1. Travis Deyarmin

2. In This Presentation  What is Stuxnet  What is Flame  Compare/Contrast  Who is Responsible  Possible Repercussions

3. Stuxnet  Worm  Used 5 Zero-Days  Targets Siemens Control Software  Infected Through USB/Network  Destroyed Uranium Enrichment Centrifuges

4. Stuxnet

6. Flame  Sniffs Network  Screenshots  Recording Audio  Keylogger  Bluesnarfing  20 Expansion Modules

7. Flame

8.  Ways of infection were similar to Stuxnet  The Autorun.inf hacking was used by both  Used the same print spooler vulnerability

9. Flame

11. Similarities  Propagation  Shared a common module for EoP (0-day)  C&C servers scattered worldwide  Sharing Module

12. Differences StuxnetFlame  Sabotage  Specific  Hit PLC  Espionage  Adaptive  Hit Computers  20Mb

13. Who’s to Blame?  Joint op between US and Israel

14.  Made this kind of attack a political option  Source code is available Consequences

15. Conclusion  Stuxnet and Flame were worms targeted at Iran  Probable US involvement  Repercussions

16. References  http://www.securelist.com/en/blog/208193522/The_Flame_Questions_and_Answers http://www.securelist.com/en/blog/208193522/The_Flame_Questions_and_Answers  http://www.cbsnews.com/8301-202_162-57443629/iran-powerful-flame-computer-virus-briefly-hit-oil- industry-but-was-defeated-with-data-recovered/ http://www.cbsnews.com/8301-202_162-57443629/iran-powerful-flame-computer-virus-briefly-hit-oil- industry-but-was-defeated-with-data-recovered/  https://www.securelist.com/en/blog/208193568/Back_to_Stuxnet_the_missing_link https://www.securelist.com/en/blog/208193568/Back_to_Stuxnet_the_missing_link  http://www.computerworld.com/s/article/9227670/Report_Obama_ordered_Stuxnet_attacks_on_Iran http://www.computerworld.com/s/article/9227670/Report_Obama_ordered_Stuxnet_attacks_on_Iran  http://www.cio.com/article/708180/Security_Researchers_Discover_Link_Between_Stuxnet_and_Fla me http://www.cio.com/article/708180/Security_Researchers_Discover_Link_Between_Stuxnet_and_Fla me  http://www.cio.com/article/640464/Report_Iran_Confirms_Stuxnet_Hit_Centrifuges http://www.cio.com/article/640464/Report_Iran_Confirms_Stuxnet_Hit_Centrifuges  http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxne t_dossier.pdf http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_stuxne t_dossier.pdf