Stuxnet: Cómo tomar el control de una Planta Nuclear

©2011 Check Point Software Technologies Ltd. [PROTECTED] — All rights reserved.

Stuxnet: How to Take Over a (Nuclear) Power Plant

Tomer Teller, Security Evangelist

April 2011

2 2 ©2011 Check Point Software Technologies Ltd. [PROTECTED] — All rights reserved. |

The Idea Behind Stuxnet

Simple!

We don’t want Iran to get the bomb

Sabotage the uranium enrichment process


Real-time control system

Controls:

– Valves

– Drive speed

Does not run Windows

But..

The Target


Operator Hello?

We are in Business

Operator (Field PG)

Controller (PLC)


The Operation

Drop Malware Reprogram Controller (Payload)

Target: Centrifuge in Natanz Mission Goal: No Nukes


Agenda

1 Terminology

Stuxnet Overview 2

Infiltration, Propagation and Exploitation 3

Summary 4


Terminology I

Exploit Software that takes advantage of

a bug in order to cause unintended

behavior (getting inside)

Worm Malware that replicates itself within

the network (propagate)

Payload The actual malicious activity,

e.g., delete file, download file

(create damage)


Terminology II

PLC

A Programmable Logic

Controller (PLC) —

control of machinery on

factory assembly lines

Field PG Typical Windows machines,

used to program PLCs

Field PG PLC


Visual Terminology

Operator (Field PG)

Controller

Industrial Machinery


“Groundbreaking” Worm

So what is so special about Stuxnet?

Why is it ―groundbreaking?‖

While We Are In This Room…

More than 50,000 new worms are propagating on the Internet

~1000 of them are undetected by antivirus

~1–2 employ unknown vulnerabilities (0-day)


Stuxnet Overview

Architecture

Single file

(Archive)

Exploits

4 unknown

Windows bugs

2 stolen

certificates

PLC pre-recorded

commands

Techniques

Antivirus evasion

Peer-2-Peer

network

Command and

control


Infection Statistics

This is not normal…

Number of Unique Infected Hosts by Country


Welcome to the Battlefield

The Bushehr Nuclear Power Plant, Iran


Operator PC (Windows)

Field PG PLC

What’s Going To Happen?

Found

Operator

Internal

Network


Typical PLC Deployment (Goal)


Field PG PLC

Internal

Network

Write

Read

Water pipe Pipeline Gas centrifuge


Infiltrate the power plant

GOAL:

Reprogram the controller

Mission Objectives:

Propagate inside the network

Infect the operator computer


Mission #1: Introduce Threat To Target Network


The Infection

Infected a willing or unknowing third party – An insider

– A contractor

– A SCADA Conference USB give-away

The original infection was most likely introduced by a removable drive


Getting From the USB to the Computer

Stuxnet Used Two Methods to Infect the

Computer via USB

Method #1

Malformed

shortcut file

(.LNK)

Method #2

Autorun

design flaw

(.INI)


Method #1: The LNK Vulnerability

Design-level flaw in Windows Desktop Explorer (not Internet Explorer) when viewing shortcuts

Shortcut Properties

File Name: Shortcut

File Size: 1 KB

ICON Location: c:\icon

In our scenario,

this file was the

Stuxnet worm d:\bad_file


How Stuxnet Exploits This Vulnerability

Stuxnet

Arrives on a

Removable

Drive (USB)

The Stuxnet worm

Shortcut file that points at the worm

Once

Viewed and

Exploited

Hides the files on the USB

Hides itself from antivirus


Autorun.inf—“Cunning” Hack

An Autorun.inf file is a configuration file placed on removable drives that instructs Windows to automatically execute a file when inserted

STUXNET’s CODE

[autorun]

OPEN = setup.exe

Filename:

autorun.inf

Stuxnet

AutoRun


Autorun.inf—“Cunning” Hack

An Autorun.inf file is a configuration file placed on removable drives that instructs Windows to automatically execute a file when inserted

STUXNET’s CODE

[autorun]

OPEN = setup.exe

Filename:

autorun.inf

Stuxnet

AutoRun


But, Files Are Visible on the USB Drive…

Catch Me If You Can


But, Files Are Visible on the USB Drive…

Catch Me If You Can

Files are still there.

We just don’t list them anymore


ANY * ANY * INFECT

Stuxnet Used Two Methods to

Infect the Computer via USB


Compromised Certificates

Both of these companies seem to have offices

in the Hsinchu Science and Industrial Park (Taiwan),

which could indicate an insider job

These Kinds of Activities Require a Legitimate

Certificate Signed and Trusted by Microsoft


DEMO TIME

Autorun.inf

LNK vulnerability (MS10-046)



Field PG PLC

Mission #1 Completed

Internal

Network



GOAL:


Mission Objectives:




Microsoft Knew About This One,

and Claimed it Wasn’t Critical Enough

Network Example

To Printer

To File

Admin Area


Stuxnet Communication Components

Communicate via Peer-2-Peer

Communicate with attackers

Infected machine

acting as Client

Infected machine

acting as Server

Get Version

Send Version

Request Update

Send Update

Master?

Do X

Do Y

Attackers

Internet


Internet


Field PG PLC

Mission #2 Completed

Found

Operator

Internal

Network

Ping

Alive!

C&C



GOAL:


Mission Objectives:




This is a rootkit – Software which

subverts the operation system

Mission #3: Infecting The Target

Monitors PLC commands being written and read

Infects a PLC by inserting bad commands

Masks the fact the PLC is infected

When Stuxnet Reaches a Field PG,

It Installs a Trojan Horse That:


Infected PLC Example (READ/WRITE)

Operator (Field PG) Controller Operation

Change

Speed

Infected

with

Stuxnet

5

Pre-recorded value

500 5

Operation

Monitor

Speed

5

Show expected value

500 5


Mission Objectives:




GOAL:



Mission Objectives:




GOAL:


Mission

Accomplished!!


Summary

Complex Stuxnet is a very sophisticated threat

Quiet Built to stay ―under the radar‖

Dedicated Targeted Iranian nuclear plant

Expensive Used 4 unknown vulnerabilities

Blueprint Stuxnet is a template for criminals

Productivity Can target other companies


Questions


Thank You

Tomer Teller, Security Evangelist

Email : [email protected]

mailto:[email protected]

Date post:	18-Nov-2014
Category:	Technology
Upload:	cxo-community
View:	1,852 times
Download:	1 times

Stuxnet: Cómo tomar el control de una Planta Nuclear

Technology