‘Crash Override’ malware heightens fears for US electric grid

The identification of malware tied to a cyberattack on Ukraine last year is putting a renewed focus on threats to America’s electric grid.

Security firms ESET and Dragos revealed the malware, dubbed “Crash Override” or “Industroyer,” this week. According to the researchers, the malware is only the second to be tailored to industrial control systems and developed and deployed to be disruptive — the first was the Stuxnet virus that ravaged Iran’s nuclear program years ago.

{mosads}The attack, which knocked out power in Kiev for about an hour, was one of two targeting Ukraine’s electric grid in recent years. Russia, which annexed Ukraine’s Crimean peninsula, is widely believed to have a connection to both attacks.

Experts say the cyber weapon could be deployed against electric infrastructure in Europe and much of Asia and the Middle East and, with slight modifications, could be used against the United States as well.

“This threat should absolutely make grid operators and the security community take these types of threats more seriously,” Robert M. Lee, CEO and founder of Dragos, told The Hill. “This is definitely an evolution of tradecraft we haven’t seen before.”

The discovery of Crash Override triggered an immediate response from the government and industry. The computer emergency readiness team at the Department of Homeland Security  (DHS) warned that, while there is no evidence the malware has affected U.S. critical infrastructure, it “could be modified to target U.S. critical information networks and systems.”

The National Cybersecurity and Communications Center, the DHS said, is working to assess the risk the malware poses to U.S. critical infrastructure.

On Tuesday, the North American Electric Reliability Corporation (NERC), a regulatory body of the electric industry, issued a public alert to its members to limit access to their networks to protect against the threat.

Lee said that his firm notified the government and key players in the electric sector on June 10, immediately after confirming the analysis of the malware and before publicly releasing details about it on Monday.

“Everybody actually took the threat seriously,” Lee said. “I was really impressed with the response by government and the sector.”

Lawmakers, meanwhile, have been raising questions about the vulnerability of the U.S. electric grid since the threat came to light.

“I worry about cyberattacks on our power grid,” Rep. Pete Olson (R-Texas), a member of the House Energy and Commerce Committee, said at a hearing Tuesday.

“I think that’s an ongoing challenge,” Amit Yoran, chairman and CEO of Tenable Network Security, told the House panel. “From a security perspective, there’s a great challenge in that industry in that the systems are incapable of being updated or there’s tremendous risk in updating those systems, which unlike our mobile phones or desktop PCs, have a lifespan measured in decades.”

“Here in the U.S., I think we are probably more advanced on our security of those power grids,” Bill Wright, government affairs and senior policy counsel at Symantec, told the lawmakers. “That said, there’s always going to be susceptibility.”

If deployed in the U.S., the malware would need to target multiple elements of the electric grid — which is comprised of numerous smaller units — to cause widespread outages.

Lee said that any outage would last only hours or days at most, given that elements of the U.S. electric grid have been engineered to switch over to manual operation in the event of storms or natural disasters.

Still, the twin attacks on Ukraine’s power have heightened long-standing concerns in Washington about threats to the electric grid.

Earlier this year, Sen. Angus King (I-Maine) introduced legislation with bipartisan support that would set up a pilot program to find security vulnerabilities in the energy sector.

The fears on Capitol Hill have been compounded by Russia’s willingness to use cyberattacks to achieve strategic gains, in the wake of what U.S. intelligence has described as Moscow’s interference campaign during the presidential election.

Dragos has named the group behind the malware “Electrum” and has linked that group to the Sandworm team — the same group security experts say was behind a 2015 cyberattack on Ukraine’s electric grid. While some experts — including Dragos — have not attributed the group to a particular country, security firm FireEye has connected it to the Russian government.

On Tuesday, Sen. John McCain (R-Ariz.) raised the issue during questioning of Attorney General Jeff Sessions in the context of threats posed by Russia to Ukraine and the United States.

“It is very disturbing that the Russians continue to push hostile actions in their foreign policy,” Sessions said.

“We do not have a sufficient strategy dealing with technological and IT penetrations of our system,” he said. “I truly believe it’s more important than I ever did before.”