3 ms·

From what I understand, the hackers never got anywhere near the control systems. The systems they compromised were related to billing and probably the company's

From what I understand, the hackers never got anywhere near the control systems. The systems they compromised were related to billing and probably the company's sharepoint and emails (hard to think what else the could make up the balance of the 100GB outside of the monitoring of the control systems). You could still slow down attacks like this by limiting bandwidth (though 8kbits might be painful for document sharing). However, if you limited users a _slightly_ more reasonable 1 megabit per second, they'd be able to complete their exfiltration in within a little over 9 days. Keep in mind, Colonial only learned of the attack after the ransom demand was made!

rapjr9 5y ago
The article says the ransomware message appeared on a computer in the control room. That seems strange, do the pipeline operators adjust fuel flow based on how much cash is coming in? Is this a common practice? Or maybe it was not the billing system that was compromised? I guess it is possible billing would be used to predict required flow rate in some way, but that means any hack of the internet connected billing system has a direct route to controlling fuel flow in the pipeline, which seems rather dangerous. Post some fake orders and suddenly there are millions of gallons of fuel wherever you say they should be. Does the pipeline also run in reverse? If not it then that fuel could be stranded.
- cesarb 5y ago
  > The article says the ransomware message appeared on a computer in the control room. That seems strange That computer was probably their "office" computer, which they would use for things like email. From what I understood from the article ("[...] an employee in Colonial’s control room saw a ransom note demanding cryptocurrency appear on a computer just before 5 a.m. The employee notified an operations supervisor who immediately began to start the process of shutting down the pipeline, [...]. By 6:10 a.m., the entire pipeline had been shut down"), the supervisor made the sensible decision of immediately starting an orderly shutdown of the pipeline, before the thing propagated to their control computers; as can be seen by the timing, doing an orderly shutdown takes a while.

rapjr9 5y ago

The article says the ransomware message appeared on a computer in the control room. That seems strange, do the pipeline operators adjust fuel flow based on how much cash is coming in? Is this a common practice? Or maybe it was not the billing system that was compromised? I guess it is possible billing would be used to predict required flow rate in some way, but that means any hack of the internet connected billing system has a direct route to controlling fuel flow in the pipeline, which seems rather dangerous. Post some fake orders and suddenly there are millions of gallons of fuel wherever you say they should be. Does the pipeline also run in reverse? If not it then that fuel could be stranded.

cesarb 5y ago
> The article says the ransomware message appeared on a computer in the control room. That seems strange That computer was probably their "office" computer, which they would use for things like email. From what I understood from the article ("[...] an employee in Colonial’s control room saw a ransom note demanding cryptocurrency appear on a computer just before 5 a.m. The employee notified an operations supervisor who immediately began to start the process of shutting down the pipeline, [...]. By 6:10 a.m., the entire pipeline had been shut down"), the supervisor made the sensible decision of immediately starting an orderly shutdown of the pipeline, before the thing propagated to their control computers; as can be seen by the timing, doing an orderly shutdown takes a while.