Right now, Russia’s war in Ukraine dominates much of the world’s headlines. Not only is it a pressing global concern, but the conflict also illustrates troubling realities that physical security stakeholders are reckoning with.
A report that was presented May 20 at the IEEE Symposium on Security and Privacy examines the physical security implications of malware attacks in Ukraine by bad actors. The research was led by a team of UC Santa Cruz students who shed a spotlight on “Industroyer One and Two” — two infamous malware attacks that took place in 2016 and 2022, respectively.
That first 2016 attack saw Ukrainians live through what is believed to be the first known blackout caused by pernicious malware. That attack targeted the country’s power grid, resulting in one-fifth of Kyiv citizens to live in total darkness. The second 2022 attack took place during the current war.
“Malware attacks against physical infrastructure have long been a looming threat in the realm of cybersecurity, but these two in Ukraine were the first attacks of their kind, and have received little attention from the academic community,” reads a UC Santa Cruz press release announcing the research.
Alvaro Cardenas is an associate professor of computer science and engineering, who advised the student research team. He says in the release that, while current physical infrastructure systems are very vulnerable, not much is said about the threat malware can pose. This is a problem that should worry every country, not just Ukraine.
“When you see a nation state designing malware to take down the power grid of another country, that seems to be a big deal. Our critical infrastructures are vulnerable to these kinds of attacks, so we need to be better prepared to defend,” Cardenas says.
Cardenas and his team of student researchers say bringing attention to these attacks can help governments and private entities know how to fortify their systems against future attacks. The researchers point out that malware attacks are only becoming “stealthier.”
This means that not only do security stakeholders need to be more educated on how these cyber-attacks can directly impact physical safety and wellbeing, but they also must think outside the box to devise advanced systems to halt these bad actors in their tracks.
To that end, Cardenas and his students are creating a “honeypot” decoy software that will give off the impression that it is a “working system” and could attract malware attacks, alerting security officials that an outside hacker is trying to target their systems. While the conflict in Ukraine might seem a world away, Cardenas says that this is something people in the United States must be aware of.
“The attacks could happen here [the U.S.], or pretty much anywhere in the world,” he says in the release. “Systems are now all controlled by computers and have pretty much the same technology.”