24 ms·
Colonial Pipeline Paid Hackers Nearly $5M in Ransom
- notsureaboutpg 5y agoI had a feeling this was the case and even had a discussion with some colleagues about whether they paid up or not. Like the article says, they couldn't afford not to.
- ed25519FUUU 5y ago“That if once you have paid him the Dane-geld, You never get rid of the Dane.” It’s going to be a tough few years being in security in the industrial control field for the next few years. https://www.poetryloverspage.com/poets/kipling/dane_geld.html https://www.poetryloverspage.com/poets/kipling/dane_geld.htm...
- mikewarot 5y agoI was thinking that now is a good time to go INTO computer security, you now have a solid example to use justifying your actions. In the past we worried about exfiltration of data, now we'll be worried about infiltration of control.
- ed25519FUUU 5y agoGood point. If only they paid software engineers who work on critical infrastructure the same as they paid software engineers who work on ads.
- splithalf 5y agoEvery corporation in the US should be lobbying to abolish Bitcoin. It’s an existential threat that could be eliminated if they pooled their financial and political resources.
- maccam912 5y agoMaybe we should abolish the USD so US patent trolls can't be paid?
- drcode 5y agoIsn't it better that these networks are getting hardened in exchange for a small cryptocurrency payment, instead of waiting for all the exploits to be used by an adversary in World War Three?
- 55555 5y agoidk, considering humans are the weakest link and socially engineering them is easy, I don't think they're going to end up much safer. A determined nation state will always be able to get in, at least with how computers currently work.
- splithalf 5y agoI’ve thought about this. No.
- megablast 5y agoHow are they getting hardened?? Magically??
- tommoor 5y agoBitcoin has nothing to do with this news? It seems like you have an unrelated axe to grind.
- bostonsre 5y agoNot sure if I agree with the sentiment or not, but I think he has a point that crypto currencies can make paying ransoms to international ransomware gangs much easier. Using the traditional banking system would have been extremely difficult and have a low chance of success for that gang. I could definitely see this reasoning being used as justification for anti crypto currency laws in the future.
- 5y ago
- purple_ferret 5y ago>The company paid the hefty ransom in untraceable cryptocurrency within hours after the attack in Monero? Wonder how they converted USD.
- TacticalCoder 5y agoI'm wondering too. Now in TFA I read: "The company paid the hefty ransom in difficult-to-trace cryptocurrency within hours after the attack..." I don't know why you got "untraceable" and I get "difficult to trace" when reading the article. Bitcoin ain't exactly difficult to trace. I wonder if Colonial took the "discount" of 30% and paid in Monero or if they paid in Bitcoin. Oh well it looks at least one company is going to give a bit more sh-t about its IT security ; ) And another thing: often these news are followed, a few weeks/months later by "How the hackers who got a $5m ransom from Colonial got caught". Waiting for that one...
- drcode 5y agoSo they paid a penetration-testing firm a consultancy fee to help harden their network.
- commandlinefan 5y agoWell, all we really know for sure is that they paid a penetration-testing firm a consultancy fee to identify where the network needs to be hardened. No guarantee they'll actually prioritize doing it.
- PaulDavisThe1st 5y agoNot even that. Well, all we really know for sure is that they paid a penetration-testing firm a consultancy fee to identify THAT the network needs to be hardened.
- _tk_ 5y agoCould you elaborate on where you see the hardening taking place? Colonial had a threat actor in their network and by paying the ransom, they supposedly left without doing any more damage. I don’t think they patched a lot of systems or hardened their servers.
- tolbish 5y agoThey "helped harden", as in they verified that the network needs hardening. /s
- coldcode 5y agoToo many companies prefer to skimp on security since it has no apparent payoff until it's too late. What I want to know are the circumstances of the hack; how did it work, what systems did it affect, what security were they lacking. Sadly these details are often ignored or hidden from view. Attacks of this kind should get a public report so that other companies can learn or at least be shamed into changing. It seems like it's more important to cover up your inadequacy and not help the next victim.
- swiley 5y agoWe need something like a fire diamond for software and data: some tuple like ((fails to)conform to spec/testing(and production) only (ie contains PII or is garbage data)/(permissive,restrictive,free) license/(un)safe library calls or language) or so. Some stuff is pretty subjective but so are the fire diamond numbers sometimes, plus we can pick objective boundaries (calls to gets cannot be safe for example.) I think it could probably work.
- edoceo 5y agoA Fire Diamond: https://en.m.wikipedia.org/wiki/NFPA_704 https://en.m.wikipedia.org/wiki/NFPA_704
- deleted 5y ago[deleted]
- ben509 5y agoPart of the problem is it's very hard to value security because, frankly, so much security is theatrics and snake oil. For instance, look at the consumer market, which is where an executive without security knowledge is coming from. All the big VPN vendors make security promises that are, frankly, false advertising. AV products are notorious for including warnings for viruses that pad their counts. That's not counting all the security applications that are malware. And if they talk to someone familiar with the industry side, they should hear some skepticism. All the static analyzers are full of flags for things that are there to drive up their numbers. There have been a few HN stories on junk CVEs that are filed so people can put them on their resume. I had to set up a WAF at work that proudly said it mitigated the OWASP top-ten (why the top ten? is #11 not important?) which include recommendations like logging that a WAF is plainly not doing. And then I tested its defense against SQL injection and it was trivial to bypass. And if a business that isn't a tech company hires contractors to fix security issues, most of the time, those guys will do a lot of check the box BS. It's fundamentally difficult, from a business operations perspective, for a company to do security because: 1. the horizon problem that you bring up 2. it's a cost-center 3. it's not their core expertise 4. if you even ask what secure looks like, you either get filibustered with long lists of best practices, or a lot of hand waving but strident proclamations.
- AbrahamParangi 5y agoPaying ransom should be illegal. Ransom funds illegal activities. Not indirectly, like buying coffee or poppyseed or whatever, but literally money that is directly reinvested in criminal activity- like ransomware.
- jsight 5y agoI feel the same way. It seems like the government wouldn't do it, but was practically encouraging the company to pay.
- colinmhayes 5y agoRansoms would still be paid. We just wouldn't know about it. I think it's better to allow companies to be transparent.
- teruakohatu 5y agoThe next group will want more than $5 million, and so on. If the lottery didnt allow advertising of big wins that were made, a lot less people would buy lottery tickets.
- ben509 5y agoNo, there's a hard upper limit on ransoms; the cost of recovery.
- nstj 5y agoWhat about when the cost of having the data exposed to the public is higher than that of recovery
- xphos 5y agoThat requires you to have that kind of data. The company could have be operating legally and not have compromising stuff. The ransomware team gains nothing if a company refuses to pay and has everything to lose by hacking. If there price is to high they are taking on a lot of risk for no reason. Hacks are smart people (I find breaking the law to be a bad decision but if one does it knowing the consequences and mitigations then they aren't dumb just unethical)
- deleted 5y ago[deleted]
- loveistheanswer 5y agoIt's better to have criminals who are only interested in a relatively small payout exposing to the general public how vulnerable critical infrastructure is than people who are interested in causing mass destruction.
- demadog 5y agoThey should have just called it a bug bounty and then everyone would be happy.
- deleted 5y ago[deleted]
- _tk_ 5y agoDisclaimer: I work as a CISO in a large corporation. The interesting bit in this article is not necessarily the sum of the ransom, but that Colonial decided to pay quasi-immediately. It seems as if the attackers had full control over their network. Another possibility: Colonial staff could not be sure that if they used their backups, everything would be encrypted immediately again - possibly the backup servers as well. My bet would be on scenario 1.
- gist 5y agoI am curious what your thoughts are on other commenters making as if it is possible to prevent these types of attacks by just taking security 'more seriously'. My guess is that you know that no matter how much is spent with a large entity and many employees it's near impossible to prevent this type of attack. People make mistakes people are easily fooled people don't follow what they are told to do and so on. I can't even begin to imagine the amount of people that could cause an issue in the size company you are a CISO at.
- Mountain_Skies 5y agoYou cannot completely eliminate risk but you certainly can reduce it and be prepared for what to do when one of those low probability risks ends up happening.
- nonameiguess 5y agoIt's certainly possible to achieve serious security but probably not practical for most private entities. I've spent most of my development career making software for the US intelligence community and their systems were definitely not going to get broken into by a ransomware gang. Security measures include multilevel air gapping plus heavily armed physical security, six foot thick concrete walls set back from the street by other concrete barriers, locating facilities on military installations, disabling USB ports on most devices, banning anything radio enabled from being anywhere near your workstations, jamming radio signals anyway, severely punishing, possibly executing, anyone caught working as an intentional insider threat, requiring multiple persons in the custody and approval chains to move any files from one network to another via write-once media like DVDs, having the transfer media itself in a separate locked cabinet in a separate locked room inside the actual classified vault serving as an office. Installing and running everything in a separately sandboxed staging environment even after it gets through all the walls and air gaps and DVDs and running it through some fairly extensive testing and analysis before putting it anywhere near a production system. Clearly, you can never make it literally impossible, but to my knowledge, nobody has ever managed to get malicious software onto a classified production system. Information leaks are, of course, another story.
- aazaa 5y ago> Once they received the payment, the hackers provided the operator with a decrypting tool to restore its disabled computer network. The tool was so slow that the company continued using its own backups to help restore the system, one of the people familiar with the company’s efforts said. I thought the protocol for these attacks was to send the decryption keys, not provide a "decrypting tool." If some kind of software was provided by the attackers, and Colonial installed it, this could be far from over. Also, if the company has backups, then why not use them instead? If they're incomplete, then that's the real problem.
- capableweb 5y agoProbably a reporter/reporting issue. No company that just have been hacked would run a binary received from the hackers in order to restore the systems, they cannot be that stupid. But then again, they did pay the ransom and also seemingly can't restore their systems from backups, so who knows how stupid they really are? More charitable reading is that the encryption key was sent over, and they started restoring with that but using standard OSS tooling.
- hangonhn 5y ago> More charitable reading is that the encryption key was sent over, and they started restoring with that but using standard OSS tooling. That would make a lot more sense but I also bet there's a non-zero chance that in a day some dumb media outlet will conflate those tools as "hacker tools" and the headline will be "Hacker tools used in Colonial pipeline hack available freely on Internet. News at 10."
- Red_Leaves_Flyy 5y agoThese inane arguments didn't kill GTA, or virtually anything else. How are they going to kill OSS that hasn't needed mainstream appeal and still doesn't? So, maybe some high school kids end up on the github pages and become 1337 hackers? Quite a stretch..
- stefan_ 5y ago
- AzzieElbab 5y agoAll that money and lawlessness that went into enabling security agencies must be crowned as the worst investment ever
- Mauricebranagh 5y agoThat has nothing to do with this the FBI presumably cannot enforce security on a company. Maybe for some industries they need to start mandating Security Clearances and background checks and no outsourcing of certain critical systems work.
- AzzieElbab 5y agoI am not familiar with any details of this hack that could point to employees or contractors. Also, I am not sure what exactly are the roles of FBI and NSA when it comes to protecting US infrastructure, can you clarify?
- Mauricebranagh 5y agoI am not a Natsec expert - and where does "employees or contractors. " come into this? I was suggesting that certain industries would have to be stricter in future in who they hire for sensitive roles.
- BigGreenTurtle 5y agoI believe a judge recently signed an order allowing the FBI to access and patch hacked exchange servers. https://www.nbcnews.com/tech/security/fbi-might-gone-ahead-fixed-microsoft-email-server-rcna680 https://www.nbcnews.com/tech/security/fbi-might-gone-ahead-f...
- Mountain_Skies 5y agoMany of those agencies seem more interested in making systems less secure so they can get in easily than in protecting systems from outsiders.
- koreanguy 5y agonobody hacked Colonial Pipeline, its a insider trading racket. which idiot would connect a oil Pipeline to the internet . its impossible. 5M in ransom show me the transaction
- dmingod666 5y ago- Got Hacked by installing malware for free. - Liked it so much, sent 5M to download another program from the same people.
- o_p 5y agoShould had paid for cybersecurity or not pay misery bug bounties. Attract talent to the blue team!
- ajay-d 5y agoThey had cyber insurance coverage[0]. But I have no idea if cyber insurance pays out ransomware ransoms. [0]https://www.insidepandc.com/article/28is3dljuei18ioo7fri8/axa-xl-and-beazley-on-risk-for-colonial-pipeline-cyberattack https://www.insidepandc.com/article/28is3dljuei18ioo7fri8/ax...
- DrBenCarson 5y agoThey should, most policies do cover ransomware. If their policy did not, CIO loses their job in 5…4…
- Mountain_Skies 5y agoIt should be noted that Colonial had several infosec openings at the time of the attack. While having those filled might not have prevented this attack, it also might have or at least put them in a better response position. There are lots of infosec openings across the country but compensation doesn't seem to be rising in response. It appears that companies are fine with leaving these positions open for long periods of time. As long as the position actually exists, they're not all that concerned with filling it. This might be complacency creep. Everyone staffed up after the cluster of breaches that happened around the time of the Target and Equifax breaches. A lack of other high profile breaches or attacks might be why many companies have become lax in keeping their staffs full.
- medicineman 5y agoI mean, if you ignore how H1B's work, yeah you could call it complacency.
- sneak 5y agoYou don't need infosec staff to know that you should have backups of the data on your important computers/servers. Being hit by ransomware is not an indicator of total IT incompetence. Having no good options but to pay the ransom absolutely is. All ransomware is doing is exposing the existing hope-based DR plans (that is to say, lack thereof) in the industry.
- alistairSH 5y agoBeing hit by ransomware is not an indicator of total IT incompetence. Having no good options but to pay the ransom absolutely is. Part of paying the ransom is the promise that the ransomer will not just unlock your system, but will also delete all the data they downloaded (which often includes a pile of PII that the ransomee doesn't want published).
- elliekelly 5y agoI wouldn’t even pin it on IT. I’d be willing to bet there’s some poor IT person, or perhaps a lot of them, cleaning up this mess who have been begging management to beef up info sec for a long time.
- podgaj 5y agoWhy is everyone taking the word of colonial pipeline and all this? I could think of several scenarios where they would want to shut down by making up the whole story. Or maybe even hired the hackers them selves.
- antattack 5y agoCorrection: Consumers Paid Nearly $5M in Ransom to Hackers.
- vernie 5y agoAlso, like if you're not paying for something, you ARE the product, man.
- wonderwonder 5y agoOne thing that this attack has proven is that if we ever reach the point where we engage in military conflict with either Russia or China we are going to be functioning as if we experienced a country wide emp within a few days. Our infrastructure is massively vulnerable.
- TechBro8615 5y agoWait til you hear about the satellites. A global hot war between super powers would be disastrous for everyone involved. That’s why it probably won’t happen. I’d be more worried about rogue actors, terrorists and other “mad men” who might get their hands on a dirty bomb or fry the power grid in New York in January.
- paulpauper 5y agoSo i take it that the involved crypto addresses should be in a blacklist database somewhere? Who if anyone is monitoring all these ransomware addresses? There are probably thousands of addresses by now.
- whall6 5y agoIn Cambodia, people buy dirt to increase their property’s elevation so that their neighbor’s house floods when the monsoon comes. Then the neighbor has to pay for more dirt and so on throughout the whole neighborhood. It seems like the attackers are finding the paths of least resistance. Beefing up security at each organization isn’t fixing the underlying problem. It’s just making the next entity the more likely target. I don’t even know what the underlying problem is though...
- petermcneeley 5y agoWhat a great story reminds me of this: https://slatestarcodex.com/2017/02/22/repost-the-non-libertarian-faq/#coordination_problems https://slatestarcodex.com/2017/02/22/repost-the-non-liberta...
- pawsforapplase 5y ago>I don’t even know what the underlying problem is though... Lack of accountability for either criminals or negligent operators? Monsoons are not directly caused by individuals, and they cannot be prevented.
- syrrim 5y agoSuppose that everyone has raised their house up on a pile of dirt. The rain comes down. It fills up the large ditches between people's houses, and leaves the houses dry. Suppose I implement better, but imperfect, security. It now costs an attacker $6 million, in salaries, paying for exploits, whatever, to hack my system. They still can only get $5 million in ransom. The attack isn't worth doing anymore, so they find a different business.
- supertrope 5y agoLike The Netherlands
- rossjudson 5y agoI don't think you understand how dirt works. Especially when it gets rained on.
- ppierald 5y agoI am definitely not an expert in these areas and I'm sure someone 100x smarter than I am has thought of this and discounted it already, but is there any ability to decompile the executable provided to Colonial and get to patterns of source code, then compel github to search their repositories for any patterns of that code? Not sure if that is even legal or whether a judge would authorize that fishing expedition, but it's an interesting thought exercise (in my head) assuming the code is even in GH.
- dehrmann 5y ago> then compel github to search their repositories for any patterns of that code Assuming we're talking private repos, compelling Github to do that is a pretty blatant fourth amendment violation unless there's a specific set of suspected repos.
- axiosgunnar 5y agoare you assuming the ransomware is collaboratively coded on github?
- Mountain_Skies 5y agoThe authors of the ransomware might have non-ransomware projects on github where an analysis of coding style gives them away. It's sounds like it would have a low probability of working but this is essentially what got the Unabomber caught. But writing styles in English might be easier to identify than in code. Maybe they'll use "cool headed logician" as a procedure name.
- mrastro 5y agoIt's unlikely their code is hosted on GitHub because the hackers wouldn't want to leave such an obvious trace there. I think you're right that unless there is evidence code is hosted there, the judge wouldn't authorize a "fishing" exercise to search random sources for the code. In a hypothetical, what would this even give? The IP addresses of the authors? They are likely running through a proxy anyways so it wouldn't help. The private key? It might have been generated server-side or using an algorithm outside the code so might not help. What I'm saying is getting the code source might not even be helpful depending on how it was implemented and if only the client code can be found.
- dang 5y agoRecent and related: AAA warns on gas prices, North Carolina invokes emergency as hackers apologize - https://news.ycombinator.com/item?id=27117515 https://news.ycombinator.com/item?id=27117515 - May 2021 (111 comments) US passes emergency waiver over fuel pipeline cyber-attack - https://news.ycombinator.com/item?id=27101092 https://news.ycombinator.com/item?id=27101092 - May 2021 (448 comments) U.S.'s Biggest Gasoline Pipeline Halted After Cyberattack - https://news.ycombinator.com/item?id=27086403 https://news.ycombinator.com/item?id=27086403 - May 2021 (202 comments)
- nneonneo 5y agoUgh. This ransomware crap doesn't stop until the money stops. At this point, ransomware operators are bribing insiders to install their custom, AV-evading ransomware directly on company servers (e.g. https://www.secureworldexpo.com/industry-news/fbi-sting-the-ransomware-gang-trying-to-bribe-employees https://www.secureworldexpo.com/industry-news/fbi-sting-the-...). No need to trick someone into running a malicious Word attachment when you can just wire someone $1M to do it deliberately! And, best of all, you can set this up in a totally plausibly deniable way - the employee just "accidentally" opens that attachment and off you go. A lot of ransomware operators are on sanctions lists. Paying them is already illegal. The US DoJ might want to check if Colonial has violated any laws in making these payments - and if they have, punishing them to serve as an example could well discourage future ransomware payers. As long as ransomware operators know they can get paid for their work, they're going to keep doing it.
- andy_ppp 5y agoI wonder how long you’d sit it out losing money before you paid. I think it’s very easy to talk a big game until you’ve lost many multiples of the ransom with no end in sight. It’s literally just a waiting game for the hackers, they have nothing to lose and everything to gain. So what if you don’t pay, you can just leave them screwed and move on to the next one.
- sudosysgen 5y agoRealistically, ransomware will just never stop until IT systems are sufficiently hardened.
- nimbius 5y agoColonial is being widely lambasted for a culture of absolutely lackadaisical security. Call me callous but numerous federal agencies exist to issue security best practices and exploit announcements. numerous vendors also exist. play stupid games, win stupid prizes. Not paying the ransom would have been tantamount to complete dissolution of the company. it would have tirggered a much wider investigation into the company with shareholders abandoning it as the outage dragged on at the hands of an incompetent leadership. Unfortunately it seems to have been a Pyrrhic victory as paying the ransom puts their shareholders at risk of serious sanctions and indictment from the US Dept. of the Treasury. https://home.treasury.gov/system/files/126/ofac_ransomware_advisory_10012020_1.pdf https://home.treasury.gov/system/files/126/ofac_ransomware_a...
- HarryHirsch 5y agoYou'd damn well hope so. In civilized countries, when you leave the key in the ignition the cops will go after the thieves. The next thing that'll happen is that they'll also go after you because you just made the roads unsafe. And this isn't a car, this is infrastructure with national security implications. Someone needs to go and do time.
- ethbr0 5y agoIf the US were to be serious about corporate IT security, they'd empower and indemnify DoD, NSA, private industry red teams to pentest against everything with a US point of presence or customers, using commercial available / in the wild methods. This would have the beneficial side effect of flushing all the incompetent paper-pushers / requirement-box-checkers out of the security industry. If you're found vulnerable, that's a fine. If something gets accidentally broken in the exercise, that's the price of commitment. Nothing is going to change until you increase the frequency / likelihood of breaches for these companies. If it's a yearly cost, it gets addressed. If it's a catastrophic possibility, it gets ignored.
- Miner49er 5y agoThe market has already solved this in the form of ransomware groups. No need to have the government do it and issue a fine, ransomware groups literally are doing what you said. I guess the government could legalize ransomware hacking to encourage it, but that'll never happen.
- magicsmoke 5y agoParallels with the golden age of piracy anyone?
- thedogeye 5y agoI'm kinda surprised the CIA doesn't randomly disappear hackers like they've done to so many terrorists the last few decades.
- aynyc 5y agoI’m willing to bet state actors blend into random ware group.
- kjrose 5y agoThe fact this was paid off, and paid off so rapidly means that targeting major infrastructure for massive payoffs is going to become more and more prominent. The next time though, it'll be $50M. I work with people in the oil fields and I know the numbers they are playing with and the fact that a single well being down can easily be $100,000 lost per hour. So obviously they want these systems back up fast. $5M for shutting down that major of a pipeline seems like too little, unless, of course, they weren't expecting the company to even pay. Now that these actors know that the oil (and quite likely other utilities) are more than willing to pay big bucks to get back online, they will be targeted far more. There are so many reasons this is very very bad.
- brightball 5y agoWhat I have heard regarding ransoms like these is that the perpetrators goal is to incentivize the transaction goes smoothly, or it won’t continue to work. So they have to follow through with unlocking and they have to use an amount of money low enough to make the decision obvious.
- Thorentis 5y agoWell from the article, the decryption tool was so slow they kept using backups along with it. Sounds like future hackers need to improve their decryption tools, or companies where speed matters (like utilities) won't bother paying.
- 5y ago
- drzoltar 5y agoDumb question: why can’t crypto currencies and exchanges place the ransom tokens on some kind of blocklist, thereby forever tainting those coins? As I understand, the rise of “privacy wallets” has greatly increased the anonymity of such transactions. But, at the end of the day, don’t we always have a ledger of the coin ids? I’m curious how the coins actually get laundered back into cash.
- theragra 5y agoRead up on monero. Transactions in Monero are almost always untraceable.
- throwkeep 5y agoCoinbase and other exchanges do that actually, when they find that an address belongs to a hacker.
- Aperocky 5y agoDumb question 2: How do you taint tokens when a "coin" is divided arbitrarily? As in, there are no minimum unit of a "coin"?
- chrismorgan 5y agoSince it’s a ledger, the coins can’t be poisoned, but you can poison the addresses (in traceable blockchains like Bitcoin, at least). At the bluntest level, refuse to transact with addresses that have received money from poisoned addresses, transitively. In practice you probably want to apply somewhat more nuanced rules, or the poison is far too likely to spread to the innocent. It could even be weaponised, by a poisoned address deliberately sending small amounts to addresses that it wishes to poison, since you can’t refuse to receive a transaction. (Incidentally also, there is a minimum unit, at least in all currencies that I know of; Bitcoin, for example, goes to eight decimal places. But yeah, each unit doesn’t have physical identity like bank notes do. Infinite divisibility is bad for efficiency as it means your data types have unbounded memory usage, so you’d need to put together a bunch of rules about how far you actually can divide things, and it’s just not worth it.)
- generationP 5y agoSo, supposedly, Colonial paid the ransom "within hours after the attack". And, supposedly, the attack didn't even hit any ICS, just the payment infrastructure ( https://www.zdnet.com/article/colonial-pipeline-ransomware-attack-everything-you-need-to-know/ https://www.zdnet.com/article/colonial-pipeline-ransomware-a... ). Why are there still gas shortages 6 days later? Not a rhetorical question at all. To me, the idea that the infrastructure we rely on is controlled by middle managers with no sense of urgency and no grasp of their domain looks like the real fridge horror story here. On the other hand, I have learnt better than to trust everything I read in the press; thus the supposedlies. Either way, "the decryption tool is slow" is not an excuse to not deliver essential supplies.
- mgolawala 5y agoYou do not need actual disruptions in supply to create a shortage. The threat of a disruption or a shortage for such a critical commodity can create a situation that it becomes a self fulfilling prophecy (short term). That is what can often create bank runs and created the "great toilet paper shortage of 2020".
- generationP 5y agoBut the pipeline has been closed: https://abc11.com/business/theres-plenty-of-gas-in-the-us-the-problem-is-getting-it-to-nc/10621763/ https://abc11.com/business/theres-plenty-of-gas-in-the-us-th... And the toilet paper shortage was not purely panic-driven. People did shit at work before the pandemic, and that part of demand switched to a different supply chain. The panic-induced bullwhip was probably stronger than the original demand spike, but the whole thing wasn't just memed into existence.
- hoppyhoppy2 5y agoThe pipeline was shut down as a preventive measure (we're being told) just in case the attackers had made their way into the control systems. Trucking of gas has been increased to compensate for the closure of the pipeline, and there was emergency legislation passed in Congress to lift regulations that would have prevented these higher levels of trucking. The gas supply has been just fine here in the Northeast; the issues I've heard about have been in the South and Southeast due to panic buying (in areas of the country that shouldn't have been negatively affected by the closure of the TX->NY pipeline).
- belatw 5y agoThat’s retirement money. Live on an island, doing drugs and drinking champagne for the rest of your life money. Im in the wrong line of work.
- xwdv 5y agoYea, crime really does pay here. If I was a lone hacker in a nation with loose laws I’d be ransoming foreign systems and building a fortune.
- ineedasername 5y agoAnd the group originally though responsible for this was actually just a ransomware-as-a-service partner here, and seem a little embarrassed about the while thing. Basically they said "yeah, we don't want our partners doing stuff that big so we'll ask them not to in the future." Hopefully that doesn't stop the full weight if the US intelligence services from coming down on them and every single other ransomware scammers they can find... And outlawing payments to these terrorists.
- bleair 5y agoAssuming the ransom was paid, it's an interesting example of how cryptocurrencies contribute to the viability of this new "business model"
- ggm 5y agoCharge the board and top execs: Take the $5m payment out of their bonus and KPI and share stock.
- ineedasername 5y agoI'm not really anti-crypto, but a strong disadvantage to society is that these attacks are made much more easily because they can bypass traditional financial institutions.
- jimmydorry 5y agoThe crypto still interfaces directly with the financial system on all ends. The company move money to an exchange (using the financial system), and the hacker cashes in the crypto eventually (using the financial system).
- ineedasername 5y agoIt's not the company side that matters. It's that it's a lot easier for the criminals to pull a few tricks to obscure their side of things significantly. Bitcoin mixers/tumblers for example so that what comes out the other end can't easily be tracked back to the crime. I'd be extremely surprised if groups making these attacks didn't use that type of thing. If it was all bank wires etc. then law enforcement could track things mich more easily. Even if they couldn't find the hackers they could still freeze the accounts, rendering the attack worthless.
- Gaelan 5y agoThe issue is that a tumbler doesn't make the dirty money go away, quite the opposite; it gives a bunch of other people little bits of dirty money. If I were a non-criminal, or even a smaller-time criminal, it wouldn't be in my best interests to use a tumbler that might give me this dirty money.
- ineedasername 5y agoIt doesn't matter if they're all criminals using the mixer-- we want to track these particular ransomware hackers, and that's made extremely difficult when all we see is their lump sum enter the mixer with countless other transactions, and countless disaggregated transactions come out the other end no longer tied to the hackers, making it much harder to track down the people that brought down most of the East Coast's pipeline infrastructure. Anything like that stunt is pretty difficult to accomplish using traditional banking institutions when we know where the money is going and can track it each step of the way, or just freeze it.
- ineedasername 5y agoPer the Boston Globe story [0] they were actually in the process of restoring from backups but it was going too slow. Something to remember: when downtime is so critical that key pieces of a country's infrastructure is at stake, backups can't be enough-- there also has to be a rapid recovery plan to actually use them. [0]https://www.bostonglobe.com/2021/05/13/business/colonial-pipeline-paid-hackers-nearly-5-million-ransom/ https://www.bostonglobe.com/2021/05/13/business/colonial-pip...
- twobitshifter 5y agoTFA says the opposite - that backups are faster than the decryption tool supplied by the hackers. Would you run a tool supplied to you by the hackers on your network? This thing could be scrubbing, adding backdoors, really anything. >Once they received the payment, the hackers provided the operator with a decrypting tool to restore its disabled computer network. The tool was so slow that the company continued using its own backups to help restore the system, one of the people familiar with the company’s efforts said.
- ineedasername 5y agoYes, that also means they had backups since the original outage but they were slow. Since they had backups they should never have paid for even slow decryption and, as you said, potential other security issues using the hackers software. So my reading of the situation is that the situation was urgent, backups were too slow, so they paid to try to have a quick fix only to have the description also be very slow. Paying might have been a complete waste of money. I could be wrong about my reading of events, but as I said originally, they lacked rapid recovery capabilities, which for something this critical is just as important as having the backups themselves.
- nyczomg 5y agoFrom the article you linked, it sounds like it was the other way around, but both ways to restore must be slow... “Once they received the payment, the hackers provided the operator with a decrypting tool to restore its disabled computer network. The tool was so slow that the company continued using its own backups to help restore the system, one of the people familiar with the company’s efforts said.”
- A4ET8a8uTh0 5y agoYou know what is a good thing about it? There is some spotlight on the issue. Maybe IT security won't be an afterthought now. I mean yeah, there are already attempts to blame everyone, but management who effectively made it clear that long term paying 5MM is cheaper than actually being careful, but I remain hopeful.
- wnevets 5y agoit pays to be a scumbag
- SyzygistSix 5y agoAre you talking about the hackers or Colonial Pipeline?
- wnevets 5y agowhy would Colonial Pipeline be the scumbag in this story?
- SyzygistSix 5y agoFor not taking the effort to secure such important infrastructure, despite bringing in huge profits. They have both the duty and the means to have first rate IT staff providing excellent tested back-ups as well as security.
- wnevets 5y agoSo victims of ransomware are now scumbags? Interesting
- mensetmanusman 5y agoI wouldn’t be surprised if the hackers are visited by a kinetic response.
- bschwindHN 5y agoReminder that these same clowns have leaked over a million gallons of gasoline into a nature preserve in North Carolina. https://www.eenews.net/stories/1063725961 https://www.eenews.net/stories/1063725961
- tbihl 5y agoI really want to be supportive of pipelines as a better option than trains or trucks, but it's really hard to do when things like this don't result in enormous payouts against these companies. The US legal system is not capable enough to allow for large pipelines. Also, this and coal are the sort of stuff that nuclear replaces...
- rswail 5y agoIt's also the sort of stuff that renewables and EVs and batteries (EVs = mobile batteries) replace. Nuclear is fine for baseload, but no good for anything else, costs a fortune, has huge externalized waste processing costs, and is inherently not fail-safe using actual deployed designs.
- tbihl 5y agoI agree that this is something that EVs and batteries could replace, but if your baseload is coming from oil, all you've done is transfer the combustion to a more efficient central site and then sent the power through the grid. Regarding base load, my suspicion is that SMRs inherently accommodate transients better because leakage becomes a bigger factor and starts to compete with poisoning effectively, so maybe you get more bang for your buck out of influencing the moderator. Regardless, even if it's only ever good for base load, that's a lot of ground nuclear could still cover in the US. Finally, the cost of nuclear comes mostly from the aggressive safety standards. There's space to fix some of that (enormous cost to the fact that radiation workers typically experience less exposure than aircrews) and also space to acknowledge that we're lowballing standards in fossil fuels, with pipeline leaks and ransomware compromise being easy examples. That's before you talk about the pollution released by fossil fuels, including the radioactive contamination released by mining and burning coal.
- ironman1478 5y agoI don't have much to add here, but I've been going to Def Con and the other Las Vegas security conferences for a few years. Every year there is a section for infrastructure security (factories, refineries, etc). Its always the smallest section and the least populated. But its simultaneously the "most important" in terms of how much damage can be done from a single attack. Every year I went and was always terrified by all the stuff I saw because all the people hosting booths were like "yeah its dead simple to get in and break things." I feel like so many people could see this coming and there are just no consequences for the companies to incentivize them to do better.
- swiley 5y agoIt sounds like it may have just been the billing system that was hacked, not the infrastructure. I've seen similar patterns and so I was surprised by this.
- suyash 5y agoDon't matter if they lock your computer access out and encrypt all the data, ransomware is installed.
- coryrc 5y agoIn 50 years I hope to find out it was pulled off by the infrastructure teams who have been arguing for more security all along and that they did some good with the money.
- ironman1478 5y agoHa. The people that man the booths there are generally researchers for pen testing companies or universities. Also, just a cool thing https://www.wired.com/story/evil-bubbles-industrial-pump-hack/ https://www.wired.com/story/evil-bubbles-industrial-pump-hac... There are like tons of attack like this that are possible and they demonstrate those at the booths
- nodesocket 5y agoCompletely agree. If interested check out the documentary Zero Days. Insane, essentially the NSA in tandem with Israel took down Iran's nuclear program by impacting their industrial control units. Many Zero Days were used with nearly an unlimited budget. [1] https://www.youtube.com/watch?v=C8lj45IL5J4&ab_channel=MadmanFilms https://www.youtube.com/watch?v=C8lj45IL5J4&ab_channel=Madma...
- Gaelan 5y agoHas anyone attempted to find this transaction on the blockchain?
- cwkoss 5y agoI love the idea of sprinkling bitcoin private keys in text files around your infrastructure, so any hacker that gets access can take the funds, but you'll be alerted to it and can quarantine the box and investigate the intrusion. Maybe include "Email us with a write up of how you got in and a bitcoin address, and we'll send more bitcoin based on how helpful it was" Rotate the keys periodically and sweep all unstolen bitcoin into a bonus fund split between everyone who had access to the machines which held the private keys. Give devops real skin in the game for keeping boxes secure. Could also develop a convention for deriving private keys from security secrets - make it so if someone gets your AWS root key, they can test the credentials to see if the company has offered a enough funds that they are willing to announce (and thus burn) their access by transferring those funds away. I wonder if you could 'license' these coins in a way that it would be legal (or at least more-legal) to take them without prior consent: if there was a legal means to monetize 'misplaced' credentials many hackers might choose that over the legally riskier and less-moral traditional alternatives. Credential rotation would certainly be more fun if it meant I was going to get a bonus!
- randomhodler84 5y agoYes but BTC is far too valuable. The piñata was only online until it was worth too much. Might work well for other Alts.
- solveit 5y agoYou know you can have fractional BTC, right?
- randomhodler84 5y agoWhat I’m more worried about is when the sat is too valuable. We can millisat it with LN, but it’s still not enough. I used to think eth was absurd with 18 but we kinda wish for more than 2.1 quadrillion of the beasties. There are world currencies used by 100M+ that are worth less than a sat today (IDR). In short while it’s more like 1B+ as BTC grows rarer.
- 5y ago
- dsyrk 5y agoAnyone seen any confirmation of which cryptocurrency they made payment in?
- ck2 5y agoSomewhere there an ICBM on the internet. If all these things like water, power and pipelines are on the internet for no reason but laziness (not like they used a USB thumb drive) then you can be sure some general has decided they want to monitor missiles on their smartphone. Putin must be laughing his ass off.
- joe_the_user 5y agoSeeing the most advanced technological processes now subject to what is crudely a protection racket brings to mind a quote by Debord: "Founded on obscurantism and poverty, the Mafia at that time was not even able to implant itself in Northern Italy. It seemed condemned to vanish before the modern State. It was a form of organized crime that could only prosper through the ‘protection’ of backward minorities, outside the world of the towns, where the laws of the bourgeoisie and the control of a rational police force could not penetrate. The defensive tactics of the Mafia could only suppress witnesses, neutralize the police and judiciary, and install as ruler in its sphere of activity the secret that is necessary to it. Subsequently it found a new field in the new obscurantism of the society of the diffuse spectacular, then in its integrated form: with the total victory of the secret, the general resignation of citizens, the complete loss of logic, and universal cowardice, all the favorable conditions were united for it to become a modern and offensive power" https://theanarchistlibrary.org/library/guy-debord-comments-on-the-society-of-the-spectacle https://theanarchistlibrary.org/library/guy-debord-comments-...
- flerchin 5y agoCrime pays.
- rootsudo 5y agoLooks like ransomware is good business.
- jimktrains2 5y agoIt was reported just over a day ago that they had decided not to pay. I wonder what changed. https://www.washingtonpost.com/business/2021/05/12/gas-shortage-colonial-pipeline-live-updates/ https://www.washingtonpost.com/business/2021/05/12/gas-short...
- marmot777 5y agoBorat does a shakedown.
- publicola1990 5y agoI hear online that the ransomware had no effect on the Colonials ability to physically pump the oil, it affected only its billing systems, but they stopped pumping anyway because it would have been difficult to reconcile the accounting/billing if they continue to operate without the billing system being live. Is this true?
- tbihl 5y agoThe far more plausible story that I've heard: it had no effect on the control network because there's only one-way communication, but the one-way was only enforced at software level, so they weren't taking chances with leaving it up and having the control network compromised.
- marmot777 5y agoI thought that it was because the billing system wasn’t accessible and that the gas itself wasn’t affected (the actual infrastructure). Yes, still very bad, but it seems there should be contingency plans for this sort of thing. 1. One primary source of gas for the Eastern sea board? Wtf? 2. The TSA overseas pipelines (lower standards and poor oversight) whereas electricity is regulated by the Dept of Energy? What the actual fucK? Nothing against then TSA but shouldn’t they focus on transportation security? 3. They didn’t have a director of cyber security and are now recruiting? If you’re running critical infrastructure shouldn’t you be putting a few dollars into this sort of thing already? What a cluster fuck.
- siculars 5y agoThere is an axiom to never negotiate with terrorists. While we all know that isn’t always entirely true, let’s recognize that this payout will be considered a turning point. Regardless whether or not you believe ransomware should be paid, my takeaway is that these ransomware attacks have done more for promoting “cyber security” than all the marketing budgets of every security vendor combined. If you’re employed as a security engineer or thinking about getting into the industry, there has never been a better time to ask for more money and more authority.
- bigmattystyles 5y agoThe amount of open or almost open VNC servers out there alone is scary. Scan for a the default port and you can find hundreds to industrial machines.
- 29athrowaway 5y ago$5M for a company of that magnitude is absolutely nothing.
- tbihl 5y agoIn past times (not to my knowledge anymore), countries at war would provide letters of marque to private ship captains, authorizing them to attack enemy shipping and keep the proceeds. That is exactly what Russia has done. What would it look like if the US, and for that matter a number of other frequently targeted countries, reciprocated?
- HenryKissinger 5y agoIn the short term, an escalatory spiral. Each side would intensify its attacks until either: (1) Someone crosses a red line, like cutting the electricity to New York City for days on end, prompting a proportionate response, or economic sanctions, or (2) Diplomacy takes over and countries reach a quick agreement to curtail their activities, like during the Cuban missile crisis.
- myrandomcomment 5y ago1. Never negotiate with terrorist 2. Never negotiate with terrorist 3. Life in prison required sentences for those convicted of these crimes 4. Death penalty for those convicted when hack results in a death (like hospital hack) 5. Zero statute of limitations on these crimes 6. State actors engaged in this get economic death penalty - 100% cut off from world banks, markets. 7. No insurance coverage for companies that suffer these hacks. They need to get their stuff sorted.
- marsven_422 5y agoProbably cheeper the paying to build a secure system.
- matheusmoreira 5y ago> The company paid the hefty ransom in difficult-to-trace cryptocurrency within hours after the attack Why won't they say what coin it is? It's Monero right? XMR? Say the name.
- entwife 5y agoThis looks like market manipulation.
- PicassoCTs 5y agoFunny thing though - this benefits decentralized, diverse infrastructure- like small solarplants with storage.. (checks) yep still up. Until the plant is air-gapped of course.
- beprogrammed 5y agoShould Trump that 5M with a huge fine for funding criminals. Terrible job.
- bfrog 5y agoThe timing of this is just almost too coincidental to be frank. There were already cyber security XO in action and in play. How much cash will this company get now from uncle Sam to fix their negligence?
- prepend 5y agoWe need a Foreign Corrupt Practices Act-style law against this. This payoff is going to fund so many more attacks. I think this company was stupid in their security and unethical in their payoff practices. Interesting to see if there will be a shareholder’s lawsuit because of the clear dollar amount of their error.
- hi41 5y agoIs there a paper describing how this breach was carried out so we can learn from it.
- sunstone 5y agoWhat a difference a day makes. Yesterday the ransomware guys were on the top of the world pressing their advantage. Today their servers have all been compromised and all their crypto wallets have been emptied and the entire group has now sworn off doing any more ransomware heists. Nothing like a nation state rattling your cage to have you re-assessing your priorities.
- stryker90 5y agoSix Industries would have been able to reverse engineer the ransomewar and retrieve unlock key for the encrypted data, thats what we seacialize in, now they need to encrypt there entire network and vback up daily. wish they would have listebn to us