4 ms·

Perhaps they didn't count on their target's profit motive being so strong that the pipeline owners were willing to cause fuel shortages and panic hoarding becau

Perhaps they didn't count on their target's profit motive being so strong that the pipeline owners were willing to cause fuel shortages and panic hoarding because they wouldn't be able to add the dollars and cents while sorting out their response.

OminousWeapons 5y ago
Or they didn't understand the degree of consolidation in the industry. Its quite possible they hit the pipeline operators without understanding the level of service outage they would cause.
- khafra 5y ago
  Antifragility advocates might say the occasional ransomware attack on infrastructure could be a good thing, in the long run, if it promotes a more resilient, less just-in-time based economy. Like Amazon's chaos monkey, but for whole economic sectors.
  - bluGill 5y ago
    Just in time is good for the economy, however like everything else there are downsides that need to be managed.
  - ______- 5y ago
    Good comment about this very thing here: https://news.ycombinator.com/item?id=27099862 https://news.ycombinator.com/item?id=27099862 > It's just a variation of the Normalization of Deviance. See this[1] short talk by Richard Cook for a very good explanation of the mechanism that causes the transition from "robust" to "superfluous". [1] https://www.youtube.com/watch?v=PGLYEDpNu60 https://www.youtube.com/watch?v=PGLYEDpNu60
  - 20after4 5y ago
    The chaos monkey(1) originated at Netflix. 1. https://netflix.github.io/chaosmonkey/ https://netflix.github.io/chaosmonkey/
BoiledCabbage 5y ago
Supposedly they paid it, but the provided decryption routine was so incredibly slow that they realized it was faster to restore from backup. Not sure how that works, but is what I read.
- not2b 5y ago
  That doesn't make much sense; if they had adequate backups and could restore from them without getting the decryption key or code, why would they pay?
  - bluGill 5y ago
    Two possibilities: They knew restoring from backups is slow, so they wanted a shortcut. They knew there was data (ie from the day of the attack) not in the backups. Take your pick - or not, I have no idea if the claim is even true.
  - andrewla 5y ago
    (Caveat: I know absolutely nothing about this particular situation) Paying would make sense because if there was a vulnerability uncovered by the initial exploit (that is, account information compromised by the initial phishing attempt) then it is perfectly possible that the restored version will be easily exploitable by the same group. I remember this being the case back in SQL Slammer days -- you could restore from backup but your backup would be infected within minutes.
  - shalmanese 5y ago
    Modern ransomware teams also threaten to leak your data onto the public internet unless you pay.
    - saagarjha 5y ago
      Free decryption, you mean ;)
  - burnished 5y ago
    I'm not 100% on this, but my understanding is that it was worthwhile due to the vast amount of money involved in the oil industry and the projected time to restore from backup.

OminousWeapons 5y ago

Or they didn't understand the degree of consolidation in the industry. Its quite possible they hit the pipeline operators without understanding the level of service outage they would cause.

khafra 5y ago
Antifragility advocates might say the occasional ransomware attack on infrastructure could be a good thing, in the long run, if it promotes a more resilient, less just-in-time based economy. Like Amazon's chaos monkey, but for whole economic sectors.
- bluGill 5y ago
  Just in time is good for the economy, however like everything else there are downsides that need to be managed.
- ______- 5y ago
  Good comment about this very thing here: https://news.ycombinator.com/item?id=27099862 https://news.ycombinator.com/item?id=27099862 > It's just a variation of the Normalization of Deviance. See this[1] short talk by Richard Cook for a very good explanation of the mechanism that causes the transition from "robust" to "superfluous". [1] https://www.youtube.com/watch?v=PGLYEDpNu60 https://www.youtube.com/watch?v=PGLYEDpNu60
- 20after4 5y ago
  The chaos monkey(1) originated at Netflix. 1. https://netflix.github.io/chaosmonkey/ https://netflix.github.io/chaosmonkey/

BoiledCabbage 5y ago

Supposedly they paid it, but the provided decryption routine was so incredibly slow that they realized it was faster to restore from backup. Not sure how that works, but is what I read.

not2b 5y ago
That doesn't make much sense; if they had adequate backups and could restore from them without getting the decryption key or code, why would they pay?
- bluGill 5y ago
  Two possibilities: They knew restoring from backups is slow, so they wanted a shortcut. They knew there was data (ie from the day of the attack) not in the backups. Take your pick - or not, I have no idea if the claim is even true.
- andrewla 5y ago
  (Caveat: I know absolutely nothing about this particular situation) Paying would make sense because if there was a vulnerability uncovered by the initial exploit (that is, account information compromised by the initial phishing attempt) then it is perfectly possible that the restored version will be easily exploitable by the same group. I remember this being the case back in SQL Slammer days -- you could restore from backup but your backup would be infected within minutes.
- shalmanese 5y ago
  Modern ransomware teams also threaten to leak your data onto the public internet unless you pay.
  - saagarjha 5y ago
    Free decryption, you mean ;)
- burnished 5y ago
  I'm not 100% on this, but my understanding is that it was worthwhile due to the vast amount of money involved in the oil industry and the projected time to restore from backup.