Luxtaxnet: Bankrupt Industrial Control System

Dillon Beresford saw Stuxnet as a challenge because he wanted to see if it was possible for a single individual to pull off an attack on a similar scale as Stuxnet that could disrupt industrial control systems. Due to the sophisticated nature of the attack, which used four separate zero-day vulnerabilities, and stolen digital certificates to craft and disguise a complex piece of malware that targeted Siemens SIMATIC Step 7 PLCs, Stuxnet was assumed to be the work of a nation-state. Surely a nation-state might have at its disposal the time and money needed to discover, or otherwise acquire these zero-day vulnerabilities, as well as the man power needed to use these flaws to compile and disguise such a clever cyberattack. An individual on the other hand would never be able to accomplish such an attack, or have such a high level understanding of the interworking of the control systems at the Natanz uranium enrichment facilities. Or so it was thought. Dillon Beresford was intrigued by the assumption that only a nation-state could pull off such a

seemingly difficult task. As a security researcher he was curious to see if he would be able to do so himself. Beresford wondered if Stuxnet was as difficult to accomplish as it appeared.
As it turned out, Beresford was in fact able to discover several new zero-day vulnerabilities in Siemens’s SIMATIC Step 7 PLCs. These vulnerabilities would allow an attacker to cause serious damage.
Beresford was now confronted with an ethical dilemma that many security researchers like himself face every time they make such a discovery: What do you do with the information, and how do you go about disclosing the vulnerabilities? “Beresford, - or a person that finds themselves in a similar position – has four general options when it comes to disclosing a zero-day vulnerability: provide the vulnerability to the vendor; release the flaw to the public at large; pass the vulnerability to an intermediary; or sell the vulnerability to an interested party.” In order to make the best decision it is important to fully understand the consequences associated with each option and consider the impact, both positive and negative, that each option would have on the researcher, the product vendor, and the general public.
In the first scenario, Beresford would only share the vulnerabilities he discovered in the S7 PLCs with the products vendor and not the general public. This option, known as limited disclosure, benefits the product vendor by making them aware of the vulnerability and allowing them to take appropriate measures to fix the issue and release patches for their product. In theory the vendor would be able to remedy the issue before new viruses and malware had an opportunity exploit it. However, once the vendor is aware of the vulnerability, the decision on whether or not to even address the issue is entirely up to them. If the vendor chose not to address the issue, a situation which happens more than one might think, the general public would still be both unaware of, and unprotected against the vulnerability. A recent example of how limited disclosure can negatively impact the public is the General Motors ignition recall. In this situation, General Motors neglected to fix a critical design flaw in the ignition switches used in many of its vehicles because the costs associated with issuing a vehicle recall would decrease overall revenue. Independent research concluded that the faulty ignition switches were directly linked to over 100 fatal car accidents involving vehicles made by General Motors. This prompted the auto maker to “recall 2.6 million [...] cars last year, [even though] it knew about problems with the switches for more than a decade.”
Beresford had to decide if he thought the public should be aware of the vulnerabilities he found in Siemens S7 PLCs. The next scenario, involves releasing the vulnerability to the public. Choosing this option, known as full disclosure, Beresford would post the details of his findings to a high profile blog or give a presentation at a computer security conference. This benefits of this approach include making the general public aware of the vulnerability, forcing Siemens to take action to patch the flaw, and providing Beresford with fame and respect from the cybersecurity community. However, the full disclosure approach does have its drawbacks. Releasing the vulnerability directly to the public provides hackers and virus writers the chance to create new malware and exploits before Siemens can the patch the flaw. This puts end users of the S7 PLCs at risk of attack. For that reason, full disclosure is “seen by many within computer security circles as irresponsible and reckless” and could damage Beresford’s professional reputation as a security researcher and jeopardize his career. An example of a vulnerability that was released directly to the public is the Heartbleed bug. “The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet.” The details of this vulnerability were publically released, and as a result, end users were left open to attack while vendors worked on finding a solution.
The third scenario, known as responsible disclosure, essentially combines limited disclosure and full disclosure into a more middle of the road approach. Beresford would first disclose the vulnerability exclusively to Siemens. This is similar limited disclosure, however, after a certain amount of time has passed, say a month for example, Beresford would release the vulnerability to the general public. With responsible disclosure Siemens now has both the time and incentive to release a security patch for the vulnerability before hackers and virus writers are aware of the issue, and thus able to write malware to exploit the flaw. This creates a situation that benefits everyone. Siemens gets a head start on writing a patch, the public learns of the vulnerability, and Beresford receives credit for his work. Responsible disclosure can be seen as a best of both worlds approach for combining the benefits from both limited and full disclosure, and avoiding their drawbacks.
In the fourth and final scenario, known as commercialization, Beresford would try and sell the vulnerabilities he discovered to the highest bidder.

Governments, security companies, and criminals are all potential buyers of zero day vulnerabilities. Security companies buy zero day vulnerabilities in order to gain a competitive edge. They use the zero days to provide their clients with protection from security risks that their competitors are unaware of. Governments often buy zero days to aid in their cyber warfare campaigns, or to protect their own systems from outside attack. Criminals buy zero days in order to exploit computer systems to accomplish malicious tasks such as stealing information, or initiating denial of service attacks. However there is no guarantee that anyone will buy the zero day from Beresford, or that he would be able to sell it before someone else discovered the vulnerability or a patch was

released.
Put in Dillon Beresford’s shoes I would choose responsible disclosure. Responsible disclosure is appealing to me because it provides the greatest benefit to all parties affected by the vulnerability. The product vendor, in this case Siemens, is made aware of the vulnerability and given ample time to come up with a solution to the problem, which it can then release to its end users. Full disclosure would put Siemens huge rush to release a patch and might result in them releasing a crude “quick fix” that has not been thoroughly tested or that does not fully address the vulnerability – An issue that can easily be avoided by giving them a reasonable amount of time to release a patch. As the individual who discovered the vulnerability I have no reason to release the information directly to the public as a form of “naming and shaming”. I don’t have to worry about not receiving credit for my work, and responsible disclosure only help to bolster my reputation as a reasonable and ethical individual. Finally, from the perspective of the end user, if the vulnerability is immediately made public, my systems are now likely to get attacked from hackers and virus writers who are also aware of the vulnerability. As an end user I would much rather the vulnerability be made public after there is a working patch to address the flaw, and responsible disclosure approach allows for exactly that.