wilamowski-b-m-irwin-j-d-industrial-communication-systems-2011

Security in Industrial Communication Systems 22-11
• Trojan horse: A Trojan horse obscures its malicious intent by pretending to have a useful function.
However, after being activated by the user, a hidden malicious function is performed that
allows a remote adversary to gain unauthorized access to the host that executes the Trojan
horse.
• Logical bomb: A logical bomb is malware that only activates itself after certain conditions are
met. A special kind of logical bomb is a time bomb where a specific point in time is used as
trigger.
• Rootkit: A rootkit is a special kind of malware that infects the system in a way that it remains
invisible at the host. To achieve this, rootkits typically replace core components of the system
software like kernel modules in operating systems.
• Backdoor or trapdoor: This kind of malware provides an alternative way to access the infected
system that bypasses the normal authentication procedure.
• Spyware: Spyware usually does not cause direct harm. It rather collects confidential information
on the host being used for further attacks, e.g., passwords or other major assets (e.g., chemical
recipes).
Like any other security attack, malware is only able to utilize existing vulnerabilities in the device to
infect it. To counteract attacks on software two possibilities exit: First, methods can be used that prevent
the existence of vulnerabilities. Second, if a full prevention is not possible, malware or the attempt to
insert it into the device’s software shall at least be detected. Countermeasures that prevent and/or detect
the existence of malware can be categorized as follows.
• Static software methods try to avoid the existence of software vulnerabilities a priori during the
software development. Typical techniques are static code analysis methods that try to detect programming
flaws (e.g., buffer overflows) as well as code-signing methods where the developer signs
the executables to confirm the non-modification. Another example is proof-carrying code where
the developer provides a proof along with a program that allows checking with certainty that the
code can be executed in a secure way.
• Dynamic software methods try to identify malware by detecting a malicious behavior during runtime.
A common approach is to use a host-based IDS that detects malicious behavior or actions
during runtime (cf. Section 22.3.4). A similar technique is called software monitoring, where
program execution is observed to check whether the software behaves according to a specified
security policy. Another approach is to use self-checking code. Here, the software itself verifies
the program code for unauthorized modifications during execution. A further approach that is
popular in environments where untrustworthy and thus possible malicious software has to be
executed is called sandboxing. Using this technique, the untrustworthy software is running in a
so-called sandbox where it is executed in a controlled way with restricted permissions. The main
advantage of this scheme is that malicious software is not able to leave the sandbox and infect
other parts of the system since an interaction with the rest of the system is only possible using
well-defined and protected interfaces.
• Hardware supported methods use hardware-specific implementations that try to avoid an insertion
of malware. A typical example is the use of microcontrollers that are implementing the
Harvard architecture. Due to the physical partitioning of instruction and data memory, code
injection is not possible by design. Another recent technique is the no execute (NX) bit in modern
CPUs, where memory regions can be designated as being non-executable. Another common
approach is the use of a coprocessor that is dedicated to perform security checks during runtime.
• Human-assisted methods: In cases where automatic methods cannot fully prevent or detect the
existence of malware, human-assisted methods can additionally be used. Typical examples are
manual inspection or the use of certificated software. Obviously, human-assisted methods are
time consuming and require extensive knowledge. Therefore, it is reasonable to use them only in
combination with automatic techniques.
© 2011 by Taylor and Francis Group, LLC