physical malware attack - york university · similar attack was used in the german steel plant....

13

CASE STUDY : GERMAN STEEL PLANT ATTACK * PHYSICAL MALWARE ATTACK

Upload: others

Post on 11-Aug-2020

0 views

Category:

Documents

0 download

Report

Download

Embed Size (px):

TRANSCRIPT

Page 1: PHYSICAL MALWARE ATTACK - York University · Similar attack was used in the German steel plant. With malicious email, attackers were able to gain access into the company production

CASE STUDY : GERMAN STEEL PLANT ATTACK

*PHYSICAL MALWARE ATTACK

Page 2: PHYSICAL MALWARE ATTACK - York University · Similar attack was used in the German steel plant. With malicious email, attackers were able to gain access into the company production

*

Page 3: PHYSICAL MALWARE ATTACK - York University · Similar attack was used in the German steel plant. With malicious email, attackers were able to gain access into the company production

Attack occurred at a German steel plant

Spear phishing is a common form of phishing attack usually targeting corporations and military organizations

Mostly due to human error that could have been avoided

IT infrastructure was not up-to-date with latest technology

Mostly government security agencies and elite hackers hired by corporations conduct such attacks

Background knowledge of employees are somehow obtained and then used by the hackers in their social engineering exploit

Group behind attack advanced persistent threat(APT)

Page 4: PHYSICAL MALWARE ATTACK - York University · Similar attack was used in the German steel plant. With malicious email, attackers were able to gain access into the company production

Page 5: PHYSICAL MALWARE ATTACK - York University · Similar attack was used in the German steel plant. With malicious email, attackers were able to gain access into the company production

This form of attack is directed towards specific organizations such as financial institutions and military organizations

The spoofed email looks like it comes from a legitimate source

Usually harvested by the top one percent elite

Directed towards people with little or no technical background, it relies heavily on social engineering

*

Page 6: PHYSICAL MALWARE ATTACK - York University · Similar attack was used in the German steel plant. With malicious email, attackers were able to gain access into the company production

Page 7: PHYSICAL MALWARE ATTACK - York University · Similar attack was used in the German steel plant. With malicious email, attackers were able to gain access into the company production

Similar attack was used in the German steel plant. With malicious email, attackers were able to gain access into the company production network.

The attackers were an expert in an industrial control systems and they were able to bypass various security systems provided by the company production network.

They were able to tamper the blast furnace. And due to the system failure one of the blast furnaces could not be shutdown. (Overriding systems also fail , due to use of specialized software).

*

Page 8: PHYSICAL MALWARE ATTACK - York University · Similar attack was used in the German steel plant. With malicious email, attackers were able to gain access into the company production

Worm that attacks programmable logic computer that manage industrial complexes

Fakes sensor signals so the system does not shut down when it should

Worm that causes physical damage

Was used to famously attack Iran's Nuclear centrifuges

Huge change from regular uses of viruses and worms

*

Page 9: PHYSICAL MALWARE ATTACK - York University · Similar attack was used in the German steel plant. With malicious email, attackers were able to gain access into the company production

Page 10: PHYSICAL MALWARE ATTACK - York University · Similar attack was used in the German steel plant. With malicious email, attackers were able to gain access into the company production

Business network connected to production network. Those two should be separate.

Implement security policies to educate.

Employ early intrusion detection systems and firewalls.

*

Page 11: PHYSICAL MALWARE ATTACK - York University · Similar attack was used in the German steel plant. With malicious email, attackers were able to gain access into the company production

*

Page 12: PHYSICAL MALWARE ATTACK - York University · Similar attack was used in the German steel plant. With malicious email, attackers were able to gain access into the company production

1. Who will be interested in doing such a thing?

2. How do you protect Industrial control systems (ICS) from such attack?

3. How should the industry deal with such attacks?

Page 13: PHYSICAL MALWARE ATTACK - York University · Similar attack was used in the German steel plant. With malicious email, attackers were able to gain access into the company production

http://www.fbi.gov/news/stories/2009/april/spearphishing_040109

http://blog.lumension.com/9630/german-steel-works-suffered-massive-damage-after-hack-attack/

http://www.mirror.co.uk/news/technology-science/technology/malicious-hackers-use-simple-email-4977018

http://papers.duckdns.org/files/2011_IECON_stuxnet.pdf

http://www.securityweek.com/cyberattack-german-steel-plant-causes-significant-damage-report

*

http://www.fbi.gov/news/stories/2009/april/spearphishing_040109

http://blog.lumension.com/9630/german-steel-works-suffered-massive-damage-after-hack-attack/

http://www.mirror.co.uk/news/technology-science/technology/malicious-hackers-use-simple-email-4977018

http://papers.duckdns.org/files/2011_IECON_stuxnet.pdf

http://www.securityweek.com/cyberattack-german-steel-plant-causes-significant-damage-report

Optimal Inspection Points for Malicious Attack Detection ...tndinh/papers/cocoon14.pdf · Optimal Inspection Points for Malicious Attack Detection 3 { The center node rwhich represents

Malicious Attack Corporate Awareness and Walk through Date 29 September 2011

Malicious Attack Corporate Awareness and Walk through Date 29 September 2011

Attackers Exploit Defensive Gaps · Exploit kit activity fell exploits dropped 34% 88% Preferred attack vectors: Attackers Shifting Attack Methods more prevalent than other types

Disrupting the attack lifecycle: how do attackers behave?€¦ · Terraforming Attacker data helps visualize likely attacker paths Determine which is the hardest path for attackers

The Principles of Modern Attacks Analysis for Penetration ...docshare04.docshare.tips/files/29321/293219355.pdfdistributed denial of service attack. To perform a DDOS attack, attackers

Optimal Inspection Points for Malicious Attack Detection

Two Quarantine Models on the Attack of Malicious Objects

Cyber Liability and Malicious Attack

The Cybercrime Economics of Malicious Macros...Research Report | The Cybercrime Economics of Malicious Macros 3 Executive Summary Attack techniques come and go as technology and user

Disease: Life and Death Attack and Defense. The Attackers BacteriaVirusesFungiParasites

Comprehensive Study of Selective Forwarding Attack in ... · of selective forwarding attack and malicious nodes. On ... Detecting Selective Forwarding Attacks in Wireless ... to detect

PROTECTING CONNECTED DEVICES AGAINST …files.informatandm.com/uploads/2017/5/CSA_Group...Service (DDoS) attack in the U.S. dramatically demonstrated the impact of a malicious attack

Issues of attack in distributed systems - A Generic Attack ... · Issues of attack in distributed systems 5 2.1 Attackers An attacker might fall into one of the following three categories

Introduction to Malicious Code (Malware) - Chalmers Maliciou… · Introduction to Malicious Code (Malware) ... • But what type of content is safe? ... Salami attack Usesseemingly

MALCOM: Generating Malicious Comments to Attack Neural ...pike.psu.edu/publications/icdm20.pdfneural fake news detectors via malicious comments. Therefore, in this paper, we formulate

Introduction to Malicious Code (Malware) - Chalmers · Introduction to Malicious Code (Malware) ... • But what type of content is safe? Targeted attacks ... • Salami attack

e d i t i o n · Script-Based Attack Protection Detects attacks by malicious scripts that try to exploit Windows PowerShell. Also detects malicious JavaScripts that can attack via

Detection and Prevention of Blackhole Attack in Wireless Sensor …ijsrcseit.com/paper/CSEIT1723234.pdf · 2017-06-06 · f) Blackhole Attack: In blackhole attack, a malicious node

Taming the Malicious Web · • Web is one of the key delivery mechanisms for malware today • Detecting malicious web pages is difficult – the web is large! – attackers have

FRAUD WITHOUT BORDERS - risk.lexisnexis.com services... · INDUSTRY All Key Regions Represented in the Top Attackers List 171% Growth in Mobile App Attack Rate YOY 401M Attack Volume

How Many Attackers Can Selﬁsh Defenders Catch?mavronic/pdf/HAWAII.pdfHow Many Attackers Can Selﬁsh Defenders ... Since malicious attacks are independent, ... with a Fractional

Finding Shilling Attack in Recommender System …ksiresearchorg.ipage.com/seke/seke18paper/seke18paper...malicious attacks, especially shilling attack because of data openness and

Introduction to Cybersecurity Best Practices · Hackers, Attackers and Individuals with Malicious Intent Regardless of what you call them – hackers, attackers or individuals with

1 Figure 4-16: Malicious Software (Malware) Malware: Malicious software Essentially an automated attack robot capable of doing much damage Usually target-of-opportunity

& Honeypotsjulien.desfossez.free.fr/doc/SEINIT_4_INET04_IDS.pdf · attacks Tools Attackers Intruder Knowledge Attack Sophistication “stealth” / advanced scanning techniques burglaries

Chapter 3 Adversarial Attack · Chapter 3 Adversarial Attack Consider a data point x 0 2Rd belonging to class C i.Adversarial attack is a malicious attempt which tries to perturb

Chapter 1 Viruses: Attack of the Malicious Programs

Malicious Control System Cyber Security Attack Case Study ... · Malicious Control System Cyber Security Attack Case Study– Maroochy Water Services, Australia. 1. Marshall Abrams,

On Tracing Attackers of Distributed Denial-of-Service Attack through

Android malware detection based on system call sequences ... · target of malicious attackers for its popularity and openness. The survey [13]reportsthat millions of malicious applications

Attack Toolkits and Malicious Websites

Web security: an introduction to attack techniques and ... · Web security: basics Moving to web attacks Attack HTTP requests containing malicious payloads could attack web applications

Detecting Malicious Web Links and Identifying Their Attack ... · Proposed a machine learning approach to detect malicious URLs and to identify attack types. • Method Collect various

Cyber-Physical Attack Lifecycle · Cyber-Physical Attack Development Lifecycle • If you know how attackers work, you can figure out how to stop them • Attack lifecycle is a common