22 ms·
It was a mistake to attack the business side of the oil company, because it created what could be sold as reasonable doubt to shut down the pipeline. As a resu
by bredren 5y ago
It was a mistake to attack the business side of the oil company, because it created what could be sold as reasonable doubt to shut down the pipeline.
As a result, the ransom had the optics of an attack on infrastructure. As evidenced by the coverage of Americans desperately filling up containers.
This created the impetus for the US to treat this as an incident far and above the ambient ransomware activities leading up to this.
It also gave the US an opportunity to show how effective it could be when it had the political cover to do so.
- geofft 5y agoI think the question is, how come an attack on a hospital does not have the optics of an attack on infrastructure? (It almost seems oil does not require infrastructure - you can, theoretically, prep for an oil infrastructure outage by storing it containers, same as you do with water and food. But you can't really prep for a medical infrastructure outage. Is it just that, as a result, there were no photos of people hoarding medical care and so there was less political will?)
- Denvercoder9 5y agoOil does require infrastructure. What you put in your car is several steps removed from what is pumped out of the ground.
- jkubicek 5y agoI think the parent's point was that if oil infrastructure is completely disrupted, consumers won't even be affected for a few days and the short-term consequences will be somewhat minor (some percentage of drivers won't be able to drive, deliveries may be delayed). If a hospital is shut down, then people will start dying immediately. The consequences are much more direct and severe.
- dbt00 5y agoI think this is simplistic and overlooks logistics and flexibility. If a hospital closes, patients can be moved. If there's no gas, patients can't get to any hospital.
- Karunamon 5y agoAt least in the cities I've lived in, there tends to be a lot of internetworking in the local hospitals. If my local hospital, CRMC, were to be hit by ransomware or otherwise taken down it's likely that a good chunk of the city's health infra would be out or at least at risk too. Not to mention the damage an attacker could do to the data stored in an EHR system like Epic.
- pixl97 5y agoWhat if you attack the hospital in the middle of, lets say a covid outbreak, where no excess capacity is available. Now you've likely caused a significant number of deaths.
- jkubicek 5y agoMy point (which wasn't well made, admittedly) is that a closed hospital has immediate and material effects. Disrupted petroleum infrastructure isn't going to affect consumers for days.
- 3GuardLineups 5y agololwut? this is insane. If oil infrastructure is completely disrupted it would be beyond catastrophic. Oil is completely foundational to our economy
- skeeter2020 5y agohospitals without IT don't just kill all their patients and shut down. They slow down and loose capacity and capability while the realtively low-tech business of doctoring continues.
- skynet-9000 5y agoNor can you store gasoline for long unless you stabilize it (and even then), and certainly not safely in most residences. Classic car owners run into this issue, as do the diesel tanks for generators in datacenters (diesel is much more stable than gasoline)
- meepmorp 5y ago> I think the question is, how come an attack on a hospital does not have the optics of an attack on infrastructure? An attack on a hospital affects someone if they work there or are using that hospital. A pipeline attack affects people who drive cars places and need gas. The latter group is much larger than the former.
- capableweb 5y agoMore apt comparison would be: Hospital affects workers who work there and people using that hospital VS Pipeline affects workers who work there and people currently refilling their cars with gas from there Or Hospital affects workers who work there and everyone within a radius who could need it at any moment VS Pipeline affects works who work there and people who generally rely on that gas to drive Suddenly the groups seems much similarly sized, while one being important for staying alive VS the other being a nice-to-have, if we consider it being offline for a week or two only. I know which one I would consider being worse if I was a country. But then we're also talking about a country who's fascination for oil is like no other, so this is hardly surprising.
- throwawayboise 5y agoSure it's "nice to have" unless it does go on longer and suddenly nobody can get to the stores to buy food and the stores don't have any food to sell because the trucks that deliver it can't get fuel.
- capableweb 5y agoThanks for expanding, that was exactly what I meant. Ok for smaller duration, while a hospital without functioning equipment is almost useless (compared to it's original status) immediately.
- SirSourdough 5y agoI mean, the pipeline in question provides half of the gas to the US East coast. You don’t have to love oil to see that losing 40% of the supply to more than 100m people overnight would be a public safety (what if emergency vehicles can’t buy fuel?) and economic risk. The number of people reliant on this pipeline is several orders of magnitude greater than would be impacted by taking a single hospital offline. You’d need to have many hospitals impacted to create a similar level of risk. The only big difference is that taking out hospital infrastructure can kill people immediately whereas the impact of a pipeline failure won’t generally be felt for days or weeks. Edit: Based on your other response it sounds like we are on the same page.
- blululu 5y agoOil is flowing constantly and continuously into every corner of the country. The storage capacity is negligible and the need is critical. Unlike a single hospital there is very little room to shift excess capacity relative to usage and the knock on effects are potentially catastrophic (we lose power to every hospital in 500 miles and nobody can run the generator).
- throwaway316943 5y agoDestroying logistic infrastructure is how you defeat a country. Petroleum is critical to the functioning of modern economies, if you cut that off things go badly. They really kicked the hornets nest on this one.
- Applejinx 5y agoIndeed: I have to think it was not a planned or desirable outcome to anybody. If the intended situation is to be able to (for instance) set up a coup attempt on the target country, have it come off well enough to produce chaos, and THEN have your tame cybercriminals knock out key infrastructure, that would be an extremely effective act of war. Freaking people out while not destroying the target country is a bad, bad misstep. They did indeed kick the hornets' nest, but so ineffectively that the best response would be to try and cover the whole thing up and pretend it was nothing. Might work for some, but I doubt the US government is amused.
- villasv 5y agoI agree with you that an attack on a hospital is an attack on infrastructure, though I disagree with your arguments regarding oil infrastructure. The difference is response is a matter of impact scale. Usually, the infrastructure of a small group of hospitals is at stake. This time an entire state is hoarding gasoline. Both are infrastructure but the latter is causing nationwide effects.
- rurban 5y agoBecause when you attack oil it will be considered as an act of war and they will counter with their war powers. Which they did. No civilian police action against Sergey followed, but military style seizures, bitmix closure and Bitcoin retrieval. This was not the FBI, but their criminal higher ups. Military style, with no civilian oversight. Which is somewhat disturbing, because first the industry is still considered more important than civil services (city councils, hospitals). And second they will still continue using Windows services in their backbones. I have nothing against using Windows as frontends, but in the backbone of a critical company it's criminal negligence. Easy to hack, no backups, untrained admins with no idea about security. Wasting billions on money on theatre, and not working servers, groupware and email.
- taylorfinley 5y agoI hate Windows with a firey passion and use linux top to bottom on all my projects and devices, but I have to disagree with you. Windows can be quite secure, as is evidenced by the last several decades of most corporate and military IT systems using it. Not having backups and untrained admins are platform agnostic security issues.
- deleted 5y ago[deleted]
- aerostable_slug 5y agoI think the point people are missing is that hospitals don't just stop providing services when they are hit by ransomware, at least not in my admittedly limited experience. There's a ton of paper involved even today and life could move on with ballpoint pens and forms. The game was changed when Colonial closed the valves and services were impacted.
- Scoundreller 5y agoAnd downtime procedures. They’re not perfect, but like pipelines, they existed and operated before computers.
- matmatmatmat 5y agoThere is actually a counterexample to this that is happening right now. The Scripps hospital system in San Diego was hit with ransomware about two weeks ago and has been more or less down since then. Patients are not able to make new appointments, medical records are unavailable. My understanding is that doctors are still seeing patients if they have existing appointments, but surgeries are getting performed at other hospitals in other health systems.
- myth_buster 5y agoCritical Infrastructure as Govt defines it https://www.cisa.gov/critical-infrastructure-sectors https://www.cisa.gov/critical-infrastructure-sectors
- Godel_unicode 5y agoI'm not sure what point this comment is trying to make, according to CISA emergency services are a critical infrastructure sector. Therefore attacks on hospitals are attacks on critical infrastructure just like a pipeline.
- myth_buster 5y agoFive distinct disciplines compose the ESS, encompassing a wide range of emergency response functions and roles: * Law Enforcement * Fire and Rescue Services * Emergency Medical Services * Emergency Management * Public Works Emergency Medical Services ≠ Hospital
- deleted 5y ago[deleted]
- jp57 5y agoIn addition to the other comments, there's a difference in scale here. Shutting down _a_ hospital would be like shutting down, say, several dozen gas stations in one part of a city. That would not have a lot of national visibility either. If they simultaneously shut down every hospital between Texas and New Jersey, it would have national optics.
- nonameiguess 5y agoHospitals themselves aren't really "infrastructure." All hospitals can operate independently from each other, so holding one for ransom only affects the one. If you can actually shut down a pipeline, you affect everywhere it ships to. Hospitals obviously do rely on infrastructure, so you'd see much more panic if someone could disrupt a national supply of blood plasma or insulin or something.
- munificent 5y agoImplicit in your question is the idea that the reason there was a stronger response here was because of optics—because a large mass of US citizens demanded it. I think a more likely answer is that optics had little to do with it. Attack a hospital and you've got angry hospital administrators mad at you. Attack an oil pipeline and you've got billionaire oil executives and shareholders who have much of the US government in their pocket mad at you. You really don't want to anger people who can buy US elections.
- manigandham 5y agoA single hospital is not major infrastructure. We can operate medical services out of tents if necessary. Oil pipelines that serve everything from energy to transportation to manufacturing are far more integral to keeping all aspects of society running for magnitudes more people.
- omgwtfbbq 5y ago>It also gave the US an opportunity to show how effective it could be when it had the political cover to do so. Not sure what you mean, what did the US do exactly?
- twobitshifter 5y agoThese guys retweeted the story. They didn’t claim responsibility but it’s a tacit acknowledgment of their involvement. https://en.m.wikipedia.org/wiki/780th_Military_Intelligence_Brigade_(United_States) https://en.m.wikipedia.org/wiki/780th_Military_Intelligence_... https://mobile.twitter.com/TheRecord_Media/status/1393192862326607872 https://mobile.twitter.com/TheRecord_Media/status/1393192862...
- tgsovlerkhgsel 5y agoCalled it here: https://news.ycombinator.com/item?id=27101406 https://news.ycombinator.com/item?id=27101406
- adrr 5y agoRussia allows their FSB operatives to moonlight on the side. Darkside hackers could be government operatives and an attack on critical infrastructure is an act of war. It is the same as bombing the pipeline if infrastructure is disabled. I am sure the cyber insurance provider won’t pay and say it was an act of war by a foreign government. It always a grey area.
- Godel_unicode 5y agoDo you have any extraordinary evidence for these extraordinary claims?
- onetimemanytime 5y agoVery few doubt that FSB and Russian mafia are one.
- Godel_unicode 5y agoEven if it's true that very few doubt it, that doesn't mean it's true that they are. See also: https://en.m.wikipedia.org/wiki/Argumentum_ad_populum https://en.m.wikipedia.org/wiki/Argumentum_ad_populum
- jascii 5y agohttps://bpr.berkeley.edu/2019/12/16/gangs-and-gulags-how-vladimir-putin-utilizes-organized-crime-to-power-his-mafia-state/ https://bpr.berkeley.edu/2019/12/16/gangs-and-gulags-how-vla...
- eevilspock 5y agothose few are all here downvoting you?
- Der_Einzige 5y agoIt's not possible to bring "extraordinary" evidence of a 3 letter agency doing this kind of shit the way some HN user would want without ending up as a political prisoner somewhere learning all about the meaning of the word "pain". Never-the-less, I have no doubt that FSB operatives are allowed to moonlight.
- tantalor 5y ago> business side of the oil company What are the sides of any company other than "business"?
- JohnTHaller 5y agoI think parent may mean infrastructure side. If it had just attacked the office side of things, it would be the usual 'company infected with ransomware' story without affecting the public.
- tantalor 5y agoMy understanding is they did limit the attack to the office side: > After Colonial Pipeline reported that its corporate computer networks were hit by the ransomware attack, the company shut down the pipeline as a precaution due to a concern that the hackers might have obtained information allowing them to carry out further attacks on vulnerable parts of the pipeline. https://en.wikipedia.org/wiki/Colonial_Pipeline_cyberattack https://en.wikipedia.org/wiki/Colonial_Pipeline_cyberattack
- bostik 5y agoThe truly cynical take is that they managed to take down Colonial's billing. In response, Colonial shut down the pipeline - because obviously delivering oil without getting paid is out of the question. Yes, it's guesswork and pretty extreme conjecture but it has just the right amount of coldheartedness to it: https://zetter.substack.com/p/biden-declares-state-of-emergency https://zetter.substack.com/p/biden-declares-state-of-emerge...
- miles 5y agoThe Colonial Pipeline Is Finally Back Online and Pumping Gas https://www.thedrive.com/news/40583/the-colonial-pipeline-is-finally-back-online-and-pumping-gas https://www.thedrive.com/news/40583/the-colonial-pipeline-is... > New details from within Colonial Pipeline have come to light surrounding the decision to shut off supply. Those briefed on the matter have suggested that fuel flows were shut down due to the company's billing system being compromised. Company officials were reportedly concerned that they would not be able to accurately bill customers for fuel delivered, and chose to stop delivery instead.
- TrackerFF 5y agoI got downvoted for saying that maybe it's time to treat serious ransomware attacks (infrastructure, security, health, etc.) as terrorism - as in the sense that they're a threat to the national security. But this kinda shows the response I was referencing to. A lot of people like to think of ransomware attacks as the ultimate stress test as far as security goes, and thus a good thing - but let's not get too blinded by our professions (most probably in tech), these kinds of attacks can have serious consequences: Imagine if some foreign state agency (masquerading as hackers) launches a multiheaded attack on, say, utilities plants - in the middle of the winter. The victims/targets will pay whatever us necessary. With that said, I understand that many people will recoil at such things - we saw what the patriot act did, and how easy it is to overstep and abuse such laws, in the name of "national security". But it is a serious problem, in the same way actual piracy thrived in the gulf of Aden, as soon as the shipping companies started paying.
- vkou 5y agoTerrorism is a non-state use of violence for political aims. Ransomware is non-state, not violent, and is done for economic, not political aims.
- waihtis 5y ago> non-state > economic, not political There’s a well known phenonenom of a certain large nation harbouring cybercrime gangs and keeping them on the government leash. Their economic activity benefits the governments political agenda. Ergo all conditions are true.
- vkou 5y agoThere's also a well-known phenomena of large nations harboring multi-national corporations that break the law in other nations they operate in. That doesn't mean that the large, developed nations in question are engaging in organized crime. Taking advantage of regulatory arbitrage does not mean that their government is in collusion with them. If it did, then we could pile a lot of crimes at the feet of Western governments. Some mining firm violently puts down a strike in Central America? Clearly, we can conclude that Canada/the US is engaging in terrorism! [1] [1] https://digitalcommons.osgoode.yorku.ca/cgi/viewcontent.cgi?referer=https://www.google.com/&httpsredir=1&article=1272&context=all_papers https://digitalcommons.osgoode.yorku.ca/cgi/viewcontent.cgi?... [2] [2] 28 Canadian companies, 44 deaths, 30 of which were targeted extra-judicial killings. Are we going to lay those at the feet of Parliament, too? [3] [3] Or do we have one set of standards for Russia, and another for our own behaviour?
- normac2 5y ago> This created the impetus for the US to treat this as an incident far and above the ambient ransomware activities leading up to this. And why would you say this is desirable to the US? Just general "governments take advantage of crises to gain power" reasons?
- gzer0 5y agoWhat? This makes no sense. The hacker group attacked resources considered "critical infrastructure"; this was closer to an act of war than any other cyber attack has come. The US Cyber Command responded swiftly. > "governments take advantage of crises to gain power" Please, elaborate? I fail to see how the US Govt is taking advantage of this crisis for more power.
- normac2 5y agoWithout breaking down my reasoning (which was pretty half-baked and underthought)--I was just trying to understand the OP's point. OP used all kinds of language we associate with governments doing sketchy stuff: "what could be sold as reasonable doubt to shut down the pipeline"; "created the impetus" ("impetus" is often used to claim the real motivations were something else); "political cover"; etc. I just didn't know how else to interpret all the cloak-and-dagger language about the US's behavior. Personally, it seems to me like our response was pretty reasonable. I think the "government takes advantage of crises" line of argument only goes so far, and at its extreme leads to dumb stuff like 9/11 truthers.
- rini17 5y agoIt was a mistake to attack overtly. I believe $5 million can be easily drained covertly and inconspicuously from megacorporations. I'm pretty sure it's actually happening we just don't hear about it.
- spoonjim 5y agoI don’t think the criminals wanted it overt. They weren’t expecting the pipeline to be shut down which is what made everything public.
- asperous 5y agoThere’s a huge network of financial controls to prevent and detect this sort of thing, it’s one of the foundations of the fields of accounting. Often there are departments looking for fraud regularly. I suspect small or medium organizations rather then megacorps would be easier targets if they haven’t invested money in accounting controls.
- dannyw 5y agoA $5m covert negotiation with the USG has a decent chance of securing the desired payout. Plenty, if not all, corporate level financial controls will be bypassed by the executive branch showing up in suits.
- vasco 5y agoIt didn't work in Office Space.
- this_user 5y agoThe fact that their coins were apparently easily stolen also debunks another favourite talking point of the crypto people that it secures your money from government access. Clearly, ways and means have been developed to do just that if necessary.
- RandallBrown 5y agoIf you store your coins on a hard drive there's nothing the government can do to get them right? They would need your private key and your hard drive?
- Teknoman117 5y agorelevant xkcd: https://xkcd.com/538/ https://xkcd.com/538/
- ac29 5y agoIf you anger a sufficiently powerful nation-state, you should assume all options are on the table for recovering you, your hard drives, and your keys.
- deleted 5y ago[deleted]
- tartoran 5y agoThe hiding crypto from government entails im large part avoiding taxes, yet it seems like the government does not do much to recover lost taxes on current schemes such as fiscal paradises and so on. I doubt the governemnt would go as far as locating a harddrive, seizing it just for tax purposes. Something else must raise their flags for them to go that route. Also this route is very hit and miss in my oppinion and on a case by case basis
- ethbr0 5y ago"Does not" and "cannot" are two different things. My read is that tax enforcement failure is intentional, lubricated by political donations and influence, vs incompetence. See the high-net-worth enforcement group at the IRS that was quickly shut down for murky reasons.
- walshemj 5y agoRipping of the average middle America Jack and Hortense is one thing - start impinging on CNI and your playing big boy and girl games.
- 867-5309 5y ago>Servers were seized (country not named) >gave the US an opportunity to show how effective it could be unless you know something we don't, that's quite a conclusion to jump to
- neither_color 5y agoThe more cynical part of me thinks the key is not which side of the company was attacked, rather the fact that it was an OIL company. The US has basically an unlimited budget and resources to go after organizations that mess with its oil supply.
- manigandham 5y agoIt was an attack on infrastructure. Motives don't matter. This is no different than physically breaking the pipeline and saying you were just testing the material strength, it's the same outcome and will have similar consequences.
- refurb 5y agoYup. This falls under the idea of “optics”. Often HN tends to dismiss it in favor of logics “well, the problem is actually quite small”. What matters is the perception of the problem. Just like with The Silk Road. Once it became large enough and Ross started to taunt the authorities to find him, the police had no choice. It’s continuing existence chipped away the legitimacy of the authorities, they had to shut it down just to maintain appearances. Just like this ransom ware. Keep it small, it’s not worth going after. Start screwing with the economy and the govt goes from 0 to 10 very quickly.