Stuxnet [HackSoc]

Overview of the Student malware, based on research for coursework. Given at Abertay Ethical Hacking Society at some point second half of 2014.

Transcript

1. Stuxnet WARFARE CYBER URANIUM **APT** TeH ALL
2. Stuxnet World First Cyber-Physical Attack
3. Wtf is Stuxnet? Cyber physical - uses cyberspace as medium to attack physical target World first (that we know of…) cyber weapon to be deployed by nation state(s) Extremely complex - 0dayz and stolen certs AWESOME - from an offensive POV Technically a Worm
4. The Target Iran’s nuclear program Specifically: Their main Fuel Enrichment Plant (FEP) Natanz International Atomic Energy Agency (IAEA) estimates Approx. 7000-9000 centrifuges (2009)
5. Irans Nuclear Program: Background Using gas enrichment IR-1 centrifuge from late 60’s/ 70’s Plans bought from former pakistanti nuclear scientist Design of IR-1 obsolete - reliability issues as early as late 80’s Most technology used obsolete
6. Natanz: Security Hardened facility: 22M underground, reinforced concrete roof, 2.5M concrete walls Air-gapped (not connected to the internet)
7. Cyber Physical: wtf? Three Layers One: IT Two: Industrial Control Systems (ICS) Three: Physical Layer
8. Cyber Physical: wtf? Three Layers One: IT Two: Industrial Control Systems (ICS) Three: Physical Layer Physical Level Cascade Protection System Centrifuge Drive System
9. Attack Routine One “Complex” - Circa 2008
10. Attack Routine One: Target Siemens S7-417 Industrial Control System (ICS) Essentially an automation platform One S7 had control of 6 Cascades (984 Centrifuges) Goal: Over pressurise centrifuges
11. Attack Routine One: Propgation USB devices Siemens Config file Didn’t infect machines unless they had siemens config software installed No engineering software = no propagation
13. Attack Routine One: The Magic Primarily active at the ICS layer Legit code still runs Essentially a Man in the Middle Feeds fake sensor values to the legit code Isolates cascade > keep pumping gas in
14. Attack Routine One: The Magic Process control logic capable of altering output disabled All output/ escape valves located in first & last 2 stages closed Emergency “Exhaust” valve is closed loop.. not so simple.
15. – Lagner To Kill a Centrifuge (2013) “The pressure controller can be told what the “real” pressure is for given analog signals and then automatically linearize the measurement to what would be the “real” pressure. If the linearization is overwritten by malicious code on the S7-417 controller, analog pressure readings will be “corrected” during the attack by the pressure controller, which then interprets all analog pressure readings as perfectly normal pressure no matter how high or low their analog values are”
16. Attack Routine One: Result Slow & methodical sabotage Over engineered Not cause catastrophic failure during execution but shorten working life of centrifuges Confuse Natanz engineers
17. Attack Routine Two “Simple” but pimp’d son - Circa 2009
18. Attack Routine Two: Target Centrifuge Drive System (CDS) - controls rotor speed Much smaller Siemens S7-315 ICS (164 Centrifuges) Goal: Take centrifuges through critical resonance (make them spin too fast) New code still contained first attack routine however is was dormant
19. Attack Routine Two: Propagation Trusted logical networks (VPNs) USB > now any machine it could Suggests loss of ability to directly infect via authorised personal
21. Attack Routine Two: Pimpin Ain’t Easy Multiple Windows Zero Days (4, like seriously 4) Stolen Driver certs (RealTek & JMicron) Exploits SCADA vulns New team? First routine probably made by ICS sec experts. This time probably real hackerz
22. Attack Routine Two: The Magic Legit code suspended IR-1 operating speed normally 63,000rpm Probably wouldn't cause much damage
23. Attack Routine Two: The Magic Attack run again 1 month later Slowed to 120rpm Then brought back up to speed Again probably didn’t cause much damage Why wasn’t this detected?
24. Attack Routine Two: Result Again not trying to cause catastrophic failure Put rotor motors under higher than expected stress to cause shorter operational life
25. Effectiveness Probably did slow down the Iranian enrichment program down By what factor is unknown Unknown number of centrifuges actually taken out
26. Observations Very different methodologies in first & second routines Nation State = very likely BUT attack possible from non nation party Unbelievably intricate working/ functional knowledge of Natanz Spread to other nations result of second routine propagating over virtual networks (VPN) Authors had no way to stop or recall Designed to work autonomously even after being cut off from C&C Bad opsec Natanz staff failed to notice significant network interaction between SCADA and PLCs
27. Mitigation Highlights biggest issue in ICS security Everyone uses same ICS, nearly identical configurations from only a few vendors Exploited features of ICS not vulns Complete rethink/ rebuilding of the way we defend infrastructure like this Ensure this kind of attack only possible by nation states Very hard to defend against this type of threat
28. Questions?