Top Banner
Trend Micro Incorporated 2013 ICS Kyle Wilhoit
18

ICS 1 (+1? Ü ,Ë6 - · PDF fileë S1[$W ÷ ß 1[1 { % /®1_3§/· ç?[ 1w+ Ao Ë"Ï Ç 1o, ¯ Ë ;'o/ ,&6.....

Feb 05, 2018

Download

Documents

dangnhan
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: ICS 1 (+1? Ü ,Ë6 - · PDF fileë S1[$W ÷ ß 1[1 { % /®1_3§/· ç?[ 1w+ Ao Ë"Ï Ç 1o, ¯ Ë ;'o/ ,&6 6&$'$ ,Ã, ;C1+ &Û@ ?? ... 0à = 1[3§6 !ã S+ ÿ/¯, ¯ Ë 1[ 0à + &k

Trend Micro Incorporated

2013

ICS

Kyle Wilhoit

Page 2: ICS 1 (+1? Ü ,Ë6 - · PDF fileë S1[$W ÷ ß 1[1 { % /®1_3§/· ç?[ 1w+ Ao Ë"Ï Ç 1o, ¯ Ë ;'o/ ,&6 6&$'$ ,Ã, ;C1+ &Û@ ?? ... 0à = 1[3§6 !ã S+ ÿ/¯, ¯ Ë 1[ 0à + &k
Page 3: ICS 1 (+1? Ü ,Ë6 - · PDF fileë S1[$W ÷ ß 1[1 { % /®1_3§/· ç?[ 1w+ Ao Ë"Ï Ç 1o, ¯ Ë ;'o/ ,&6 6&$'$ ,Ã, ;C1+ &Û@ ?? ... 0à = 1[3§6 !ã S+ ÿ/¯, ¯ Ë 1[ 0à + &k

| 1

Page 4: ICS 1 (+1? Ü ,Ë6 - · PDF fileë S1[$W ÷ ß 1[1 { % /®1_3§/· ç?[ 1w+ Ao Ë"Ï Ç 1o, ¯ Ë ;'o/ ,&6 6&$'$ ,Ã, ;C1+ &Û@ ?? ... 0à = 1[3§6 !ã S+ ÿ/¯, ¯ Ë 1[ 0à + &k

| 2

Page 5: ICS 1 (+1? Ü ,Ë6 - · PDF fileë S1[$W ÷ ß 1[1 { % /®1_3§/· ç?[ 1w+ Ao Ë"Ï Ç 1o, ¯ Ë ;'o/ ,&6 6&$'$ ,Ã, ;C1+ &Û@ ?? ... 0à = 1[3§6 !ã S+ ÿ/¯, ¯ Ë 1[ 0à + &k

| 3

Page 6: ICS 1 (+1? Ü ,Ë6 - · PDF fileë S1[$W ÷ ß 1[1 { % /®1_3§/· ç?[ 1w+ Ao Ë"Ï Ç 1o, ¯ Ë ;'o/ ,&6 6&$'$ ,Ã, ;C1+ &Û@ ?? ... 0à = 1[3§6 !ã S+ ÿ/¯, ¯ Ë 1[ 0à + &k
Page 7: ICS 1 (+1? Ü ,Ë6 - · PDF fileë S1[$W ÷ ß 1[1 { % /®1_3§/· ç?[ 1w+ Ao Ë"Ï Ç 1o, ¯ Ë ;'o/ ,&6 6&$'$ ,Ã, ;C1+ &Û@ ?? ... 0à = 1[3§6 !ã S+ ÿ/¯, ¯ Ë 1[ 0à + &k

| 5

Page 8: ICS 1 (+1? Ü ,Ë6 - · PDF fileë S1[$W ÷ ß 1[1 { % /®1_3§/· ç?[ 1w+ Ao Ë"Ï Ç 1o, ¯ Ë ;'o/ ,&6 6&$'$ ,Ã, ;C1+ &Û@ ?? ... 0à = 1[3§6 !ã S+ ÿ/¯, ¯ Ë 1[ 0à + &k

1

2

1 http://www.us-cert.gov/control_systems/pdf/ICS-CERT_Monthly_Monitor_Oct-Dec2012.pdf2 https://www.snort.org/; http://www.honeyd.org/

| 6

Page 9: ICS 1 (+1? Ü ,Ë6 - · PDF fileë S1[$W ÷ ß 1[1 { % /®1_3§/· ç?[ 1w+ Ao Ë"Ï Ç 1o, ¯ Ë ;'o/ ,&6 6&$'$ ,Ã, ;C1+ &Û@ ?? ... 0à = 1[3§6 !ã S+ ÿ/¯, ¯ Ë 1[ 0à + &k

| 7

Page 10: ICS 1 (+1? Ü ,Ë6 - · PDF fileë S1[$W ÷ ß 1[1 { % /®1_3§/· ç?[ 1w+ Ao Ë"Ï Ç 1o, ¯ Ë ;'o/ ,&6 6&$'$ ,Ã, ;C1+ &Û@ ?? ... 0à = 1[3§6 !ã S+ ÿ/¯, ¯ Ë 1[ 0à + &k

Who’s Really Attacking Your ICS Equipment? | 8

3

3 http://www.tri-plc.com/nano10.htm

Page 11: ICS 1 (+1? Ü ,Ë6 - · PDF fileë S1[$W ÷ ß 1[1 { % /®1_3§/· ç?[ 1w+ Ao Ë"Ï Ç 1o, ¯ Ë ;'o/ ,&6 6&$'$ ,Ã, ;C1+ &Û@ ?? ... 0à = 1[3§6 !ã S+ ÿ/¯, ¯ Ë 1[ 0à + &k

| 9

Page 12: ICS 1 (+1? Ü ,Ë6 - · PDF fileë S1[$W ÷ ß 1[1 { % /®1_3§/· ç?[ 1w+ Ao Ë"Ï Ç 1o, ¯ Ë ;'o/ ,&6 6&$'$ ,Ã, ;C1+ &Û@ ?? ... 0à = 1[3§6 !ã S+ ÿ/¯, ¯ Ë 1[ 0à + &k

4

4 http://www.shodanhq.com/

| 10

Page 13: ICS 1 (+1? Ü ,Ë6 - · PDF fileë S1[$W ÷ ß 1[1 { % /®1_3§/· ç?[ 1w+ Ao Ë"Ï Ç 1o, ¯ Ë ;'o/ ,&6 6&$'$ ,Ã, ;C1+ &Û@ ?? ... 0à = 1[3§6 !ã S+ ÿ/¯, ¯ Ë 1[ 0à + &k

Who’s Really Attacking Your ICS Equipment? | 11 | 11Who’s Really Attackingngngnggngngngnggngggnggngngngngggnnnnnnn Your IC q p ? | 11S S EEEEququipmeuquipmenntt? | 1? | 1 | 111 | 11

Page 14: ICS 1 (+1? Ü ,Ë6 - · PDF fileë S1[$W ÷ ß 1[1 { % /®1_3§/· ç?[ 1w+ Ao Ë"Ï Ç 1o, ¯ Ë ;'o/ ,&6 6&$'$ ,Ã, ;C1+ &Û@ ?? ... 0à = 1[3§6 !ã S+ ÿ/¯, ¯ Ë 1[ 0à + &k

5

5 http://about-threats.trendmicro.com/Malware.aspx?language=au&name=TROJ_MEREDROP.II; http://about-threats.trendmicro.com/us//archive/malware/WORM_ATAK.A

| 12

Page 15: ICS 1 (+1? Ü ,Ë6 - · PDF fileë S1[$W ÷ ß 1[1 { % /®1_3§/· ç?[ 1w+ Ao Ë"Ï Ç 1o, ¯ Ë ;'o/ ,&6 6&$'$ ,Ã, ;C1+ &Û@ ?? ... 0à = 1[3§6 !ã S+ ÿ/¯, ¯ Ë 1[ 0à + &k

6

6 http://www.digitalbond.com/tools/quickdraw/

| 13

Page 16: ICS 1 (+1? Ü ,Ë6 - · PDF fileë S1[$W ÷ ß 1[1 { % /®1_3§/· ç?[ 1w+ Ao Ë"Ï Ç 1o, ¯ Ë ;'o/ ,&6 6&$'$ ,Ã, ;C1+ &Û@ ?? ... 0à = 1[3§6 !ã S+ ÿ/¯, ¯ Ë 1[ 0à + &k

http://www.tofinosecurity.com/blog/controlling-stuxnet-–-no-more-flat-networks-please-lets-embrace-security-zones

| 14

Page 17: ICS 1 (+1? Ü ,Ë6 - · PDF fileë S1[$W ÷ ß 1[1 { % /®1_3§/· ç?[ 1w+ Ao Ë"Ï Ç 1o, ¯ Ë ;'o/ ,&6 6&$'$ ,Ã, ;C1+ &Û@ ?? ... 0à = 1[3§6 !ã S+ ÿ/¯, ¯ Ë 1[ 0à + &k

| 15 | 15 | 15

Page 18: ICS 1 (+1? Ü ,Ë6 - · PDF fileë S1[$W ÷ ß 1[1 { % /®1_3§/· ç?[ 1w+ Ao Ë"Ï Ç 1o, ¯ Ë ;'o/ ,&6 6&$'$ ,Ã, ;C1+ &Û@ ?? ... 0à = 1[3§6 !ã S+ ÿ/¯, ¯ Ë 1[ 0à + &k

(TRENDMICRO INCORPORATED) TREND MICRO INCORPORATED

©2013 by Trend Micro Incorporated. All rights reserved. Trend Micro and the Trend Micro t-ball logo are trademarks or registered trademarks of Trend Micro Incorporated. All other product or company names may be trademarks or registered trademarks of their owners.