6 ms·

So, a very limited state of emergency which allows fuel that is ordinarily piped to be transported by truck. Ancillarily, It's not evident this cyberattack act

So, a very limited state of emergency which allows fuel that is ordinarily piped to be transported by truck. Ancillarily, It's not evident this cyberattack actually compromised the industrial controls, but rather trashed the administrative system controlling the controls.

bradstewart 5y ago
It's interesting to consider the human link between the admin systems and industrial control systems here. If we assume the controls are on an airgapped network, the attackers, in some sense, jumped the airgap and shutdown the pipeline. Obviously not as bad as an actual compromise of the control systems though, which presumably could cause leaks, explosions, etc.
- rckoepke 5y ago
  Generally the controls are firewalled from the administrative/business systems, not air-gapped. Production data (like gallons per minute of flow through the pipeline) must be sent from the controls to the business analytics software. That's generally done through a firewall over TCP/IP.
  - DrPhish 5y ago
    Often that kind of reporting data is delivered back via a “data diode” unidirectional network. That said, there is usually just a dmz between biz and prod to enable remote support of the controls system (ala the Purdue model), and not any real air gap.
  - mysterydip 5y ago
    I've seen systems where data is sent via UDP and the physical connection was transmit-only (for example, only the transmit fiber plugged in to the port) to avoid potential firewall exploitation.
  - daniellarusso 5y ago
    …and the controls still have internet access, but it is NAT’ed, and it still has a fresh copy of Internet Explorer 9. I have only witnessed this once, at a wastewater treatment plant, so very anecdotal.
- frombody 5y ago
  I've worked on these systems, they are separate. They likely could have kept running the pipeline without incident. I imagine when the government stepped in they decided to dial their procedures up to 10 and they plan on making an example out of this incident and the perpetrators.
pm90 5y ago
> James Chappell, co-founder and chief innovation officer at Digital Shadows, believes DarkSide bought account login details relating to remote desktop software like TeamViewer and Microsoft Remote Desktop. Once they get in to the internal network, they could possibly have access to anything. Most organizations don't follow good practices for internal services and there's all kinds of unauthenticated crap that's accessible to anyone who knows where to look. If its really a ransomware attack, they could have taken over some internal system, or maybe just locked out remote access. We will need to know more, but at first glance it doesn't look very good.
jb775 5y ago
> It means drivers in 18 states can work extra or more flexible hours when transporting gasoline, diesel, jet fuel and other refined petroleum products. This means truck drivers hauling 45,500+ lbs of an extremely flammable liquid aren't required to sleep. I worked in the supply chain industry for a few years, dropping these restrictions is unheard of. My instinct tells me this issue is a lot worse than it seems now.
- waihtis 5y ago
  Could be that, or the heightened sensitivity to all issues cyber we’re experiencing right now
- Cthulhu_ 5y ago
  Armchair take: The pipelines handle a lot of fuel, and the US needs / uses a lot of fuel; to move the same amount, you need a lot of trucks. And if that need is not met, the economy etc will be disrupted heavily, price of fuel will go up, and the price of fuel going up has caused massive issues in the past.
  - BoorishBears 5y ago
    Last time I checked the amount of sleep I need doesn't go down when an oil pipeline stops flowing. It's offloading the risk to drivers to benefit these companies first and foremost, which is ridiculous. The cherry on top is the article pointing out even with the extra hours they won't be anywhere near meeting demand...
- dmix 5y ago
  Don't trucks transport fuel like this all the time? Or maybe it's the quantity.
  - vladvasiliu 5y ago
    They do, but to me GP's issue is with relaxing the requirements for rest. IE, the issue isn't that drivers transport fuel, but that possibly tired drivers do so.

bradstewart 5y ago

It's interesting to consider the human link between the admin systems and industrial control systems here. If we assume the controls are on an airgapped network, the attackers, in some sense, jumped the airgap and shutdown the pipeline. Obviously not as bad as an actual compromise of the control systems though, which presumably could cause leaks, explosions, etc.

rckoepke 5y ago
Generally the controls are firewalled from the administrative/business systems, not air-gapped. Production data (like gallons per minute of flow through the pipeline) must be sent from the controls to the business analytics software. That's generally done through a firewall over TCP/IP.
- DrPhish 5y ago
  Often that kind of reporting data is delivered back via a “data diode” unidirectional network. That said, there is usually just a dmz between biz and prod to enable remote support of the controls system (ala the Purdue model), and not any real air gap.
- mysterydip 5y ago
  I've seen systems where data is sent via UDP and the physical connection was transmit-only (for example, only the transmit fiber plugged in to the port) to avoid potential firewall exploitation.
- daniellarusso 5y ago
  …and the controls still have internet access, but it is NAT’ed, and it still has a fresh copy of Internet Explorer 9. I have only witnessed this once, at a wastewater treatment plant, so very anecdotal.
frombody 5y ago
I've worked on these systems, they are separate. They likely could have kept running the pipeline without incident. I imagine when the government stepped in they decided to dial their procedures up to 10 and they plan on making an example out of this incident and the perpetrators.

pm90 5y ago

> James Chappell, co-founder and chief innovation officer at Digital Shadows, believes DarkSide bought account login details relating to remote desktop software like TeamViewer and Microsoft Remote Desktop. Once they get in to the internal network, they could possibly have access to anything. Most organizations don't follow good practices for internal services and there's all kinds of unauthenticated crap that's accessible to anyone who knows where to look. If its really a ransomware attack, they could have taken over some internal system, or maybe just locked out remote access. We will need to know more, but at first glance it doesn't look very good.

jb775 5y ago

> It means drivers in 18 states can work extra or more flexible hours when transporting gasoline, diesel, jet fuel and other refined petroleum products. This means truck drivers hauling 45,500+ lbs of an extremely flammable liquid aren't required to sleep. I worked in the supply chain industry for a few years, dropping these restrictions is unheard of. My instinct tells me this issue is a lot worse than it seems now.

waihtis 5y ago
Could be that, or the heightened sensitivity to all issues cyber we’re experiencing right now
Cthulhu_ 5y ago
Armchair take: The pipelines handle a lot of fuel, and the US needs / uses a lot of fuel; to move the same amount, you need a lot of trucks. And if that need is not met, the economy etc will be disrupted heavily, price of fuel will go up, and the price of fuel going up has caused massive issues in the past.
- BoorishBears 5y ago
  Last time I checked the amount of sleep I need doesn't go down when an oil pipeline stops flowing. It's offloading the risk to drivers to benefit these companies first and foremost, which is ridiculous. The cherry on top is the article pointing out even with the extra hours they won't be anywhere near meeting demand...
dmix 5y ago
Don't trucks transport fuel like this all the time? Or maybe it's the quantity.
- vladvasiliu 5y ago
  They do, but to me GP's issue is with relaxing the requirements for rest. IE, the issue isn't that drivers transport fuel, but that possibly tired drivers do so.