Last December, a cyber attack on Ukrainian Electric power grid caused the power outage in the northern part of Kiev — the country’s capital — and surrounding areas, causing a blackout for tens of thousands of citizens for an hour and fifteen minutes around midnight. 

Now, security researchers have discovered the culprit behind those cyber attacks on the Ukrainian industrial control systems and, if combined with “Hostage” software, could keep power grids down for MONTHS! 

Slovakia-based security software maker ESET and US critical infrastructure security firm Dragos Inc. say they have discovered a new dangerous piece of malware in the wild that targets critical industrial control systems and is capable of causing blackouts. 

Dubbed “Industroyer” or “CrashOverRide,” the grid-sabotaging malware was likely to be used in the December 2016 cyber attack against Ukrainian electric utility Ukrenergo, which the security firms say represents a dangerous advancement in critical infrastructure hacking.

According to the researchers, Crash Over Ride is the biggest threat designed to disrupt industrial control systems, after Stuxnet — the first malware allegedly developed by the US and Israel to sabotage the Iranian nuclear facilities in 2009.

THIS MALWARE DOES NOT EXPLOIT ANY SOFTWARE FLAW

Unlike Stuxnet worm, the CrashOverRide malware does not exploit any “zero-day” software vulnerabilities to do its malicious activities; instead, it relies on four industrial communication protocols used worldwide in power supply infrastructure, transportation control systems, and other critical infrastructure systems.

The CrashOverRide malware can control electricity substation’ switches and circuit breakers, designed decades ago, allowing an attacker to simply turning off power distribution, cascading failures and causing more severe damage to equipment.
Industroyer malware is a backdoor that first installs four payload components to take control of switches and circuit breakers; and then connects to a remote command-and-control server to receive commands from the attackers.

“Industroyer payloads show the authors’ in-depth knowledge and understanding of industrial control systems.” ESET researchers explain.

“The malware contains a few more features that are designed to enable it to remain under the radar, to ensure the malware’s persistence, and to wipe all traces of itself after it has done its job.”

Since there have been four malware discovered in the wild to date that target industrial control systems, including Stuxnet, Havex, BlackEnergy, and CrashOverRide; Stuxnet and CrashOverRide were designed only for sabotage, while BlackEnergy and Havex were meant for conducting espionage.

“The functionality in the CRASHOVERRIDE framework serves no espionage purpose and the only real feature of the malware is for attacks which would lead to electric outages,” reads Dragos analysis [PDF] of the malware.

MALWARE CAN CAUSE WIDER AND LONGER-LASTING BLACKOUTS

The analysis of the malware suggests CrashOverRide could cause power outages far more widespread, sophisticated and longer lasting than the one Ukraine suffered last December.

Dragos CEO Robert M. Lee said the Crash
OverRide malware is capable of causing power outages that can last up to a few days in portions of a country’s electric grid, but it is not capable enough to bring down the entire grid of a nation.

The malware includes interchangeable, plug-in components that could allow CrashOverRide to be altered to different electric power utilities or even launched simultaneous attacks on multiple targets.

“CrashOverRide is not unique to any particular vendor or configuration and instead leverages knowledge of grid operations and network communications to cause impact; in that way, it can be immediately re-purposed in Europe and portions of the Middle East and Asia,” Dragos’ paper reads. 

“CrashOverRide is extensible and with a small amount of tailoring such as the inclusion of a DNP3 [Distributed Network Protocol 3] protocol stack would also be effective in the North American grid.”

According to the researchers, the malware can be modified to target other types of critical infrastructure, like transportation, gas lines, or water facilities, as well with additional protocol modules.

The security firms have already alerted government authorities and power grid companies about the dangerous threat, along with some advises that could help them to defend against this threat.

Fellow American,

I urge you to put everything else aside for a moment and watch this URGENT news before it’s too late.

The security firms already argued that the 2016 power outage was likely caused by the same group of hackers who caused 2015 blackout — Sandworm, a state-sponsored hacking group believed to be from Russia.

Dragos tracked the perpetrators behind CrashOverRide as Electrum and assessed “with high confidence through confidential sources that Electrum has direct ties to the Sandworm team.“

The security firms have already alerted government authorities and power grid companies about the dangerous threat, along with some advises that could help them to defend against this threat.

NIGHTMARE SCENARIO:

Just weeks ago, literally millions of computers around the world suddenly succumbed to a vicious malware called ‘WannaCry” developed by the US National Security Agency and set free to the world when servers of one of its contractors were hacked.

That malware took computers hostage and required infected users to cough-up $300 “ransom” within days or the price would rise to $600.  If left unpaid for a brief time period, the data on the system would be forever destroyed.

The “nightmare scenario” is the coupling of Industroyer/CrashOverRide with a ransomware like Wannacry.

If the power grid malware was part of ransomware, then utilities would not be able to simply turn the power back on because all the data inside their grid switches and transformers would be encrytped and inaccesible to them for repair!   Hackers could turn off power grids, hold them for days via ransomware and if the utilities didn;t cough-up God-Only -Knows how much, then the ransomware would intentionally destroy all the switch and transformer controls!

In order to bring power back on, utilities would have to go switch-by-switch and re-install software; a process that could take MONTHS.

What would you do without electricity for a week?  A month?  

Maybe it’s time to look into and emergency electrical generator?  Building an EMP Device Is Not Expensive or Difficult.Follow the instructions in the video below.

SOURCE–HALTurnerShow