乌克兰电力系统BlackEnergy病毒分析与防御

王勇; 王钰茗; 张琳; 张林鹏

doi:10.11959/j.issn.2096-109x.2017.00139

您当前的位置：

首页 >

文章列表页 >

乌克兰电力系统BlackEnergy病毒分析与防御

学术论文 | 更新时间：2024-06-03

- 乌克兰电力系统BlackEnergy病毒分析与防御
- Analysis and defense of the BlackEnergy malware in the Ukrainian electric power system
- 网络与信息安全学报 2017年3卷第1期页码：46-53
- 作者机构：
- 作者简介：
  
  [ "王勇（1973-），男，河南驻马店人，博士，上海电力学院教授，主要研究方向为电力系统攻防试验床、病毒分析、入侵检测。" ]
  [ "王钰茗（1994-），女，山东烟台人，上海电力学院本科生，主要研究方向为病毒分析。" ]
  [ "张琳（1995-），女，黑龙江绥化人，上海电力学院本科生，主要研究方向为病毒分析。" ]
  [ "张林鹏（1991-），男，河北邢台人，上海电力学院硕士生，主要研究方向为电力系统防火墙。" ]
- 基金信息：
  
  上海科委地方能力建设基金资助项目;The Project of Shanghai Science and Technology Committee(15110500700);上海市浦江人才计划基金资助项目;Shanghai Pujiang Program(16PJ1433100);上海自然科学基金资助项目;Shanghai Municipal Natural Science Foundation(16ZR1436300);上海科委中小企业创新基金资助项目;Shanghai Science and TechnologyInnovation Fund for Small and Medium Enterprises(1601H1E2600)
- DOI：10.11959/j.issn.2096-109x.2017.00139
  中图分类号： TP393
- 网络首发：2017-01，
  
  纸质出版：2017-01-15
- 稿件说明：
移动端阅览
王勇, 王钰茗, 张琳, 等. 乌克兰电力系统BlackEnergy病毒分析与防御[J]. 网络与信息安全学报, 2017,3(1):46-53.

Yong WANG, Yu-ming WANG, Lin ZHANG, et al. Analysis and defense of the BlackEnergy malware in the Ukrainian electric power system[J]. Journal of network and information security, 2017, 3(1): 46-53.
王勇, 王钰茗, 张琳, 等. 乌克兰电力系统BlackEnergy病毒分析与防御[J]. 网络与信息安全学报, 2017,3(1):46-53. DOI： 10.11959/j.issn.2096-109x.2017.00139.

Yong WANG, Yu-ming WANG, Lin ZHANG, et al. Analysis and defense of the BlackEnergy malware in the Ukrainian electric power system[J]. Journal of network and information security, 2017, 3(1): 46-53. DOI： 10.11959/j.issn.2096-109x.2017.00139.

摘要

2015年12月，乌克兰电力系统遭到BlackEnergy病毒攻击，导致伊万诺—弗兰科夫斯克州地区发生多处同时停电的事故，该病毒也威胁到我国电力系统安全。通过获取不同版本的BlackEnergy病毒样本，构建了分析环境，发现了BlackEnergy攻击方式，并给出了防御方法。

Abstract

Ukrainian electric power system suffered BlackEnergy virus attacks in December 2015

resulting in blackout accident occurred simultaneously at multiple areas in Ivano-Frankovsk region

the malware also pose a threat to the electric power system security in China. Based on different versions of samples of BlackEnergy acquired

the attack mode was analyzed and the prevention of the virus was provided under the proper analysis environment.

关键词

Keywords

references

Brian Prince(2014). Researchers go inside black energy mal-ware [EB/OL ] . http://www.securityweek.com/researchers-go-inside-blackenergy-malware http://www.securityweek.com/researchers-go-inside-blackenergy-malware .

John Hultquist(2014).Sandworm team–targeting SCADA sys-tems [EB/OL ] . https://www.isightpartners.com/2014/10/sandworm-team-targeting-scada-systems/ https://www.isightpartners.com/2014/10/sandworm-team-targeting-scada-systems/ .

安天实验室 . 乌克兰停电事件启示录 [J ] . 中国信息安全， 2016 ( 4 ): 48 - 53 .

Antiy Lab . Revelation of blackout in Ukraine [J ] . China Information Security , 2016 ( 4 ): 48 - 53 .

绿盟科技(2016) . 从乌电事件看我国电力安全 [EB/OL ] . http://www.aiweibang.com/yuedu/82697112.html http://www.aiweibang.com/yuedu/82697112.html .

NSFOCUS.(2016) . Power safety in China from Ukraine's power grid incident [EB/OL ] . http://www. aiweibang.com/yuedu/ 82697112. html http://www. aiweibang.com/yuedu/ 82697112. html .

哈尔滨安天科技股份有限公司、北京四方继保自动化股份有限公司、复旦大学网络空间治理研究中心 . 乌克兰电力系统遭受攻击事件综合分析 [J ] . 信息安全研究， 2016 ( 3 ): 243 .

Harbin Antiy Tech. Co. Ltd., Beijing Sifang Automation Co. Ltd., Fudan University Network Space Management Research Center . Comprehensive analysis of Ukraine's power grid incident [J ] . Journal of Information Security Research , 2016 ( 3 ): 243 .

安天实验室安全研究与应急处理中心 . BlackEnergy简报 [EB/OL ] . http://www.antiy.com/response/BlackEnergy/BlackEnergy.html http://www.antiy.com/response/BlackEnergy/BlackEnergy.html .

Antiy CERT . BlackEnergy briefing [EB/OL ] . http://www.antiy.com/response/BlackEnergy/ Black-Energy.html http://www.antiy.com/response/BlackEnergy/ Black-Energy.html .

F-secure . (2014)BLACKENERGY＆QUEDAGH: the convergence of crimeware and APT attacks [EB/OL ] . https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf https://www.f-secure.com/documents/996508/1030745/blackenergy_whitepaper.pdf .

CVE通用漏洞与披露(2014). Microsoft Windows OLE 远程执行代码漏洞(CNNVD-201410-268) [EB/OL ] . http://cve.scap.org.cn/CVE-2014-4114.html http://cve.scap.org.cn/CVE-2014-4114.html .

CVE Common vulnerabilities and disclosures(2014). Windows OLE remote code execution vulnerability (CNNVD-201410-268) [EB/OL ] . http://cve.scap.org.cn/CVE-2014-4114.html http://cve.scap.org.cn/CVE-2014-4114.html .

翰海源安全(2014). Windows 任意代码执行0day (CVE-2014-4114)分析报告 [EB/OL ] . http://www.freebuf. com/news/46956.html http://www.freebuf. com/news/46956.html .

Nanjing Vulnhunt Information Security Inc. Analysis report of Windows arbitrary code execution of 0day (CVE-2014-4114) [EB/OL ] . http://www.freebuf.com/news/46956.html http://www.freebuf.com/news/46956.html .

CVE 通用漏洞与披露(2014). GE intelligent platforms proficy HMI/SCADA-CIMPLICITY 目录遍历漏洞(CNNVD-201401-524) [EB/OL ] . http://cve.scap.org.cn/CVE-2014-0751.html http://cve.scap.org.cn/CVE-2014-0751.html .

CVE Common vulnerabilities and disclosures. GE Intelligent plat-forms proficy HMI/SCADA-CIMPLICITY directory traversal vul-nerability (CNNVD-201401-524) [EB/OL ] . http://cve.scap.org. cn/CVE-2014-0751.html http://cve.scap.org. cn/CVE-2014-0751.html .

王得金 . 从乌克兰电网被攻击事件看我国基础电网面临的安全风险及处置建议 [J ] . 中国信息安全， 2016 ( 3 ): 91 - 93 .

WANG D J . Security risks faced by China's basic power grids and suggestions on disposal from the attacked events in Ukraine power grid [J ] . China Information Security , 2016 ( 3 ): 91 - 93 .

浏览量

1126

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

暂无数据