W32.Stuxnet Dossier, Installation and Propagation · Outline 1 Introduction 2 Architecture 3...

W32.Stuxnet Dossier, Installation and PropagationEnsimag-4MMSR-Network Security - Student Seminar1

david.souto@ensimag.imag.fr,daniil.yanenko@ensimag.imag.fr,florian.richter@ensimag.imag.fr

2012-04-18

1https://ensiwiki.ensimag.fr/index.php/4MMSR-Network_Security-2011-2012

Nicolas Falliere, Liam O Murchu, Eric Chien ()W32.Stuxnet Dossier 1/28 2012-04-18 1 / 28

Authors

Nicolas Falliere(Senior SoftwareEngineer)Liam O Murchu(Development Manager)Eric Chien(Technical Director)part of SymantecSecurity Response(antivirus and computersecurity research group,over 400 full-timeemployees)

SymantecFounded 1982Headquarters: MountainView, Californiaproviding security, storageand systems managementsolutionse. g. Norton products

Outline

1 Introduction

2 Architecture

3 Injection

4 Preparation

5 Propagation

6 Counter measures

7 Conclusion

Introduction

Outline

1 Introduction

2 Architecture

3 Injection

4 Preparation

5 Propagation

6 Counter measures

7 Conclusion

Introduction

Stuxnet

computer wormfirst discovered in June 2010first infected systems June 2009targets industrial control systems with PLC(Programmable Logic Controller) made by Siemensfor Windows XP, ME, 2000, 2003, Vista, 7, Server 2008

Introduction

Distribution

measured Sept. 29, 2010 (by monitoring traffic to Command &Control server)

Introduction

Attack Scenario

Architecture

Outline

1 Introduction

2 Architecture

3 Injection

4 Preparation

5 Propagation

6 Counter measures

7 Conclusion

Architecture

DLL file

Injection

Outline

1 Introduction

2 Architecture

3 Injection

4 Preparation

5 Propagation

6 Counter measures

7 Conclusion

Injection

there is no stuxnet-process,stuxnet hides in trustedprocessesinjection is performed on everycall of an exportinjects into trusted processgoal: hide from antimalware

Trusted processesProduct process nameKaspersky KAV avp.exeMcafee Mcshield.exeAntiVir avguard.exeBitDefender bdagent.exeEtrust UmxCfg.exeF-Secure fsdfwd.exeSymantec rtvscan.exeSymantec Common Client ccSvcHst.exeEset NOD32 ekrn.exeTrend Pc-Cillin tmpproxy.exeWindows Lsass.exeWindows Winlogon.exeWindows Svchost.exe

Preparation

Outline

1 Introduction

2 Architecture

3 Injection

4 Preparation

5 Propagation

6 Counter measures

7 Conclusion

Preparation Export 15

Export 15

Preparation Zero-day exploit

Zero-day exploit

exploits computer application vulnerabilities that are unknown toothers or the software developer beforeVulnerability window: time period between first exploitation anddevelopment of counter measuresAttack vector: a concrete way to exploit vulnerability

Preparation MS10-092: 0-day Task Scheduler

MS10-092: 0-day Task Scheduler

target platform: Windows Vista and higher (introduction of new TaskScheduler)goal: escalate privileges to SYSTEMtask information as xml file read- and writable by userintegrity protected by weak CRC32 checksum

Preparation MS10-092: 0-day Task Scheduler

MS10-092: 0-day Task Scheduler

Attack1 create task with low privileges2 read task configuration file from %SystemRoot%\system32\Tasks3 modify task configuration file (change privileges)4 calculate CRC32 of original file and adapt altered file to match it5 run task

Propagation

Outline

1 Introduction

2 Architecture

3 Injection

4 Preparation

5 Propagation

6 Counter measures

7 Conclusion

Propagation Peer-to-peer

Peer-to-peer

implements a Microsoft RPC server and clientautomatic updates in LAN

Propagation WinCC

WinCC (Windows Control Center)for supervision and controlling of Siemens’ industrial systemsMicrosoft SQL Server for loggingVulnerability: hardcoded publicly known and documented password inSQL server

Propagation WinCC

Infecting WinCC computers

connect as Administrator using password ’2WSXcder’create table with hex representation of main Stuxnet DLL:

CREATE TABLE sysbinlog ( abin image )INSERT INTO sysbinlog VALUES (0x...)

write dll to disk via OLE Automation Stored Proceduresadd as stored procedure and execute

SET @ainf = @aind + ‘\\sql%05x.dbi’EXEC sp_addextendedproc sp_dumpdbilog, @ainfEXEC sp_dumpdbilog

Propagation Network shares

Network shares

Two methods used:search for accessible network shares

search for other computers with same user accounts as local userfor all available credentials, try access $admin and $Cdrop stuxnet-dll on systemschedule task to execute stuxnet-dll

Windows RPC Vulnerability: MS08-67buffer overflow in Windows RPCalready used by Confickermore sophisticated implementation (employes recent techniques likeReturn Oriented Programming)

Propagation Printer spooler vulnerability

Printer spooler vulnerability

discovered April 2009, fixed Sept 14, 2010precondition: printer shared on targetgoal: remote code execution

Attackconnect to print spooler as guestprint two ”documents” to files in %SYSTEM%-directorythe files are ”printed” with print spooler’s instead guest’s of privileges

winsta.exe → stuxnet.dllwbem\mof\sysnullevnt.mof → registers event, to execute winsta.exe

Propagation Propagation via removable drive

LNK Vulnerability: MS10-046

Counter measures

Outline

1 Introduction

2 Architecture

3 Injection

4 Preparation

5 Propagation

6 Counter measures

7 Conclusion

Counter measures

For Stuxnet in particular:install recent security updates (for all used vulnerabilities exist fixesnow)

For similar future malwarenone, only impederequest software manufactures to fix known vulnerabilities quicklyinstall recent security updatesisolation (take network, usb-sticks, ... into account)

Conclusion

Outline

1 Introduction

2 Architecture

3 Injection

4 Preparation

5 Propagation

6 Counter measures

7 Conclusion

Conclusion

largest and costliest development effort in malware history(estimation: 10 million $)4 zero-day exploits2 compromised certificatesonly nation state capable to produce it→ cyberweapon

Conclusion For Further Reading

Aleksandr Matrosov Eugene Rodionov, David Harley and Juraj Malcho.“Stuxnet Under the Microscope - ESET”. In:http://go.eset.com/us/resources/white-papers/Stuxnet_Under_the_Microscope.pdf.Nicolas Falliere, Liam O Murchu and Eric Chien. “W32.Stuxnet Dossier”.In: http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxnet_dossier.pdf.Wikipedia. “Stuxnet”. In: http://en.wikipedia.org/wiki/Stuxnet.— . “Zero-day Attack”. In:http://en.wikipedia.org/wiki/Zero-day_attack.

W32.Stuxnet Dossier, Installation and Propagation · Outline 1 Introduction 2 Architecture 3...

Documents

Transcript of W32.Stuxnet Dossier, Installation and Propagation · Outline 1 Introduction 2 Architecture 3...

W32.Stuxnet Dossier · W32.Stuxnet Dossier Version 1.3 (November 2010) W32.Stuxnet Dossier Page 2 Security Response techniques, complex process injection and hooking code, network

Fighting malware and spam CONTENTS IN THIS ISSUE · W32/Klez Worm 17,659 0.38% W32/Hakaglan Worm 15,248 0.33% W32/Rjump Worm 12,257 0.27% W32/Parite File 11,680 0.25% W32/Sohanad

STUXNET. Summary What is Stuxnet? Industial Control Systems The target/s of Stuxnet. How Stuxnet spreads. The impact of Stuxnet on PLC’s.

W32.Stuxnet DossierW32.Stuxnet Dossier Page 3 Security Response Attack Scenario The following is a possible attack scenario. It is only speculation driven by the technical features

Stuxnet Final

W32.Stuxnet Dossier - Massachusetts Institute of Technology · 2016-01-29 · While the bulk of the analysis is complete, Stuxnet is an ... In this paper we take a de-tailed look

W32 Presentation

Stuxnet worm

W32.Stuxnet Dossier - Around Cyber€¦ · W32.Stuxnet has gained a lot of attention from researchers and me-dia recently. There is good reason for this. Stuxnet is one of the most

Combatting W32 Conficker Worm

APT Case Study - W32.Stuxnet Dossier - Purdue Engineering · PDF fileAPT Case Study - W32.Stuxnet Dossier Nicolas Falliere, ... - Siemens Simatic S7-300 PLC ... tt e sta da d so twa

Combating w32 Conficker Worm

W32.Stuxnet Dossier - WIRED · W32.Stuxnet Dossier Page 3 Security Response Attack Scenario The following is a possible attack scenario. It is only speculation driven by the technical

Stuxnet - a new generation of security problemswebuser.hs-furtwangen.de/~heindl/ebte-2011ws/Stuxnet...W32.Downadup (a.k.a Conficker), as well as the Microsoft Windows Print Spooler

w32 Duqu the Precursor to the Next Stuxnet

Stuxnet Virus

W32.Stuxnet Dossier - University Of Maryland · W32.Stuxnet Dossier Page 2 Security Response techniques, complex process injection and hooking code, network infection routines, peer-to-peer

W32.Stuxnet Dossier - WIRED · 2010-10-01 · While the bulk of analysis is complete, Stuxnet is an incredibly large and ... In this paper we take a de-tailed look at Stuxnet and

W32.Stuxnet Dossierit666/reading_list/ZeroDay/w32_stuxnet_dossier.pdf · W32.Stuxnet Dossier Page 3 Security Response Attack Scenario The following is a possible attack scenario.

Stuxnet dc9723