection & mem dump on the D20MX • Inject code via VxWorks C shell memory edit command m to simulate a rootkit [SCREENSHOTS OR VIDEO RECORDING HERE] • Collect volatile memory using the dump memory command d [SCREENSHOTS OR VIDEO RECORDING HERE] 23
  • 24. Data Collection: VxWorks DFIR Tool – Problem 24 • We need tools that enable us to perform DFIR on ICS and embedded devices.
  • 25. Data Collection: VxWorks DFIR Tool - Solution A collection of utilities that enable us to: • Read (and write) to memory on the device programmatically • We don’t want to have do dump memory manually • Cache the live memory locally • We shouldn’t need to fetch the same memory twice to check for different issues. • Compare the system image • Knowing the image is good is the first step toward looking somewhere else. • Provide the ability to read/write and cache device data to other tools • Tools can be written more generically when they don’t need to worry about how to get the data 25
  • 26. Data Collection: VxWorks DFIR Tool - Cool Features • Can easily accommodate different transport mechanisms • Serial • TCP/Serial bridges • Protocols specific to other dumping utilities • Supports caching • Allows resuming if connectivity is lost • Sparse memory dumping • Comparative analysis works on • Anything that looks like a seek-able Python File Object • Cache Files • Memory Dumps • Sparse Memory Maps • Special Objects that request live memory 26
  • 27. Data Collection: VxWorks DFIR Tool – Validating the host image 27
  • 28. Data Collection: VxWorks DFIR Tool - Cool Projects We Used • CLE Loads Everything – (angr/CLE) • Loads our system image and provides an abstraction to a process memory space • Identifies architecture, endianness, etc. • Will soon support relocatable images (important for modules like appl.out) • Capstone - Nguyen Anh Quynh • Easy access to disassemble exactly what we needed 28
  • 29. Data Collection: VxWorks DFIR Tool – Plans for the Future • Documentation • Expand the tool to work on other devices • Refine the scripts into easy-to-use modules • Moving the code to GitHub • Allow for feedback / feature requests / bug submissions 29
  • 30. Data Collection: SEL-3530 RTAC Specs • 533 MHz Power PC • 1024 MB DDR2 ECC RAM • 2GB Storage • Embedded SEL Linux Tools to use • SEL-3530 RTAC Instruction Manual • SEL-5033 Instruction Manual • SEL-5033 software • Web Browser (Chrome, FireFox, etc) • Terminal for SSH (Tera Term, PuTTY) 30
  • 31. Data Collection: SEL-3530 Digital data • Running configuration • User Accounts • Running firmware • CPU usage % • Memory usage % • POST checks • Reports (several) Physical Data • Password jumper 31
  • 32. Data Collection: SEL-3530 These are the screenshots from when I sent a malformed DNP3 message that caused the RTAC to lose the configuration. https://ics-cert.us-cert.gov/advisories/ICSA-13-219-01 32
  • 33. Data Collection: SEL-3530 • Section 3: Testing and Troubleshooting • Section 5: Web HMI and Logging • Section 6: Security • There are tags in the RTAC database that are assigned to help troubleshoot but are also useful for forensics as well. • Several log types • SOE report • IED report • syslog 33
  • 34. Data Collection: SEL-3530 • Example of IED Report • Can be accessed via web or ODBC (MS Access) • No Linux Shell • Pros & cons • No SSH Interface with RTAC • SSH used for engineering remote access to relays 34
  • 35. Data Collection: SEL-3530 • The RTAC can capture ethernet and serial traffic  SEL-5033 software and the Comm Monitor • AG2012-15 Using Wireshark® to Troubleshoot Protocol Communications Issues on an RTAC  DNP3 example • AG2015-15 Using Wireshark® to Decode RTAC Serial Line Messages and SEL Protocols  SEL Fast Messaging example • SEL published several serial Wireshark dissectors  SELFM, Telegyr 8979 35
  • 36. For Further Reading… • HD Moore’s blogpost on VxWorks from 2010. • https://community.rapid7.com/community/metasploit/blog/2010/08/02/shiny-old-vxworks- vulnerabilities • Metasploit module for VxWorks remote memory dump (wdbrpc_memory_dump) • David Odell’s blogpost on QNX from 2012. • https://www.optiv.com/blog/pentesting-qnx-neutrino-rtos • ICS-CERT recommended practices for ICS forensics • https://ics-cert.us-cert.gov/sites/default/files/recommended_practices/Forensics_RP.pdf 36
  • 37. For Further Reading… • Travis Goodspeed’s embedded device work on the MSP430 family • http://travisgoodspeed.blogspot.com/2007/11/ti-ez430-in-linux-with-iar-kickstart.html • http://travisgoodspeed.blogspot.com/2008/08/repurposing-ti-ez430u-part-3.html • Ralph Langner’s forensics work on Stuxnet payloads for Siemens PLCs • http://www.langner.com/en/wp-content/uploads/2013/11/To-kill-a-centrifuge.pdf • The Dec 23, 2015 Ukrainian Power Grid attack included writing over firmware of embedded Ethernet-serial converters. • https://ics.sans.org/media/E-ISAC_SANS_Ukraine_DUC_5.pdf 37

Notas do Editor

  1. Modified from the Mandiant IR services datasheet
  2. 1. “During collection, data related to a specific event is identified, labeled, recorded, and collected, and its integrity is preserved. In the second phase, examination, forensic tools and techniques appropriate to the types of data that were collected are executed to identify and extract the relevant information from the collected data while protecting its integrity. Examination may use a combination of automated tools and manual processes. The next phase, analysis, involves analyzing the results of the examination to derive useful information that addresses the questions that were the impetus for performing the collection and examination. The final phase involves reporting the results of the analysis, which may include describing the actions performed, determining what other actions need to be performed, and recommending improvements to policies, guidelines, procedures, tools, and other aspects of the forensic process.” From NIST SP 800-86
  3. You need to preserve the data if possible…even on embedded devices. There may be manual ways to dump the running configuration and maybe the volatile memory.
  4. Physical data is important no matter if you have an equipment database or not.
  5. When in doubt, read the manual! There usually is a section on troubleshooting, configuration or file transfer, and even shell commands.
  6. Current Issues: Slow data Collection - We averaged 2300 bytes per second over serial - This would take us about 5 days to dump the full 1GB memory space Unknown protocol availability - Dumping data to our serial-connected RPi was not conducive to actually getting work done
  7. I don’t need to know what you need to know in order to help. I can provide abstracted memory objects that simply let you read
  8. We utilize the Special Objects that request live memory and Cache Files.
  9. Here we see differences in the .text, .data, and .sdata sections. An attacker has injected code into the ipfirewall_start function that prevents the firewall from starting. Note: This is simply a “return 0;” The .data and .sdata were flagged as not matching the disk due to runtime data. Note: These were omitted to simplify the slide, not by some magical filtering that deemed the changes sane or safe.
  10. Appl.out is a relocatable image which poses a problem due to absolute-address instructions that reference a relocatable section. These are the only two projects I ended up sticking with.
  11. We need to check to see if there are any stops in place that prevent us from doing this or even saying we plan on doing this.
  12. Most of these can be collected from the RTAC webpage or through the SEL-5033 software