Six months on from a hacking attack that caused a blackout in Kiev, Ukraine, security researchers have warned that the malware that was used in the attack would be “easy” to convert to cripple infrastructure in other nations.

The discovery of the malware, dubbed “Industroyer” and “Crash Override”, highlights the vulnerability of critical infrastructure, just months after the WannaCry ransomware took out NHS computers across the UK.

Industroyer, analysed by the researchers from Slovakia’s ESET and the US’s Dragos, is only the second known case of a virus built and released specifically to disrupt industrial control systems. The first was Stuxnet, a worm that sabotaged the Iranian nuclear programme, which was thought to have been built by the US and Israel.

The virus attacks electricity substations and circuit breakers using industrial communication protocols which are standardised across a number of types of critical infrastructure – from power, water and gas supply to transportation control.

Those control protocols date back decades, to long before security practices such as encryption and authentication were standardised. Their only real security feature involves sequestering them on networks that aren’t directly connected to the internet; but as the need for economic efficiency has pressed in, even that has been jettisoned.

This common attack vector makes Industroyer so dangerous, according to ESET: “The problem is that these protocols were designed decades ago, and back then industrial systems were meant to be isolated from the outside world,” says Anton Cherepanov, a senior malware researcher at the firm. “Thus, their communication protocols were not designed with security in mind. That means that the attackers didn’t need to be looking for protocol vulnerabilities; all they needed was to teach the malware ‘to speak’ those protocols.”

Facebook Twitter Pinterest

That allows it to attack multiple types of critical infrastructure with only small changes. “Attackers could adapt the malware to any environment,” says Cherepanov, “which makes it extremely dangerous”.

Andrew Clarke, of security firm One Identity, said: “This is as scary as it sounds. First, it’s very difficult to detect because it uses known and allowable code yet in nefarious modes. In addition, we’re not talking about stealing some incriminating photos from some celebrities cloud storage location. This is controlling the power grid. It means that hospitals could lose power mid-surgery. Or traffic lights cut out causing accidents.”

The specific attack on Kiev was a relatively low-key affair, particularly compared to the sweeping blackouts that had been caused by another cyber-attack a year earlier. But those earlier attacks, while more damaging, required human control to leverage the security breach into actual damage; in contrast, Industroyer can cause blackouts automatically. That has led some to wonder if the Kiev attack was more of a test to see whether the malware would work in practice. But regardless, Cherepanov says, the attack “should serve as a wake-up call for those responsible for security of critical systems around the world”.

On top of its attack functions, Industroyer also has the ability to damage the control PC itself, rendering it unbootable and potentially elongating any resultant blackout.

The US Department of Homeland Security said it was investigating the malware, though it had seen no evidence to suggest it has infected US critical infrastructure. No specific attribution for the Kiev attack has been confirmed, but the Ukrainian government has blamed Russia, as it did for the similar attacks in 2015. Officials in Moscow have repeatedly denied responsibility.

As with WannaCry, it is possible to fix the risk posed by Industroyer before it leads to disaster – but to do so will be expensive and time consuming, according to Paul Elon, a director at cybersecurity firm Tripwire. “Due to economic pressures, it has become necessary for many organisations to centralise some of the management and control functions that would have previously been local to industrial plants, refineries, and distribution facilities.

“This centralisation has meant expanding the reach of the enterprise network into the industrial environment, and in doing so exposing those industrial environments to levels of cyber risk for which they were neither secured nor designed.”