I heard about the CrashOverride malware, which targets industrial control systems. What does it do? What should...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
enterprises do to prevent an attack?
CrashOverride shut down Ukraine's power grid in December 2016. The National Cybersecurity and Communications Integration Center started investigating the malware strain after this incident, and cybersecurity firms Eset and Dragos have published reports on it already.
What's already known is that the malware can target any organization that uses specific industrial control system (ICS) protocols. While these ICS protocols aren't used in the United States, the malware's plug-in components could be modified to attack the United States' power grid, as well as other critical information networks and systems.
The CrashOverride malware exploits the lack of authentication and authorization in the ICS protocols when valid commands are issued to remote terminal units. Services are denied to local serial COM ports on Windows devices, and communication with field equipment stops working. The malware uses Open Platform Communication to scan and map ICS environments.
CrashOverride also has the ability to exploit Siemens' relay devices, which are vulnerable to denial-of-service attacks. The relay normally opens circuit breakers if it detects dangerous power levels, so if the relay was maliciously shut down, it would need to be manually reset to restore functionality.
Another capability of the CrashOverride malware is a wiper module to render Windows systems useless. This requires time-wasting and costly rebuild or backup restoration.
To prevent a CrashOverride malware attack, critical infrastructure organizations should follow best practices as outlined in "Seven Steps to Effectively Defend Industrial Control Systems," a paper released by the U.S. Department of Homeland Security, the National Security Agency and the FBI. The steps are:
- implement application whitelisting;
- ensure proper configuration and patch management;
- reduce your attack surface area;
- build a defendable environment;
- manage authentication (and authorization);
- implement secure remote access; and
- monitor and respond.
ICS-CERT provides updates on control system vulnerabilities, mitigation strategies and other cybersecurity issues. The ICS and network monitoring tools your organization uses must be free of vulnerabilities. Automatic tool and patch downloads from trusted vendors should help the organization stay current.
Ask the expert:
Want to ask Judith Myerson a question about security? Submit your question now via email. (All questions are anonymous.)
Find out how WannaCry malware affects ICS networks
Learn about the threat of Conficker malware to ICS and SCADA systems
Discover why enterprises need more ICS security awareness training
Dig Deeper on Malware, virus, Trojan and spyware protection and removal
Related Q&A from Judith Myerson
NIST recently issued guidance on mitigating the security risks of application containers. Expert Judith Myerson outlines some of the risks and fixes ...continue reading
BrickerBot is similar to other IoT malware like Mirai, Hajime and others. Expert Judith Myerson explains what makes BrickerBot different, and what ...continue reading
A wave of Jenkins vulnerabilities related to plug-ins were recently discovered. Expert Judith Myerson explains the flaws and how enterprises should ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.