Jump to content

How To Plan An Industrial Cyber-sabotage Operation:


Recommended Posts

If you've been following the Stuxnet worm, you may have seen Ralph Langler's excellent analysis of the attack, published last week.

Stuxnet is probably the most interesting piece of malware I've ever covered, and the more we learn about it, the more it seems to have been ripped from the pages of a spy novel. A targeted attack that used four zero-day attacks, compromised digital certificates, inside knowledge of a specific industrial computer installation, it was launched by someone or some group that apparently didn't really care if its target ever found out about the attack.

I've been trying to get Ralph to give me an interview for several days now, but he's not ready to talk quite yet. In the interim, however, he did email me this blow-by-blow description of how he thinks Stuxnet was executed. To me, what he says seems completely credible. It's a very interesting description of an incredibly sophisticated operation.

Did it work? Who was really behind it? We may never know the answer to those questions.

Here's Ralph's write-up. The word Myrtus appears in one of the worm's drivers:

The best way to approach Stuxnet is to think of it as part of an operation – operation myrtus. Operation myrtus can be broken down into three major stages: Preparation, infiltration, and execution.

Stage 1, preparation:

- Assemble team, consisting of multiple units (intel, covert ops, exploit writers, process engineers, control system engineers, product specialists, military liaison)

- Assemble development & test lab, including process model

- Do intel on target specifics, including identification of key people for initial infiltration

- Steal digital certificates

Stage 2, infiltration:

- Initial infiltration using USB sticks, perhaps using contractor's comprised web presence

- Weapon spreads locally via USB stick sharing, shared folders, printer spoolers

- Contact to command & control servers for updates, and for evidence of compromise (important)

- Update local peers by using embedded peer-to-peer networking

- shut down CC servers

Stage 3, execution:

- Check controller configuration

- Identify individual target controllers

- Load rogue ladder logic

- Hide rogue ladder logic from control system engineers

- Check PROCESS condition

- Activate attack sequence

What this shows is that the 0day exploits were only of temporary use during the infiltration stage. Quite a luxury for such sophisticated exploits! After the weapon was in place, the main attack is executed on the controllers. At that point, where the rogue ladder logic is executed, it’s all solid, reliable engineering – attack engineering.

Source: http://blogs.csoonline.com/1260/how_to_pla...look_at_stuxnet

Link to comment
Share on other sites

In an attack like this, the attacker(s) must always have a clear picture in his head of what is inside and outside the box.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Create New...