Stuxnet and others in this list of state-of-the-art Internet worms had certain features that they were very stealthy in leaking out the information they harvested. Thus it managed to go under the radar and would typically go unnoticed by IDS/Firewalls. Stuxnet also had a feature that the infected machines contacted and updated other infected machines via RPC in a P2P fashion.

My question here: What additions or changes might be required to have intelligent UTMs/IDSs which can detect such malware which tend to be stealthy and go under the radar?

I am not inviting speculations here, but knowledge-based opinions and some great ideas...

  • Speaking of honeypots as a means to compliment IDS systems' role, this could be useful: code.google.com/p/ghost-usb-honeypot – Ion Oct 11 '13 at 10:49
  • @Ion Stuxnet was anyways too smart for honeypots... – pnp Oct 12 '13 at 9:35
  • 3
    It's funny that you say "like stuxnet". A part of the Stuxnet program was to have spies plug in prepared USB sticks. It's not only a technical problem that needs to be solved in order to prevent Stuxnet 2.0. – Luc Oct 12 '13 at 13:50
  • @Luc I understand your point. However, I am looking for only technical viewpoints here... – pnp Oct 14 '13 at 5:09

I can think of some ways:

  1. Malware connect to C&C server. if you monitor your traffic (as sensitive system should be monitored) - than you find unusual traffic that can be sign (and should be investigated)

  2. If the malware uses USB flash drives to spread itself, and you have different computer platforms in your environment (e,g: windows, mac, linux and BSD systems), than you will see other platforms executables on the flash drives. This way you have a real "sample" of the malware to analyze. (most malware are platform specific), so you can see the malware files if you connect the flash drive to a non-windows machine without the risk of being infected)

  3. Honeypots - You said that stuxnet is too smart to fall in honeypots, but I think that it all about who is smarter - the honeypot or the malware. If you use a common honeypot - the malware will ignore it for sure, but if the honeypot is using new techniques - it will not be detected as one by malwares. keep in mind that some highly sophiticated malware, like Duqu and Flame, do spread only when instructed by C&C servers, that makes them much less vulnerable to finding by honeypots.

After I wrote this, I went to see how Stuxnet was found, Stuxnet itself was detected because of a bug who made BSOD (Blue Screen of Death) on infected computers (source). Flame was found while researchers were looking for another malware. I couldn't find how Duqu was found.

So we can all be very clever, but what we really need to find such sophisticated viruses is luck...

  • 1
    Ummm... disagreed with point 1. Stuxnet was pretty stealthy- the detection systems could never understand its actions as 'unusual'. Plus it upgraded itself in a P2P fashion. Centralized C&C is not present in P2P-based botnets, AFAIK. Rgding point 2- it is more of 'damage control' and analysis after being infected. What about detecting it before? Rgding point 3- you mention that smarter honeypots may help, but you do not mention how to go about having 'new techniques' ... And luck ... c'mon! – pnp Oct 14 '13 at 5:18
  • 1.it all depends - are you "blacklisting" stuff or "whitelisting" stuff, whitelist can see some encrypted packets to an unknown server. 1B. P2P can be suspicious too (depends on the functionality and the structure of your system and your network). 2. To detect before - you have to use behavioral analysis of the files before you run them. won't work for stuxnet. 3. A technique is considered "new" until somebody publishs it on the net or in a book, so... – Ohad Cohen Oct 14 '13 at 10:23

Your question can be seen in broader context: How to defend against an APT (advanced persistent threat) style attack (aka targeted attack).

Qucik recap about main characteristics of APT attacks:

Attack vector

As seen so far, most such attacks use one of three attack vectors (with some examples):

  1. spear phising:
  2. infected USB:
  3. strategic web compromises

In practice all of this 3 predominant attack vectors can't be prevented for 100% in any larger company with big enough network and large number of employees. So because prevention eventaully fails we have to build our defense on detection capabilities. But as we all know detecting targeted attacks is hard and such attacks can run unnoticed for years as APT1 Mandinat Report showed us. It is hard mainly because of stealthiness of malware used in these attacks.

Stealthiness

Stealthiness of targeted attacks is based on fact that malware used in executing this kind of attack is custom malware - it hasn't been seen in the wild before by AV software, IDS systems don't have signatures for it, etc.

Defense approaches

Defense concepts against such attacks still emerges and evolves, some notable examples:

Lockheed martin's approach based on Threat Intelligence & Kill Chains (link1 link2)

OR

RSA's and Center for Internet Security's cyber-risk intelligence approach (link1 link2)

It is believed that Stuxnet was created by a major entity (such as government) which means that it was created by experts that knew very well what they were doing and made it extremely hard to detect. In fact they could have worked with different companies which own the knowledge, products, or technologies which they were specifically attacking. With that said I believe the best way to detect this sort of malware is to use a policy based security (i.e. Symantec Critical System protection) which are more pro-active than reactive. With this sort of policy based technology you can limit the system to perform only certain activities that expected from it. For example, the security policy can be set so that it blocks any RPC communication. If RPC communication is occurring it would trigger warning message logs. These warning messages can be correlated using the tool's central reporting console to detect a disparity on what the system is doing and how it is moving away from its normal operation.

Others may correct me, but I recall something that was unique about the Stuxnet attack is that Stuxnet was digitally signed ... as Siemens software. As it targeted Siemens control systems it was likely that applications signed by Siemens were already trusted, and so one layer of defence was rendered useless. To do that of course, required that either someone managed to reverse engineer Siemens application signing cert, hacked Siemens and got a copy of their private key, or coerced Siemens into cooperating with them...

I don't know about intelligent IDS, but a dumb host based IDS (file integrity checker) which does not ignore binaries just because they are signed would have detected the problem - both on MS-Windows and SCADA.

For more sophisticated measures....active monitoring of DNS traffic (along with appropriate segregation of environments) would have detected the contact attempts to the C&C. Monitoring/detection of abnormal network traffic may have detected the scanning and RPC activity.

All three techniques are still valid and applicable to other malware today, but if you have a very real requirement to protect against a determined nation state, then you're going to have to do a lot more than just this.

This particular scenario is about the worst case to plan for.

We know the Stuxnet attack as a very highly attuned persistent virus spreading through two previously unknown security vulnerabilities. However, the real scenario is worse than that.

There were previous attacks made on the same site by proto-stuxnet viruses whose job was to study the defenses. These were detected and cleaned, but were successful in their goal of determining what defenses were in place.

In the alternate history that Iran had specific defenses against the Stuxnet we know, Stuxnet would have been different and the defenses still would have been inadequate. This is the hardest problem that information security would ever have to face. A specifically targeted virus at you by an entity that studied your weaknesses is not defeatable. There is no solution to this problem.

I kind of know a set of defenses that might have worked, but they work or don't work at a very low level causing the virus to neither be activated nor detected and you don't even know the attack was attempted, which is not what you want as the attacker will observe the quiet failure and try again with a different attack path.

  • Stuxnet is not quite as magical as you seem to think. It required some idiot be tricked into plugging in a USB stick containing the malware, and could have been easily defeated by use of proper security (not using MD5 for signatures or letting untrusted USB devices near high-speed motors, for example). – forest Nov 8 at 2:32
  • @forest: the MD5 did nothing but yeah USB port blockers would have stopped that one. The point is he said something like stuxnet to which I interpret as something with that level of force and cunning and budget behind it. Shall the 1500 rank chess player defeat the grandmaster given knight odds? – Joshua Nov 8 at 2:43
  • The chess player does not have to defeat the grandmaster, only avoid losing. The only winning move is not to play. The same is true in information security. Proper compartmentalization/isolation would have completely defeated Stuxnet and any similar attacks. If it weren't for someone being sloppy with untrusted USB drives, it would have required nothing short of a massive supply chain compromise and potentially decades of waiting to do any damage to the centrifuges. – forest Nov 8 at 2:44

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.