This Is How They Tell Me the World Ends: The Cyberweapons Arms Race

by Nicole Perlroth

All optimism evaporated in 2014, when the Russians took their attacks one step further. That January, CrowdStrike discovered that Russian hackers had successfully compromised industrial control software companies and Trojanized the software updates that made their way into hundreds of industrial control systems across the country. It was the same technique the Americans and Israelis had used five years earlier with Flame, when they infected computers in Iran using Trojanized Microsoft software updates. But the Russians had been far less judicious. It wasn’t just U.S. oil and gas companies anymore; Russian hackers infected the software updates that reached the industrial controllers inside hydroelectric dams, nuclear power plants, pipelines, and the grid, and were now inside the very computers that could unleash the locks at the dams, trigger an explosion, or shut down power to the grid.