Supervisory control and data acquisition (SCADA), generally refers to industrial control systems: computer systems that monitor and control industrial, infrastructure, or facility-based processes. Industrial processes include those of manufacturing, production, power generation, fabrication, and refining, and may run in continuous, batch, repetitive, or discrete modes. Infrastructure processes may be public or private, and include water treatment and distribution, wastewater collection and treatment, oil and gas pipelines, electrical power transmission and distribution, Wind farms, civil defense siren systems, and large communication systems. And facility processes occur both in public facilities and private ones, including buildings, airports, ships, and space stations. They monitor and control HVAC, access, and energy consumption.

SCADA systems have evolved through three generations: Monolithic, Distributed, Networked. In the first generation, “Monolithic”, computing was done by mainframe computers. Networks did not exist at the time SCADA was developed. During the Second generation: “Distributed”, the processing was distributed across multiple stations which were connected through a LAN and they shared information in real time with proprietary protocols. The current generation SCADA systems, “Networked” generation, use open system architecture rather than a vendor-controlled proprietary environment. The SCADA system utilizes open standards and protocols, thus distributing functionality across a WAN rather than a LAN.

For the current generation SCADA system, SonicWALL UTM research team has researched the public protocols and created the following application signatures to monitor and control the SCADA traffic.

• 773 Modbus — Outbound TCP
• 774 Modbus — Inbound TCP
• 6017 ICCP — COTP Connection Request
• 6018 ICCP — Unauthorized Association Request
• 6019 ICCP — Unauthorized MMS Write Request Attempt
• 6029 ICCP — Invalid OSI-SSEL
• 6034 ICCP — Invalid OSI PSEL
• 6035 DNP3 — Disable Unsolicited Responses
• 6036 DNP3 — Unsolicited Response Storm
• 6037 DNP3 — Cold Restart From Client
• 6038 DNP3 — Stop Application
• 6039 DNP3 — Warm Restart
• 6040 DNP3 — Broadcast Request from Client

From the statistics, we can see the SCADA systems are well distributed in the following countries:

  Country			Networks	hits  UNITED STATES			2182		15539047  INDIA				486		20317  CANADA				391		389251  TAIWAN, PROVINCE OF CHINA	304		6479034  ITALY				266		150232  UNITED KINGDOM			224		42618  SPAIN				181		6823  BRAZIL				137		22696  TURKEY				123		480351  GERMANY			103		2499369 

As the description of the third generation of the SCADA system, more and more open system architecture rather than a vendor-controlled proprietary environment are widely used. Due to the usage of standard protocols and the fact that many networked SCADA systems are accessible from the Internet, the systems are potentially vulnerable to remote cyber-attacks. In particular, the most security issues that researchers are concerned about:

• the lack of concern about security and authentication in the design, deployment and operation of existing SCADA networks
• the belief that SCADA systems have the benefit of security through obscurity through the use of specialized protocols and proprietary interfaces
• the belief that SCADA networks are secure because they are physically secured
• the belief that SCADA networks are secure because they are disconnected from the Internet

For the above concerns, SonicWALL research team has devoted consistent efforts to protect their customers from being attacked by attackers taking use of SCADA related vulnerabilities. For example, the following IPS signatures were developed especially for the SCADA vulnerabilities. There are also more than 100 generic shellcode IPS/GAV signatures that cover the rest of the SCADA attacks in the meantime.

• 6027 Modbus TCP Illegal Packet Size
• 5056 CitectSCADA Buffer Overflow Attempt
• 5951 RealFlex SCADA SCPC_INITIALIZE BO Attempt
• 5952 RealFlex SCADA SCPC_INITIALIZE_RF BO Attempt

Stuxnet, as one of the SCADA vulnerabilities, is a Windows computer worm discovered in July 2010 that targets industrial software and equipment. The worm initially spreads indiscriminately, but includes a highly specialized malware payload that is designed to target only SCADA systems that are configured to control and monitor specific industrial processes. Different variants of Stuxnet targeted five Iranian organizations, with the probable target widely suspected to be uranium enrichment infrastructure in Iran. It is said the Iran nuclear program, which uses embargoed Siemens equipment procured clandestinely, has been damaged by Stuxnet.

SonicWALL research team paid attention to the Stuxnet worm when it was first discovered. The GAV signatures detecting Stuxnet worms were first created on July 13th, 2010. The signatures are listed as bellow. Some of them may have retired because those variants have been removed from the affected websites.

• 5423 Stuxnet
• 4228 Stuxnet.A_5
• 3917 Stuxnet.A_4
• 1601 Stuxnet.A_3
• 41726 Stuxnet.B
• 42142 Stuxnet.B_2
• 41962 Stuxnet.D
• 41730 Stuxnet.A_2
• 41728 Stuxnet.A

For the current deployment, we can see the top 10 networks affected by Stuxnet grouped by countries are:

  Country                         Networks   UNITED STATES                     206   INDIA                              11   BRAZIL                             10   CANADA                              8   UNITED KINGDOM                      3   FRANCE                              2   GERMANY                             2   ICELAND                             2   PHILIPPINES                         2  

SonicWALL UTM Research team received reports of a new spam campaign pretending to be arriving from Facebook abuse Department spreading in the wild. It involves the new variant of Oficla Trojan that SonicWALL blocked as GAV: Oficla.MME. This worm also downloads component files including mass mailer, info-stealer and FakeAV malware.

The sample e-mail format of the spam campaign includes the following:

Subject:

• Spam from your Facebook account
• Spam from your account
• Your password has been changed

Attachment: Attached_SecurityCode{Random Numbers}.zip

If the user downloads and executes the malicious executable inside the zip attachment, it performs the following activity:

• Creates the process SVCHOST.EXE and injects its code.
• Deletes the original executable file

Downloads other malware:

• Application Datagog.exe – [ detected as GAV: FakeAV.MME (Trojan) ]
• %windir%system32aspimgr.exe – [ detected as GAV: Mailer.G (Trojan) ]
• %temp%Qojmytwjb.exe – [ detected as GAV: Mailer.G_2 (Trojan) ]
• %temp%grabbers – [ detected as GAV: Grabber.A (Trojan) ]

Dropped files:

• %windir%s32.txt
• %windir%ws386.ini
• %temp%_check32.bat
• Application Datainstall

Added Registry:

• Key: HKEY_CURRENT_USERSoftwareMicrosoftWindows NTCurrentVersionWinlogon
  Value: Shell
  Data:”C:Documents and SettingsresearchApplication Datagog.exe”
• Key: HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesaspimgr
  Value: ImagePath
  Data: %windir%System32aspimgr.exe

Network Activity:

HTTP GET Requests:

• http://campaign{REMOVED}ions.ru/connect/load.php
• http://campaign{REMOVED}hools.ru/connect/load.php
• http://campf{REMOVED}om.ru/connect/load.php
• http://camp{REMOVED}a.ru/connect/load.php

HTTP POST Requests:
This worm downloads a malware component that steals information from the system. It sends those information to this URL:

• http://campaign{REMOVED}ations.ru/connect/grabbers.php

DNS Requests:

• cl6{REMOVED}tart.ru
• hy{REMOVED}ys.ru
• ml6{REMOVED}art.ru
• 94.244.80.60

Mass Mailer

Checks for internet connectivity by connecting to the following sites
• www.yahoo.com
• www.web.de

Checks connectivity to SMTP servers by querying MX records as show below:

Collects e-mail addresses but ignores addresses with the following strings:

• abuse
• accoun
• admin
• anyone
• apache.org
• arachnoid
• -bugs
• ca.com
• caube
• cauce
• cauce.org
• certific
• -certs
• ci.el-paso.tx.us
• cloudmark.com
• digsigtrust
• e-trust
• example
• fraud
• gold-certs
• google
• ht.ht
• icrosof
• linux
• listserv
• mailwasher
• majordomo
• messagelabs
• mydomai
• nobody
• nodomai
• noone
• nothing
• paulgraham.com
• phishing
• postmaster
• privacy
• rating
• rx.t-online
• samples
• secur
• service
• somebody
• someone
• submit
• support
• symantec
• thawte
• the.bat
• valicert
• verisign
• verisign.com
• webmaster
• webroot.com

Information Stealing
Steals credentials from the following applications:

Poker Games:
• Full Tilt Poker
• Pacificpoker
• PartyPoker
• Titan Poker

FTP Clients:

• BitKinex
• Bullet Proof FTP
• BulletProof FTP Client 2009
• BulletProof FTP Client 2010
• ClassicFTP
• CoffeeCup FTP
• CuteFTP 6 Home
• CuteFTP 6 Professional
• CuteFTP 7 Home
• CuteFTP 7 Professional
• CuteFTP 8 Home
• CuteFTP 8 Professional
• CuteFTP Lite
• CuteFTP Pro
• CuteFTP
• Dev Zero G
• DirectFTP
• ExpanDrive
• FAR Manager FTP
• FTP Commander
• FTP Explorer
• FTPClient
• FTPRush
• FileZilla
• FlashFXP
• Fling
• Frigate3 FTP
• NetDrive
• SmartFTP
• Sota
• TurboFTP
• WS_FTP
• WebDrive

Web Browser

• Flock
• Google Chrome
• IE
• Mozilla
• Opera
• Safari
• Seamonkey
• ThuderBird

IM Clients

• AIM
• ICQ
• MSN
• Messenger-2
• Miranda
• Trillian
• Yahoo
• Vypress

Mail Clients

• Eudora
• Forte
• Mail Commander
• Mail.Ru
• POP Peeper
• PocoMail
• Windows Mail

Others

• Myspace
• Pandion
• Sipphone

FakeAV

After Installing the FakeAV application, it will show a Fake Microsoft Security Essentials Alert as seen below:



After Clicking the “Scan Online” Button, it will show this message and prompts for rebooting the system:



After rebooting the system, the following FakeAV screens will appear. It will then ask the user to pay for the software to completely clean the system.

SonicWALL Gateway AntiVirus provides protection against this threat via the following signatures:

• GAV: FakeAV.MME (Trojan)
• GAV: Grabber.A (Trojan)
• GAV: Mailer.G (Trojan)
• GAV: Mailer.G_2 (Trojan)
• GAV: Oficla.MME (Trojan)

The SonicWALL UTM research team has seen an increase in Fake AV Malware. Such Malware attempts to scare users into buying Fake Antivirus software that performs fake scans and returns bogus results. Fakerean_7 (Trojan) is yet another piece of Malware that performs such malicious activity.

The Trojan performs the following DNS queries:

• {random 9-14 char domain}.com [we observed over 100 of these requests]
• microsoft.com

The Trojan uses a typical Windows installer icon and claims to have originated from Valve Corporation:

Upon infection the Trojan removes itself from the location it is run from. It then shows a fake virus scan informing the user that the system is infected with Malware:

Clicking the “register” button leads to the following page:

The Trojan will periodically show variations of the following pop-ups:

The Trojan creates the following files on the filesystem:

• C:Documents and SettingsAll UsersApplication Datac5t4g1kso4fl53 [Detected as GAV: Fakerean_7 (Trojan)]
• C:Documents and Settings{USER}Local SettingsApplication Datac5t4g1kso4fl53 [Detected as GAV: Fakerean_7 (Trojan)]
• C:Documents and Settings{USER}Local SettingsApplication Datahxk.exe [Detected as GAV: Fakerean_7 (Trojan)]
• C:Documents and Settings{USER}Local SettingsTempc5t4g1kso4fl53 [Detected as GAV: Fakerean_7 (Trojan)]
• C:Documents and Settings{USER}Templatesc5t4g1kso4fl53 [Detected as GAV: Fakerean_7 (Trojan)]

The Trojan creates the following keys in the Windows registry:

Registry Spawning keys:

• HKEY_CLASSES_ROOT.exeDefaultIcon @ “%1”
• HKEY_CLASSES_ROOT.exeshellopencommand @ “”C:Documents and Settings{USER}Local SettingsApplication Datahxk.exe” -a “%1″ %*”
• HKEY_CURRENT_USERSoftwareClasses.exeshellopencommand @ “”C:Documents and Settings{USER}Local SettingsApplication Datahxk.exe” -a “%1″ %*”
• HKEY_CURRENT_USERSoftwareClassesexefileshellopencommand @ “”C:Documents and Settings{USER}Local SettingsApplication Datahxk.exe” -a “%1″ %*”
• HKEY_CURRENT_USERSoftwareClassesexefileshellopencommand IsolatedCommand “”%1″ %*”
• HKEY_CURRENT_USERSoftwareClassesexefileshellrunascommand @ “”%1″ %*”
• HKEY_CURRENT_USERSoftwareClassesexefileshellrunascommand IsolatedCommand “”%1″ %*”
• HKEY_USERSS-1-5-21-1993962763-1202660629-1957994488-1003_Classesexefileshellopencommand @ “”C:Documents and Settings{USER}Local SettingsApplication Datahxk.exe” -a “%1″ %*”

Disabling firewall:

• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyDomainProfile EnableFirewall dword:00000000
• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyDomainProfile DoNotAllowExceptions dword:00000000
• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyDomainProfile DisableNotifications dword:00000001

The Trojan deletes the following keys from the Windows registry:

To disable Windows Automatic Updates:

• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_WUAUSERV000 ClassGUID “{8ECC055D-047F-11D1-A537-0000F8753ED1}”
• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_WUAUSERV000 DeviceDesc “Automatic Updates”
• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_WUAUSERV000Control ActiveService “wuauserv”
• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServiceswuauserv ImagePath hex “%systemroot%system32svchost.exe -k netsvcs”
• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServiceswuauserv DisplayName “Automatic Updates”

SonicWALL Gateway AntiVirus provides protection against this threat with the following signature:

• GAV: Fakerean_7 (Trojan)