I heard about the CrashOverride malware, which targets industrial control systems. What does it do? What should...
enterprises do to prevent an attack?
CrashOverride shut down Ukraine's power grid in December 2016. The National Cybersecurity and Communications Integration Center started investigating the malware strain after this incident, and cybersecurity firms Eset and Dragos have published reports on it already.
What's already known is that the malware can target any organization that uses specific industrial control system (ICS) protocols. While these ICS protocols aren't used in the United States, the malware's plug-in components could be modified to attack the United States' power grid, as well as other critical information networks and systems.
The CrashOverride malware exploits the lack of authentication and authorization in the ICS protocols when valid commands are issued to remote terminal units. Services are denied to local serial COM ports on Windows devices, and communication with field equipment stops working. The malware uses Open Platform Communication to scan and map ICS environments.
CrashOverride also has the ability to exploit Siemens' relay devices, which are vulnerable to denial-of-service attacks. The relay normally opens circuit breakers if it detects dangerous power levels, so if the relay was maliciously shut down, it would need to be manually reset to restore functionality.
Another capability of the CrashOverride malware is a wiper module to render Windows systems useless. This requires time-wasting and costly rebuild or backup restoration.
To prevent a CrashOverride malware attack, critical infrastructure organizations should follow best practices as outlined in "Seven Steps to Effectively Defend Industrial Control Systems," a paper released by the U.S. Department of Homeland Security, the National Security Agency and the FBI. The steps are:
- implement application whitelisting;
- ensure proper configuration and patch management;
- reduce your attack surface area;
- build a defendable environment;
- manage authentication (and authorization);
- implement secure remote access; and
- monitor and respond.
ICS-CERT provides updates on control system vulnerabilities, mitigation strategies and other cybersecurity issues. The ICS and network monitoring tools your organization uses must be free of vulnerabilities. Automatic tool and patch downloads from trusted vendors should help the organization stay current.
Ask the expert:
Want to ask Judith Myerson a question about security? Submit your question now via email. (All questions are anonymous.)
Find out how WannaCry malware affects ICS networks
Learn about the threat of Conficker malware to ICS and SCADA systems
Discover why enterprises need more ICS security awareness training
Dig Deeper on Malware, virus, Trojan and spyware protection and removal
Related Q&A from Judith Myerson
Multiple Border Gateway Protocol vulnerabilities were found impacting security in the Quagga routing software. Expert Judith Myerson explains how ... Continue Reading
A previously disclosed flaw found in Broadcom's Wi-Fi controller chips is now believed to affect the Lenovo ThinkPad. Learn how this vulnerability ... Continue Reading
ICS-CERT issued a warning about a new vulnerability in Nortek Linear eMerge E3 products. Discover what this vulnerability is and how it affects ... Continue Reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.