1. 濡備綍閬告搰闇€瑕佹劅鏌撶殑PLC銆�
      Stuxnet鏈冩牴鎿�(j霉)鐩(bi膩o)绯荤当(t菕ng)鐨勭壒榛�锛屼娇鐢ㄤ笉鍚岀殑浠ｇ⒓渚嗘劅鏌揚LC銆� 涓€鍊嬫劅鏌撶殑搴忓垪鍖呮嫭浜嗚ū澶歅LC 妯″锛堜唬纰兼ā濉婂拰鏁�(sh霉)鎿�(j霉)妯″锛�锛岀敤浠ユ敞鍏LC渚嗘敼璁婄洰妯�(bi膩o)PLC 鐨勮鐐�銆傞€欏€嬪▉鑴呭寘鎷簡涓夊€嬫劅鏌撳簭鍒椼€傚叾涓叐鍊嬮潪甯哥浉浼�锛屽姛鑳戒篃鐩稿悓锛屾垜鍊戝皣鍏跺懡鍚嶇偤搴忓垪A鍜孊銆傜涓夊€嬪簭鍒楁垜鍊戝懡鍚嶇偤搴忓垪C銆係tuxnet閫氶亷椹楄瓑鈥滄寚绱嬧€濅締鍒ゆ柗绯荤当(t菕ng)鏄惁鐐鸿▓鍔冩敾鎿婄殑鐩(bi膩o)銆傚畠鏈冩鏌ワ細 PLC绋/瀹舵棌锛氬彧鏈塁PU 6ES7-417 鍜�6ES7-315-2 鏈冭鎰熸煋銆傜郴绲�(t菕ng)鏁�(sh霉)鎿�(j霉)妯″锛歋DB 鏈冭瑙ｆ瀽锛涙牴鎿�(j霉)浠栧€戝寘鍚殑鏁�(sh霉)鎿�(j霉)锛屾劅鏌撻€茬▼鏈冮伕鎿嘇,B鎴栧叾瀹冩劅鏌撴柟寮忛枊濮嬭鍕�銆傜暥(d膩ng)瑙ｆ瀽SDB 鏅�锛屼唬纰兼渻鎼滅储閫欏叐鍊嬪€兼槸鍚﹀瓨鍦�-- 7050h and 9500h锛涚劧鍚庢牴鎿�(j霉)閫欏叐鍊嬫暩(sh霉)鍊肩殑鍑虹従(xi脿n)娆℃暩(sh霉)锛岄伕鎿囧簭鍒桝 鎴朆 涓殑涓€绋締鎰熸煋PLC銆� 浠ｇ⒓閭勬渻鍦⊿DB 妯″鐨�50h 瀛愰泦涓悳绱㈠瓧绡€(ji茅)搴�2C CB 00 01, 閫欏€嬪瓧绡€(ji茅)搴忓弽鏄犱簡閫氫俊铏曠悊鍣–P 342-5 (鐢ㄤ綔Profibus-DP) 鏄惁瀛樺湪銆� 鑰岄伕鎿囧簭鍒桟閫茶鎰熸煋鐨勬浠跺墖鐢卞叾浠栧洜绱犳(g貌u)鎴�銆�
      2. 鎰熸煋鏂规硶銆�
      Stuxnet浣跨敤鈥滀唬纰兼彃鍏モ€濈殑鎰熸煋鏂瑰紡銆傜暥(d膩ng)Stuxnet 鎰熸煋OB1鏅�锛屽畠鏈冨煼(zh铆)琛屼互涓嬭鐐猴細 澧炲姞鍘熷妯″鐨勫ぇ灏�锛� 鍦ㄦā濉婇枊闋鍏ユ儭鎰忎唬纰�锛� 鍦ㄦ儭鎰忎唬纰煎悗鎻掑叆鍘熷鐨凮B1 浠ｇ⒓銆係tuxnet涔熸渻鐢ㄩ浼间簬鎰熸煋OB1鐨勬柟寮忔劅鏌揙B35銆傚畠鏈冪敤鑷韩渚嗗彇浠ｆ(bi膩o)婧�(zh菙n)鐨勫崝(xi茅)鍚岃檿鐞嗗櫒DP_RECV 浠ｇ⒓濉�锛岀劧鍚庡湪Profibus (涓€鍊嬫(bi膩o)婧�(zh菙n)鐨勭敤浣滃垎甯冨紡I/O鐨勫伐妤�(y猫)缍�(w菐ng)绲�(lu貌)绺界窔) 涓帥閴ょ恫(w菐ng)绲�(lu貌)閫氫俊銆� 鍒╃敤A/B鏂规硶鐨勬劅鏌撴椹熷涓嬶細 妾㈡煡PLC 椤炲瀷锛� 瑭查鍨嬪繀闋堢偤S7/315-2锛� 妾㈡煡SDB 妯″锛屽垽鏂锋噳(y墨ng)瑭插鍏ュ簭鍒桝 鎴朆 涓殑鍝竴鍊�锛� 鎵惧埌DP_RECV锛屽皣鍏跺京(f霉)鍒跺埌FC1869锛屽苟鐢⊿tuxnet宓屽叆鐨勪竴鍊嬫儭鎰忔嫹璨濆皣鍏跺彇浠�锛� 鍦ㄥ簭鍒椾腑瀵叆鎯℃剰妯″锛堢附鍏�20鍊嬶級锛岀敱Stuxnet 宓屽叆锛� 鎰熸煋OB1锛屼护鎯℃剰浠ｇ⒓鍙互鍦ㄦ柊鐨勫懆鏈熼枊濮嬫檪鍩�(zh铆)琛�锛� 鎰熸煋OB35, 瀹冨皣鎵紨鈥滅湅闁€鐙椻€濈殑瑙掕壊銆�
      3. 鎰熸煋浠ｇ⒓銆�
      琚敞鍏B1 鍔熻兘鐨勪唬纰兼槸鐢ㄤ締鎰熸煋搴忓垪A 鍜孊鐨�銆傞€欎簺搴忓垪鍖呭惈浜嗕互涓嬫ā濉婏細 浠ｇ⒓濉婏細FC1865 鑷矲C1874, FC1876 鑷矲C1880 锛堟敞鎰忥細FC1869骞堕潪Stuxnet鐨勪竴閮ㄥ垎锛岃€屾槸PLC鐨凞P_RECV妯″鐨勪竴鍊嬫嫹璨濓級锛� 鏁�(sh霉)鎿�(j霉)妯″锛欴B888 鑷矰B891銆� 搴忓垪A 鍜孊 鐢―P_RECV 鎺涢墹妯″渚嗘敂鎴狿rofibus 涓殑鏁�(sh霉)鎿�(j霉)鍖�锛屽苟鏍规摎(j霉)鍦ㄩ€欎簺妯″涓壘鍒扮殑鏁�(sh霉)鍊�锛屼締妲�(g貌u)閫犲叾浠栫殑鏁�(sh霉)鎿�(j霉)鍖呭苟鐧�(f膩)閫佸嚭鍘�銆傞€欑敱涓€鍊嬪京(f霉)闆滅殑鐙€鎱�(t脿i)姗熸帶鍒讹紙鐙€鎱�(t脿i)姗熻寤虹珛鍦ㄤ笂闈㈡彁鍒扮殑FC 妯″涓級銆傞€欏€嬬媭鎱�(t脿i)姗熷彲閮ㄥ垎鍙楁帶浜庢暩(sh霉)鎿�(j霉)濉奃B890 涓殑DLL銆� 鍦ㄦ煇浜涙浠朵笅锛屽簭鍒桟鏈冭瀵叆涓€鍊婸LC銆傞€欏€嬪簭鍒楁瘮A鍜孊鍖呭惈鏇村鐨勬ā濉婏細 FC6055 鑷矲C6084锛汥B8062, DB8063锛汥B8061, DB8064 鑷矰B8070 锛堝湪閬嬭涓敘(ch菐n)鐢燂級銆� 搴忓垪C涓昏鐐轰簡灏嘔/O淇℃伅璁€瀵叆PLC鐨勫収(n猫i)瀛樻枃浠舵槧灏勭殑I/O 鍗€(q奴)鍩�锛屼互鍙婂鍦嶈ō(sh猫)鍌欑殑I/O銆� 绋嬪簭A/B 鐨勬帶鍒舵祦濡備笅鍦栨墍绀猴紝鍦ㄤ箣鍓嶇殑Step7 绶ㄨ集鍣ㄧ殑鎴湒涓篃鏈夐儴鍒嗛’绀猴紙鏁�(sh霉)鎿�(j霉)妯″FC1873锛�
      4. Rootkit Stuxnet PLC rootkit浠ｇ⒓鍏ㄩ儴钘忚韩浜庡亣鍐掔殑s7otbxdx.dll涓�銆�
      鐐轰簡涓嶈PLC鎵€妾㈡脯鍒�锛屽畠鑷冲皯闇€瑕佹噳(y墨ng)浠樹互涓嬫儏娉侊細 灏嶈嚜宸辩殑鎯℃剰鏁�(sh霉)鎿�(j霉)妯″鐨勮畝璜嬫眰锛涘皪鍙楁劅鏌撴ā濉�(OB1 , OB35, DP_RECV) 鐨勮畝璜嬫眰锛涘彲鑳借钃婼tuxnet鑷韩浠ｇ⒓鐨勫璜嬫眰銆� Stuxnet鍖呭惈浜嗙洠(ji膩n)娓拰鏀旀埅閫欎簺璜嬫眰鐨勪唬纰硷紝瀹冩渻淇敼閫欎簺璜嬫眰浠ヤ繚璀塖tuxnet 鐨凱LC 浠ｇ⒓涓嶆渻琚櫦(f膩)鐝�(xi脿n)鎴栬鐮村銆備笅闈㈠垪鍑轰簡骞惧€婼tuxnet鐢ㄨ鎺涢墹鐨勫皫(d菐o)鍑哄懡浠や締鎳�(y墨ng)浠橀€欎簺鎯呮硜鐨勪緥瀛愶細 s7blk_read: 鐩�(ji膩n)娓畝璜嬫眰锛岃€屽悗Stuxnet 鏈冭繑鍥烇細鐪熷璜嬫眰鐨凞P_RECV (淇濆瓨鐐篎V1869)锛涢尟瑾や俊鎭�锛屽鏋滆畝璜嬫眰鏈冩秹鍙婂埌瀹冪殑鎯℃剰妯″锛汷B1鎴朞B35鐨勫共鍑堢増鏈殑鎷疯矟s7blk_write: 鐩�(ji膩n)娓棞(gu膩n)浜嶰B1/OB35鐨勫璜嬫眰锛屼互淇濊瓑浠栧€戠殑鏂扮増鏈篃鏈冭鎰熸煋銆俿7blk_findfirst / s7blk_findnext: 閫欎簺渚嬬▼琚敤浜庢灇鑸塒LC涓殑妯″銆傛儭鎰忔ā濉婃渻琚嚜鍕曡烦閬庛€俿7blk_delete: 鐩�(ji膩n)娓皪妯″鐨勨€滃埅闄も€濇搷浣�銆� 濡備笂鏂囨墍杩帮紝Stuxnet 鏄竴鍊嬮潪甯稿京(f霉)闆滅殑濞佽剠锛岃€屽叾涓殑PLC 鎰熸煋浠ｇ⒓浠ゅ晱椤屾洿鍔犻洠浠ヨВ姹�銆�