Cybersecurity Firms Uncover Malware That Could Cause Power Outages Around The Globe
“This could cause wide-scale damage to infrastructure systems that are vital.”
By Jim Finkle
LOADINGERROR LOADING
June 12 (Reuters) - Two cyber security firms have uncovered malicious software that they believe caused a December 2016 Ukraine power outage, they said on Monday, warning the malware could be easily modified to harm critical infrastructure operations around the globe.
ESET, a Slovakian anti-virus software maker, and Dragos Inc, a U.S. critical-infrastructure security firm, released detailed analyzes of the malware, known as Industroyer or Crash Override, and issued private alerts to governments and infrastructure operators to help them defend against the threat.
Advertisement
The U.S. Department of Homeland Security said it was investigating the malware, though it had seen no evidence to suggest it has infected U.S. critical infrastructure.
The two firms said they did not know who was behind the cyber attack. Ukraine has blamed Russia, though officials in Moscow have repeatedly denied blame.
Still, the firms warned that there could be more attacks using the same approach, either by the group that built the malware or copycats who modify the malicious software.
“The malware is really easy to re-purpose and use against other targets. That is definitely alarming,” said ESET malware researcher Robert Lipovsky said in a telephone interview. “This could cause wide-scale damage to infrastructure systems that are vital.”
Advertisement
The Department of Homeland Security corroborated that warning, saying it was working to better understand the threat posed by Crash Override.
“The tactics, techniques and procedures described as part of the Crash Override malware could be modified to target U.S. critical information networks and systems,” the agency said in an alert posted on its website.
The alert posted some three dozen technical indicators that a system had been compromised by Crash Override and asked firms to contact the agency if they suspected their systems were compromised by the malware.
Dragos founder Robert M. Lee said the malware was capable of attacking power systems across Europe and could be leveraged against the United States “with small modifications.”
Advertisement
It is able to cause outages of up to a few days in portions of a nation’s grid, but is not potent enough to bring down a country’s entire grid, Lee said by phone.
With modifications, the malware could attack other types of infrastructure including local transportation providers, water and gas providers, Lipovsky said.
Power firms are concerned there will be more attacks, Alan Brill, a leader of Kroll’s cyber security practice, said in a telephone interview.
“You are dealing with very smart people who came up with something and deployed it,” Brill said. “It represents a risk to power distribution organizations everywhere.”
Industroyer is only the second piece of malware uncovered to date that is capable of disrupting industrial processes without the need for hackers to manually intervene.
Advertisement
The first, Stuxnet, was discovered in 2010 and is widely believed by security researchers to have been used by the United States and Israel to attack Iran’s nuclear program.
A spokesman for Ukraine’s state cyber police said it was not clear whether the malware was used in the December 2016 attack. Ukraine’s state-run Computer Emergency Response Team did not immediately respond to requests for comment.
The Kremlin and Russia’s Federal Security Service did not reply to requests for comment.
Crash Override can be detected if a utility monitors its network for abnormal traffic, including signs the malware is searching for the location of substations or sending messages to switch breakers, according to Lee, a former U.S. Air Force cyber warfare operations officer.
Malware has been used in other disruptive attacks on industrial targets, including the 2015 Ukraine power outage, but in those cases human intervention was required.
ESET said it had been analyzing the malware for several months and had held off on going public to preserve the integrity of investigations into the power system hack.
Advertisement
ESET last week provided samples with Dragos, which said it was able to confirm the malware was used in the Ukraine grid attack.
Our 2024 Coverage Needs You
It's Another Trump-Biden Showdown — And We Need Your Help
The Future Of Democracy Is At Stake
Our 2024 Coverage Needs You
Your Loyalty Means The World To Us
As Americans head to the polls in 2024, the very future of our country is at stake. At HuffPost, we believe that a free press is critical to creating well-informed voters. That's why our journalism is free for everyone, even though other newsrooms retreat behind expensive paywalls.
Our journalists will continue to cover the twists and turns during this historic presidential election. With your help, we'll bring you hard-hitting investigations, well-researched analysis and timely takes you can't find elsewhere. Reporting in this current political climate is a responsibility we do not take lightly, and we thank you for your support.
The 2024 election is heating up, and women's rights, health care, voting rights, and the very future of democracy are all at stake. Donald Trump will face Joe Biden in the most consequential vote of our time. And HuffPost will be there, covering every twist and turn. America's future hangs in the balance. Would you consider contributing to support our journalism and keep it free for all during this critical season?
HuffPost believes news should be accessible to everyone, regardless of their ability to pay for it. We rely on readers like you to help fund our work. Any contribution you can make — even as little as $2 — goes directly toward supporting the impactful journalism that we will continue to produce this year. Thank you for being part of our story.
It's official: Donald Trump will face Joe Biden this fall in the presidential election. As we face the most consequential presidential election of our time, HuffPost is committed to bringing you up-to-date, accurate news about the 2024 race. While other outlets have retreated behind paywalls, you can trust our news will stay free.
But we can't do it without your help. Reader funding is one of the key ways we support our newsroom. Would you consider making a donation to help fund our news during this critical time? Your contributions are vital to supporting a free press.
As Americans head to the polls in 2024, the very future of our country is at stake. At HuffPost, we believe that a free press is critical to creating well-informed voters. That's why our journalism is free for everyone, even though other newsrooms retreat behind expensive paywalls.
Our journalists will continue to cover the twists and turns during this historic presidential election. With your help, we'll bring you hard-hitting investigations, well-researched analysis and timely takes you can't find elsewhere. Reporting in this current political climate is a responsibility we do not take lightly, and we thank you for your support.
Thank you for your past contribution to HuffPost. We are sincerely grateful for readers like you who help us ensure that we can keep our journalism free for everyone.
The stakes are high this year, and our 2024 coverage could use continued support. Would you consider becoming a regular HuffPost contributor?
Dear HuffPost Reader
Thank you for your past contribution to HuffPost. We are sincerely grateful for readers like you who help us ensure that we can keep our journalism free for everyone.
The stakes are high this year, and our 2024 coverage could use continued support. If circumstances have changed since you last contributed, we hope you'll consider contributing to HuffPost once more.