21 ms·

U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack

258 points by opaque 5y ago

post_break 5y ago
Yikes, get ready for a huge jump in oil pricing.
- leppr 5y ago
  Oh, what a surprise, another unexpected event pumping oil prices.
  - beckingz 5y ago
    There's no need to use crude jokes here. It's a gasoline pipeline, so more refined jokes are appropriate.
    - ruined 5y ago
      musk lithium coup
- Armisael16 5y ago
  Why would oil prices jump? This isn’t an oil pipeline.
  - post_break 5y ago
    Because there was already a glut, now the places that feed this pipeline have to be backed up. Just because it’s gasoline doesn’t mean it’s not a link in the whole chain.
  - dylan604 5y ago
    Because they can and do use any excuse to bump the prices.
  - stunt 5y ago
    Because unlike their network gateways, their pricing change is unidirectional.
- jumelles 5y ago
  > Colonial’s pipeline transports 2.5 million barrels each day, taking refined gasoline, diesel fuel and jet fuel from the Gulf Coast up to New York Harbor and New York’s major airports. Most of that goes into major storage tanks, and with energy use depressed by the pandemic, the attack was unlikely to cause any immediate disruptions. https://www.nytimes.com/2021/05/08/us/cyberattack-colonial-pipeline.html https://www.nytimes.com/2021/05/08/us/cyberattack-colonial-p...
deleted 5y ago
[deleted]
motohagiography 5y ago
Let's see if 15+ years of security people getting after critical infrastructure asset owners like this has made any difference. At least they detected something and shut it down to control the response. They also know the costs to repair and replace things. I don't suspect the pipeline uses a federation of heterogeneous systems to operate its SCADA actuators, so I would speculate it is likely a single firmware vulnerability facilitating it. The global chip shortage for replacement parts if they are needed seems like a strategic coincidence. Definitely an evolving story.
- procarch2019 5y ago
  I work in control systems OT space. A lot of distributed control systems and scada systems interface with the business layer in some fashion to provide access to time series and event data and to allow for alerts via email/mobile. Some people do this properly with good network segmentation, firewalls, A/V and patching, etc (there are several standards that dictate best practice). That said, even when doing it properly you're introducing attack vectors. I don't think it would be a firmware vulnerability, but instead something malicious affecting the computers they use to control the process.
  - motohagiography 5y ago
    The reason I'm going for firmware is while the HMIs could have had a solarwinds style exposure, but that's just any generically wormable OS vulnerability, and not something that should cause a physical shutdown. To shutdown a pipeline, it's not a management console issue, hence why I'd speculate it's in the ICS devices themselves, which probably use uClinux toolchains on SoCs from one or two large vendors. I did some smart meter and ICS security work in the 00's, and there were a few vendors who would be strategic targets. The attack tools available now are unbelievably better, while the attack surface is pretty much the same due to the long lifecycles of ICS components, and considering today we've got cheap SDRs and gnuradio blocks for most wireless protocols, AVR tools, buspirate and the good/greatfet, ghidra/ida, and python for reverse engineering, the vulnerability research on this stuff moves way faster than the industry ability to respond. If this is a serious attack, the only way to respond will be if they are very lucky, it's a worm and they can stand up a honeynet with spare gear to catch a sample and any good infosec firm can pull it apart. But if it's an active APT group, there's probably a political solution, as given what's possible, this would seem to be just a shot over the bow.
ruined 5y ago
nice
ArkanExplorer 5y ago
Given Government inaction on climate change, could we begin to see motivated individuals or groups taking matters into their own hands and targeting fossil fuel infrastructure in this manner?
- aardvarkr 5y ago
  That would be domestic terrorism and is an easy way to turn the entire population against the cause
  - adrianmonk 5y ago
    It could do more harm than good, but it remains possible that someone will do it anyway. It's a legitimate scenario for these types of companies to consider in their cyber-security planning and preparation (assuming they have any).
    - pm90 5y ago
      Domestic attacks would be somewhat more difficult to carry out without being detected. It’s much easier for the Government to track domestic actors since there’s so much data collected on them both Nationally and by local law enforcement. That’s why international attacks are more prevalent and bold: they’re not as easily traceable. However, that also comes with its downsides: if the USG wants, it might just use lethal force against you. So ultimately the people who tend to do this repeatedly end up being state owned or state protected actors, who are likely offered some sort of protection by their State from retribution by the USG.
      - zero_deg_kevin 5y ago
        1/6 looked pretty easy. It also looked like it was pretty easy to catch the most gods-awfully expensive intelligence agencies in the world completely flat-footed.
  - ArkanExplorer 5y ago
    With a bus load of activists you could probably shut down a coal mine or coal power plant. Just repeat the interruptions until the location is closed. Environmentalists used to chain themselves to trees. Would the same physical actions work for climate change? Its difficult to see the public being opposed to this when coal infrastructure is on the edge of irrelevancy anyway and easily replaced.
rossdavidh 5y ago
So, two possible responses by the government to the current increase in these kinds of attacks: 1) blame the lack of computer security in our infrastructure, and work on improving that 2) blame cybercurrencies, and try to eliminate them Any bets on which one our government will choose?
- waihtis 5y ago
  Didn’t see anything about ransomware in the article?
- aardvarkr 5y ago
  That a pretty low effort dig at the government. What the hell does that have to do with something that is obviously state sponsored cyber espionage? Go troll somewhere else
  - kingsuper20 5y ago
    'obviously'? Meh. One argument you can make is to partly defund the surveillance-based departments and agencies and put together a cybersecurity agency who is tasked with hardening the country's systems. I have no idea how someone would build a legislative and personnel firewall to protect it from the existing need to peep through keyholes, it's probably not possible.
- deleted 5y ago
  [deleted]
- wolverine876 5y ago
  That's quite a strawperson - it creates a fictional story and then criticize the characters. The U.S. government has been addressing computer security in infrastructure for a long time.
  - joejerryronnie 5y ago
    I’d prefer a new Cybersecurity branch of the military with full funding and resources rather than Space Force.
neonate 5y ago
https://archive.md/kEziH https://archive.md/kEziH
Xunxi 5y ago
It's only a matter of time, there's gonna be physical casualties at some point in time. We've all seen it in the movies. Experts have warned of the dangers of tethering vital utilities controls to the internet. Is it not possible to develop protocol or device that operates outside of the web but functions like the'two-man' rule used to launch nuclear bombs?
- shagie 5y ago
  One such example... a test done at the Idaho National Lab https://www.wired.com/story/how-30-lines-of-code-blew-up-27-ton-generator/ https://www.wired.com/story/how-30-lines-of-code-blew-up-27-... That lab tends to specialize in cybersecurity and infrastructure. https://www.wired.com/2011/10/idaho-national-laboratory/ https://www.wired.com/2011/10/idaho-national-laboratory/ The critical infrastructure part of the lab: https://inl.gov/critical-infrastructure-protection/ https://inl.gov/critical-infrastructure-protection/
- extropy 5y ago
  It's like 100x more expensive. Would be nice to have separate data lines, running fiber optics sealed in pressurized conduits for double tamper detection. The military actually does this for their critical infra.
  - mschuster91 5y ago
    > Would be nice to have separate data lines, running fiber optics sealed in pressurized conduits for double tamper detection. At least German Telekom has been doing this for ages for the trunk cables serving entire areas with analog phone service - although not for tamper detection as an anti-spionage measure, but rather to detect and pinpoint damage to the cables, e.g. from excavators, tree growth or splice seals degrading.
    - oasisbob 5y ago
      Pressurizing conduits also helps prevent water ingress.
- 5y ago
t3rabytes 5y ago
A few years back we had two different instances of this pipeline getting shut down from newly-found leaks. While they say it won’t cause gas shortages, these articles tend to drive people to the pumps in droves in the southeastern states served by it (like mine, NC!).
v8dev123 5y ago
All these attacks usually caused by two things, office macros and mimikatz.
- rurban 5y ago
  Easier: Microsoft Windows
  - trompetenaccoun 5y ago
    The government needs to finally ban Windows. In addition to being insecure it's used by many criminals for their scams and blackmail operations.
  - v8dev123 5y ago
    I re-call the Russians did a full featured malware for macOS called Proton. You may find videos of that in Youtube. Of course, Macros works in macOS too if the user has installed Microsoft Office
Pfhreak 5y ago
I'm surprised we don't see more attacks on pipelines - both digital and physical. There are many folks out there who take issue with them or see them as a vulnerable part of our infrastructure.
kaliali 5y ago
In case it hasn't crossed your mind yet Its the chinese
- ackbar03 5y ago
  What, blaming Russia doesn't bring the same satisfaction anymore?
- guilhas 5y ago
  Yes this attack ip was traced to a Chinese wet market The attacker nickname? The bat Working together with Xl and Kim Jong-un in a Wuhan cyber facility
koheripbal 5y ago
Washington Post reported it was a ransomware attack. It may not have been a targeted attack.
- tedk-42 5y ago
  20 odd posts and yours is the only sensible one. It's certainly a security incident but until we know more it's hard to say the infrastructure was specifically targetted for an 'attack'
- nabilhat 5y ago
  The WaPo article itself is much more detailed. The bits about the age and fragility of Colonial's pipelines are far more significant than ransomware. Colonial's continued neglect is more disruptive than any single attack on the pipeline. The persistence of unreliable infrastructure is a more valuable disruptive asset to an organized opponent than a single targeted attack. Tangent - Also interesting, the WaPo article [0] bears little resemblance to itself from only hours ago [1]. The article has grown by about 50%, while contents have come and gone. That's my favorite application for archive dot is - Seeing the timelapse of iterative releases, watching journalism bend and sway in the current of its own response. I'm not making any judgements, the internet is already sloshing with useless hot takes about journalism and media. It's just fascinating to see the modern editorial process at work, out in the open. [0] https://www.washingtonpost.com/business/2021/05/08/cyber-attack-colonial-pipeline/ https://www.washingtonpost.com/business/2021/05/08/cyber-att... [1] https://archive.is/vlNs2 https://archive.is/vlNs2
  - throwawayboise 5y ago
    Relates to the Kent Beck "Latency vs Througput" post[1] on here right now... do you post the story immediately, and start getting feedback, or do you wait and do research and get it (more) right before posting it? [1] https://news.ycombinator.com/item?id=27088272 https://news.ycombinator.com/item?id=27088272
protomyth 5y ago
Perhaps we should pass a law that no utilities / infrastructure should be attached to the internet. Private networks are fine for this purpose.
- procarch2019 5y ago
  I think the issue there is data, even on critical infra. Modernization, reliability and the such require data analysis. There are definitely ‘strong’ ways of protecting the assets and mitigating attack vectors, but almost no way to eliminate them entirely. For example, event if you isolate the process computers you’ll typically have an interface node that presents the data up a level (hopefully to a DMZ). Obviously you can be compromised if that interface node is. Some critical infra is air gapped though. Other systems implement SIS systems in parallel with general process systems to mitigate catastrophic failure further.
  - protomyth 5y ago
    They can gather the data on the infrastructure network and then carry across an air gap on a USB or tape to do their analysis. I don't see the upside of allowing any connectivity to the internet given the danger other than some mechanism for sending an alert. I'm sure creative people can air gap that too (camera on the internet side and some image recognition for example).
    - procarch2019 5y ago
      That's massively inconvenient, although I'm sure necessary in some cases. Some businesses actually perform analysis in 'real time' so they can adjust the process accordingly, witch requires that data be accessible. This may actually be such a case as I'm sure they have to interface with customers (tank farms) to react to supply/demand on the branches. For all I know Colonial does have a private network for that purpose though. Usually PAT is really for chemical processes where you are looking for a particular yield and those analytical services are located closer to the process (in terms of networks). There are devices called data diodes that provide unidirectional network topology, but not all time series data interfaces can work with them. All in all, I agree that total air gap is obviously the best way to mitigate network attack vectors, but sometimes not practical. No controlling device should be at level 3 or 4 though (business or enterprise level).
jtchang 5y ago
In a twisted sort of way I am happy to see these types of ransomware attacks making headlines. Before it was much harder to quantify how much a breach might cost but with ransomeware you get a fuzzy lower bound. Also the prevalence of these attacks might actually make us all safer in the long run.
- enkid 5y ago
  Absolutely, it's better to have a ransomware attack against the workstations instead of a more developed attack that blew the pipeline up.
  - runeks 5y ago
    This is interesting. Ransomware authors may be protecting their targets against destructive attacks since this would reduce their profits. In the same way that botnets attempt to protect their host from being infected by competing malware.
- dehrmann 5y ago
  This one in particular is good because, it's public, it's not that scary, but it's easy to make the jump to scary attacks.
  - deleted 5y ago
    [deleted]
- bourgwaletariat 5y ago
  I think I understand your POV and can see why one might find some peace in it, but I don't. More crime, or I suppose mroe news about it, so we know how much crime costs? More attacks make us safer? It's a means justify the ends argument, but it doesn't hold water. It's eerily similar to "burn it all down" https://en.wikipedia.org/wiki/Accelerationism https://en.wikipedia.org/wiki/Accelerationism, which, itself is on the rise and burning from both ends. I infer your point to be that more attacks might cause the victims to step up their defenses. It's a cat and mouse game. Always has been in all realms. "It'll get worse before it gets better." I've been hearing that for decades. I'm starting to wonder, due to what appears to be a decline in civility. Following the rules only works if we all do. Those who eschew the rules have an obvious advantage. Where has integrity gone? We are tearing ourselves apart and justifying it ... or coming to terms with it I suppose, by saying it'll be better some day. Well... when... exactly? By what measure will we know? I know Stephen Pinker, Hans Rosling, and various folks say it's the best time to be a human. Okay. Sure. I see the math. I'd like to see them update their charts for data out over the past year. But ... anecdotally, none of that math seems to percolate down to my community. The people around me are in constant fear. I just saw a woman walking down the road, all by herself, I had clear vision for a mile and so no one else but her... and she was wearing a mask. She was afraid. She was anxious. Regardless of the relative safety that exists today, or the belief that it'll be safer tomorrow because of the lack of said safety, the people around me aren't feeling it. They're buying guns because red people are coming for them... or the blue people already are. Or the government will. There is literally no milk at the store because of an HDPE shortage prompting the grocer to put a Force Majeur notice on the dairy fridge door. Trust has broken down. Fear of our own neighbors is up. Crime is up. Poverty is up. Suicide is up. Cyber crime is up. Inflation is up. The Gini coefficient is up. I really have trouble believing that making it worse real fast, or even reporting more of it, is going to make it better. I don't see it.
mikewarot 5y ago
Connecting infrastructure to the internet is something that is done for many reasons. It would be a vast improvement of security if most of those connections went through a data diode[1] and only allowed monitoring. Knowing what is happening now with critical infrastructure, through the internet, can be done in a completely safe manner. It is a solved problem. [1] - https://en.wikipedia.org/wiki/Unidirectional_network https://en.wikipedia.org/wiki/Unidirectional_network
- deleted 5y ago
  [deleted]
- jeffbee 5y ago
  What would be the difference between having a data diode between your control and monitoring network and external monitoring systems, versus just splitting the monitoring part off into a completely separate network with ordinary two-way traffic?
  - stunt 5y ago
    What you explained doesn't solve the problem. You still want to have an unidirectional network in place at least between your critical infrastructure to the monitoring systems. Monitoring systems are usually separate and often have their dedicated network too, but they still need some sort of network connection to your critical infrastructure to do their job (monitoring).
    - mikewarot 5y ago
      If you put a data diode between your infrastructure and the internet, you can see the status from anywhere, yet never compromise it from the outside.
      - stunt 5y ago
        Yes, I think we are on the same page. I was trying to explain that having a separate monitoring infra and network group wouldn't work as a replacement for unidirectional network setup, because you sill need to open network access between critical infra and the monitoring system in your design, which will expose it to the internet. So like you said, you still need to have an unidirectional network in place.
dang 5y ago
Url changed from https://www.bloomberg.com/news/articles/2021-05-08/u-s-s-biggest-gasoline-and-pipeline-halted-after-cyberattack https://www.bloomberg.com/news/articles/2021-05-08/u-s-s-big..., which points to this.
deleted 5y ago
[deleted]
bourgwaletariat 5y ago
I wonder if this has anything to do with the Colonial gas pipeline leak? It's been a problem for over 8 months now. Was in the news recently again. Over a million gallons spilled, but they don't really know how much. https://www.msn.com/en-us/news/us/eight-months-later-colonial-pipeline-spill-continuing-to-impact-huntersville-residents/ar-BB1fPAL6 https://www.msn.com/en-us/news/us/eight-months-later-colonia...
Honey_Mustard 5y ago
"Eastern European-based criminal gang — DarkSide," They never say Western European criminal gang, they always brainwash people to think eastern europeans are criminals.
johnnymonster 5y ago
Hashtag stop posting paywall stories on HN
joe_the_user 5y ago
"This is as close as you can get to the jugular of infrastructure in the United States," said Amy Myers Jaffe, research professor and managing director of the Climate Policy Lab. "It's not a major pipeline. It's the pipeline." About that infrastructure security... this forum has gone over in detail the situation of infrastructure security in quite a bit of detail as other stuff has happened. It's easy to say "you need to isolate your critical network from your office network" but that costs dollars and time and letting things fall to shit is free 'till the time comes and then other people the price rather than you. The privately held, Georgia-based company is owned by CDPQ Colonial Partners L.P., IFM (US) Colonial Pipeline 2 LLC, KKR-Keats Pipeline Investors L.P., Koch Capital Investments Company LLC and Shell Midstream Operating LLC. All the best names of neoliberalism!
- Spooky23 5y ago
  Companies like this are tax dodges that socialize risk. The limited partners enjoy fat returns with minimal downside.
  - perl4ever 5y ago
    I'm not sure about these, but there are public limited partnerships that anyone can buy like a stock. If you don't realize what you are getting into, you may regret it because you will get a K-1 at tax time. I don't know if it's any more of a tax dodge than an REIT.
    - Spooky23 5y ago
      These structures characterize cash flows as return on capital, which defer taxation. There’s a bunch of games played.
      - perl4ever 5y ago
        I didn't think it deferred taxation; just the opposite. That's what I was referring to about the K-1; you pay taxes on the income of the partnership even if you didn't sell any shares.
tidydata 5y ago
There’s nothing in this article indicating the operator has a recovery plan in place involving restoring backups to get these systems online. Seems grossly negligent on their behalf, and made almost satiric by the fact that Fireye can be mentioned without reference to their own massive security lapses. Too much focus always on the “hackers” and never the obvious security lapses solved by diverting executive pay to more bodies and training to cover them, but oh well right?
- thisisnico 5y ago
  IT is typically grossly understaffed and underfunded in these businesses. At the site-level, you'll see some very out of date tech running critical systems. IT is a cost-center to be reduced as much as possible, oversight is non-existent.
  - crmd 5y ago
    You always know you’re dealing with one of these companies when IT reports up into the CFO.
    - adolph 5y ago
      Could be worse, I saw IT reporting through HR once upon a time.
      - crmd 5y ago
        Horrible
    - Bukhmanizer 5y ago
      I used to work at a scientific research institute where the entire IT department reported to a single researcher for no apparent reason.
- deleted 5y ago
  [deleted]
- 5y ago
nfoz 5y ago
I hope this ransomware called itself the Da Vinci virus? Because this sounds a whole lot like the plot of Hackers [1]. The greatest movie of all time, btw. [1] https://en.wikipedia.org/wiki/Hackers_(film) https://en.wikipedia.org/wiki/Hackers_(film)
- gabereiser 5y ago
  Give ‘em a cookie! Hack the planet!
- Sherl 5y ago
  More movie recommendations please
  - CoastalCoder 5y ago
    Not GP, but: - The Godfather - Chariots of Fire - Dr. Strangelove - Das Boot (original German version) - About Time - Who Framed Roger Rabbit? - Tron
  - LeoPanthera 5y ago
    If you like Hackers, the obvious other two are Sneakers, which is good, and The Net, which is not.
  - morsch 5y ago
    This one is probably not well known in the anglophone world: https://en.m.wikipedia.org/wiki/23_(film) https://en.m.wikipedia.org/wiki/23_(film) Based on a true story, though it's debated endlessly. Clifford Stoll's Cuckoo's egg deals with the same material.
- trentnix 5y ago
  I know you play the game!
- LeoPanthera 5y ago
  Wellll sort of. The "Da Vinci" virus claimed it was going to capsize oil tankers in order to cause an ecological disaster. Not just shut down a pipeline.
CallMeMarc 5y ago
On the good side, someday we’ll probably get an episode of Darknet Diaries on this one.
- JohnJamesRambo 5y ago
  You just brightened my day.
Merrill 5y ago
Why don't critical infrastructure networks use a different CRC-32 polynomial for their IP packets?
- champtar 5y ago
  Security through obscurity is not security
- detaro 5y ago
  How would that help in any way?
  - Merrill 5y ago
    Any IP packet that is valid on the Internet would be invalid and dropped on the critical infrastructure network. The only packets that could pass between the Internet and the critical infrastructure network would be those that are intentionally bridged by rewriting the CRC-32. This should not be done at the IP level, but only by application level bridges. It would prevent inadvertent connections between the Internet and the critical infrastructure network.
    - detaro 5y ago
      The usual problem are systems that are intentionally connected to both networks, and after compromise happily serve as points to enter the inner network.
      - Merrill 5y ago
        ‘Arm Waving’ Response to Hackers Makes Oil Industry Easy Prey Everyone from the facility managers to the private equity owners assumed that the plant’s computer network was “air-gapped” -- a term referring to computers that aren’t connected to the internet or another unsecured network. But when Mission Secure installed monitoring devices to check, they discovered that a worker on the night shift was connecting his Roku device to the internet to watch episodes of “CSI: Miami.” https://www.bloomberg.com/news/articles/2021-05-12/colonial-breach-exposes-cyber-weaknesses-in-oil-and-gas-industry https://www.bloomberg.com/news/articles/2021-05-12/colonial-... So stuff like this wouldn't happen.
dsyrk 5y ago
I’d be curious to know how much ransom is being asked. Before Bitcoin something this big was impossible to try and pull off.
- rasz 5y ago
  Before the bitcoin you would ask for release of prisoners. https://en.wikipedia.org/wiki/Lufthansa_Flight_615 https://en.wikipedia.org/wiki/Lufthansa_Flight_615 or get steady funding https://en.wikipedia.org/wiki/Carlos_the_Jackal https://en.wikipedia.org/wiki/Carlos_the_Jackal https://www.rferl.org/a/carlos_the_jackal_on_trial_for_1980s_bombings/24383237.html https://www.rferl.org/a/carlos_the_jackal_on_trial_for_1980s...
Griffinsauce 5y ago
It's hilarious to me that a country that invests so much in their military doesn't seem to invest in the security of their infrastructure at all. The entire war machine will grind to a halt without oil. It would be one of the first thing to attack.
- wait_a_minute 5y ago
  lol war machine? what war machine? there's proxy wars and internal civil conflicts happening abroad, and definitely shady profiteering in some places, and definitely refugee crisis many of which are caused by climate change actually...but what war machine are you talking about? there's no real war out there. if there was, most of us wouldn't be here posting anymore. I hope to God there's never actual war out there.
  - kevingadd 5y ago
    You'll find that many of the ongoing/recent conflicts listed on these pages involve bombs/rockets/aircraft/tanks, not to mention soldiers on the ground and in some cases occupation. https://en.wikipedia.org/wiki/Category:2020s_conflicts https://en.wikipedia.org/wiki/Category:2020s_conflicts Remember when Russia invaded and seized part of Ukraine a few years ago? https://en.wikipedia.org/wiki/Annexation_of_Crimea_by_the_Russian_Federation https://en.wikipedia.org/wiki/Annexation_of_Crimea_by_the_Ru...
  - Griffinsauce 5y ago
    There's lots of actual war. Not all wars are world wars. Edit: it's also not the point of my post. The US invests in its military partially under the pretense of existential threats (basically, commies invading the mainland). That is undermined by having an laughably easy to cripple defense.
mimikatz 5y ago
We need to have military responses to these attacks. Ransomware is running rampant because they don't fear any punishment for attacks. If people attacked our hospitals and pipelines with explosives we wouldn't sit by and do nothing.
- walrus01 5y ago
  Precisely ascribing the origins of a malware attack, with 100% confidence, to one specific nation state is a very hard problem to solve. The time/effort that it would take for one nation to launch an attack on a 2nd party, seeming to come from a third-party, or one of their own adversaries, is not very great. At least not with the 100% confidence that politicians would want before the US military starts dropping JDAMs on buildings. I would give fairly even odds that something like this is the work of an organization nation state, and also even odds that it's the work of some underemployed teenagers in a basement.
- detaro 5y ago
  To take the last high-profile ransomware gang stopped, if we ignore for a moment that the US didn't find them, you think sending US special forces into Ukraine to arrest or kill some unarmed dudes in a basement would have aided US interests more than just having local law enforcement arrest them? Does this policy of deploying troops expand to gangs in NATO member states and other close allies?
- boomboomsubban 5y ago
  >If people attacked our hospitals and pipelines with explosives we wouldn't sit by and do nothing. You are proposing that we attack them with explosives, are you fine with them retaliating in kind? What if you lived next to some hackers targeting a foreign country, would you think it's acceptable to get blown up for their actions?
wait_a_minute 5y ago
hmmm...might be time for me to develop a side-expertise in cybersecurity...always kinda scoffed at those electives before, but now I see that there are literal lives at stake if our nation doesn't have excellent talent working in fields like cybersecurity for national defense.
flakiness 5y ago
After reading "This Is How They Tell Me the World Ends" [1], I feel the world working normally is rather a sheer luck. (Probably I'm very late to realize this, but anyway ) To me the only reasonable survival strategy is redundancy, but I have no idea how we can reach there. [1] https://www.amazon.com/This-They-Tell-World-Ends/dp/1635576059 https://www.amazon.com/This-They-Tell-World-Ends/dp/16355760...
croes 5y ago
Seems like this company has more than just IT problems https://newrepublic.com/article/161498/huntersville-north-carolina-colonial-pipeline-spill https://newrepublic.com/article/161498/huntersville-north-ca...

258 points by opaque 5y ago

post_break 5y ago

Yikes, get ready for a huge jump in oil pricing.

leppr 5y ago
Oh, what a surprise, another unexpected event pumping oil prices.
- beckingz 5y ago
  There's no need to use crude jokes here. It's a gasoline pipeline, so more refined jokes are appropriate.
  - ruined 5y ago
    musk lithium coup
Armisael16 5y ago
Why would oil prices jump? This isn’t an oil pipeline.
- post_break 5y ago
  Because there was already a glut, now the places that feed this pipeline have to be backed up. Just because it’s gasoline doesn’t mean it’s not a link in the whole chain.
- dylan604 5y ago
  Because they can and do use any excuse to bump the prices.
- stunt 5y ago
  Because unlike their network gateways, their pricing change is unidirectional.
jumelles 5y ago
> Colonial’s pipeline transports 2.5 million barrels each day, taking refined gasoline, diesel fuel and jet fuel from the Gulf Coast up to New York Harbor and New York’s major airports. Most of that goes into major storage tanks, and with energy use depressed by the pandemic, the attack was unlikely to cause any immediate disruptions. https://www.nytimes.com/2021/05/08/us/cyberattack-colonial-pipeline.html https://www.nytimes.com/2021/05/08/us/cyberattack-colonial-p...

deleted 5y ago

[deleted]

motohagiography 5y ago

Let's see if 15+ years of security people getting after critical infrastructure asset owners like this has made any difference. At least they detected something and shut it down to control the response. They also know the costs to repair and replace things. I don't suspect the pipeline uses a federation of heterogeneous systems to operate its SCADA actuators, so I would speculate it is likely a single firmware vulnerability facilitating it. The global chip shortage for replacement parts if they are needed seems like a strategic coincidence. Definitely an evolving story.

procarch2019 5y ago
I work in control systems OT space. A lot of distributed control systems and scada systems interface with the business layer in some fashion to provide access to time series and event data and to allow for alerts via email/mobile. Some people do this properly with good network segmentation, firewalls, A/V and patching, etc (there are several standards that dictate best practice). That said, even when doing it properly you're introducing attack vectors. I don't think it would be a firmware vulnerability, but instead something malicious affecting the computers they use to control the process.
- motohagiography 5y ago
  The reason I'm going for firmware is while the HMIs could have had a solarwinds style exposure, but that's just any generically wormable OS vulnerability, and not something that should cause a physical shutdown. To shutdown a pipeline, it's not a management console issue, hence why I'd speculate it's in the ICS devices themselves, which probably use uClinux toolchains on SoCs from one or two large vendors. I did some smart meter and ICS security work in the 00's, and there were a few vendors who would be strategic targets. The attack tools available now are unbelievably better, while the attack surface is pretty much the same due to the long lifecycles of ICS components, and considering today we've got cheap SDRs and gnuradio blocks for most wireless protocols, AVR tools, buspirate and the good/greatfet, ghidra/ida, and python for reverse engineering, the vulnerability research on this stuff moves way faster than the industry ability to respond. If this is a serious attack, the only way to respond will be if they are very lucky, it's a worm and they can stand up a honeynet with spare gear to catch a sample and any good infosec firm can pull it apart. But if it's an active APT group, there's probably a political solution, as given what's possible, this would seem to be just a shot over the bow.

ruined 5y ago

nice

ArkanExplorer 5y ago

Given Government inaction on climate change, could we begin to see motivated individuals or groups taking matters into their own hands and targeting fossil fuel infrastructure in this manner?

aardvarkr 5y ago
That would be domestic terrorism and is an easy way to turn the entire population against the cause
- adrianmonk 5y ago
  It could do more harm than good, but it remains possible that someone will do it anyway. It's a legitimate scenario for these types of companies to consider in their cyber-security planning and preparation (assuming they have any).
  - pm90 5y ago
    Domestic attacks would be somewhat more difficult to carry out without being detected. It’s much easier for the Government to track domestic actors since there’s so much data collected on them both Nationally and by local law enforcement. That’s why international attacks are more prevalent and bold: they’re not as easily traceable. However, that also comes with its downsides: if the USG wants, it might just use lethal force against you. So ultimately the people who tend to do this repeatedly end up being state owned or state protected actors, who are likely offered some sort of protection by their State from retribution by the USG.
    - zero_deg_kevin 5y ago
      1/6 looked pretty easy. It also looked like it was pretty easy to catch the most gods-awfully expensive intelligence agencies in the world completely flat-footed.
- ArkanExplorer 5y ago
  With a bus load of activists you could probably shut down a coal mine or coal power plant. Just repeat the interruptions until the location is closed. Environmentalists used to chain themselves to trees. Would the same physical actions work for climate change? Its difficult to see the public being opposed to this when coal infrastructure is on the edge of irrelevancy anyway and easily replaced.

rossdavidh 5y ago

So, two possible responses by the government to the current increase in these kinds of attacks: 1) blame the lack of computer security in our infrastructure, and work on improving that 2) blame cybercurrencies, and try to eliminate them Any bets on which one our government will choose?

waihtis 5y ago
Didn’t see anything about ransomware in the article?
aardvarkr 5y ago
That a pretty low effort dig at the government. What the hell does that have to do with something that is obviously state sponsored cyber espionage? Go troll somewhere else
- kingsuper20 5y ago
  'obviously'? Meh. One argument you can make is to partly defund the surveillance-based departments and agencies and put together a cybersecurity agency who is tasked with hardening the country's systems. I have no idea how someone would build a legislative and personnel firewall to protect it from the existing need to peep through keyholes, it's probably not possible.
deleted 5y ago
[deleted]
wolverine876 5y ago
That's quite a strawperson - it creates a fictional story and then criticize the characters. The U.S. government has been addressing computer security in infrastructure for a long time.
- joejerryronnie 5y ago
  I’d prefer a new Cybersecurity branch of the military with full funding and resources rather than Space Force.

neonate 5y ago

https://archive.md/kEziH https://archive.md/kEziH

Xunxi 5y ago

It's only a matter of time, there's gonna be physical casualties at some point in time. We've all seen it in the movies. Experts have warned of the dangers of tethering vital utilities controls to the internet. Is it not possible to develop protocol or device that operates outside of the web but functions like the'two-man' rule used to launch nuclear bombs?

shagie 5y ago
One such example... a test done at the Idaho National Lab https://www.wired.com/story/how-30-lines-of-code-blew-up-27-ton-generator/ https://www.wired.com/story/how-30-lines-of-code-blew-up-27-... That lab tends to specialize in cybersecurity and infrastructure. https://www.wired.com/2011/10/idaho-national-laboratory/ https://www.wired.com/2011/10/idaho-national-laboratory/ The critical infrastructure part of the lab: https://inl.gov/critical-infrastructure-protection/ https://inl.gov/critical-infrastructure-protection/
extropy 5y ago
It's like 100x more expensive. Would be nice to have separate data lines, running fiber optics sealed in pressurized conduits for double tamper detection. The military actually does this for their critical infra.
- mschuster91 5y ago
  > Would be nice to have separate data lines, running fiber optics sealed in pressurized conduits for double tamper detection. At least German Telekom has been doing this for ages for the trunk cables serving entire areas with analog phone service - although not for tamper detection as an anti-spionage measure, but rather to detect and pinpoint damage to the cables, e.g. from excavators, tree growth or splice seals degrading.
  - oasisbob 5y ago
    Pressurizing conduits also helps prevent water ingress.
5y ago

t3rabytes 5y ago

A few years back we had two different instances of this pipeline getting shut down from newly-found leaks. While they say it won’t cause gas shortages, these articles tend to drive people to the pumps in droves in the southeastern states served by it (like mine, NC!).

v8dev123 5y ago

All these attacks usually caused by two things, office macros and mimikatz.

rurban 5y ago
Easier: Microsoft Windows
- trompetenaccoun 5y ago
  The government needs to finally ban Windows. In addition to being insecure it's used by many criminals for their scams and blackmail operations.
- v8dev123 5y ago
  I re-call the Russians did a full featured malware for macOS called Proton. You may find videos of that in Youtube. Of course, Macros works in macOS too if the user has installed Microsoft Office

Pfhreak 5y ago

I'm surprised we don't see more attacks on pipelines - both digital and physical. There are many folks out there who take issue with them or see them as a vulnerable part of our infrastructure.

kaliali 5y ago

In case it hasn't crossed your mind yet Its the chinese

ackbar03 5y ago
What, blaming Russia doesn't bring the same satisfaction anymore?
guilhas 5y ago
Yes this attack ip was traced to a Chinese wet market The attacker nickname? The bat Working together with Xl and Kim Jong-un in a Wuhan cyber facility

koheripbal 5y ago

Washington Post reported it was a ransomware attack. It may not have been a targeted attack.

tedk-42 5y ago
20 odd posts and yours is the only sensible one. It's certainly a security incident but until we know more it's hard to say the infrastructure was specifically targetted for an 'attack'
nabilhat 5y ago
The WaPo article itself is much more detailed. The bits about the age and fragility of Colonial's pipelines are far more significant than ransomware. Colonial's continued neglect is more disruptive than any single attack on the pipeline. The persistence of unreliable infrastructure is a more valuable disruptive asset to an organized opponent than a single targeted attack. Tangent - Also interesting, the WaPo article [0] bears little resemblance to itself from only hours ago [1]. The article has grown by about 50%, while contents have come and gone. That's my favorite application for archive dot is - Seeing the timelapse of iterative releases, watching journalism bend and sway in the current of its own response. I'm not making any judgements, the internet is already sloshing with useless hot takes about journalism and media. It's just fascinating to see the modern editorial process at work, out in the open. [0] https://www.washingtonpost.com/business/2021/05/08/cyber-attack-colonial-pipeline/ https://www.washingtonpost.com/business/2021/05/08/cyber-att... [1] https://archive.is/vlNs2 https://archive.is/vlNs2
- throwawayboise 5y ago
  Relates to the Kent Beck "Latency vs Througput" post[1] on here right now... do you post the story immediately, and start getting feedback, or do you wait and do research and get it (more) right before posting it? [1] https://news.ycombinator.com/item?id=27088272 https://news.ycombinator.com/item?id=27088272

protomyth 5y ago

Perhaps we should pass a law that no utilities / infrastructure should be attached to the internet. Private networks are fine for this purpose.

procarch2019 5y ago
I think the issue there is data, even on critical infra. Modernization, reliability and the such require data analysis. There are definitely ‘strong’ ways of protecting the assets and mitigating attack vectors, but almost no way to eliminate them entirely. For example, event if you isolate the process computers you’ll typically have an interface node that presents the data up a level (hopefully to a DMZ). Obviously you can be compromised if that interface node is. Some critical infra is air gapped though. Other systems implement SIS systems in parallel with general process systems to mitigate catastrophic failure further.
- protomyth 5y ago
  They can gather the data on the infrastructure network and then carry across an air gap on a USB or tape to do their analysis. I don't see the upside of allowing any connectivity to the internet given the danger other than some mechanism for sending an alert. I'm sure creative people can air gap that too (camera on the internet side and some image recognition for example).
  - procarch2019 5y ago
    That's massively inconvenient, although I'm sure necessary in some cases. Some businesses actually perform analysis in 'real time' so they can adjust the process accordingly, witch requires that data be accessible. This may actually be such a case as I'm sure they have to interface with customers (tank farms) to react to supply/demand on the branches. For all I know Colonial does have a private network for that purpose though. Usually PAT is really for chemical processes where you are looking for a particular yield and those analytical services are located closer to the process (in terms of networks). There are devices called data diodes that provide unidirectional network topology, but not all time series data interfaces can work with them. All in all, I agree that total air gap is obviously the best way to mitigate network attack vectors, but sometimes not practical. No controlling device should be at level 3 or 4 though (business or enterprise level).

jtchang 5y ago

In a twisted sort of way I am happy to see these types of ransomware attacks making headlines. Before it was much harder to quantify how much a breach might cost but with ransomeware you get a fuzzy lower bound. Also the prevalence of these attacks might actually make us all safer in the long run.

enkid 5y ago
Absolutely, it's better to have a ransomware attack against the workstations instead of a more developed attack that blew the pipeline up.
- runeks 5y ago
  This is interesting. Ransomware authors may be protecting their targets against destructive attacks since this would reduce their profits. In the same way that botnets attempt to protect their host from being infected by competing malware.
dehrmann 5y ago
This one in particular is good because, it's public, it's not that scary, but it's easy to make the jump to scary attacks.
- deleted 5y ago
  [deleted]
bourgwaletariat 5y ago
I think I understand your POV and can see why one might find some peace in it, but I don't. More crime, or I suppose mroe news about it, so we know how much crime costs? More attacks make us safer? It's a means justify the ends argument, but it doesn't hold water. It's eerily similar to "burn it all down" https://en.wikipedia.org/wiki/Accelerationism https://en.wikipedia.org/wiki/Accelerationism, which, itself is on the rise and burning from both ends. I infer your point to be that more attacks might cause the victims to step up their defenses. It's a cat and mouse game. Always has been in all realms. "It'll get worse before it gets better." I've been hearing that for decades. I'm starting to wonder, due to what appears to be a decline in civility. Following the rules only works if we all do. Those who eschew the rules have an obvious advantage. Where has integrity gone? We are tearing ourselves apart and justifying it ... or coming to terms with it I suppose, by saying it'll be better some day. Well... when... exactly? By what measure will we know? I know Stephen Pinker, Hans Rosling, and various folks say it's the best time to be a human. Okay. Sure. I see the math. I'd like to see them update their charts for data out over the past year. But ... anecdotally, none of that math seems to percolate down to my community. The people around me are in constant fear. I just saw a woman walking down the road, all by herself, I had clear vision for a mile and so no one else but her... and she was wearing a mask. She was afraid. She was anxious. Regardless of the relative safety that exists today, or the belief that it'll be safer tomorrow because of the lack of said safety, the people around me aren't feeling it. They're buying guns because red people are coming for them... or the blue people already are. Or the government will. There is literally no milk at the store because of an HDPE shortage prompting the grocer to put a Force Majeur notice on the dairy fridge door. Trust has broken down. Fear of our own neighbors is up. Crime is up. Poverty is up. Suicide is up. Cyber crime is up. Inflation is up. The Gini coefficient is up. I really have trouble believing that making it worse real fast, or even reporting more of it, is going to make it better. I don't see it.

mikewarot 5y ago

Connecting infrastructure to the internet is something that is done for many reasons. It would be a vast improvement of security if most of those connections went through a data diode[1] and only allowed monitoring. Knowing what is happening now with critical infrastructure, through the internet, can be done in a completely safe manner. It is a solved problem. [1] - https://en.wikipedia.org/wiki/Unidirectional_network https://en.wikipedia.org/wiki/Unidirectional_network

deleted 5y ago
[deleted]
jeffbee 5y ago
What would be the difference between having a data diode between your control and monitoring network and external monitoring systems, versus just splitting the monitoring part off into a completely separate network with ordinary two-way traffic?
- stunt 5y ago
  What you explained doesn't solve the problem. You still want to have an unidirectional network in place at least between your critical infrastructure to the monitoring systems. Monitoring systems are usually separate and often have their dedicated network too, but they still need some sort of network connection to your critical infrastructure to do their job (monitoring).
  - mikewarot 5y ago
    If you put a data diode between your infrastructure and the internet, you can see the status from anywhere, yet never compromise it from the outside.
    - stunt 5y ago
      Yes, I think we are on the same page. I was trying to explain that having a separate monitoring infra and network group wouldn't work as a replacement for unidirectional network setup, because you sill need to open network access between critical infra and the monitoring system in your design, which will expose it to the internet. So like you said, you still need to have an unidirectional network in place.

dang 5y ago

Url changed from https://www.bloomberg.com/news/articles/2021-05-08/u-s-s-biggest-gasoline-and-pipeline-halted-after-cyberattack https://www.bloomberg.com/news/articles/2021-05-08/u-s-s-big..., which points to this.

deleted 5y ago

[deleted]

bourgwaletariat 5y ago

I wonder if this has anything to do with the Colonial gas pipeline leak? It's been a problem for over 8 months now. Was in the news recently again. Over a million gallons spilled, but they don't really know how much. https://www.msn.com/en-us/news/us/eight-months-later-colonial-pipeline-spill-continuing-to-impact-huntersville-residents/ar-BB1fPAL6 https://www.msn.com/en-us/news/us/eight-months-later-colonia...

Honey_Mustard 5y ago

"Eastern European-based criminal gang — DarkSide," They never say Western European criminal gang, they always brainwash people to think eastern europeans are criminals.

johnnymonster 5y ago

Hashtag stop posting paywall stories on HN

joe_the_user 5y ago

"This is as close as you can get to the jugular of infrastructure in the United States," said Amy Myers Jaffe, research professor and managing director of the Climate Policy Lab. "It's not a major pipeline. It's the pipeline." About that infrastructure security... this forum has gone over in detail the situation of infrastructure security in quite a bit of detail as other stuff has happened. It's easy to say "you need to isolate your critical network from your office network" but that costs dollars and time and letting things fall to shit is free 'till the time comes and then other people the price rather than you. The privately held, Georgia-based company is owned by CDPQ Colonial Partners L.P., IFM (US) Colonial Pipeline 2 LLC, KKR-Keats Pipeline Investors L.P., Koch Capital Investments Company LLC and Shell Midstream Operating LLC. All the best names of neoliberalism!

Spooky23 5y ago
Companies like this are tax dodges that socialize risk. The limited partners enjoy fat returns with minimal downside.
- perl4ever 5y ago
  I'm not sure about these, but there are public limited partnerships that anyone can buy like a stock. If you don't realize what you are getting into, you may regret it because you will get a K-1 at tax time. I don't know if it's any more of a tax dodge than an REIT.
  - Spooky23 5y ago
    These structures characterize cash flows as return on capital, which defer taxation. There’s a bunch of games played.
    - perl4ever 5y ago
      I didn't think it deferred taxation; just the opposite. That's what I was referring to about the K-1; you pay taxes on the income of the partnership even if you didn't sell any shares.

tidydata 5y ago

There’s nothing in this article indicating the operator has a recovery plan in place involving restoring backups to get these systems online. Seems grossly negligent on their behalf, and made almost satiric by the fact that Fireye can be mentioned without reference to their own massive security lapses. Too much focus always on the “hackers” and never the obvious security lapses solved by diverting executive pay to more bodies and training to cover them, but oh well right?

thisisnico 5y ago
IT is typically grossly understaffed and underfunded in these businesses. At the site-level, you'll see some very out of date tech running critical systems. IT is a cost-center to be reduced as much as possible, oversight is non-existent.
- crmd 5y ago
  You always know you’re dealing with one of these companies when IT reports up into the CFO.
  - adolph 5y ago
    Could be worse, I saw IT reporting through HR once upon a time.
    - crmd 5y ago
      Horrible
  - Bukhmanizer 5y ago
    I used to work at a scientific research institute where the entire IT department reported to a single researcher for no apparent reason.
deleted 5y ago
[deleted]
5y ago

nfoz 5y ago

I hope this ransomware called itself the Da Vinci virus? Because this sounds a whole lot like the plot of Hackers [1]. The greatest movie of all time, btw. [1] https://en.wikipedia.org/wiki/Hackers_(film) https://en.wikipedia.org/wiki/Hackers_(film)

gabereiser 5y ago
Give ‘em a cookie! Hack the planet!
Sherl 5y ago
More movie recommendations please
- CoastalCoder 5y ago
  Not GP, but: - The Godfather - Chariots of Fire - Dr. Strangelove - Das Boot (original German version) - About Time - Who Framed Roger Rabbit? - Tron
- LeoPanthera 5y ago
  If you like Hackers, the obvious other two are Sneakers, which is good, and The Net, which is not.
- morsch 5y ago
  This one is probably not well known in the anglophone world: https://en.m.wikipedia.org/wiki/23_(film) https://en.m.wikipedia.org/wiki/23_(film) Based on a true story, though it's debated endlessly. Clifford Stoll's Cuckoo's egg deals with the same material.
trentnix 5y ago
I know you play the game!
LeoPanthera 5y ago
Wellll sort of. The "Da Vinci" virus claimed it was going to capsize oil tankers in order to cause an ecological disaster. Not just shut down a pipeline.

CallMeMarc 5y ago

On the good side, someday we’ll probably get an episode of Darknet Diaries on this one.

JohnJamesRambo 5y ago
You just brightened my day.

Merrill 5y ago

Why don't critical infrastructure networks use a different CRC-32 polynomial for their IP packets?

champtar 5y ago
Security through obscurity is not security
detaro 5y ago
How would that help in any way?
- Merrill 5y ago
  Any IP packet that is valid on the Internet would be invalid and dropped on the critical infrastructure network. The only packets that could pass between the Internet and the critical infrastructure network would be those that are intentionally bridged by rewriting the CRC-32. This should not be done at the IP level, but only by application level bridges. It would prevent inadvertent connections between the Internet and the critical infrastructure network.
  - detaro 5y ago
    The usual problem are systems that are intentionally connected to both networks, and after compromise happily serve as points to enter the inner network.
    - Merrill 5y ago
      ‘Arm Waving’ Response to Hackers Makes Oil Industry Easy Prey Everyone from the facility managers to the private equity owners assumed that the plant’s computer network was “air-gapped” -- a term referring to computers that aren’t connected to the internet or another unsecured network. But when Mission Secure installed monitoring devices to check, they discovered that a worker on the night shift was connecting his Roku device to the internet to watch episodes of “CSI: Miami.” https://www.bloomberg.com/news/articles/2021-05-12/colonial-breach-exposes-cyber-weaknesses-in-oil-and-gas-industry https://www.bloomberg.com/news/articles/2021-05-12/colonial-... So stuff like this wouldn't happen.

dsyrk 5y ago

I’d be curious to know how much ransom is being asked. Before Bitcoin something this big was impossible to try and pull off.

rasz 5y ago
Before the bitcoin you would ask for release of prisoners. https://en.wikipedia.org/wiki/Lufthansa_Flight_615 https://en.wikipedia.org/wiki/Lufthansa_Flight_615 or get steady funding https://en.wikipedia.org/wiki/Carlos_the_Jackal https://en.wikipedia.org/wiki/Carlos_the_Jackal https://www.rferl.org/a/carlos_the_jackal_on_trial_for_1980s_bombings/24383237.html https://www.rferl.org/a/carlos_the_jackal_on_trial_for_1980s...

Griffinsauce 5y ago

It's hilarious to me that a country that invests so much in their military doesn't seem to invest in the security of their infrastructure at all. The entire war machine will grind to a halt without oil. It would be one of the first thing to attack.

wait_a_minute 5y ago
lol war machine? what war machine? there's proxy wars and internal civil conflicts happening abroad, and definitely shady profiteering in some places, and definitely refugee crisis many of which are caused by climate change actually...but what war machine are you talking about? there's no real war out there. if there was, most of us wouldn't be here posting anymore. I hope to God there's never actual war out there.
- kevingadd 5y ago
  You'll find that many of the ongoing/recent conflicts listed on these pages involve bombs/rockets/aircraft/tanks, not to mention soldiers on the ground and in some cases occupation. https://en.wikipedia.org/wiki/Category:2020s_conflicts https://en.wikipedia.org/wiki/Category:2020s_conflicts Remember when Russia invaded and seized part of Ukraine a few years ago? https://en.wikipedia.org/wiki/Annexation_of_Crimea_by_the_Russian_Federation https://en.wikipedia.org/wiki/Annexation_of_Crimea_by_the_Ru...
- Griffinsauce 5y ago
  There's lots of actual war. Not all wars are world wars. Edit: it's also not the point of my post. The US invests in its military partially under the pretense of existential threats (basically, commies invading the mainland). That is undermined by having an laughably easy to cripple defense.

mimikatz 5y ago

We need to have military responses to these attacks. Ransomware is running rampant because they don't fear any punishment for attacks. If people attacked our hospitals and pipelines with explosives we wouldn't sit by and do nothing.

walrus01 5y ago
Precisely ascribing the origins of a malware attack, with 100% confidence, to one specific nation state is a very hard problem to solve. The time/effort that it would take for one nation to launch an attack on a 2nd party, seeming to come from a third-party, or one of their own adversaries, is not very great. At least not with the 100% confidence that politicians would want before the US military starts dropping JDAMs on buildings. I would give fairly even odds that something like this is the work of an organization nation state, and also even odds that it's the work of some underemployed teenagers in a basement.
detaro 5y ago
To take the last high-profile ransomware gang stopped, if we ignore for a moment that the US didn't find them, you think sending US special forces into Ukraine to arrest or kill some unarmed dudes in a basement would have aided US interests more than just having local law enforcement arrest them? Does this policy of deploying troops expand to gangs in NATO member states and other close allies?
boomboomsubban 5y ago
>If people attacked our hospitals and pipelines with explosives we wouldn't sit by and do nothing. You are proposing that we attack them with explosives, are you fine with them retaliating in kind? What if you lived next to some hackers targeting a foreign country, would you think it's acceptable to get blown up for their actions?

wait_a_minute 5y ago

hmmm...might be time for me to develop a side-expertise in cybersecurity...always kinda scoffed at those electives before, but now I see that there are literal lives at stake if our nation doesn't have excellent talent working in fields like cybersecurity for national defense.

flakiness 5y ago

After reading "This Is How They Tell Me the World Ends" [1], I feel the world working normally is rather a sheer luck. (Probably I'm very late to realize this, but anyway ) To me the only reasonable survival strategy is redundancy, but I have no idea how we can reach there. [1] https://www.amazon.com/This-They-Tell-World-Ends/dp/1635576059 https://www.amazon.com/This-They-Tell-World-Ends/dp/16355760...

croes 5y ago

Seems like this company has more than just IT problems https://newrepublic.com/article/161498/huntersville-north-carolina-colonial-pipeline-spill https://newrepublic.com/article/161498/huntersville-north-ca...