DEF CON 33 - Don’t Cry Wolf: Evidence based assessments of ICS Threats - Jimmy Wylie & Sam Hanson

Here's the revised summary addressing the feedback concerns, with improved clarity, completeness, and emphasis on key themes:

Revised Summary:

The video details how malware analysts at DRAOS systematically identify and assess Industrial Control System (ICS) threats using a rigorous three-part framework to prevent misclassification and unnecessary alarm. The analysts stress that evidence-based rigor is critical to maintaining community trust, as demonstrated by the 2021 "Tardigrade" incident, where a misidentified ransomware variant caused widespread panic in the biotech sector despite being nothing more than a common Cobalt Strike Beacon delivery tool 1:49-2:52.

Core Framework for ICS Malware Classification 3:14-4:36:
For a sample to be classified as ICS malware, it must satisfy three evidence-based criteria:

1. ICS Capability: Code can interact with ICS/OT environments (e.g., speak OT protocols, manipulate PLC logic).
2. Malicious Intent: Provable evidence the software was designed to harm OT environments (e.g., not a red team tool).
3. Adverse Effects: Verified potential to cause OT harm (e.g., steal process data, enable unauthorized access, alter device logic).

Case Studies Highlighting Analytical Challenges:

• IoT Exploit Toolkit 7:37-11:58:
  A massive tool with 175+ ICS exploits and 19 industrial protocol support. Despite its capabilities, it was deemed not ICS malware due to "dual-use dilemmas" (e.g., detailed vulnerability documentation suggesting defensive/red team use).
• Kurtler SCADA 12:04-15:15:
  A simple VNC client brute-forcer that successfully compromised HMIs. Though not technically ICS malware (lacking ICS-specific actions), it proved that **sophistication is irrelevant