Incubation of ICS Malware (English)

10

Click here to load reader

description

Dale Peterson and Corey Thuen pinch hit for Kyle Wilhoit to present his concept of malware incubation. It is creating a realistic environment for malware to be grown so that it can be studied and help with incident response.

Transcript of Incubation of ICS Malware (English)

Page 1: Incubation of ICS Malware (English)
Page 2: Incubation of ICS Malware (English)

SCADA Honeypots

• A device or system (Honeynet) that is on a live network, but has no operational purpose– Different levels of interaction / realism– How long will it fool an attacker

Page 3: Incubation of ICS Malware (English)

Detect Attacks

• Nothing should access the Honeypot since it has no legitimate purpose

• Any traffic is either an attack or spurious traffic

• Debate on the value of Honeypot’s in detecting attacks– Many say there are better, more efficient

solutions– IDS and other network monitoring

Page 4: Incubation of ICS Malware (English)

Learn How Attackers Work

• Real value of the Honeypot• High interaction may lead to attacker

revealing advanced techniques, end goals, other info

• Decision … how exposed is the Honeypot?– Widely exposed (on Internet) many will hit the

Honeypot and lots of data to review– Hidden on secure network, may see little

activity

Page 5: Incubation of ICS Malware (English)
Page 6: Incubation of ICS Malware (English)

Analysis is Important

Page 7: Incubation of ICS Malware (English)
Page 8: Incubation of ICS Malware (English)

Incubator

Page 9: Incubation of ICS Malware (English)

Why An Incubator?

• Be prepared to analyze malware / attacks• Identify what the attack did so you can fix

the affected systems• Learn what information or control was lost• Attempt to identify the attacker

Page 10: Incubation of ICS Malware (English)

INCUBATION HANDBOOK - Yonkin Farm - Welcome · INCUBATION HANDBOOK Brinsea – The Incubation Specialists Incubation Handbook Brinsea – The Incubation Specialists Brinsea Products

INCUBATION HANDBOOK - Yonkin Farm - Welcome · INCUBATION HANDBOOK Brinsea – The Incubation Specialists Incubation Handbook Brinsea – The Incubation Specialists Brinsea Products

Cyber Threat Landscape The Uncharted Industrial · The Reality – Defense is Doable •Industrial infrastructures are some of the most ... -Campaigns: Sandworm-ICS Malware: Stuxnet

Cyber Threat Landscape The Uncharted Industrial · The Reality – Defense is Doable •Industrial infrastructures are some of the most ... -Campaigns: Sandworm-ICS Malware: Stuxnet

DETECTING AND PROTECTING AGAINST · 84 control system (ICS) application white listing, malware detection and mitigation, change control 85 management, user authentication and authorization,

DETECTING AND PROTECTING AGAINST · 84 control system (ICS) application white listing, malware detection and mitigation, change control 85 management, user authentication and authorization,

Dream Incubation

Dream Incubation

Incubation Guide

Incubation Guide

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Improving accuracy of malware detection by …...FFRI, Inc. Background – malware and its detection 4 Increasing malware Targeted Attack (Unknown malware) Malware generators Obfuscators

Moist Air Incubation And Deep Matrix Incubation Box.

Moist Air Incubation And Deep Matrix Incubation Box.

Business incubation

Business incubation

TRISIS Malware - · PDF file2 TL: WITE information may be distribted withot restriction Executive Summary In mid-November 2017, the Dragos, Inc. team discovered ICS-tailored malware

TRISIS Malware - · PDF file2 TL: WITE information may be distribted withot restriction Executive Summary In mid-November 2017, the Dragos, Inc. team discovered ICS-tailored malware

Poultry Incubation

Poultry Incubation

Knowledge needed to develop malware to infect and impact … · introduced and recently businesses have started to integrate ICS with regular Information Technology (IT). These changes

Knowledge needed to develop malware to infect and impact … · introduced and recently businesses have started to integrate ICS with regular Information Technology (IT). These changes

Good Incubation

Good Incubation

Malware & Anti-Malware

Malware & Anti-Malware

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Intrusion Detection and Malware Analysis - Malware collection134.2.173.140/lehre/ws10/ids-malware/12-malware-collection.pdf · Intrusion Detection and Malware Analysis Malware collection

Analyzing Malware Detection Effectiveness with Multiple Anti- Malware Programs Shouhuai Xu CS @ UTSA Ravi Sandhu ICS @ UTSA Jose A. Morales SEI @ CMU.

Analyzing Malware Detection Effectiveness with Multiple Anti- Malware Programs Shouhuai Xu CS @ UTSA Ravi Sandhu ICS @ UTSA Jose A. Morales SEI @ CMU.

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] Felix.Leder@norman.com 5. desember 2011 malware

Malware Fails Best Bugs in Malware Felix Leder [Malware ... · 1 Malware Fails Best Bugs in Malware Felix Leder [Malware Detection Team] [email protected] 5. desember 2011 malware

Evolution of ICS Attacks and the Prospects for Future ... · discovery of Stuxnet in 2010. •[1] •[2] Since this ground-breaking, epoch-defining malware emerged, ICS asset owners

Evolution of ICS Attacks and the Prospects for Future ... · discovery of Stuxnet in 2010. •[1] •[2] Since this ground-breaking, epoch-defining malware emerged, ICS asset owners

Design Incubation

Design Incubation

Circadian Incubation

Circadian Incubation

Outsourcing Incubation - Incubation As A Service

Outsourcing Incubation - Incubation As A Service