Original release date: June 12, 2017 | Last revised: July 27, 2017Systems Affected
\nIndustrial Control Systems
\nOverview
\nThe National Cybersecurity and Communications Integration Center (NCCIC) is aware of public reports from ESET and Dragos outlining a new, highly capable Industrial Controls Systems (ICS) attack platform that was reportedly used in 2016 against critical infrastructure in Ukraine. As reported by ESET and Dragos, the CrashOverride malware is an extensible platform that could be used to target critical infrastructure sectors. NCCIC is working with its partners to validate the ESET and Dragos analysis, and develop a better understanding of the risk this new malware poses to U.S. critical infrastructure.Although this activity is still under investigation, NCCIC is sharing this report to provide organizations with detection and mitigation recommendations to help prevent future compromises within their critical infrastructure networks. NCCIC continues to work with interagency and international partners on this activity and will provide updates as information becomes available.For a downloadable copy of indicators of compromise (IOCs), see:IOCs (.csv)IOCs (.stix)To report activity related to this Alert, please contact NCCIC at NCCICCustomerService@hq.dhs.gov or 1-888-282-0870.Risk EvaluationNCCIC Cyber Incident Scoring System (NCISS) Rating Priority Level (Color)Yellow (Medium)A medium priority incident may affect public health or safety, national security, economic security, foreign relations, civil liberties, or public confidence.DetailsThere is no evidence to suggest this malware has affected U.S. critical infrastructure. However, the tactics, techniques, and procedures (TTPs) described as part of the CrashOverride malware could be modified to target U.S. critical information networks and systems.
\nDescription
\nTechnical AnalysisCrashOverride malware represents a scalable, capable platform. The modules and capabilities publically reported appear to focus on organizations using ICS protocols IEC101, IEC104, and IEC61850, which are more commonly used outside the United States in electric power control systems. The platform fundamentally abuses the functionality of a targeted ICS system\u2019s legitimate control system to achieve its intended effect. While the known capabilities do not appear to be U.S.-focused, it is important to recognize that the general TTPs used in CrashOverride could be leveraged with modified technical implementations to affect U.S.-based critical infrastructure. With further modification, CrashOverride or similar malware could have implications beyond electric power so all critical infrastructure organizations should be evaluating their systems to susceptibilities in the TTPs outlined. The malware has several reported capabilities:Issues valid commands directly to remote terminal units (RTUs) over ICS protocols. As reported by Dragos, one such command sequence toggles circuit breakers in a rapid open-close-open-close pattern. This could create conditions where individual utilities may island from infected parties, potentially resulting in a degradation of grid reliability.Denies service to local serial COM ports on windows devices, therefore preventing legitimate communications with field equipment over serial from the affected device.Scans and maps ICS environment using a variety of protocols, including Open Platform Communications (OPC). This significantly improves the payload\u2019s probability of success.Could exploit Siemens relay denial-of-service (DoS) vulnerability, leading to a shutdown of the relay. In this instance, the relay would need to be manually reset to restore functionality.Includes a wiper module in the platform that renders windows systems inert, requiring a rebuild or backup restoration.DetectionAs CrashOverride is a second stage malware capability and has the ability to operate independent of initial C2, traditional methods of detection may not be sufficient to detect infections prior to the malware executing. As a result, organizations are encouraged to implement behavioral analysis techniques to attempt to identify precursor activity to CrashOverride. As additional information becomes available on stage one infection vectors and TTPs, this alert will be updated.NCCIC is providing a compilation of IOCs (see links above) from a variety of sources to aid in the detection of this malware. The sources provided do not constitute an exhaustive list and the U.S. Government does not endorse or support any particular product or vendor\u2019s information referenced in this report. However, NCCIC has included this data to ensure wide distribution of the most comprehensive information available and will provide updates as warranted.Signaturesimport \u201cpe\u201dimport \u201chash\u201drule dragos_crashoverride_exporting_dlls{meta:description = \u201cCRASHOVERRIDE v1 Suspicious Export\u201dauthor = \u201cDragos Inc\u201dcondition:pe.exports(\u201cCrash\u201d) & pe.characteristics}rule dragos_crashoverride_suspcious{meta:description = \u201cCRASHOVERRIDE v1 Wiper\u201dauthor = \u201cDragos Inc\u201dstrings:$s0 = \u201cSYS_BASCON.COM\u201d fullword nocase wide$s1 = \u201c.pcmp\u201d fullword nocase wide$s2 = \u201c.pcmi\u201d fullword nocase wide$s3 = \u201c.pcmt\u201d fullword nocase wide$s4 = \u201c.cin\u201d fullword nocase widecondition:pe.exports(\u201cCrash\u201d) and any of ($s*)}rule dragos_crashoverride_name_search {meta:description = \u201cCRASHOVERRIDE v1 Suspicious Strings and Export\u201dauthor = \u201cDragos Inc\u201dstrings:$s0 = \u201c101.dll\u201d fullword nocase wide$s1 = \u201cCrash101.dll\u201d fullword nocase wide$s2 = \u201c104.dll\u201d fullword nocase wide$s3 = \u201cCrash104.dll\u201d fullword nocase wide$s4 = \u201c61850.dll\u201d fullword nocase wide$s5 = \u201cCrash61850.dll\u201d fullword nocase wide$s6 = \u201cOPCClientDemo.dll\u201d fullword nocase wide$s7 = \u201cOPC\u201d fullword nocase wide$s8 = \u201cCrashOPCClientDemo.dll\u201d fullword nocase wide$s9 = \u201cD2MultiCommService.exe\u201d fullword nocase wide$s10 = \u201cCrashD2MultiCommService.exe\u201d fullword nocase wide$s11 = \u201c61850.exe\u201d fullword nocase wide$s12 = \u201cOPC.exe\u201d fullword nocase wide$s13 = \u201chaslo.exe\u201d fullword nocase wide$s14 = \u201chaslo.dat\u201d fullword nocase widecondition:any of ($s*) and pe.exports(\u201cCrash\u201d)}rule dragos_crashoverride_hashes {meta:description = \u201cCRASHOVERRIDE Malware Hashes\u201dauthor = \u201cDragos Inc\u201dcondition:filesize < 1MB andhash.sha1(0, filesize) == \u201cf6c21f8189ced6ae150f9ef2e82a3a57843b587d\u201d orhash.sha1(0, filesize) == \u201ccccce62996d578b984984426a024d9b250237533\u201d orhash.sha1(0, filesize) == \u201c8e39eca1e48240c01ee570631ae8f0c9a9637187\u201d orhash.sha1(0, filesize) == \u201c2cb8230281b86fa944d3043ae906016c8b5984d9\u201d orhash.sha1(0, filesize) == \u201c79ca89711cdaedb16b0ccccfdcfbd6aa7e57120a\u201d orhash.sha1(0, filesize) == \u201c94488f214b165512d2fc0438a581f5c9e3bd4d4c\u201d orhash.sha1(0, filesize) == \u201c5a5fafbc3fec8d36fd57b075ebf34119ba3bff04\u201d orhash.sha1(0, filesize) == \u201cb92149f046f00bb69de329b8457d32c24726ee00\u201d orhash.sha1(0, filesize) == \u201cb335163e6eb854df5e08e85026b2c3518891eda8\u201d}rule dragos_crashoverride_moduleStrings {meta:description = \u201cIEC-104 Interaction Module Program Strings\u201dauthor = \u201cDragos Inc\u201dstrings:$s1 = \u201cIEC-104 client: ip=%s; port=%s; ASDU=%u\u201d nocase wide ascii$s2 = \u201c MSTR ->> SLV\u201d nocase wide ascii$s3 = \u201c MSTR<\/p>\n