Story image

The malware that brought down Ukraine – is it really that sophisticated?

21 Jun 17

In December last year a power blackout in Ukraine’s capital Kiev was deemed to be not just a fault in the system, but in fact a malicious cyberattack.

What is interesting, is that it was almost the same time just 12 months ago that the capital experienced a similar attack and power outage -  experts say the country appears to be a ‘testbed’ for attacks to be used around the world.

In both instances, the attacks against Ukraine’s power grid shut off critical energy systems supplying heat and light to millions of homes, showing the true potential of cybercrime.

Hackers are believed to have remained undetected in the Ukrenergo IT network for six months, planning their moves and stealing privileges to access systems before taking steps to shut down the power.

New research from ESET and Dragos Inc. has uncovered the malware responsible for the most recent attack, and they’re calling it Industroyer or CrashOverride with the potential to be more powerful than Stuxnet.

However, federal technical director for Tenable, John Chirhart says there is a lot of ‘buzz’ going around about Industroyer as one of the most sophisticated threats out there, but with no zero days in the Industroyer payload, the significance of this malware as a stand-alone event is in fact quite small.

“Security for critical infrastructure assets like industrial control systems is important, but we need to remember that malware like Industroyer, or WannaCry, represent the new normal of today’s fast-paced security environment and require a different approach,” says Chirhart.

“There’s no way to be strategic about your security if you’re always reacting to the threat of the day.”

Chirhart says as cloud and Internet of Things (IoT) reduce the distinction between operational tech like ICS/SCADA and information technology like laptops and mobile devices, most security vendors have failed to innovate at the rate of change.

This means the convergence of modern IT and OT computing assets is leaving customers struggling to discover and secure all of the devices on their networks.

“Single use ‘best of breed’ security products are no longer enough. CISOs need a unified view from a single platform that can draw on active, passive and agent scanning to see everything from containers to MRI machines,” says Chirhart.

“Stop chasing the latest headline-breaking threat and instead, implement a strategic and agile security program to proactively manage cyber risk for the modern enterprise. That’s what separates a world-class cyber organization from a mediocre one.”

Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."
Businesses too slow on attack detection – CrowdStrike
The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 cases.
Proofpoint launches feature to identify most targeted users
“One of the largest security industry misconceptions is that most cyberattacks target top executives and management.”
McAfee named Leader in Magic Quadrant an eighth time
The company has been once again named as a Leader in the Gartner Magic Quadrant for Security Information and Event Management.
Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.
25% of malicious emails still make it through to recipients
Popular email security programmes may fail to detect as much as 25% of all emails with malicious or dangerous attachments, a study from Mimecast says.
Google Cloud, Palo Alto Networks extend partnership
Google Cloud and Palo Alto Networks have extended their partnership to include more security features and customer support for all major public clouds.