13 ms·

The fact this was paid off, and paid off so rapidly means that targeting major infrastructure for massive payoffs is going to become more and more prominent. Th

• brightball 5y ago
  What I have heard regarding ransoms like these is that the perpetrators goal is to incentivize the transaction goes smoothly, or it won’t continue to work. So they have to follow through with unlocking and they have to use an amount of money low enough to make the decision obvious.
  • Thorentis 5y ago
    Well from the article, the decryption tool was so slow they kept using backups along with it. Sounds like future hackers need to improve their decryption tools, or companies where speed matters (like utilities) won't bother paying.
    • kjrose 5y ago
      This was the error yeah.
      • er4hn 5y ago
        Given how encryption is generally symmetric in terms of operations and speed, I wonder how long the original encryption took as well? What warnings were overlooked leading up to the attack fully going into place?
• charlesju 5y ago
  Yeah, but now there is also a massive bounty out for these hackers. Money needs to get out at some point and that's when they'll get nailed.
  • windexh8er 5y ago
    Unfortunately these types of breaches don't net the culprits nearly as expeditiously as we'd all like. Given that they're likely based in a country that could care less or may be adversarial to the US this may even be lauded. In the grand scheme of things it's very low likelihood we'll see any level of prosecution for this incident in the next year or two, if ever. And even then it will likely only result in attribution in a random report a year from now with no actual consequences for the attackers. The final thing is the amount of money isn't extraordinary. As others have said it's mostly a rounding error in annual revenue that passes books of a company like this.
    • charlesju 5y ago
      Check front page of HN :)
• TechBro8615 5y ago
  Sounds like a $50m incentive to hire a security team.
  • manquer 5y ago
    Or more likely insurance. The insurance may demand better practices for lower premium in turn
    • valdiorn 5y ago
      There were some news reports yesterday about insurance companies dropping cyber-ransom insurance from their offerings (AXA, I think). Very likely more insurance companies will do the same soon, or at least, refuse to insure the company unless they comply with some cybersecurity standards.
      • erosenbe0 5y ago
        Pretty much. Insurance industry can be helpful here. They can develop audits and make requirements same as they do for worker safety procedures.
  • kjrose 5y ago
    From my experience. They will hire you but they won't pay your invoice until net-270
    • ravel-bar-foo 5y ago
      You're the second person who mentioned net-270 in this thread. What's the context?
      • kjrose 5y ago
        It means you invoice and they pay after 270 days of receiving the invoice. Basically the large oil firms know they hold all the cards so they regularly delay payment as long as possible.
• alasdair_ 5y ago
  I agree. I’d give 60% odds that there is at least one significant attack (ransomware plus shutdown) on US power grids in the next 18 months.
  • HenryKissinger 5y ago
    Basic game theory dictates that the cost of ransoms will continue to rise until it hits the price point at which the targeted company would have to replace its compromised systems from scratch. 5M, 50M, 500M, 5B, 50B? I wonder how the government would react if a hacker group held gas/power/clean water/etc. hostage for millions of Americans for a ransom in the tens of billions
    • notyourday 5y ago
      > I wonder how the government would react if a hacker group held gas/power/clean water/etc. hostage for millions of Americans for a ransom in the tens of billions War.
      • michaelmrose 5y ago
        Too grandiose a word for a targeted assassination of a handful of folks.
        • justsid 5y ago
          Not if the hacker group is a nation state. Sure, small time hacking is cute and all, but the US isn’t going to just roll over and be all like “oh no, you hit critical infrastructure that had a big impact on peoples life. Carry on”
          • publicola1990 5y ago
            Even this time too government was aware that Colonial paid the Ransom. The question was asked in the Whitehouse press breifing, it was told that this is essentially a private sector matter, Government will not advice Colonial in this regard. Also they said it was Colonial's prerogative to decide and act. Transcript of Whitehouse Press Briefing: https://www.whitehouse.gov/briefing-room/press-briefings/2021/05/10/press-briefing-by-press-secretary-jen-psaki-homeland-security-advisor-and-deputy-national-security-advisor-dr-elizabeth-sherwood-randall-and-deputy-national-security-advisor-for-cyber-and-emerging/ https://www.whitehouse.gov/briefing-room/press-briefings/202...
• DevX101 5y ago
  I think these ransoms are net good. I'd rather greedy hackers shake them down for money then having the country get crippled by political terrorists or enemy nation states that can't be negotiated or reasoned with. There are lots of infrastructure management teams taking security more seriously than they were a month ago. That alone is worth more than $5M
  • bostonsre 5y ago
    Yea, I think I tend to agree with you. It may cause a lot of pain in the short term, but being forced to pay penetration testers seems like it could be a net good in the long term for security in general. I don't think nation state attackers would be so kind as to un-fuck your system after they cripple it, even for a massive fee.
    • joe_the_user 5y ago
      Company: Well this is a painful lesson Me: Only if you learn it. Penetration testing is part of a security program. If you don't have a security program, penetration "testing" isn't useful whether it's painful or not. Haves the careers or investments of anyone significant who brought things to this point been screwed? If not, nothing will change.
      • bostonsre 5y ago
        I think ransomware gangs will be emboldened and more will go after bigger targets. I also think ransom demands will grow and insurance premiums will continue to grow as well. I'm hoping there is some attainable point where it makes financial sense to practice good security.
      • at-fates-hands 5y ago
        >> Me: Only if you learn it. As someone with a lot of friends and co-workers who are on the info-sec side, the stories I repeatedly hear of how many times they visit the same company year/year and little if anything is done to harden their networks, and impose stricter security on their users is way more common than it should be. Most, if not all of these networks should be taken offline and siloed, but you know that won't happen now, the genie is out of the bottle. If they did, it would create a much smaller attack surface for critical infrastructure. As it sits now? Doubtful we would go back to that world.
• tgsovlerkhgsel 5y ago
  The bigger the difference between the cost of the downtime and the ransom, the most likely it is to be paid. Assuming you were in a TV show, and offered two options: Spin wheel 1 with a 95% chance of winning $5M, or spin wheel 2 with a 50% chance of winning $50M, which one are you going to spin? The EV is higher on the second one, sure, but taking the near-certain 5M may still be a better choice - a bird in the hand is worth two in the bush. Additionally, this group is said to do its research and adjust ransoms accordingly, so it seems likely that the ransom amount was a carefully thought out choice.
  • p1necone 5y ago
    The difference in actual value between the two for me at least is much smaller than the difference in numerical value. Both amounts are enough for me to never work another day in my life, and instead focus on building what I want to build. Past that massive increase in quality of life extra money is relatively meaningless (to me) . This is the same reason that people who decry spending money on lottery tickets as a stupid thing to do based on the EV alone are thinking far too simplistically.
    • tgsovlerkhgsel 5y ago
      > The difference in actual value between the two for me at least is much smaller than the difference in numerical value. That was exactly one of the reasons why I showed that example. While this may be different for a gang that has to split the money N ways, the "bird in the hand" might still be worth the two (or ten) in the bush, due to this or other factors.
    • femto 5y ago
      Off topic, but I'm curious: What do you want to build and why can't you start building it now?
      • p1necone 5y ago
        Mostly software - games and related tooling, learning more about type systems and applying it in a homebrew language. I can start building it now. But after already spending 40 hours a week writing code at my day job and having those problems swimming around in my head all the time it's hard to find the motivation to do more, even when what I do for my day job isn't as creatively fulfilling.
• resonantjacket5 5y ago
  It's kinda the opposite scenario. The hackers knew they were willing to pay more but didn't actually want to cause this much attention and so lowballed so they'd quickly pay. At least according to https://finance.yahoo.com/news/colonial-pipeline-paid-hackers-nearly-141548661.html https://finance.yahoo.com/news/colonial-pipeline-paid-hacker... Krehel (chief executive officer and founder of digital forensics firm LIFARS and a former cyber expert at Loews Corp) said a $5 million ransom for a pipeline was “very low.” “Ransom is usually around $25 million to $35 million for such a company. I think the threat actor realized they stepped on the wrong company and triggered a massive government response,” he said.
  • toss1 5y ago
    Yup. They start doing this kind of damage, and they can start to expect the wrong kind of attention -- a kinetic response, as in cruise missile into the upper left window, circular error probable = 50cm., or similar. Unless Vlad starts frowning on this behavior, which persists at his pleasure, it may take that (or a seriously escalatory cyber response) to lower the threat to acceptable levels.
• nodesocket 5y ago
  This was extremely poor (I'd say weak) leadership by Colonial Pipeline. While continuing to be down is painful, it puts a spotlight on the issue and forces hands of critical infrastructure to improve security and reach out to security companies for audits and consulting. Also, they could have gotten additional support from the US government and political support by continuing to stay down instead of the back alley payout. Not to mention, rewarding people for bad behavior is never a good idea. I learned this as a child... "If you give a mouse a cookie, then he'll ask you for a glass of milk."
  • publicola1990 5y ago
    It appeared that they informed the government that they are paying the ransom, Government's view was that it was a private sector matter so it is prerogative of Colonial to act.
• JohnJamesRambo 5y ago
  They could always just keep the "X" unplugged, it is doubtful hackers from Russia go onsite and sabotage things. Maybe this will make companies realize if they can't secure it at least just disconnect it. Everything doesn't have to be online.
  • gorgoiler 5y ago
    The “X” may be unplugged but your day-labor contract industrial cleanup techs are hired through an Uber-for-Cleaners Hygiene-as-a-service Heroku app that’s had every backup silently deleted for a month and has just been replaced with a funny cat photo by someone claiming their name is spelled with a zero in it. You can’t hire cleaners. Site cleanup is suspended. Your insurance is invalid if workers are onsite while hazmats are left uncleaned. You shut down on the day you were about to ship a full warehouse of product. Manufacturing grinds to a halt because the outbound warehouse is full. You have to cease goods incoming because they were misusing the day-labor app for handling delivery grunt work. Ph0bos Security Services also hacked your email so now everyone has to use personal phones and WhatsApp but upper management won’t share their numbers with anyone except the foreman so he is now the bottleneck for everyone who needs approval to make out of budget purchases to handle the capacity overload that’s happening everywhere except for hazmat cleaning. But the pumps were airgapped so at least they didn’t get hacked.
• hhs 5y ago
  In 2019, ProPublica wrote how paying ransoms benefit insurance companies. They called this: "The extortion economy: How insurance companies are fueling a rise in ransomware attacks. Even when public agencies and companies hit by ransomware could recover their files on their own, insurers prefer to pay the ransom. Why? The attacks are good for business." [0] [0]: https://www.propublica.org/article/the-extortion-economy-how-insurance-companies-are-fueling-a-rise-in-ransomware-attacks https://www.propublica.org/article/the-extortion-economy-how...
  • mianos 5y ago
    For such a long article it's (IMHO) a fairly naive view. Sure insurance companies make some profit, specially in the beginning but, eventually, the price gets higher and higher and the cost to secure becomes less than the cost of insurance. We had a similar issue with builder's insurance down here in Australia. It's was (and still is) cheaper to get insurance than build a quality building. Eventually that caught up with the builders (and they moved to using a seperate corporate entity for each building and closing it after the building is built, but that's another story of corruption).
    • cutemonster 5y ago
      > a seperate corporate entity for each building Hmm, so if buying a house, it can be good to first find out if this house is the only one the construction company has built > insurance companies make some profit, specially in the beginning I've gotten the impression that CEOs often don't plan much longer than any bonus program periods? And, later when getting too expensive, can't they just then start telling the companies to use their backups instead.
  • vegetablepotpie 5y ago
    Thank you for posting that link, it was really informative. > ProPublica has found that they [insurers] often accommodate attackers’ demands, even when alternatives such as saved backup files may be available. What a perverse set of incentives. Insurance companies are paid to manage risk. Risks go up the more they pay ransoms. As risks go up, the risks are more visible, more companies get policies, insurance gets more money. This is bordering or racketeering. How many times do people on HN say “back up your files”. Certainly that’s the way to do it if you want less ransomware. It’s not sexy, it’s not “visible”, but it will reduce your risk. But apparently, the goal here is to encourage more ransomware.
• bob33212 5y ago
  It is much better to pay a 50M bug bounty than to have a system downtime cause billions in damage.
• WalterBright 5y ago
  Security professionals need to start getting serious about demanding physical write-enable switches to all embedded systems, so malware won't survive a reboot. Backup media must be append-only unless a physical write-enable switch is pressed. Physical write-enable switches used to be standard. I'm not buying the crazy argument that remote update is necessary to remove malware installed using remote update.
• langitbiru 5y ago
  My friend who works in cyber security share this framework to deal with ransomware with me: https://securityandtechnology.org/ransomwaretaskforce/report/ https://securityandtechnology.org/ransomwaretaskforce/report... This problem needs to be solved in collective level.
• fossuser 5y ago
  Moneystuff had a good post that touched on this today. Even if they don’t pay, the scammers buy puts on the public stock for the companies they’re ransoming so they profit off of blowing them up too. I’d imagine that’s easier to track and stop, but it’s interesting.
• bourgwaletariat 5y ago
  It is a scientific fact that there will be more of it. It's called operant conditioning. If you reward behavior, you get more of it. If you think it's about the ransom though, think bigger. Can you even imagine how many billions of dollars silicon valley is going to make off it? They just paid Microsoft dozens of billions for some AR glasses. How much for some software to prevent cyber terrorism? How much did TSA get to secure planes? $8 Billion/yr. $18 Billion for border protection. How much for cyber border protection? $100 Billion? Where will it go? Google? Microsoft? Palantir? Facebook? Twitter? Amazon? Trillions. They haven't even gotten started. $5 Million is pennies. Rounding error.
• whimsicalism 5y ago
  I think you're entirely wrong. I doubt the hackers realized quite what they had hacked, and by the time they did realize, they were probably shaking in their boots. My guess is they lowballed - $5m is considerably less than other payments I have seen them take before for a much bigger catch.
• mathattack 5y ago
  It certainly will fund them to go stronger in the future. (And now invents bad behavior even more) The challenge is this isn’t this Colonial’s problem. It’s the next one. At some point it will wake up the authorities to go after them more seriously too.
  • whimsicalism 5y ago
    Hardly, they regularly take much more than this. This is an organized criminal enterprise, I just read through a chatlog where they got $12 million and this is just one of many. $5m was 100% a lowball because of the geopolitical implications of this attack.
    • mathattack 5y ago
      Interesting. I hadn’t realized that the quiet payoffs were so high.
• stryker90 5y ago
  Please let them know about SIX-INDUSTRIES.COM we created the encryption technology that the NSA and u.s. military use, we also do a lot more! SIX-INDUSTRIES.COM David Cantrell - VP dcantrell@six-industries.com Phone: (480) 666-5510