CrashOverride Power Grid Malware - Is this the next Russian 'threat' to the West?

A hack with malware called CrashOverride (aka Industroyer) can take down a power grid, and was previously demonstrated to work when launched in the Ukraine at Kiev last December, 2016. This attack was allegedly traced back to a hacker group dubbed "Electrum" which is suspected to be Russian, and even allied with the Russian government.

Watch out, the mainstream media is creating the image of Russia as the big-bad-wolf or bogeyman again. Russia is trying to find ways to attack the freedom-loving innocent Americans. Maybe they are right, or maybe not.

Credit: Flickr/Adam Thomas/REMIXED

The malware isn't for spying, but for cyber-sabotage of a nations infrastructure. Portions of a nation's grid can be induced with outages, but they can't take down the whole national grid.

Several news agencies are reporting this as a possible test run for an attack on Europe, or with a few tweaks be used to target the United States. A security firm called Dragos issued a report on the malware Monday, where they describe CrashOverride as a completely new platform and the first malware framework they know of that was created specifically to attack electric grid systems.

This isn't news to the US though, as the U.S. Computer Emergency Readinness Team has the CrashOverride malware evaluated as a yellow or medium risk. "A medium priority incident may affect public health or safety, national security, economic security, foreign relations, civil liberties, or public confidence."

Another security company Eset also a report Monday, saying:

Industroyer is a particularly dangerous threat, since it is capable of controlling electricity substation switches and circuit breakers directly.

Industroyer's dangerousness lies in the fact that it uses protocols in the way they were designed to be used. The problem is that these protocols were designed decades ago, and back then industrial systems were meant to be isolated from the outside world. Thus, their communication protocols were not designed with security in mind. That means that the attackers didn't need to be looking for protocol vulnerabilities; all they needed was to teach the malware "to speak" those protocols.

The malware looks to open circuit breakers that stop the flow of electricity, and stay closed even if a grid operator tries to close them. It also erases the software used to control the system, meaning the grid operator has to do everything with manual controls at the substation in order to restore the power.

Many people in the US government and media have made claims that the Russian government tried to disrupt the US presidential election and influence its outcome. Now they are adding on to that anti-Russian hysteria this new threat of a possible power grid attack. With the great dependence our modern Western lives have on electricity throughout the year and especially the winter, it's understandable that this threat -- whether real or not -- will elicit fear.

Some articles about this story are even saying that the attack was outright "carried out by Russian government hackers" according tot the US researchers they had information from. Not that the hacker group is likely Russian and suspected to be working with the Russian government due the hack behavior appearing to align with the image of a malicious foreign nation such as Russia. US government officials haven't claimed what some have as quoted above, but apparently in private some officials are beating a different drum.

iSight Partners is a cyberintelligence firm, and they believe, not that they know, but believe the attacks are linked directly to the security services in Russia as contractors or actual government agents. Dragos says the "Sandworm" group from previous attacks in 2015 and the new attack attributed to "Electrum" have forensic evidence that indicate they are related.

CrashOverride isn't the first malware designed to take down the control systems of some part of a nation. The U.S. and Israel did it first with the Stuxnet worm that was designed to disrupt Iran's nuclear program.

Experts say CrashOverride can potentially be modified to go after other control systems like those for the water or gas. This hasn't been done yet. Maybe there are more security upgrades on those installations? I'm curious about nuclear power plant control systems as well.

Whoever made this recent malware, it can be used to disrupt power at most for a couple of days, meaning it's not going to trigger a doomsday scenario where people are stuck without power, looting stores and fighting for bare survival in a post-electric world. As for it being a Russian government sponsored effort, I don't know, but the anti-Russian profile of the media gives me suspicion to doubt the beliefs of these security experts.

---

References:

• Found: “Crash Override” malware that triggered Ukrainian power outage
• Crash Override: Malware that took down a power grid may have been a test run
• ‘Crash Override’ malware heightens fears for US electric grid
• Russia Has Developed a Cyber Weapon That Can Disrupt Power Grids, New Research Finds