sb-au logo
Story image

The malware that brought down Ukraine – is it really that sophisticated?

21 Jun 2017

In December last year a power blackout in Ukraine’s capital Kiev was deemed to be not just a fault in the system, but in fact a malicious cyberattack.

What is interesting, is that it was almost the same time just 12 months ago that the capital experienced a similar attack and power outage -  experts say the country appears to be a ‘testbed’ for attacks to be used around the world.

In both instances, the attacks against Ukraine’s power grid shut off critical energy systems supplying heat and light to millions of homes, showing the true potential of cybercrime.

Hackers are believed to have remained undetected in the Ukrenergo IT network for six months, planning their moves and stealing privileges to access systems before taking steps to shut down the power.

New research from ESET and Dragos Inc. has uncovered the malware responsible for the most recent attack, and they’re calling it Industroyer or CrashOverride with the potential to be more powerful than Stuxnet.

However, federal technical director for Tenable, John Chirhart says there is a lot of ‘buzz’ going around about Industroyer as one of the most sophisticated threats out there, but with no zero days in the Industroyer payload, the significance of this malware as a stand-alone event is in fact quite small.

“Security for critical infrastructure assets like industrial control systems is important, but we need to remember that malware like Industroyer, or WannaCry, represent the new normal of today’s fast-paced security environment and require a different approach,” says Chirhart.

“There’s no way to be strategic about your security if you’re always reacting to the threat of the day.”

Chirhart says as cloud and Internet of Things (IoT) reduce the distinction between operational tech like ICS/SCADA and information technology like laptops and mobile devices, most security vendors have failed to innovate at the rate of change.

This means the convergence of modern IT and OT computing assets is leaving customers struggling to discover and secure all of the devices on their networks.

“Single use ‘best of breed’ security products are no longer enough. CISOs need a unified view from a single platform that can draw on active, passive and agent scanning to see everything from containers to MRI machines,” says Chirhart.

“Stop chasing the latest headline-breaking threat and instead, implement a strategic and agile security program to proactively manage cyber risk for the modern enterprise. That’s what separates a world-class cyber organization from a mediocre one.”

Download image
Equinix study: Firms turn to NFV to support distributed networks
Decision-makers looking for a solution that virtualises a wide range of network functions should evaluate NFV, study finds.More
Story image
Global attack volume down, but fraud and cyber threats still going strong
“The move to digital, for both businesses and consumers, has been significant. Yet with this change comes opportunity for exploitation. Fraudsters look for easy targets: whether government support packages, new lines of credit or media companies with fewer barriers to entry."More
Story image
Why it’s essential to re-write IT security for the cloud era
Key components of network security architecture for the cloud era should be built from the ground up, as opposed to being bolted on to legacy solutions built for organisations functioning only on-premises or from only managed devices.More
Link image
Gartner report: Why SD-WAN is becoming the de-facto option
Network service providers are increasingly challenged by established and new competition in the overlay SD-WAN management as well as in the underlay WAN transport, the report says.More
Story image
Check Point acquires Odo Security to bolster remote security offering
The deal will integrate Odo’s remote access software with Check Point’s Inifinity architecture, bolstering the latter company’s remote security capabilities in a time where working and learning from home has become the norm, and looks to largely remain that way in the near future.More
Story image
The importance of selecting a secure SD-WAN solution
It’s essential to adopt a secure SD-WAN solution to avoid the risks that an unsecured SD-WAN solution can introduce, writes Wavelink managing director Ilan Rubin.More