Hello,

We noticed you're browsing in private or incognito mode.

To continue reading this article, please exit incognito mode or log in.

Not an Insider? Subscribe now for unlimited access to online articles.

Connectivity

A Hack Used to Plunge Ukraine Into Darkness Could Still Do Way More Damage

Eight years after Stuxnet, hackers are testing another piece of malware designed to take down critical infrastructure.

Late last year, a cyberattack on Ukraine’s power grid plunged 20 percent of the nation’s capital, Kiev, into darkness. Now security researchers have published details of the malware that they believe may have been used to make that happen.

While the cybersecurity firm ESET won't say that the piece of malware it calls Industroyer is definitely the software that was used to take down Ukraine’s power, it sure looks like the number one suspect: it’s designed to infiltrate a system and then control electricity substation switches and circuit breakers. 

It’s unclear how Industroyer finds its way on to infrastructure computers, but once there it scans the network to find hardware that it can take down. It also reports to its master rather cleverly, sending information to control servers that are hidden using the identify obfuscator known as Tor, and then only communicating outside of regular working hours.

Because the commands it leverages were developed decades ago, they were designed to work on computers that sat in isolation. They were never intended for use in a networked world where hackers could inject malware from a distance, so gaining access to the system makes an awful lot possible—and Wired describes in some detail how some of the potential attacks could work.

Perhaps the most worrying part of the research is the potential capability of the malware in the future. The commands it uses to switch off substations are actually used inside all kinds of infrastructure—not just electricity supply networks but traffic control systems, waterworks, and more—and ESET warns that the code could be repurposed to perform attacks on those kinds of systems, too.

That’s why, in an article describing the malware, ESET’s senior malware researcher, Anton Cherepanov, calls Industroyer the “biggest threat to industrial control systems since Stuxnet.” That piece of malware, you may recall, was famously used to sabotage an Iranian nuclear power plant back in 2009.

The bad news is that these kinds of problems look set to become more widespread. As aging energy systems are connected up to the Internet in a bid to modernize, they are becomingly newly vulnerable in much the same way as Kiev’s grid. The good news, though, as we recently reported, is that many companies are building new technologies to help overcome these problems. Hopefully, they’ll do that rather quickly.

(Read more: ESET, Wired, “Ukraine’s Power Grid Gets Hacked Again, a Worrying Sign for Infrastructure Attacks,” “A Way to Attack Nuclear Plants,” “Patching the Electric Grid”)

Cut off? Read unlimited articles today.

Become an Insider
Already an Insider? Log in.
More from Connectivity

What it means to be constantly connected with each other and vast sources of information.

Want more award-winning journalism? Subscribe to Insider Plus.
  • Insider Plus {! insider.prices.plus !}*

    {! insider.display.menuOptionsLabel !}

    Everything included in Insider Basic, plus the digital magazine, extensive archive, ad-free web experience, and discounts to partner offerings and MIT Technology Review events.

    See details+

    Print + Digital Magazine (6 bi-monthly issues)

    Unlimited online access including all articles, multimedia, and more

    The Download newsletter with top tech stories delivered daily to your inbox

    Technology Review PDF magazine archive, including articles, images, and covers dating back to 1899

    10% Discount to MIT Technology Review events and MIT Press

    Ad-free website experience

/3
You've read of three free articles this month. for unlimited online access. You've read of three free articles this month. for unlimited online access. This is your last free article this month. for unlimited online access. You've read all your free articles this month. for unlimited online access. You've read of three free articles this month. for more, or for unlimited online access. for two more free articles, or for unlimited online access.