How could malware like Stuxnet be detected?

Question

Stuxnet and others in this list of state-of-the-art Internet worms had certain features that they were very stealthy in leaking out the information they harvested. Thus it managed to go under the radar and would typically go unnoticed by IDS/Firewalls. Stuxnet also had a feature that the infected machines contacted and updated other infected machines via RPC in a P2P fashion.

My question here: What additions or changes might be required to have intelligent UTMs/IDSs which can detect such malware which tend to be stealthy and go under the radar?

I am not inviting speculations here, but knowledge-based opinions and some great ideas...

Answer 1

I can think of some ways:

1. Malware connect to C&C server. if you monitor your traffic (as sensitive system should be monitored) - than you find unusual traffic that can be sign (and should be investigated)

2. If the malware uses USB flash drives to spread itself, and you have different computer platforms in your environment (e,g: windows, mac, linux and BSD systems), than you will see other platforms executables on the flash drives. This way you have a real "sample" of the malware to analyze. (most malware are platform specific), so you can see the malware files if you connect the flash drive to a non-windows machine without the risk of being infected)

3. Honeypots - You said that stuxnet is too smart to fall in honeypots, but I think that it all about who is smarter - the honeypot or the malware. If you use a common honeypot - the malware will ignore it for sure, but if the honeypot is using new techniques - it will not be detected as one by malwares. keep in mind that some highly sophiticated malware, like Duqu and Flame, do spread only when instructed by C&C servers, that makes them much less vulnerable to finding by honeypots.

After I wrote this, I went to see how Stuxnet was found, Stuxnet itself was detected because of a bug who made BSOD (Blue Screen of Death) on infected computers (source). Flame was found while researchers were looking for another malware. I couldn't find how Duqu was found.

So we can all be very clever, but what we really need to find such sophisticated viruses is luck...

Answer 2

Your question can be seen in broader context: How to defend against an APT (advanced persistent threat) style attack (aka targeted attack).

Qucik recap about main characteristics of APT attacks:

Attack vector

As seen so far, most such attacks use one of three attack vectors (with some examples):

1. spear phising:
   • GhostNet
   • Safe: A Targeted Threat
   • Cyberespionage in South Korea
2. infected USB:
   • Stuxnet
   • Worst cyber attack on US military came via flash drive
3. strategic web compromises

In practice all of this 3 predominant attack vectors can't be prevented for 100% in any larger company with big enough network and large number of employees. So because prevention eventaully fails we have to build our defense on detection capabilities. But as we all know detecting targeted attacks is hard and such attacks can run unnoticed for years as APT1 Mandinat Report showed us. It is hard mainly because of stealthiness of malware used in these attacks.

Stealthiness

Stealthiness of targeted attacks is based on fact that malware used in executing this kind of attack is custom malware - it hasn't been seen in the wild before by AV software, IDS systems don't have signatures for it, etc.

Defense approaches

Defense concepts against such attacks still emerges and evolves, some notable examples:

Lockheed martin's approach based on Threat Intelligence & Kill Chains (link1 link2)

OR

RSA's and Center for Internet Security's cyber-risk intelligence approach (link1 link2)

Answer 3

It is believed that Stuxnet was created by a major entity (such as government) which means that it was created by experts that knew very well what they were doing and made it extremely hard to detect. In fact they could have worked with different companies which own the knowledge, products, or technologies which they were specifically attacking. With that said I believe the best way to detect this sort of malware is to use a policy based security (i.e. Symantec Critical System protection) which are more pro-active than reactive. With this sort of policy based technology you can limit the system to perform only certain activities that expected from it. For example, the security policy can be set so that it blocks any RPC communication. If RPC communication is occurring it would trigger warning message logs. These warning messages can be correlated using the tool's central reporting console to detect a disparity on what the system is doing and how it is moving away from its normal operation.

Answer 4

Others may correct me, but I recall something that was unique about the Stuxnet attack is that Stuxnet was digitally signed ... as Siemens software. As it targeted Siemens control systems it was likely that applications signed by Siemens were already trusted, and so one layer of defence was rendered useless. To do that of course, required that either someone managed to reverse engineer Siemens application signing cert, hacked Siemens and got a copy of their private key, or coerced Siemens into cooperating with them...

Answer 5

I don't know about intelligent IDS, but a dumb host based IDS (file integrity checker) which does not ignore binaries just because they are signed would have detected the problem - both on MS-Windows and SCADA.

For more sophisticated measures....active monitoring of DNS traffic (along with appropriate segregation of environments) would have detected the contact attempts to the C&C. Monitoring/detection of abnormal network traffic may have detected the scanning and RPC activity.

All three techniques are still valid and applicable to other malware today, but if you have a very real requirement to protect against a determined nation state, then you're going to have to do a lot more than just this.

Answer 6

This particular scenario is about the worst case to plan for.

We know the Stuxnet attack as a very highly attuned persistent virus spreading through two previously unknown security vulnerabilities. However, the real scenario is worse than that.

There were previous attacks made on the same site by proto-stuxnet viruses whose job was to study the defenses. These were detected and cleaned, but were successful in their goal of determining what defenses were in place.

In the alternate history that Iran had specific defenses against the Stuxnet we know, Stuxnet would have been different and the defenses still would have been inadequate. This is the hardest problem that information security would ever have to face. A specifically targeted virus at you by an entity that studied your weaknesses is not defeatable. There is no solution to this problem.

I kind of know a set of defenses that might have worked, but they work or don't work at a very low level causing the virus to neither be activated nor detected and you don't even know the attack was attempted, which is not what you want as the attacker will observe the quiet failure and try again with a different attack path.