Travis Deyarmin CYBER ESPIONAGE STUXNET AND FLAME In

Travis Deyarmin CYBER ESPIONAGE STUXNET AND FLAME

In This Presentation � What is Stuxnet � What is Flame � Compare/Contrast � Who is Responsible � Possible Repercussions

Stuxnet � Worm � Used 5 Zero-Days � Targets Siemens Control Software � Infected Through USB/Network � Destroyed Uranium Enrichment Centrifuges

Stuxnet

Flame � Sniffs Network � Screenshots � Recording Audio � Keylogger � Bluesnarfing � 20 Expansion Modules

Flame

Flame � Ways of infection were similar to Stuxnet � The Autorun. inf hacking was used by both � Used the same print spooler vulnerability

Flame

Similarities � Propagation � Shared a common module for Eo. P (0 -day) � C&C servers scattered worldwide � Sharing Module

Differences Stuxnet Flame � Sabotage � Espionage � Specific � Adaptive � Hit PLC Computers � 20 Mb

Who’s to Blame? � Joint op between US and Israel

Consequences � Made this kind of attack a political option � Source code is available

Conclusion � Stuxnet and Flame were worms targeted at Iran � Probable US involvement � Repercussions

References � � � � http: //www. securelist. com/en/blog/208193522/The_Flame_Questions_and_Answers http: //www. cbsnews. com/8301 -202_162 -57443629/iran-powerful-flame-computer-virus-briefly-hit-oilindustry-but-was-defeated-with-data-recovered/ https: //www. securelist. com/en/blog/208193568/Back_to_Stuxnet_the_missing_link http: //www. computerworld. com/s/article/9227670/Report_Obama_ordered_Stuxnet_attacks_on_Iran http: //www. cio. com/article/708180/Security_Researchers_Discover_Link_Between_Stuxnet_and_Fla me http: //www. cio. com/article/640464/Report_Iran_Confirms_Stuxnet_Hit_Centrifuges http: //www. symantec. com/content/en/us/enterprise/media/security_response/whitepapers/w 32_stuxne t_dossier. pdf