Cyrus

Field IDS

In industrial control systems, usually between PLCs and control equipment in the field, there is no monitoring and control beyond the information in the PLC. In this case, if the PLC is infected with malware, it can cause widespread destruction by sending and displaying false information to the HMI and simultaneously sending destructive commands to the equipment in the field. In fact, the operator does not have any other tools for validation except the information available in the HMI.

The Stuxnet virus used exactly this weakness and by infecting PLCs while displaying false information to the operators, it sent destructive commands to the centrifuges at the same time and has caused disruption in the control system. The Cyrus Field IDS product is an industrial IDS in the field area, which by sniffing the commands issued to the equipment in the field area, shows the status of the commands received by the equipment directly to the operator. The operator can match the commands actually received by the field with the information sent by the PLC to the HMI.

If there is a difference between the information received from the PLC and Cyrus Filed IDS, the industrial network is definitely infected with Malware. If a product like Cyrus Field IDS was installed on the line at the time of the Stuxnet attack This anomaly was immediately detectable. If both Cyrus Field IDS and Cyrus Firewall products are used in an industrial network, this analysis can be done by Firewall. In this case, the Firewall can intelligently detect this abnormality and inform the operator of abnormal conditions on the line by sending an Alert. Due to the use of different hardware, different companies have developed their software protocols according to the conditions, many of which are based on RS232 or RS485 serial port.

In addition to being able to detect attacks and intrusions at the TCP/IP level, industrial IDSs must also be able to detect attacks in the most industrial ZONE End Point. In the following, we explain in more technical detail how the Cyrus Field IDS product can detect attacks like Stuxnet: In 1987 and 1988, the Stuxnet malware infected the control system of the Natanz nuclear facility and caused disruption in the uranium enrichment process.

Simply put: what Stuxnet did was that after penetrating the system, if Step7 software (which is used to program Siemens PLCs) is installed) implemented a wrapper on its Dll files so that when downloading the program written in the PLC, it would first add its destructive dll block and then place the original program. All these works were done legally and were done by the main dll and the communication protocol of Siemens, with the difference that it added a Stuxnet block interface between the program and the main dll. This block was responsible for controlling the drive of the centrifuge motor and stirring the production cycle.