2018年工控與IOT攻擊與取證初探.pdf

1、工控與工控與IOT 攻擊與取證初探攻擊與取證初探回到 20142014 ISCCLICK TO ADD SUBHEADINGTypeface:Arial 20Inner textTypeface:Arial 142018 又是震網?當然不是今年是什么?Inner textTypeface:Arial 1461.如何發起針對IOT和工控系統的攻擊?（攻擊）2.如何找出是誰進行了攻擊?(取證)演講內容：讓我們從吸塵器開始Typeface:Arial 14什么類型的攻擊?智能吸塵器網絡追蹤痕跡在哪里?電子取證流程圖Smart Vacuum cleanerSmartphoneWi-Fi RouterS

2、mart Vacuum cleaner Network trace那又怎么樣!我不用帶攝像頭的吸塵器機器人手臂會怎樣？機器臂 Script of the malicious arm movement Logs看起來很暴力Robotic Arm Logs3.5:0002d05h20m22.919s:2018-08-29 13:35:13.919:-5:C0A0:7:null:1:Program forkprotected starting.(Last saved:2018-08-27 19:40:43):null3.5:0002d06h27m21.104s:2018-08-29 13:35:23

3、.104:-3:C0A0:7:null:1:forkprotected:Program forkprotected started:null3.5:0002d07h00m53.136s:2018-08-29 14:08:55.136:-3:C0A0:7:null:1:forkprotected:Program forkprotected stopped:null3.5:0002d09h37m58.671s:2018-08-29 17:52:48.671:-5:C0A0:7:null:1:Program forkprotected starting.(Last saved:2018-08-27

4、19:40:43):null3.5:0002d09h38m06.591s:2018-08-29 17:52:56.591:-5:C0A0:7:null:1:Program forkprotected starting.(Last saved:2018-08-27 19:40:43):null3.5:0002d10h44m56.832s:2018-08-29 17:52:58.832:-3:C0A0:7:null:1:forkprotected:Program forkprotected started:null3.5:0002d10h47m27.216s:2018-08-29 17:55:29

5、.216:-3:C0A0:7:null:1:forkprotected:Program forkprotected paused:null 程序入口echo movej(-1.5743878523456019,0.0984121561050415,-1.054539982472555,-2.1616690794574183,1.530264973640442,0.9618288278579712,a=3.141592653589793,v=3.141592653589793)|nc xxxx yyyyecho movej(-3.123030487691061,-2.62030488649477

6、2,-0.5577314535724085,-1.4209883848773401,-3.139153782521383,0.9618288278579712,a=3.141592653589793,v=3.141592653589793)|nc xxxx yyyyecho movej(0.04313834384083748,-2.656261746083395,-0.5591471830951136,-1.4209168593036097,-3.139153782521383,0.9618288278579712,a=350.141592653589793,v=4000.1415926535

7、89793)|nc ncxxxx yyyy 惡意手臂移動腳本痕跡在哪里?又是電子證據地圖PLCWorkstationRobotic ArmSwitch/Router機器臂日志3.5:0002d06h16m57.904s:2018-08-29 13:26:49.904:-3:C0A0:7:null:1:movej:Program movej started:null3.5:0002d06h17m00.984s:2018-08-29 13:26:52.984:-3:C0A0:7:null:1:movej:Program movej stopped:null3.5:0002d06h17m02.016

8、s:2018-08-29 13:26:53.016:-3:C0A0:7:null:1:movej:Program movej started:null3.5:0002d06h17m04.600s:2018-08-29 13:26:56.600:-3:C0A0:7:null:1:movej:Program movej stopped:null3.5:0002d06h17m06.120s:2018-08-29 13:26:57.120:-3:C0A0:7:null:1:movej:Program movej started:null3.5:0002d06h17m07.440s:2018-08-29

9、 13:26:59.440:-3:C0A0:7:null:1:movej:Program movej stopped:null Logs好吧,我不用機器人這個會怎么樣?DoSStop-in-the-middle讓我們看一個“幾乎”真實的電梯系統Touch panel for floor selectionPLC to control the lift電梯系統電梯系統HMI 控制升降系統發動機23 控制電路控制三相交流電動機電梯轎廂24連接PLC和觸摸板的網絡交換機控制電梯系統的PLC電梯系統的電子數據取證流程圖PLCHMIPC with TIASwitch電梯網絡流量追蹤PLC程序塊的元數據

10、在TIA程序中，對象由程序塊表示 每個程序塊都有自己的元數據和屬性 這使得取證人員能夠識別出程序塊的二進制大小、最后的編譯日期和最后修改日期PLC程序塊的元數據Every program block has their own set of timestamps西門子PLC診斷緩沖區 診斷緩沖區記錄了PLC的行為以及與TIA 入口的交互活動 它包括時間戳、事件id和事件的詳細描述 由于PLC的內存大小有限，診斷緩沖區只記錄最近發生的事件電梯系統取證流程圖PLCHMIPC with TIASwitch電梯網絡流量PLC程序塊的元數據西門子PLC 診斷緩沖區CISC33系統中只有有限的取證痕跡，我

11、們能做更多嗎？-加入取證模塊For detection and investigation.我們應該在哪里插入取證模塊？我們應該在哪里插入取證模塊？PLC scan cycle 取證模塊 I/O,內存改變檢測 數據轉換 輸出處理狀態Forensic blockTCP or other communication channelHistorianProcess logic monitor取證模塊取證模塊 POCFC:check_io_changed比較任意位變化1)所有輸入和2)所有輸出3)選擇的內存地址FC:Block_1將系統時間戳和所有的輸入輸出轉換為人類可讀的字符串FC:Block_2將

12、格式化的字符串發送到專用的tcp服務器過程邏輯攻擊檢測過程邏輯攻擊檢測 程序員將修改過的過程邏輯上傳至PLC 當某些輸入被觸發時，打開汽車綠色燈 違反安全規則，當行人的綠燈亮時汽車的綠燈永遠不應該亮著。過程邏輯攻擊檢測過程邏輯攻擊檢測 惡意程序 觸發 安全規則 檢測結果Output(00101.)Car red(0),Car yellow(0),car green(1),Pedestrian red(0),Pedestrian green(1)檢測定時炸彈攻擊檢測定時炸彈攻擊在每一個時間間隔，輸出點火動作行動只持續一個周期，并將再次關閉可以逃避許多檢測方法太快了，無法被抓拍到沒有網絡流量檢測定

13、時炸彈攻擊檢測定時炸彈攻擊 惡意程序 觸發 每五秒，關閉后續的循環 安全規則 演示目的：檢測是否任何黃燈被觸發 逃避TIA Step7的監視 檢測結果我們的研究論文CHAN C.F.,Chow K.P.,Yiu S.M.and K.Yau,Enhancing Forensic and Abnormality DetectionCapabilities for Programmable Logic Controllers,The Fourteenth IFIP WG 11.9 InternationalConference on Digital Forensics,2018K.Yau,Chow

14、K.P.and Yiu S.M.,Effective Logging System for Digital Forensic Readiness of SiemensProgrammable Logic Controllers,The Fourteenth IFIP WG 11.9 International Conference on DigitalForensics,2018YAU K.K.and Chow K.P.,Applying Machine Learning to PLC Event Detection and Logging forForensic Purpose,The Th

15、irteenth IFIP WG 11.9 International Conference on Digital Forensics,2017S.M.YIU,Cyber Security Research on Industrial Control Systems(Invited talk),Cyber-security forindustry 4.0 conference,23 June,2017,Hong KongS.M.YIU,工控系統可編程邏輯控制器(PLC)的攻防(Invited talk),XDef 2017,Nov 2017,Wuhan,ChinaCHAN C.B.and Ch

16、ow K.P.,Industrial Control System Internal Network Threat Analysis:A Study of theSiemens PLC-Controlled Elevator System,Eleventh Annual IFIP Working Group 11.10 InternationalConference on Critical Infrastructure Protection,2017CHAN C.B.and Chow K.P.,Forensic Analysis of a Siemens Programmable Logic Controller,TenthAnnual IFIP Working Group 11.10 International Conference on Critical Infrastructure Protection,2016謝 謝！