The identification of malware tied to a cyberattack on Ukraine last year is putting a renewed focus on threats to America’s electric grid.
Security firms ESET and Dragos revealed the malware, dubbed “Crash Override” or “Industroyer,” this week. According to the researchers, the malware is only the second to be tailored to industrial control systems and developed and deployed to be disruptive — the first was the Stuxnet virus that ravaged Iran’s nuclear program years ago.
The attack, which knocked out power in Kiev for about an hour, was one of two targeting Ukraine’s electric grid in recent years. Russia, which annexed Ukraine’s Crimean peninsula, is widely believed to have a connection to both attacks.
Experts say the cyber weapon could be deployed against electric infrastructure in Europe and much of Asia and the Middle East and, with slight modifications, could be used against the United States as well.
“This threat should absolutely make grid operators and the security community take these types of threats more seriously,” Robert M. Lee, CEO and founder of Dragos, told The Hill. “This is definitely an evolution of tradecraft we haven’t seen before.”
The discovery of Crash Override triggered an immediate response from the government and industry. The computer emergency readiness team at the Department of Homeland Security (DHS) warned that, while there is no evidence the malware has affected U.S. critical infrastructure, it “could be modified to target U.S. critical information networks and systems.”
The National Cybersecurity and Communications Center, the DHS said, is working to assess the risk the malware poses to U.S. critical infrastructure.
On Tuesday, the North American Electric Reliability Corporation (NERC), a regulatory body of the electric industry, issued a public alert to its members to limit access to their networks to protect against the threat.
Lee said that his firm notified the government and key players in the electric sector on June 10, immediately after confirming the analysis of the malware and before publicly releasing details about it on Monday.
“Everybody actually took the threat seriously,” Lee said. “I was really impressed with the response by government and the sector.”
Lawmakers, meanwhile, have been raising questions about the vulnerability of the U.S. electric grid since the threat came to light.
“I worry about cyberattacks on our power grid,” Rep. Pete Olson (R-Texas), a member of the House Energy and Commerce Committee, said at a hearing Tuesday.
“I think that’s an ongoing challenge,” Amit Yoran, chairman and CEO of Tenable Network Security, told the House panel. “From a security perspective, there’s a great challenge in that industry in that the systems are incapable of being updated or there’s tremendous risk in updating those systems, which unlike our mobile phones or desktop PCs, have a lifespan measured in decades.”
“Here in the U.S., I think we are probably more advanced on our security of those power grids,” Bill Wright, government affairs and senior policy counsel at Symantec, told the lawmakers. “That said, there’s always going to be susceptibility.”
If deployed in the U.S., the malware would need to target multiple elements of the electric grid — which is comprised of numerous smaller units — to cause widespread outages.