Found: “Crash Override” malware that triggered Ukrainian power outage

Spread the love

Enlarge / An overview of Crash Override/Industroyer, including the four international specifications it uses to communicate with electric grid devices all over the world.

reader comments 51

Last December, hackers with suspected ties to Russia caused a power outage in Ukraine in a deliberate attempt to leave households without electricity during what’s typically one of the coldest months of the year. Now, the advanced malware that triggered the power failure has been found in the wild. This discovery is prompting concerns that the attack tools could be repurposed or reused in new sabotage operations, possibly by unrelated hacking groups.

security firm Dragos has named the tool platform, is the first known malware framework designed to attack electric grid systems. Dragos researchers said it was used successfully in what may have been a dress rehearsal on a December 17 hack on an electric transmission substation in Kiev. While the Kiev outage lasted only a few hours, several features of the malware that weren’t turned on in the December hack have the potential to cause disruptions that persist for as long as a week. Crash Override is a completely new platform that was far more advanced than the general-purpose tools the same group used to attack Ukraine’s power grid in December 2015.

What makes Crash Override so sophisticated is its ability to use the same arcane technical protocols that individual electric grid systems rely on to communicate with one another. As such, the malware is more notable for its mastery of the industrial processes used by global grid operators than its robust code. Its fluency in the low-level grid languages allowed it to instruct Ukrainian devices to de-energize and re-energize substation lines, a capability not seen in the attack a year earlier that used a much cruder set of tools and techniques. The concern is that “Industroyer”—the other name given to the malware—can be used against a broad range of electric systems around the world.

In a separate report published Monday, researchers from antivirus provider Eset explained:

Industroyer is a particularly dangerous threat, since it is capable of controlling electricity substation switches and circuit breakers directly. To do so, it uses industrial communication protocols used worldwide in power-supply infrastructure, transportation control systems, and other critical infrastructure systems (such as water and gas).

These switches and circuit breakers are digital equivalents of analogue switches; technically they can be engineered to perform various functions. Thus, the potential impact may range from simply turning off power distribution, cascading failures and more serious damage to equipment. The severity may also vary from one substation to another, as well. Needless to say, disruption of such systems can directly or indirectly affect the functioning of vital services.

Industroyer’s dangerousness lies in the fact that it uses protocols in the way they were designed to be used. The problem is that these protocols were designed decades ago, and back then industrial systems were meant to be isolated from the outside world. Thus, their communication protocols were not designed with security in mind. That means that the attackers didn’t need to be looking for protocol vulnerabilities; all they needed was to teach the malware “to speak” those protocols.

Joe Slowik, the Dragos researcher who led the investigation into Crash Override, told Ars that he located the malware after colleagues at Eset provided the cryptographic hashes of some of the malware they believed was used in the attacks. Asked if that meant the Crash Override code was available to other potential hacker groups, Slowik wrote: “Yes, this is true for those with access to particular repositories of commercial data. Now that this information is public and information (such as file hashes) are in the hands of the broader community, it is reasonable to expect that others will obtain samples and analyze them for non-defensive purposes.”

hacking campaign that company researchers said was the work of Sandworm that targeted NATO, the Ukrainian and Polish governments, and European Industries. One of the hacking group’s calling cards was BlackEnergy, a tool that was once used in denial-of-service attacks but was later used in espionage campaigns.

A revamped version of BlackEnergy was one of two pieces of malware found on the Ukrainian computers compromised in the 2015 attack. The attackers used BlackEnergy3 to break into the corporate networks of the targeted power companies and then further encroach into the supervisory control and data acquisition systems the companies used to generate and transmit electricity. Based on the reconnaissance BlackEnergy3 performed, the attackers were able to use legitimate functionality commonly found in power distribution and transmission to trigger a failure that caused more than 225,000 people to go without power for more than six hours.

Crash Override would appear to be a slightly more evolved manifestation of that reconnaissance. Its modular design means that individual pieces can be removed and added as needed to target individual electrical grids, or it means Crash Override could possibly extend its reach into new industries. While comparisons to Stuxnet—the US- and Israeli-developed worm that targeted Iran’s nuclear program—are exaggerated, the existence of the platform is nonetheless significant, particularly if newer, improved versions become more widely available or used.

Spread the love

Leave a Reply

Your email address will not be published. Required fields are marked *