Difference between revisions of "Stuxnet"
GKnibbeler (talk | contribs) |
GKnibbeler (talk | contribs) |
||
| Line 21: | Line 21: | ||
Later that year Stuxnet was discovered and with it the cause for all the failing centrifuges. | Later that year Stuxnet was discovered and with it the cause for all the failing centrifuges. | ||
=== Zero Day Attacks === | === Four Zero-Day Attacks === | ||
Zero Day Attacks target vulnerabilities that have not yet been found and therefore also not been patched giving attackers huge advantages. Finding these vulnerabilities and developing working exploits costs a lot of time, money and human resources. | Zero Day Attacks target vulnerabilities that have not yet been found and therefore also not been patched giving attackers huge advantages. Finding these vulnerabilities and developing working exploits costs a lot of time, money and human resources. | ||
==== Replication ==== | ==== Replication ==== | ||
| Line 39: | Line 37: | ||
Local Privilege Escalation vulnerability (CVE-2010-2743): Starting the .dll as a new process within csrss.exe (Windows XP / Windows 2000) | Local Privilege Escalation vulnerability (CVE-2010-2743): Starting the .dll as a new process within csrss.exe (Windows XP / Windows 2000) | ||
== | === Discovery === | ||
== References == | == References == | ||
* | * Kim Zetter. Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon. Broadway Books, 2015 | ||
* | * Ben Buchanan. The Hacker and the State. Harvard University Press, 2020 | ||
* Nicolas Falliere, Liam O Murchu, and Eric Chien. W32. Stuxnet dossier. White paper, Symantec Corp., Security Response, 5(6):29, 2011 | |||
* D.E. Sanger. Confront and Conceal: Obama’s Secret Wars and Surprising Use of American Power. Crown, 2012 | |||
* T. M. Chen and S. Abu-Nimeh. Lessons from stuxnet. Computer, 44(4):91-93, 2011 | |||
[[Category:Documentation]] | [[Category:Documentation]] | ||
Revision as of 14:03, 20 December 2020
Summary
Stuxnet exploits several vulnerabilities including four zero-day exploits and targets a very specific overall setup found at the Iranian uranium enrichment plants especially Natanz.
Targeted software and hardware setup
- Operating system: 32-bit Windows Operating System (2k, XP, 2003, Vista, Server 2008, 7, Server 2008 R2)
- SCADA Software: Siemens STEP7
- Hardware: S7-315-2/S7-417 PLCs with specific PROFIBUS VFD
Description
Historical background
In April 2006 Iran announced they have successfully enriched uranium refusing to give in to international demands to close its nuclear program. From February to November 2007 about 3000 new centrifuges were installed in Natanz, a uranium enrichment plant. In the same year the US Congress released $400 million for covert operations against Iran´s nuclear program as Israel and other Arab Countries have continuously asked for help against Iran. In 2008 they again approached the US hoping for help with an airstrike on Natanz but the US leaders feared this would lead to a wide-range war and also, as Natanz was situated mostly underground, they pointed out that an airstrike would probably not be very effective.
Throughout 2009 the number of centrifuges at Natanz was increased to 8700 and on at least one occasion President Ahmadinejad proudly led a tour through the plant providing the world with videos and images of the control rooms and centrifuges.
Early 2010 the IAEA (International Atomic Energy Agency) inspectors that periodically visited Natanz, noticed a huge number of centrifuges being replaced. Later that year Stuxnet was discovered and with it the cause for all the failing centrifuges.
Four Zero-Day Attacks
Zero Day Attacks target vulnerabilities that have not yet been found and therefore also not been patched giving attackers huge advantages. Finding these vulnerabilities and developing working exploits costs a lot of time, money and human resources.
Replication
Shortcut "LNK" Files Automatic File Execution vulnerability (CVE-2010-2568): Bypassing disabled auto-run allowing auto-execution
Print Spooler Service Impersonation vulnerability (CVE-2010-2729): Installing .exe to %System% Folder that loads .dll file
Escalation
Task Scheduler Escalation of Privilege vulnerability (CVE-2010-3888): Starting the .dll as a new process with administrator rights (Windows Vista / Windows 7 / Windows Server R2)
Local Privilege Escalation vulnerability (CVE-2010-2743): Starting the .dll as a new process within csrss.exe (Windows XP / Windows 2000)
Discovery
References
- Kim Zetter. Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon. Broadway Books, 2015
- Ben Buchanan. The Hacker and the State. Harvard University Press, 2020
- Nicolas Falliere, Liam O Murchu, and Eric Chien. W32. Stuxnet dossier. White paper, Symantec Corp., Security Response, 5(6):29, 2011
- D.E. Sanger. Confront and Conceal: Obama’s Secret Wars and Surprising Use of American Power. Crown, 2012
- T. M. Chen and S. Abu-Nimeh. Lessons from stuxnet. Computer, 44(4):91-93, 2011