Researchers Offer a 'VirusTotal for ICS'

Free online sandbox, honeypot tool simulates a real-world industrial network environment.

Dark Reading logo in a gray background | Dark Reading

S4x18 CONFERENCE – Miami – A team of researchers plans to release an open source online tool for capturing and vetting industrial control system (ICS) malware samples that operates as a sandbox with honeypot features.

David Atch, vice president of research for CyberX, here today outlined details of the free, Web-based sandbox tool he and his team initially developed for research purposes. "It's like a VirusTotal for ICS," he explains in an interview.

VirusTotal is the wildly popular online tool that uses multiple antivirus and scan engines to analyze suspicious files and URLs for malware.

The goal was to create a sandbox that simulates real-world industrial networks. The sandbox tool allows ICS malware to execute and unpack, and then detects telltale malicious activities such as OPC (Open Platform Communications) scanning or overwriting programmable logic controller (PLC) configuration files, and provides quick offline detection, according to CyberX, which plans to roll out the tool in the next couple of months.

Atch says existing network sandbox technology for non-ICS, or IT environments, often misses ICS-specific malware because it doesn't account for OT protocols and devices, for example, and doesn't simulate OT components. "There are not enough tools for the ICS community," Atch says. And VirusTotal isn't ideal for ICS-specific malware, either, he says.

Take Stuxnet. The first Stuxnet variant was sent to VirusTotal in 2007, notes Ralph Langner, founder and CEO of Langner Communications, but Stuxnet wasn't detected until 2012, he says. "I strongly support the idea" of a VirusTotal for ICS malware, he says.

Langner, a top Stuxnet expert, says ICS malware analysis is time-consuming. "It took me three years to analyze Stuxnet," he says.

The ICS malware sandbox tool is aimed at more efficiently spotting ICS-specific malware, and can simulate the types of traffic to and from a PLC, for example, as its honeypot function. That allows the malware to execute in a safe space while unpacking and uncovering its functions and matching them with other known variants. The tool includes OT software, virtualized ICS processes and files, and a low-interaction ICS network (the honeypot element).

The concept of an ICS sandbox isn't new: researchers at Trend Micro in 2013 stood up two honeypot-based architectures that posed as a typical ICS/SCADA environment at a water utility, including one that included a Web-based application for a water pressure station. There were 39 attacks from 14 different nations over a 28-day period. Most attacks on ICS/SCADA systems appeared to come from China (35%), followed by the US (19%) and Laos (12%).

Related Content:

About the Author

Kelly Jackson Higgins, Editor-in-Chief, Dark Reading

Kelly Jackson Higgins is the Editor-in-Chief of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, Virginia Business magazine, and other major media properties. Jackson Higgins was recently selected as one of the Top 10 Cybersecurity Journalists in the US, and named as one of Folio's 2019 Top Women in Media. She began her career as a sports writer in the Washington, DC metropolitan area, and earned her BA at William & Mary. Follow her on Twitter @kjhiggins.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights