Dipl.-Inform. Carsten Eilers

Wie für die Heimautomation und das Internet der Dinge im Kleinen [40] gilt der alte Grundsatz der IT-Sicherheit für die Industriesteuerungen erst recht: Wenn es Schwachstellen gibt, werden die auch irgend wann ausgenutzt. Mit im Fall von Industriesteuerungen möglicherweise drastischen Folgen.

Das bisher nichts wirklich Schlimmes passiert ist, ist reines Glück. Alle bisher bekannt gewordenen Angriffe blieben für die Allgemeinheit folgenlos und tauchten meist nur in Form von Statistiken in Veröffentlichungen wie den "Year in Review"-Berichten des US-amerikanischen ICS-CERT auf [51]. Hoffen wir, dass das so bleibt!

Und hier noch die Links und Literaturverweise aus dem Artikel:

• [1] Sean Sullivan, F-Secure: "Espionage Attack Uses LNK Shortcut Files"
• [2] Chester Wisniewski, Sophos: "Windows zero-day vulnerability uses shortcut files on USB"
• [3] VirusBlokAda: "Rootkit.TmpHider" (auf Archive.org)
• [4] Microsoft Security Advisory "(2286198): Vulnerability in Windows Shell Could Allow Remote Code Execution"
• [5] Tareq Saade, Microsoft Malware Protection Center: "The Stuxnet Sting"
• [6] Alexander Gostev, Kaspersky: "Myrtus and Guava, Episode 2"
• [7] Chester Wisniewski, Sophos: "Certified uncertainty"
• [8] Sophos: "W32/Stuxnet-B"
• [9] Sean Sullivan, F-Secure: "More Analysis of Case LNK Exploit"
• [10] Graham Cluley, Sophos: "Yes, there's malware. But don't change your SCADA password, advises Siemens"
• [11] Siemens: "SIMATIC WinCC / SIMATIC PCS 7: Information about Malware / Viruses / Trojan horses"
• [12] Christopher Budd, Microsoft Security Response Center: "Out of Band Release to address Microsoft Security Advisory 2286198"
• [13] Holly Stewart, Microsoft Malware Protection Center: "Stuxnet, malicious .LNKs, ...and then there was Sality"
• [14] Microsoft Security Bulletin "MS10-046 - Critical: Vulnerability in Windows Shell Could Allow Remote Code Execution (2286198)"
• [15] Alexander Gostev, Kaspersky: "Myrtus and Guava, Episode MS10-061"
• [16] Liam O Murchu, Symantec: "Stuxnet Using Three Additional Zero-Day Vulnerabilities"
• [17] Nicolas Falliere, Symantec: "Stuxnet Introduces the First Known Rootkit for Industrial Control Systems"
• [18] Nicolas Falliere, Symantec: "Exploring Stuxnet’s PLC Infection Process"
• [19] Eric Chien, Symantec: "Stuxnet: A Breakthrough"
• [20] Frank Rieger, Knowledge Brings Fear: "stuxnet: targeting the iranian enrichment centrifuges in Natanz?"
• [21] William J. Broad, John Markoff, David E. Sanger; New York Times: "Israeli Test on Worm Called Crucial in Iran Nuclear Delay"
• [22] Marty Edwards, Todd Stauffer: "Control System Security Assessments"; 2008 Automation Summit (PDF)
• [23] Kim Zetter, Wired: "How Digital Detectives Deciphered Stuxnet, the Most Menacing Malware in History"
• [24] Paul Roberts, ThreatPost: "Report: Iran Resorts to Rip And Replace To Kill Off Stuxnet"
• [25] David Albright, Paul Brannan, Christina Walrond; Institute for Science and International Security: "Did Stuxnet Take Out 1,000 Centrifuges at the Natanz Enrichment Plant?" (auch als PDF)
• [26] David Albright, Paul Brannan, Christina Walrond; Institute for Science and International Security: "Stuxnet Malware and Natanz: Update of ISIS December 22, 2010 Report" (auch als PDF)
• [27] Symantec Security Response, Symantec: "Updated W32.Stuxnet Dossier is Available"
• [28] Richard Sale, ISSSource: "Stuxnet Loaded by Iran Double Agents"
• [29] David E. Sanger , New York Times: "Obama Order Sped Up Wave of Cyberattacks Against Iran"
• [30] Graham Cluley, Sophos: "Stuxnet: How USA and Israel created anti-Iran virus, and then lost control of it"
• [31] Geoff McDonald, Liam O Murchu, Stephen Doherty, Eric Chien; Symantec: "Stuxnet 0.5: The Missing Link" (PDF)
• [32] Ralph Langner, The Langner Group: "To Kill a Centrifuge - A Technical Analysis of What Stuxnet's Creators Tried to Achieve" (PDF)
• [33] Brian Krebs, Krebs on Security: "Cyber Intrusion Blamed for Hardware Failure at Water Utility"
• [34] Brian Donohue, ThreatPost: "Water Utility Damaged by Cyberattack"
• [35] Ellen Nakashima, The Washington Post: "Foreign hackers targeted U.S. water plant in apparent malicious cyber attack, expert says"
• [36] Kim Zettler, Wired: "Exclusive: Comedy of Errors Led to False ‘Water-Pump Hack’ Report"
• [37] pr0f auf Pastebin: loldhs pr0f
• [38] Chester Wisniewski, Sophos: "Interview with SCADA hacker pr0f about the state of infrastructure security"
• [39] Paul Roberts, ThreatPost: "Hacker Says Texas Town Used Three Character Password To Secure Internet Facing SCADA System"
• [40] Jan-Ole Malchow, Johannes Klick; 21. DFN-Workshop "Sicherheit in vernetzten Systemen": "Erreichbarkeit von digitalen Steuergeräten - ein Lagebild" (PDF)
• [41] Carsten Eilers: "Internet of (In)Security?", Entwickler Magazin 4.2014
• [42] Michael Mimoso, ThreatPost: "Shodan Search Engine Project Enumerates Internet-Facing Critical Infrastructure Devices"
• [43] Michael Mimoso, ThreatPost: "Hackers Aggressively Scanning ICS, SCADA Default Credentials, Vulnerabilities"
• [44] ICS-CERT Advisories
• [45] ICS-CERT Alerts
• [46] Carsten Eilers, JAXenter.de: "Die Heartbleed-Katastrophe: Wie funktioniert der Angriff und was kann passieren?"
• [47] ICS-ALERT-14-099-01: "Situational Awareness Alert for OpenSSL Vulnerability"
• [48] Wikipedia: "Unidirectional network"
• [49] genua: Datendiode zur sicheren Vernetzung von Maschinenanlagen und KRITIS
• [50] Daavid Hentunen, F-Secure: "Havex Hunts for ICS/SCADA Systems"
• [51] ICS-CERT - Other Reports
• [52] Steffen Wendzel, Sebastian Szlosarczyk; "Hack in the Box" Amsterdam 2014: "Alice’s Adventures in Smart Building Land – Novel Adventures in a Cyber Physical Environment"
• [53] Billy Rios, "Black Hat" Asia 2014: "Owning a Building: Exploiting Access Control and Facility Management Systems"
• [54] Lucas Apa, Carlos Mario Penagos; "Black Hat" USA 2013: "Compromising Industrial Facilities From 40 Miles Away"
• [55] Eric Forner, Brian Meixell; "Black Hat" USA 2013: "Out of Control: Demonstrating SCADA device exploitation"
• [56] Kyle Wilhoit, "Black Hat" USA 2013: "The SCADA That Didn't Cry Wolf- Who's Really Attacking Your ICS Devices- Part Deux!"
• [57] Dan Tentler, "Hack in the Box" Amsterdam 2013: "System Shock: The Shodan Computer Search Engine" (Präsentation als PDF)
• [58] Kyle Wilhoit, "Black Hat" Europe 2013: "Who's Really Attacking Your ICS Devices?"
• [59] Carsten Eilers: "SCADA-Systeme und Industriesteuerungen auf den Sicherheitskonferenzen ab 2010"

Ergänzend gibt es ab hier hier im Blog eine Serie von Artikeln mit einem Überblick über die Vorträge zu SCADA-Systemen und Industriesteuerungen auf den Sicherheitskonferenzen ab 2010.

Carsten Eilers