Ralph Langner: Cracking Stuxnet, a 21st-century cyber weapon

翻译人员: Felix Chen 校对人员: Angelia King

The idea behind the Stuxnet computer worm

震网电脑蠕虫背后的思想

is actually quite simple.

其实非常简单。

We don't want Iran to get the bomb.

我们不希望伊朗拥有核武器。

Their major asset for developing nuclear weapons

他们用于开发核武器的主要设备

is the Natanz uranium enrichment facility.

是纳坦兹的铀浓缩设施。

The gray boxes that you see,

各位看到的灰盒子

these are real-time control systems.

是实时控制系统。

Now if we manage to compromise these systems

如果我们设法侵入这些

that control drive speeds and valves,

控制驱动器的速度和阀门的系统中，

we can actually cause a lot of problems

我们实际上可以用离心机

with the centrifuge.

造成很多问题。

The gray boxes don't run Windows software;

这个灰盒子不能运行Windows软件；

they are a completely different technology.

它们用的是完全不同的技术。

But if we manage

但如果我们设法

to place a good Windows virus

把一个Windows病毒

on a notebook

放到一名

that is used by a maintenance engineer

设备工程师用于配置

to configure this gray box,

这个灰盒子的笔记本上，

then we are in business.

然后我们就可以开始行动了。

And this is the plot behind Stuxnet.

这就是震网病毒背后的阴谋。

So we start with a Windows dropper.

那么我从一个Windows注入器开始。

The payload goes onto the gray box,

它携带的病毒传播到灰盒子，

damages the centrifuge,

破坏离心机，

and the Iranian nuclear program is delayed --

伊朗核项目延迟 --

mission accomplished.

任务完成。

That's easy, huh?

很容易，是吧？

I want to tell you how we found that out.

我想告诉大家我们是如何发现这些的。

When we started our research on Stuxnet six months ago,

当六个月前我们开始研究震网病毒时，

it was completely unknown what the purpose of this thing was.

我们对它的目的一无所知。

The only thing that was known

唯一知道的是，

is it's very, very complex on the Windows part, the dropper part,

它的Windows部分，注入器部分非常非常复杂，

used multiple zero-day vulnerabilities.

使用了多重零日漏洞攻击。

And it seemed to want to do something

它似乎想要对

with these gray boxes, these real-time control systems.

这些灰盒子，这些实时控制系统做些什么。

So that got our attention,

这引起了我们的注意，

and we started a lab project

我们启动了一个实验室项目，

where we infected our environment with Stuxnet

用震网病毒感染我们的系统，

and checked this thing out.

并进行了仔细的检查。

And then some very funny things happened.

接着一些非常有趣的事发生了。

Stuxnet behaved like a lab rat

震网病毒表现的像只

that didn't like our cheese --

不喜欢起司的大白鼠 --

sniffed, but didn't want to eat.

嗅一嗅起司，但并不想吃。

Didn't make sense to me.

我有些不理解。

And after we experimented with different flavors of cheese,

而在我们实验了各种不同的起司之后，

I realized, well, this is a directed attack.

我意识到，这是一个定向攻击。

It's completely directed.

它完全是定向的。

The dropper is prowling actively

如果找到了特定的配置，

on the gray box

注入器就会

if a specific configuration is found,

主动潜入灰盒子里，

and even if the actual program code that it's trying to infect

即使它正试图感染的实际的程序

is actually running on that target.

也在干着同样的事儿。

And if not, Stuxnet does nothing.

如果没有找到目标，震网病毒什么也不做。

So that really got my attention,

这确实引起了我的注意，

and we started to work on this

我们开始昼夜不停的

nearly around the clock,

对这个进行研究，

because I thought, "Well, we don't know what the target is.

因为我觉得我们还不知道它的目标呢。

It could be, let's say for example,

目标也许是，打个比方，

a U.S. power plant,

一座美国发电厂，

or a chemical plant in Germany.

或德国的化工厂。

So we better find out what the target is soon."

因此我们最好尽快找出它的目标。

So we extracted and decompiled

我们提取并反编译了

the attack code,

攻击代码，

and we discovered that it's structured in two digital bombs --

发现它包含两个数字炸弹 --

a smaller one and a bigger one.

一个小些的和一个大些的。

And we also saw that they are very professionally engineered

而我们也发现，它们是被了解所有内幕信息的人

by people who obviously had all insider information.

非常专业地制作出来的。

They knew all the bits and bites

他们了解所要攻击

that they had to attack.

目标的所有细节。

They probably even know the shoe size of the operator.

他们甚至知道操作员鞋子的号码。

So they know everything.

他们知道一切。

And if you have heard that the dropper of Stuxnet

如果各位曾经听说过，震网病毒的注入器

is complex and high-tech,

复杂且是高科技的，

let me tell you this:

让我告诉各位：

the payload is rocket science.

它携带的病毒非常复杂。

It's way above everything

这远超过我们

that we have ever seen before.

曾经见过的技术。

Here you see a sample of this actual attack code.

在这儿各位能看到实际的攻击代码的片段。

We are talking about --

我们在讨论 --

around about 15,000 lines of code.

大约1万5千行代码。

Looks pretty much like old-style assembly language.

看起来很像旧式的汇编语言。

And I want to tell you how we were able

我想告诉各位我们是

to make sense out of this code.

如何弄明白这些代码的。

So what we were looking for is, first of all, system function calls,

我们首先要寻找的是系统函数调用，

because we know what they do.

因为我们知道这些函数做什么。

And then we were looking for timers and data structures

然后我们要找到定时器和数据结构，

and trying to relate them to the real world --

接着尝试把它们和现实世界联系起来 --

to potential real world targets.

与潜在的现实世界目标联系起来。

So we do need target theories

因此我们需要目标理论

that we can prove or disprove.

我们能用它来证实与否。

In order to get target theories,

为了得到目标理论，

we remember

我们记得

that it's definitely hardcore sabotage,

这绝对会造成严重的破坏，

it must be a high-value target

因此必然有个高价值的目标，

and it is most likely located in Iran,

而且很有可能就位于伊朗境内，

because that's where most of the infections had been reported.

因为在伊朗报告的病毒感染最多。

Now you don't find several thousand targets in that area.

在这一区域并不会发现许多目标。

It basically boils down

基本上可以把目标缩小至

to the Bushehr nuclear power plant

布歇赫尔核电厂

and to the Natanz fuel enrichment plant.

和纳坦兹的铀浓缩厂。

So I told my assistant,

因此我对我的助理说，

"Get me a list of all centrifuge and power plant experts from our client base."

“给我一个包含我们客户群中所有离心机和发电厂专家的列表。”

And I phoned them up and picked their brain

我跟他们通了电话，让他们

in an effort to match their expertise

用他们的专业知识帮忙

with what we found in code and data.

分析我们在代码和数据中的发现。

And that worked pretty well.

这非常管用。

So we were able to associate

我们能把这个小的

the small digital warhead

数字弹头与转子控制器

with the rotor control.

联系起来了。

The rotor is that moving part within the centrifuge,

这个转子是离心机内部的运动机件，

that black object that you see.

就是各位看到的那个黑色物体。

And if you manipulate the speed of this rotor,

如果控制这个转子的速度，

you are actually able to crack the rotor

实际上就能破解转子

and eventually even have the centrifuge explode.

并甚至最终能让离心机爆炸。

What we also saw

我们也看到了

is that the goal of the attack

攻击的目的

was really to do it slowly and creepy --

是让这一切令人恐怖的事缓慢地发生--

obviously in an effort

显然这会

to drive maintenance engineers crazy,

让维护工程师们发疯，

that they would not be able to figure this out quickly.

他们不可能很快找出问题所在。

The big digital warhead -- we had a shot at this

大的数字弹头 -- 通过仔细地

by looking very closely

观察数据和数据结构，

at data and data structures.

我们有机会对它有所了解。

So for example, the number 164

例如，数字164

really stands out in that code;

在这些代码中非常引人注目；

you can't overlook it.

不可能忽略它。

I started to research scientific literature

我开始研究与这些分离机

on how these centrifuges

如何被建造在纳坦兹

are actually built in Natanz

有关的科学文献，

and found they are structured

并发现它们被组织在

in what is called a cascade,

一个被称为层级的东西之中，

and each cascade holds 164 centrifuges.

每个层级包含164个离心机。

So that made sense, that was a match.

这有点清楚了，匹配起来了。

And it even got better.

甚至更好地匹配了。

These centrifuges in Iran

在伊朗的这些离心机

are subdivided into 15, what is called, stages.

被分成15个所谓的机组。

And guess what we found in the attack code?

猜测我们在攻击代码中发现了什么？

An almost identical structure.

一个几乎完全相同的机组结构。

So again, that was a real good match.

因此，再一次地很好地匹配上了。

And this gave us very high confidence for what we were looking at.

这在我们所进行的工作上给了我们更多自信。

Now don't get me wrong here, it didn't go like this.

现在别误会我，它不是像这样进行的。

These results have been obtained

这些结果中包含了

over several weeks of really hard labor.

我们数周的辛苦劳动。

And we often went into just a dead end

我们常常走入死胡同

and had to recover.

并回到起点。

Anyway, so we figured out

总之，我们找出了

that both digital warheads

这两个从不同角度

were actually aiming at one and the same target,

瞄准着同一个目标的

but from different angles.

数字弹头。

The small warhead is taking one cascade,

小弹头选择一个层级，

and spinning up the rotors and slowing them down,

旋转加速转子，接着让它们慢下来，

and the big warhead

然后大弹头

is talking to six cascades

选择六个层级

and manipulating valves.

并操控阀门。

So in all, we are very confident

总的来说，我们非常自信

that we have actually determined what the target is.

我们确定了目标是什么。

It is Natanz, and it is only Natanz.

就是纳坦兹，只可能是纳坦兹。

So we don't have to worry

我们并不担心

that other targets

其他可能被震网病毒

might be hit by Stuxnet.

要攻击的目标。

Here's some very cool stuff that we saw --

有些我们看到的非常酷的东西 --

really knocked my socks off.

确实让我大吃一惊的东西。

Down there is the gray box,

这儿下面是灰盒子，

and on the top you see the centrifuges.

在上面看到的是离心机。

Now what this thing does

事情是这样的，

is it intercepts the input values from sensors --

它拦截了从传感器发送来的输入值--

so for example, from pressure sensors

例如，来自压力传感器

and vibration sensors --

和震动传感器的输入值 --

and it provides legitimate program code,

并提供合法的代码，

which is still running during the attack,

这代码会在攻击期间仍然保持运行，

with fake input data.

随代码一起的还有假的输入数据。

And as a matter of fact, this fake input data

事实上，这假的输入数据

is actually prerecorded by Stuxnet.

是震网病毒事先预存的。

So it's just like from the Hollywood movies

正如好莱坞电影

where during the heist,

中的抢劫片段，

the observation camera is fed with prerecorded video.

观察摄像头被连上了事先录制好的视频。

That's cool, huh?

很酷，不是么？

The idea here is obviously

它的打算显然

not only to fool the operators in the control room.

不仅是要愚弄控制室中的操作员。

It actually is much more dangerous and aggressive.

它实际上要更危险，更具侵略性。

The idea

它的打算

is to circumvent a digital safety system.

是要绕过数字安全系统。

We need digital safety systems

我们需要数字安全系统

where a human operator could not act quick enough.

在那些人类操作员不能做出足够快的行动的地方。

So for example, in a power plant,

例如，在发电厂，

when your big steam turbine gets too over speed,

当巨大的蒸汽轮机转速过快时，

you must open relief valves within a millisecond.

必须在一毫秒内打开安全阀。

Obviously, this cannot be done by a human operator.

显然，人类操作员不可能做到。

So this is where we need digital safety systems.

因此，在这儿就需要数字安全系统。

And when they are compromised,

而当它们受到损害时，

then real bad things can happen.

真正的问题就会出现。

Your plant can blow up.

电厂会爆炸。

And neither your operators nor your safety system will notice it.

操作员和安全系统都不会注意到。

That's scary.

这很可怕。

But it gets worse.

但还会更糟。

And this is very important, what I'm going to say.

我将要说到的，非常重要。

Think about this:

想想这个。

this attack is generic.

这种攻击是通用的。

It doesn't have anything to do, in specifics,

它不需要对离心机，

with centrifuges,

对铀浓缩做什么

with uranium enrichment.

具体的事情。

So it would work as well, for example,

它也将发挥作用，例如，

in a power plant

在一个发电厂

or in an automobile factory.

或是一个汽车制造厂。

It is generic.

这很普通。

And you don't have -- as an attacker --

作为一名攻击者，你不需要 --

you don't have to deliver this payload

不需要用U盘把病毒

by a USB stick,

传播出去，

as we saw it in the case of Stuxnet.

如我们在震网病毒这一案例中看到的那样。

You could also use conventional worm technology for spreading.

你也可以用传统的蠕虫技术进行传播。

Just spread it as wide as possible.

尽可能广泛地传播它。

And if you do that,

如果做到了这些

what you end up with

最终就会拥有

is a cyber weapon of mass destruction.

一个大规模杀伤性的网络武器。

That's the consequence

这就是我们不得不

that we have to face.

面对的后果。

So unfortunately,

不幸地是，

the biggest number of targets for such attacks

这类攻击数量最多的目标

are not in the Middle East.

不是在中东。

They're in the United States and Europe and in Japan.

而是在美国、欧洲和日本。

So all of the green areas,

所有这些绿色的区域，

these are your target-rich environments.

这些是目标密集的区域。

We have to face the consequences,

我们不得不面对这些后果，

and we better start to prepare right now.

我们最好立即开始做准备。

Thanks.

谢谢。

(Applause)

（掌声）

Chris Anderson: I've got a question.

克里斯·安德森：我有个问题。

Ralph, it's been quite widely reported

拉尔夫，广为流传

that people assume that Mossad

人们认为摩萨德

is the main entity behind this.

是幕后主使。

Is that your opinion?

你怎么看？

Ralph Langner: Okay, you really want to hear that?

拉尔夫·兰纳：好的，你真的想知道？

Yeah. Okay.

是的，好吧。

My opinion is that the Mossad is involved,

我认为摩萨德牵涉其中，

but that the leading force is not Israel.

但主导力量不是以色列。

So the leading force behind that

其后的主导力量

is the cyber superpower.

是网络超级大国。

There is only one,

只有一个，

and that's the United States --

那就是美国 --

fortunately, fortunately.

很幸运，很幸运。

Because otherwise,

因为否则的话，

our problems would even be bigger.

我们面临的问题就更加严重了。

CA: Thank you for scaring the living daylights out of us. Thank you, Ralph.

克里斯：谢谢你吓了我们一大跳，谢谢你，拉尔夫。

(Applause)

（掌声）