Subscribe to the Blunt Force Truth podcast

Crash Override’ Malware Heightens Fears For US Electric Grid

The identification of malware tied to a cyberattack on Ukraine last year is putting a renewed focus on threats to America’s electric grid.

Security firms ESET and Dragos revealed the malware, dubbed “Crash Override” or “Industroyer,” this week. According to the researchers, the malware is only the second to be tailored to industrial control systems and developed and deployed to be disruptive — the first was the Stuxnet virus that ravaged Iran’s nuclear program years ago.

The attack, which knocked out power in Kiev for about an hour, was one of two targeting Ukraine’s electric grid in recent years. Russia, which annexed Ukraine’s Crimean peninsula, is widely believed to have a connection to both attacks.

Experts say the cyber weapon could be deployed against electric infrastructure in Europe and much of Asia and the Middle East and, with slight modifications, could be used against the United States as well.

“This threat should absolutely make grid operators and the security community take these types of threats more seriously,” Robert M. Lee, CEO and founder of Dragos, told The Hill. “This is definitely an evolution of tradecraft we haven’t seen before.”

The discovery of Crash Override triggered an immediate response from the government and industry. The computer emergency readiness team at the Department of Homeland Security  (DHS) warned that, while there is no evidence the malware has affected U.S. critical infrastructure, it “could be modified to target U.S. critical information networks and systems.”

The National Cybersecurity and Communications Center, the DHS said, is working to assess the risk the malware poses to U.S. critical infrastructure.

On Tuesday, the North American Electric Reliability Corporation (NERC), a regulatory body of the electric industry, issued a public alert to its members to limit access to their networks to protect against the threat.

Lee said that his firm notified the government and key players in the electric sector on June 10, immediately after confirming the analysis of the malware and before publicly releasing details about it on Monday.

“Everybody actually took the threat seriously,” Lee said. “I was really impressed with the response by government and the sector.”

Lawmakers, meanwhile, have been raising questions about the vulnerability of the U.S. electric grid since the threat came to light.

“I worry about cyberattacks on our power grid,” Rep. Pete Olson (R-Texas), a member of the House Energy and Commerce Committee, said at a hearing Tuesday.

“I think that’s an ongoing challenge,” Amit Yoran, chairman and CEO of Tenable Network Security, told the House panel. “From a security perspective, there’s a great challenge in that industry in that the systems are incapable of being updated or there’s tremendous risk in updating those systems, which unlike our mobile phones or desktop PCs, have a lifespan measured in decades.”

“Here in the U.S., I think we are probably more advanced on our security of those power grids,” Bill Wright, government affairs and senior policy counsel at Symantec, told the lawmakers. “That said, there’s always going to be susceptibility.”

If deployed in the U.S., the malware would need to target multiple elements of the electric grid — which is comprised of numerous smaller units — to cause widespread outages.

Lee said that any outage would last only hours or days at most, given that elements of the U.S. electric grid have been engineered to switch over to manual operation in the event of storms or natural disasters.

(First reported by The Hill) http://thehill.com/policy/cybersecurity/337877-crash-override-malware-heightens-fears-for-us-electric-grid   (June 15, 2017)

Want more BFT? Leave us a voicemail on our page or follow us on Twitter @BFT_Podcast and Facebook @BluntForceTruthPodcast. We want to hear from you! There’s no better place to get the #BluntForceTruth.


Want more BFT? Leave us a voicemail on our page or follow us on Twitter @BFT_Podcast and Facebook @BluntForceTruthPodcast. We want to hear from you! There’s no better place to get the #BluntForceTruth.