Malware Threatens Power Grids

Russian-backed hackers appear to have the ability to remotely shut down power stations, researchers claim. However, the cyber weapon appears to only have been successfully deployed once so far.

Two companies, Dragos Inc and ESET, have revealed their analysis of malware that was used in an attack on a transmission station in Kiev, the Ukrainian capital, last December. The outage lasted for an hour and blacked out buildings that normally use 20 percent of the city's electricity. (Source: washingtonpost.com)

Malware Easily Customized

The researchers say the malware, which they've dubbed Crash Override, was specifically created to attack power stations. It's reminiscent of Stuxnet, a US and Israeli cyber weapon created to compromise Iran's nuclear program.

While the Kiev attack was relatively minor in scope and effect, the researchers believe Crash Override could easily be adapted to attack other facilities. What makes it particularly concerning is that much of the code used appears not to have been specific to the Kiev facility. Instead, it appears to give the creators the ability to plug-in 'instructions' that customize the attack to a particular power station.

The code also suggests a different style of attack to previous attempts to hit infrastructure. In those attempts, the hackers used the code to gain access to the systems then (successfully or otherwise) attempted to manually switch equipment off.

Attacks Could Be Coordinated

Contrastingly, Crash Override's code can automatically gain access and issue the shutdown commands, effectively by inserting them directly into the list of procedures that the systems follows. This suggests it would be much easier to run such an attack on a massive scale, simultaneously going after multiple sites without needing large numbers of people operating the attack.

It could also be possible to program the shutdown to take place at a particular time, even if the system wasn't connected to the Internet at that point.

The researcher noted that in theory the code might also allow the attackers to intentionally overload power grid components while disabling safety measures such as circuit breakers, thus causing physical damage rather than simply switching equipment off. However, the researchers were much less certain about this element than the rest of their findings. (Source: wired.com)

What's Your Opinion?

Should governments do more to increase cyber defenses for infrastructure such as power networks? Did the US give up the moral high ground by working on the Stuxnet program? Does the international community need to develop guidelines and "rules of play" for cyber attacks similar to the conventions that exist on physical military conflict?