Researchers Offer a VirusTotal for ICS

Free online sandbox, honeypot tool simulates a real-world industrial network environment.

S4x18 CONFERENCE – Miami – A team of researchers plans to release an open source online tool for capturing and vetting industrial control system (ICS) malware samples that operates as a sandbox with honeypot features.
David Atch, vice president of research for CyberX, here today outlined details of the free, Web-based sandbox tool he and his team initially developed for research purposes. Its like a VirusTotal for ICS, he explains in an interview.
VirusTotal is the wildly popular online tool that uses multiple antivirus and scan engines to analyze suspicious files and URLs for malware.
The goal was to create a sandbox that simulates real-world industrial networks. The sandbox tool allows ICS malware to execute and unpack, and then detects telltale malicious activities such as OPC (Open Platform Communications) scanning or overwriting programmable logic controller (PLC) configuration files, and provides quick offline detection, according to CyberX, which plans to roll out the tool in the next couple of months.
Atch says existing network sandbox technology for non-ICS, or IT environments, often misses ICS-specific malware because it doesnt account for OT protocols and devices, for example, and doesnt simulate OT components. There are not enough tools for the ICS community, Atch says. And VirusTotal isnt ideal for ICS-specific malware, either, he says.
Take Stuxnet. The first Stuxnet variant was sent to VirusTotal in 2007, notes Ralph Langner, founder and CEO of Langner Communications, but Stuxnet wasnt detected until 2012, he says. I strongly support the idea of a VirusTotal for ICS malware, he says.
Langner, a top Stuxnet expert, says ICS malware analysis is time-consuming. It took me three years to analyze Stuxnet, he says.
The ICS malware sandbox tool is aimed at more efficiently spotting ICS-specific malware, and can simulate the types of traffic to and from a PLC, for example, as its honeypot function. That allows the malware to execute in a safe space while unpacking and uncovering its functions and matching them with other known variants. The tool includes OT software, virtualized ICS processes and files, and a low-interaction ICS network (the honeypot element).
The concept of an ICS sandbox isnt new: researchers at Trend Micro
in 2013 stood up two honeypot-based architectures
that posed as a typical ICS/SCADA environment at a water utility, including one that included a Web-based application for a water pressure station. There were 39 attacks from 14 different nations over a 28-day period. Most attacks on ICS/SCADA systems appeared to come from China (35%), followed by the US (19%) and Laos (12%).
Related Content:
Vulnerable Mobile Apps: The Next ICS/SCADA Cyber Threat
17 Things We Should Have Learned in 2017 but Probably Didnt
The Coolest Hacks of 2017
20 Cybersecurity Vendors Getting Venture Capital Love

Last News
▸ Scan suggests Heartbleed patches may not have been successful. ◂ Discovered: 23/12/2024 Category: security	▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security	▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Researchers Offer a VirusTotal for ICS