Scourge · December 17 2016

The Scourge of Industroyer

Chronicle

On the evening of 17 December 2016 malware designed to speak electric-grid protocols directly (IEC 104, IEC 61850, OPC DA) opened the breakers at the Pivnichna transmission substation. Part of Kyiv lost power for about an hour, a year after Ukraine's first cyber blackout. ESET, which named it Industroyer, and Dragos, which named it CrashOverride, attributed it to the Sandworm group.

Lesson learned

It proved that an attack on the grid could be automated and reused elsewhere, and that industrial protocols born without authentication must be protected by segmentation and monitoring.

Prayer of reparation

O Industroyer, who spoke the language of substations better than many engineers, let our networks heed only those authorised to give orders. Amen.

How it is remembered

Remembered by monitoring industrial protocol traffic, segmenting substation networks and regularly rehearsing manual restoration.