I heard about the CrashOverride malware, which targets industrial control systems. What does it do? What should...
enterprises do to prevent an attack?
CrashOverride shut down Ukraine's power grid in December 2016. The National Cybersecurity and Communications Integration Center started investigating the malware strain after this incident, and cybersecurity firms Eset and Dragos have published reports on it already.
What's already known is that the malware can target any organization that uses specific industrial control system (ICS) protocols. While these ICS protocols aren't used in the United States, the malware's plug-in components could be modified to attack the United States' power grid, as well as other critical information networks and systems.
The CrashOverride malware exploits the lack of authentication and authorization in the ICS protocols when valid commands are issued to remote terminal units. Services are denied to local serial COM ports on Windows devices, and communication with field equipment stops working. The malware uses Open Platform Communication to scan and map ICS environments.
CrashOverride also has the ability to exploit Siemens' relay devices, which are vulnerable to denial-of-service attacks. The relay normally opens circuit breakers if it detects dangerous power levels, so if the relay was maliciously shut down, it would need to be manually reset to restore functionality.
Another capability of the CrashOverride malware is a wiper module to render Windows systems useless. This requires time-wasting and costly rebuild or backup restoration.
To prevent a CrashOverride malware attack, critical infrastructure organizations should follow best practices as outlined in "Seven Steps to Effectively Defend Industrial Control Systems," a paper released by the U.S. Department of Homeland Security, the National Security Agency and the FBI. The steps are:
- implement application whitelisting;
- ensure proper configuration and patch management;
- reduce your attack surface area;
- build a defendable environment;
- manage authentication (and authorization);
- implement secure remote access; and
- monitor and respond.
ICS-CERT provides updates on control system vulnerabilities, mitigation strategies and other cybersecurity issues. The ICS and network monitoring tools your organization uses must be free of vulnerabilities. Automatic tool and patch downloads from trusted vendors should help the organization stay current.
Ask the expert:
Want to ask Judith Myerson a question about security? Submit your question now via email. (All questions are anonymous.)
Find out how WannaCry malware affects ICS networks
Learn about the threat of Conficker malware to ICS and SCADA systems
Discover why enterprises need more ICS security awareness training
Dig Deeper on Malware, virus, Trojan and spyware protection and removal
Related Q&A from Judith Myerson
A swatting attack resulted in the death of a Kansas man. Expert Judith Myerson looks at the technology these attacks use and what can be done to make...continue reading
The Devil's Ivy bug affects millions of internet-connected security cameras. Expert Judith Myerson explains how the exploit works and what can be ...continue reading
An IoT botnet attack on Huawei home routers showed similarities to the Mirai malware. Expert Judith Myerson explains the threat and how enterprises ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.