Threat Intelligence

1/16/2018
09:15 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

Researchers Offer a 'VirusTotal for ICS'

Free online sandbox, honeypot tool simulates a real-world industrial network environment.

S4x18 CONFERENCE – Miami – A team of researchers plans to release an open source online tool for capturing and vetting industrial control system (ICS) malware samples that operates as a sandbox with honeypot features.

David Atch, vice president of research for CyberX, here today outlined details of the free, Web-based sandbox tool he and his team initially developed for research purposes. "It's like a VirusTotal for ICS," he explains in an interview.

VirusTotal is the wildly popular online tool that uses multiple antivirus and scan engines to analyze suspicious files and URLs for malware.

The goal was to create a sandbox that simulates real-world industrial networks. The sandbox tool allows ICS malware to execute and unpack, and then detects telltale malicious activities such as OPC (Open Platform Communications) scanning or overwriting programmable logic controller (PLC) configuration files, and provides quick offline detection, according to CyberX, which plans to roll out the tool in the next couple of months.

Atch says existing network sandbox technology for non-ICS, or IT environments, often misses ICS-specific malware because it doesn't account for OT protocols and devices, for example, and doesn't simulate OT components. "There are not enough tools for the ICS community," Atch says. And VirusTotal isn't ideal for ICS-specific malware, either, he says.

Take Stuxnet. The first Stuxnet variant was sent to VirusTotal in 2007, notes Ralph Langner, founder and CEO of Langner Communications, but Stuxnet wasn't detected until 2012, he says. "I strongly support the idea" of a VirusTotal for ICS malware, he says.

Langner, a top Stuxnet expert, says ICS malware analysis is time-consuming. "It took me three years to analyze Stuxnet," he says.

The ICS malware sandbox tool is aimed at more efficiently spotting ICS-specific malware, and can simulate the types of traffic to and from a PLC, for example, as its honeypot function. That allows the malware to execute in a safe space while unpacking and uncovering its functions and matching them with other known variants. The tool includes OT software, virtualized ICS processes and files, and a low-interaction ICS network (the honeypot element).

The concept of an ICS sandbox isn't new: researchers at Trend Micro in 2013 stood up two honeypot-based architectures that posed as a typical ICS/SCADA environment at a water utility, including one that included a Web-based application for a water pressure station. There were 39 attacks from 14 different nations over a 28-day period. Most attacks on ICS/SCADA systems appeared to come from China (35%), followed by the US (19%) and Laos (12%).

Related Content:

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MariaColeman
50%
50%
MariaColeman,
User Rank: Apprentice
1/23/2018 | 11:54:10 AM
Interesting
That is pretty interesting) 
WriteMyPaper
50%
50%
WriteMyPaper,
User Rank: Apprentice
1/17/2018 | 4:33:44 AM
My Opinion
That`s something definitely worth knowing.
It Takes an Average of 3 to 6 Months to Fill a Cybersecurity Job
Kelly Jackson Higgins, Executive Editor at Dark Reading,  3/12/2019
Box Mistakes Leave Enterprise Data Exposed
Dark Reading Staff 3/12/2019
How the Best DevSecOps Teams Make Risk Visible to Developers
Ericka Chickowski, Contributing Writer, Dark Reading,  3/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: LOL  Hope this one wins
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6149
PUBLISHED: 2019-03-18
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
CVE-2018-15509
PUBLISHED: 2019-03-18
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
CVE-2018-20806
PUBLISHED: 2019-03-17
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
CVE-2019-5616
PUBLISHED: 2019-03-15
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
CVE-2018-17882
PUBLISHED: 2019-03-15
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.