Security Response
Contents
Introduction ....................................................... 1
Executive Summary ........................................... 2
Attack Scenario .................................................. 3
Timeline .............................................................. 4
Infection Statistics ............................................. 5
Stuxnet Architecture.......................................... 8
Installation ....................................................... 12
Load Point ........................................................ 16
Command and Control ......................................17
Windows Rootkit Functionality ....................... 20
Stuxnet Propagation Methods......................... 21
Modifying PLCs ................................................ 32
Payload Exports ............................................... 39
Payload Resources ........................................... 40
Variants ............................................................ 42
Summary .......................................................... 45
Appendix .......................................................... 46
While the bulk of analysis is complete, Stuxnet is an incredibly large and
complex threat. The authors expect to make revisions to this document
shortly after release as new information is uncovered or may be publicly
disclosed. This paper is the work of numerous individuals on the Syman-
tec Security Response team over the last three months well beyond the
cited authors. Without their assistance, this paper would not be possible.
Introduction
W32.Stuxnet has gained a lot of attention from researchers and me-
dia recently. There is good reason for this. Stuxnet is one of the
most complex threats we have analyzed. In this paper we take a de-
tailed look at Stuxnet and its various components and particularly
focus on the final goal of Stuxnet, which is to reprogram industrial
control systems. Stuxnet is a large, complex piece of malware with
many different components and functionalities. We have already
covered some of these components in our blog series on the top-
ic. While some of the information from those blogs is included here,
this paper is a more comprehensive and in-depth look at the threat.
Stuxnet is a threat that was primarily written to target an industrial con-
trol system or set of similar systems. Industrial control systems are
used in gas pipelines and power plants. It’s final goal is to reprogram
industrial control systems (ICS) by modifying code on programmable
logic controllers (PLCs) to make them work in a manner the attacker in-
tended and to hide those changes from the operator of the equipment.
In order to achieve this goal the creators amassed a vast array of com-
ponents to increase their chances of success. This includes zero-day
exploits, a Windows rootkit, the first ever PLC rootkit, antivirus evasion
Nicolas Falliere, Liam O Murchu,
and Eric Chien
W32.Stuxnet Dossier
Septermber 2010, version 1.0
剩余48页未读，继续阅读
资源评论
xiaoru8062015-01-12权威的分析报告
哈哈112222018-05-15权威的分析报告
asxzasxzasxzasxz2015-04-08不知道是哪个地方出的报告，希望楼主说明一下
