1、工控与工控与IOT 攻击与取证初探攻击与取证初探回到 20142014 ISCCLICK TO ADD SUBHEADINGTypeface:Arial 20Inner textTypeface:Arial 142018 又是震网?当然不是今年是什么?Inner textTypeface:Arial 1461.如何发起针对IOT和工控系统的攻击?（攻击）2.如何找出是谁进行了攻击?(取证)演讲内容：让我们从吸尘器开始Typeface:Arial 14什么类型的攻击?智能吸尘器网络追踪痕迹在哪里?电子取证流程图Smart Vacuum cleanerSmartphoneWi-Fi RouterS

2、mart Vacuum cleaner Network trace那又怎么样!我不用带摄像头的吸尘器机器人手臂会怎样？机器臂 Script of the malicious arm movement Logs看起来很暴力Robotic Arm Logs3.5:0002d05h20m22.919s:2018-08-29 13:35:13.919:-5:C0A0:7:null:1:Program forkprotected starting.(Last saved:2018-08-27 19:40:43):null3.5:0002d06h27m21.104s:2018-08-29 13:35:23

3、.104:-3:C0A0:7:null:1:forkprotected:Program forkprotected started:null3.5:0002d07h00m53.136s:2018-08-29 14:08:55.136:-3:C0A0:7:null:1:forkprotected:Program forkprotected stopped:null3.5:0002d09h37m58.671s:2018-08-29 17:52:48.671:-5:C0A0:7:null:1:Program forkprotected starting.(Last saved:2018-08-27

4、19:40:43):null3.5:0002d09h38m06.591s:2018-08-29 17:52:56.591:-5:C0A0:7:null:1:Program forkprotected starting.(Last saved:2018-08-27 19:40:43):null3.5:0002d10h44m56.832s:2018-08-29 17:52:58.832:-3:C0A0:7:null:1:forkprotected:Program forkprotected started:null3.5:0002d10h47m27.216s:2018-08-29 17:55:29

5、.216:-3:C0A0:7:null:1:forkprotected:Program forkprotected paused:null 程序入口echo movej(-1.5743878523456019,0.09845,-1.054539982472555,-2.74183,1.530264973640442,0.96712,a=3.9793,v=3.9793)|nc xxxx yyyyecho movej(-3.1061,-2.62030488649477

6、2,-0.55773,-1.4209883848773401,-3.1383,0.96712,a=3.9793,v=3.9793)|nc xxxx yyyyecho movej(0.043748,-2.656261746083395,-0.55936,-1.42097,-3.1383,0.96712,a=350.9793,v=4000.1415926535

7、89793)|nc ncxxxx yyyy 恶意手臂移动脚本痕迹在哪里?又是电子证据地图PLCWorkstationRobotic ArmSwitch/Router机器臂日志3.5:0002d06h16m57.904s:2018-08-29 13:26:49.904:-3:C0A0:7:null:1:movej:Program movej started:null3.5:0002d06h17m00.984s:2018-08-29 13:26:52.984:-3:C0A0:7:null:1:movej:Program movej stopped:null3.5:0002d06h17m02.016

8、s:2018-08-29 13:26:53.016:-3:C0A0:7:null:1:movej:Program movej started:null3.5:0002d06h17m04.600s:2018-08-29 13:26:56.600:-3:C0A0:7:null:1:movej:Program movej stopped:null3.5:0002d06h17m06.120s:2018-08-29 13:26:57.120:-3:C0A0:7:null:1:movej:Program movej started:null3.5:0002d06h17m07.440s:2018-08-29

9、 13:26:59.440:-3:C0A0:7:null:1:movej:Program movej stopped:null Logs好吧,我不用机器人这个会怎么样?DoSStop-in-the-middle让我们看一个“几乎”真实的电梯系统Touch panel for floor selectionPLC to control the lift电梯系统电梯系统HMI 控制升降系统发动机23 控制电路控制三相交流电动机电梯轿厢24连接PLC和触摸板的网络交换机控制电梯系统的PLC电梯系统的电子数据取证流程图PLCHMIPC with TIASwitch电梯网络流量追踪PLC程序块的元数据

10、在TIA程序中，对象由程序块表示 每个程序块都有自己的元数据和属性 这使得取证人员能够识别出程序块的二进制大小、最后的编译日期和最后修改日期PLC程序块的元数据Every program block has their own set of timestamps西门子PLC诊断缓冲区 诊断缓冲区记录了PLC的行为以及与TIA 入口的交互活动 它包括时间戳、事件id和事件的详细描述 由于PLC的内存大小有限，诊断缓冲区只记录最近发生的事件电梯系统取证流程图PLCHMIPC with TIASwitch电梯网络流量PLC程序块的元数据西门子PLC 诊断缓冲区CISC33系统中只有有限的取证痕迹，我

11、们能做更多吗？-加入取证模块For detection and investigation.我们应该在哪里插入取证模块？我们应该在哪里插入取证模块？PLC scan cycle 取证模块 I/O,内存改变检测 数据转换 输出处理状态Forensic blockTCP or other communication channelHistorianProcess logic monitor取证模块取证模块 POCFC:check_io_changed比较任意位变化1)所有输入和2)所有输出3)选择的内存地址FC:Block_1将系统时间戳和所有的输入输出转换为人类可读的字符串FC:Block_2将

12、格式化的字符串发送到专用的tcp服务器过程逻辑攻击检测过程逻辑攻击检测 程序员将修改过的过程逻辑上传至PLC 当某些输入被触发时，打开汽车绿色灯 违反安全规则，当行人的绿灯亮时汽车的绿灯永远不应该亮着。过程逻辑攻击检测过程逻辑攻击检测 恶意程序 触发 安全规则 检测结果Output(00101.)Car red(0),Car yellow(0),car green(1),Pedestrian red(0),Pedestrian green(1)检测定时炸弹攻击检测定时炸弹攻击在每一个时间间隔，输出点火动作行动只持续一个周期，并将再次关闭可以逃避许多检测方法太快了，无法被抓拍到没有网络流量检测定

13、时炸弹攻击检测定时炸弹攻击 恶意程序 触发 每五秒，关闭后续的循环 安全规则 演示目的：检测是否任何黄灯被触发 逃避TIA Step7的监视 检测结果我们的研究论文CHAN C.F.,Chow K.P.,Yiu S.M.and K.Yau,Enhancing Forensic and Abnormality DetectionCapabilities for Programmable Logic Controllers,The Fourteenth IFIP WG 11.9 InternationalConference on Digital Forensics,2018K.Yau,Chow

14、K.P.and Yiu S.M.,Effective Logging System for Digital Forensic Readiness of SiemensProgrammable Logic Controllers,The Fourteenth IFIP WG 11.9 International Conference on DigitalForensics,2018YAU K.K.and Chow K.P.,Applying Machine Learning to PLC Event Detection and Logging forForensic Purpose,The Th

15、irteenth IFIP WG 11.9 International Conference on Digital Forensics,2017S.M.YIU,Cyber Security Research on Industrial Control Systems(Invited talk),Cyber-security forindustry 4.0 conference,23 June,2017,Hong KongS.M.YIU,工控系统可编程逻辑控制器(PLC)的攻防(Invited talk),XDef 2017,Nov 2017,Wuhan,ChinaCHAN C.B.and Ch

16、ow K.P.,Industrial Control System Internal Network Threat Analysis:A Study of theSiemens PLC-Controlled Elevator System,Eleventh Annual IFIP Working Group 11.10 InternationalConference on Critical Infrastructure Protection,2017CHAN C.B.and Chow K.P.,Forensic Analysis of a Siemens Programmable Logic Controller,TenthAnnual IFIP Working Group 11.10 International Conference on Critical Infrastructure Protection,2016谢 谢！