Analysis and defense of the BlackEnergy malware in the Ukrainian electric power system

Yong WANG; Yu-ming WANG; Lin ZHANG; Lin-peng ZHANG

doi:10.11959/j.issn.2096-109x.2017.00139

您当前的位置：

首页 >

文章列表页 >

Analysis and defense of the BlackEnergy malware in the Ukrainian electric power system

Academic paper | 更新时间：2024-06-03

- Analysis and defense of the BlackEnergy malware in the Ukrainian electric power system
- Journal of network and information security Vol. 3, Issue 1, Pages: 46-53(2017)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2017.00139
  CLC： TP393
- Online First：2017-01，
  
  Published：15 January 2017
- 稿件说明：
移动端阅览
Yong WANG, Yu-ming WANG, Lin ZHANG, et al. Analysis and defense of the BlackEnergy malware in the Ukrainian electric power system[J]. Journal of network and information security, 2017, 3(1): 46-53.
DOI：

Yong WANG, Yu-ming WANG, Lin ZHANG, et al. Analysis and defense of the BlackEnergy malware in the Ukrainian electric power system[J]. Journal of network and information security, 2017, 3(1): 46-53. DOI： 10.11959/j.issn.2096-109x.2017.00139.

摘要

2015年12月，乌克兰电力系统遭到BlackEnergy病毒攻击，导致伊万诺—弗兰科夫斯克州地区发生多处同时停电的事故，该病毒也威胁到我国电力系统安全。通过获取不同版本的BlackEnergy病毒样本，构建了分析环境，发现了BlackEnergy攻击方式，并给出了防御方法。

Abstract

Ukrainian electric power system suffered BlackEnergy virus attacks in December 2015

resulting in blackout accident occurred simultaneously at multiple areas in Ivano-Frankovsk region

the malware also pose a threat to the electric power system security in China. Based on different versions of samples of BlackEnergy acquired

the attack mode was analyzed and the prevention of the virus was provided under the proper analysis environment.

关键词

Keywords

references

Brian Prince(2014). Researchers go inside black energy mal-ware [EB/OL ] . http://www.securityweek.com/researchers-go-inside-blackenergy-malware http://www.securityweek.com/researchers-go-inside-blackenergy-malware .

John Hultquist(2014).Sandworm team–targeting SCADA sys-tems [EB/OL ] . https://www.isightpartners.com/2014/10/sandworm-team-targeting-scada-systems/ https://www.isightpartners.com/2014/10/sandworm-team-targeting-scada-systems/ .

安天实验室 . 乌克兰停电事件启示录 [J ] . 中国信息安全， 2016 ( 4 ): 48 - 53 .

Antiy Lab . Revelation of blackout in Ukraine [J ] . China Information Security , 2016 ( 4 ): 48 - 53 .

绿盟科技(2016) . 从乌电事件看我国电力安全 [EB/OL ] . http://www.aiweibang.com/yuedu/82697112.html http://www.aiweibang.com/yuedu/82697112.html .

NSFOCUS.(2016) . Power safety in China from Ukraine's power grid incident [EB/OL ] . http://www. aiweibang.com/yuedu/ 82697112. html http://www. aiweibang.com/yuedu/ 82697112. html .

哈尔滨安天科技股份有限公司、北京四方继保自动化股份有限公司、复旦大学网络空间治理研究中心 . 乌克兰电力系统遭受攻击事件综合分析 [J ] . 信息安全研究， 2016 ( 3 ): 243 .

Harbin Antiy Tech. Co. Ltd., Beijing Sifang Automation Co. Ltd., Fudan University Network Space Management Research Center . Comprehensive analysis of Ukraine's power grid incident [J ] . Journal of Information Security Research , 2016 ( 3 ): 243 .

安天实验室安全研究与应急处理中心 . BlackEnergy简报 [EB/OL ] . http://www.antiy.com/response/BlackEnergy/BlackEnergy.html http://www.antiy.com/response/BlackEnergy/BlackEnergy.html .

Antiy CERT . BlackEnergy briefing [EB/OL ] . http://www.antiy.com/response/BlackEnergy/ Black-Energy.html http://www.antiy.com/response/BlackEnergy/ Black-Energy.html .

F-secure . (2014)BLACKENERGY＆QUEDAGH: the convergence of crimeware and APT attacks [EB/OL ] . https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf .

CVE通用漏洞与披露(2014). Microsoft Windows OLE 远程执行代码漏洞(CNNVD-201410-268) [EB/OL ] . http://cve.scap.org.cn/CVE-2014-4114.html http://cve.scap.org.cn/CVE-2014-4114.html .

CVE Common vulnerabilities and disclosures(2014). Windows OLE remote code execution vulnerability (CNNVD-201410-268) [EB/OL ] . http://cve.scap.org.cn/CVE-2014-4114.html http://cve.scap.org.cn/CVE-2014-4114.html .

翰海源安全(2014). Windows 任意代码执行0day (CVE-2014-4114)分析报告 [EB/OL ] . http://www.freebuf. com/news/46956.html http://www.freebuf. com/news/46956.html .

Nanjing Vulnhunt Information Security Inc. Analysis report of Windows arbitrary code execution of 0day (CVE-2014-4114) [EB/OL ] . http://www.freebuf.com/news/46956.html http://www.freebuf.com/news/46956.html .

CVE 通用漏洞与披露(2014). GE intelligent platforms proficy HMI/SCADA-CIMPLICITY 目录遍历漏洞(CNNVD-201401-524) [EB/OL ] . http://cve.scap.org.cn/CVE-2014-0751.html http://cve.scap.org.cn/CVE-2014-0751.html .

CVE Common vulnerabilities and disclosures. GE Intelligent plat-forms proficy HMI/SCADA-CIMPLICITY directory traversal vul-nerability (CNNVD-201401-524) [EB/OL ] . http://cve.scap.org. cn/CVE-2014-0751.html http://cve.scap.org. cn/CVE-2014-0751.html .

王得金 . 从乌克兰电网被攻击事件看我国基础电网面临的安全风险及处置建议 [J ] . 中国信息安全， 2016 ( 3 ): 91 - 93 .

WANG D J . Security risks faced by China's basic power grids and suggestions on disposal from the attacked events in Ukraine power grid [J ] . China Information Security , 2016 ( 3 ): 91 - 93 .

Views

1126

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

No data

Related Author

No data

Related Institution

No data

⁰