Industroyer: biggest threat to industrial control systems since Stuxnet
summary
Claims that Industroyer is the first malware built to attack power grids and the largest ICS threat since Stuxnet are backed by code that controls switches via IEC 60870-5-101, IEC 60870-5-104, IEC 61850 and OPC DA, a launcher that timed the December 2016 Ukraine outage, and a modular toolkit: CNC backdoor, custom port scanner, Siemens DoS exploit, MS SQL abuse for lateral movement, a data-wiper that corrupts SCADA workstations and replaces Notepad for persistence; the campaign cuts power to ~230,000 people and recovers within about an hour.
AI-written summary · about
chapters (21)
- 0:00Introduction
- 0:50Overview
- 3:52BlackEnergy
- 8:48Backdoor
- 14:52What is it
- 15:22Protocols
- 17:15OneOne
- 19:00OneAll
- 20:22Wireshark
- 20:52Command payload
- 21:57Network payload demonstration
- 23:04OPC GA
- 25:22Effects
- 27:19Denial of Service
- 27:37Exploiting the vulnerability
- 28:14Data wiper module
- 28:40Launcher module
- 28:52Configuration software
- 30:16Vendor agnostic
- 31:37Takeaways
- 32:15The gist of the threat
related talks
52mThe Industrial Cyberthreat Landscape: Year in Review Report with Updates
30mPractical Attack Vectors and Their Ideal Defensive Strategies for ICS & SCADA
39mThe Renaissance of Cyber Physical Offensive Capabilities
58mIndustrial Control Systems : Pentesting PLCs 101 (Part 1/2)
34mIs the Power Grid a Huge Cybersecurity Risk?
43mGet Smart on Smart Tech!
27mOn Our Worst Day: Whole-of-Nation Industrial Incident Response in the USA
40mSmart IoT: IoT Botnet Attacks on Power Grids Exploiting Their Weak Points