Quantitatively Assessing and Visualising Industrial System Attack Surfaces

CHAPTER 1. INTRODUCTION 15
Stuxnet
In July of 2010 the control system community started to discuss Stuxnet. This is the
name given to a worm that propagated itself randomly, but only included payloads fit-
ting for specific industrial system deployments. A full technical analysis was written by
Falliere, O’Murchu, Chien [9], but a great deal of work detailing the industrial controller
compromise was done by Langner [11]. The target of this malware appears to be a ura-
nium enrichment facility in Iran, but there were other payload codes and the target of
those remains unknown. The authors appear to be well-funded nation state actors, and a
few nations are under suspicion but conclusive evidence has not yet appeared. Plenty of
circumstantial indicators are present, but no formal allegations or proceedings have been
made.
The original element in this incident is Stuxnet’s combination of undirected propaga-
tion methods with targeted payloads designed to affect only specific processes in specific
facilities. It spread using traditional security vulnerabilities (4 of them) in commercial
operating systems, and then wormed its way through two ICS applications (with hard-
coded passwords) to inhibit the functioning of Variable Frequency Drives (VFD) made
by specific vendors. It used a trick to remain hidden from SCADA engineers, displaying
the last program sent to the VFDs even when running its own malicious code. This is the
malware equivalent of playing back CCTV footage of a bank vault from the night before,
while robbers raid the vault.
Thus Stuxnet marks the entry of malicious state actors into the widely accepted threat
model. Previously, many people in business who suggested infrastructure software might
be targeted by nation states were not taken seriously. Post-Stuxnet the consensus was
almost unanimous that nation states were targeting each other’s infrastructure.
Since we have not found the authors of Stuxnet, this analysis of authorship and motive
may be flawed. At a minimum they are highly funded professionals who can remain
operationally anonymous and function without clear financial motives. This marks a
substantial shift of the folk threat model of control system security, and warrants global
re-evaluation of the security measures defending industrial networks.
1.2.2 NERC CIP
Armed with knowledge of past events, we can see that there may be an argument for
government regulation and potentially market failure. This seems to be the position of
the US government which has tasked a number of different agencies with providing part
of an overall solution. We will focus on those relevant to our research, namely Industrial
Control System Computer Emergency Response Team (ICS-CERT) and North American
Electric Reliability Corporation Critical Infrastructure Protection (NERC-CIP).