Story image

The malware that brought down Ukraine – is it really that sophisticated?

21 Jun 17

In December last year a power blackout in Ukraine’s capital Kiev was deemed to be not just a fault in the system, but in fact a malicious cyberattack.

What is interesting, is that it was almost the same time just 12 months ago that the capital experienced a similar attack and power outage -  experts say the country appears to be a ‘testbed’ for attacks to be used around the world.

In both instances, the attacks against Ukraine’s power grid shut off critical energy systems supplying heat and light to millions of homes, showing the true potential of cybercrime.

Hackers are believed to have remained undetected in the Ukrenergo IT network for six months, planning their moves and stealing privileges to access systems before taking steps to shut down the power.

New research from ESET and Dragos Inc. has uncovered the malware responsible for the most recent attack, and they’re calling it Industroyer or CrashOverride with the potential to be more powerful than Stuxnet.

However, federal technical director for Tenable, John Chirhart says there is a lot of ‘buzz’ going around about Industroyer as one of the most sophisticated threats out there, but with no zero days in the Industroyer payload, the significance of this malware as a stand-alone event is in fact quite small.

“Security for critical infrastructure assets like industrial control systems is important, but we need to remember that malware like Industroyer, or WannaCry, represent the new normal of today’s fast-paced security environment and require a different approach,” says Chirhart.

“There’s no way to be strategic about your security if you’re always reacting to the threat of the day.”

Chirhart says as cloud and Internet of Things (IoT) reduce the distinction between operational tech like ICS/SCADA and information technology like laptops and mobile devices, most security vendors have failed to innovate at the rate of change.

This means the convergence of modern IT and OT computing assets is leaving customers struggling to discover and secure all of the devices on their networks.

“Single use ‘best of breed’ security products are no longer enough. CISOs need a unified view from a single platform that can draw on active, passive and agent scanning to see everything from containers to MRI machines,” says Chirhart.

“Stop chasing the latest headline-breaking threat and instead, implement a strategic and agile security program to proactively manage cyber risk for the modern enterprise. That’s what separates a world-class cyber organization from a mediocre one.”

DigiCert conquers Google's distrust of Symantec certs
“This could have been an extremely disruptive event to online commerce," comments DigiCert CEO John Merrill. 
One Identity a Visionary in Magic Quad for PAM
One Identity was recognised in the Gartner Magic Quadrant for Privileged Access Management for completeness of vision and ability to execute.
Gartner names newcomer Exabeam a leader in SIEM
The vendor landscape for SIEM is evolving, with recent entrants bringing technologies optimised for analytics use cases.
52mil users affected by Google+’s second data breach
Google+ APIs will be shut down within the next 90 days, and the consumer platform will be disabled in April 2019 instead of August 2019 as originally planned.
Symantec releases neural network-integrated USB scanning station
Symantec Industrial Control System Protection Neural helps defend against USB-borne cyber attacks on operational technology.
Ramping up security with next-gen firewalls
The classic firewall lacked the ability to distinguish between different kinds of web traffic.
Gartner names LogRhythm leader in SIEM solutions
Security teams increasingly need end-to-end SIEM solutions with native options for host- and network-level monitoring.
Cylance makes APIs available in endpoint detection offering
Extensive APIs enable security teams to more efficiently view, enrich, and contextualise real-time intelligence collected at the endpoint to keep systems secure.