从方程式泄漏工具包事件分析工控HMI/SCADA安全问题  

Analysis on HMI/SCADA Security from Hint of Equation Group Leakage Event

作　　者：李明政 孙一桉 

机构地区：[1]北京匡恩网络科技有限责任公司,北京100000

出　　处：《通信技术》2017年第3期550-557,共8页Communications Technology

摘　　要：网络技术飞速发展,带来了不少网络安全问题。近年来,网络安全事件不断发生,危害程度越来越大,网络安全已经上升到国家安全战略高度。网络安全最关键是系统的漏洞挖掘和利用技术。近期Equation Group被黑工具包泄漏事件,更是将民众和国家对网络安全和漏洞的关注推向了一个新高度。传统互联网方向的终端安全和web安全已经有很多互联网公司和安全公司投入大量时间和精力去研究,但是关系国计民生的工控系统的相关研究人员和公司却很少。由于工控设备和网络具有专用性、封闭性和复杂性,工控漏洞的挖掘利用与传统信息系统的漏洞挖掘和利用存在很大区别。因此,对常见的工控上位机软件进行相关分析,对工控的漏洞类型进行相关分类,并针对各种不同类型的工控漏洞的挖掘给出了新的挖掘方法。The rapid development of network technology brings lots of network security issues. Network security incidents constantly occur and their damages become more and more serious in recent years. Network security now rises to the height of national security strategy. The core of the network security is the technology of vulnerability discovery and exploitation. The Equation Group security event occurred in 2016 makes people pay more attention to the network security. Much work is done on traditional software security and web security by internet companies and security companies. However till now less study on ICS（Industrial Control System） security is done, and less companies specilized in this field. The ICS devices and ICS networks have the characteristics of being not open, and high degree of complexity, the discovery and exploition of ICS vulnerabilities is different from traditional internet vulnerabilities. This paper focuses on the analysis of ICS software, gives the related categories of ICS vulnerability, and proposes some new method to find ICS software vulnerabilities in accordance with the different types of ICS.

关 键 词：工业控制系统 漏洞挖掘 静态分析 污染分析 规则匹配 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]