公共基础设施威胁与安全.pdfVIP

公共基础设施威胁与安全 AhnLab EPS 演讲人：金起荣 部 门 : 融合产品开发室 职 位：室长 ? AhnLab, Inc. All rights reserved. 方便有效率的专用终端 ? 产业系统 - 公共基础设施 - 工厂设备 ? 金融系统 - POS - ATM ? 封闭网 业务领域? KIOSK - 机场 - 商场 - 活动场所 ? AhnLab, Inc. All rights reserved. 为什么专用终端很危险? 专用终端的维护 和保护工作难进 行。 升级困难 网络连接松 懈 如AV这样占容 量大的安全解 决方案难以适 用. 中断困难. 各种各样的人 员来经营 ? AhnLab, Inc. All rights reserved. 错误的观念 拦截未经许可的 程序执行等于安全 不使用外置储存 设备等于安全 封闭的网络 免疫恶意代码威胁 只要限制网络连接 即可以防止侵入 从无法预测的路径感染的恶意代码会破坏系统，造成信息泄露 ? AhnLab, Inc. All rights reserved. Traditional Security Threats Single malware One-time attack Broad range of targets 高级持续性威胁 - APT (Advanced Persistent Threat) 3 完全改变的攻击方式 Advanced Security Threats Specific target Modularized malware Additional updates Privilege escalation Long-term stealth ? AhnLab, Inc. All rights reserved. StuxNet证明了这些. ? Iran’s SCADA-controlled nuclear facilities attacked (Jan. to Sep. ‘10) - Stuxnet penetrated Iran’s nuclear facility to sabotage the country’s uranium enrichment program ? Stuxnet wreaked havoc in China (Jul. ‘10) Stuxnet is a sophisticated worm that infiltrates even “closed” networks to inflict severe damages to specific industrial control systems. Incidents caused by Stuxnet Stuxnet is specially-designed malware to target the SCADA system. While other targeted attacks are usually geared towards financial gain, Stuxnet is designed to infect only the SCADA control system1) to run out of control. Stuxnet; targeting industrial systems 1) Siemens WinCC/Step7 system - 6 million PC in China infected by Stuxnet ? Stuxnet found in the US, India, Indonesia and Pakistan Individuals’ PC Internal System 1 Infection via USB drive CC?? C ControlPC 2 Transmit information on infected system / Index.php?data=66a54e2 3 Internal network Infection 0-Day Attack Shared Folder, AutoRun MS08-064. 046. 061 4 Attack Command Shar RPC server communication 5 Create attack commands 6 Send attack commands 7 Create admin’s PLC control commands 8 Modify PLC control commands 9 Run get attack 10 Industrial facilities