‘Crash Override’ malware heightens fears for US electric grid
‘Crash Override’ malware heightens fears for US electric
grid
BY MORGAN CHALFANT - 06/15/17 06:00 AM EDT
‘Crash Override’ malware heightens fears for US electric
grid
The identification of malware tied to a cyberattack on
Ukraine last year is putting a renewed focus on threats to America’s electric
grid.
Security firms ESET and Dragos revealed the malware,
dubbed “Crash Override” or “Industroyer,” this week. According to the
researchers, the malware is only the second to be tailored to industrial
control systems and developed and deployed to be disruptive — the first was the
Stuxnet virus that ravaged Iran’s nuclear program years ago.
The attack, which knocked out power in Kiev for about an
hour, was one of two targeting Ukraine’s electric grid in recent years. Russia,
which annexed Ukraine’s Crimean peninsula, is widely believed to have a
connection to both attacks.
Experts say the cyber weapon could be deployed against
electric infrastructure in Europe and much of Asia and the Middle East and,
with slight modifications, could be used against the United States as well.
“This threat should absolutely make grid operators and
the security community take these types of threats more seriously,” Robert M.
Lee, CEO and founder of Dragos, told The Hill. “This is definitely an evolution
of tradecraft we haven’t seen before.”
The discovery of Crash Override triggered an immediate
response from the government and industry. The computer emergency readiness
team at the Department of Homeland Security
(DHS) warned that, while there is no evidence the malware has affected
U.S. critical infrastructure, it “could be modified to target U.S. critical
information networks and systems.”
The National Cybersecurity and Communications Center, the
DHS said, is working to assess the risk the malware poses to U.S. critical
infrastructure.
On Tuesday, the North American Electric Reliability
Corporation (NERC), a regulatory body of the electric industry, issued a public
alert to its members to limit access to their networks to protect against the
threat.
Lee said that his firm notified the government and key
players in the electric sector on June 10, immediately after confirming the
analysis of the malware and before publicly releasing details about it on
Monday.
“Everybody actually took the threat seriously,” Lee said.
“I was really impressed with the response by government and the sector.”
Lawmakers, meanwhile, have been raising questions about
the vulnerability of the U.S. electric grid since the threat came to light.
“I worry about cyberattacks on our power grid,” Rep. Pete
Olson (R-Texas), a member of the House Energy and Commerce Committee, said at a
hearing Tuesday.
“I think that’s an ongoing challenge,” Amit Yoran,
chairman and CEO of Tenable Network Security, told the House panel. “From a
security perspective, there’s a great challenge in that industry in that the
systems are incapable of being updated or there’s tremendous risk in updating
those systems, which unlike our mobile phones or desktop PCs, have a lifespan
measured in decades.”
“Here in the U.S., I think we are probably more advanced
on our security of those power grids,” Bill Wright, government affairs and
senior policy counsel at Symantec, told the lawmakers. “That said, there’s
always going to be susceptibility.”
If deployed in the U.S., the malware would need to target
multiple elements of the electric grid — which is comprised of numerous smaller
units — to cause widespread outages.
Lee said that any outage would last only hours or days at
most, given that elements of the U.S. electric grid have been engineered to
switch over to manual operation in the event of storms or natural disasters.
Still, the twin attacks on Ukraine’s power have
heightened long-standing concerns in Washington about threats to the electric
grid.
Earlier this year, Sen. Angus King (I-Maine) introduced
legislation with bipartisan support that would set up a pilot program to find
security vulnerabilities in the energy sector.
The fears on Capitol Hill have been compounded by
Russia’s willingness to use cyberattacks to achieve strategic gains, in the
wake of what U.S. intelligence has described as Moscow’s interference campaign
during the presidential election.
Dragos has named the group behind the malware “Electrum”
and has linked that group to the Sandworm team — the same group security
experts say was behind a 2015 cyberattack on Ukraine’s electric grid. While
some experts — including Dragos — have not attributed the group to a particular
country, security firm FireEye has connected it to the Russian government.
On Tuesday, Sen. John McCain (R-Ariz.) raised the issue
during questioning of Attorney General Jeff Sessions in the context of threats
posed by Russia to Ukraine and the United States.
“It is very disturbing that the Russians continue to push
hostile actions in their foreign policy,” Sessions said.
“We do not have a sufficient strategy dealing with
technological and IT penetrations of our system,” he said. “I truly believe
it’s more important than I ever did before.”
Comments
Post a Comment