Colonial Pipeline cyberattack

[Grey Havoc]

Cyber attack shuts down top U.S. fuel pipeline network

USA-PRODUCTS/COLONIAL PIPELINE (UPDATE 6, PIX):UPDATE 6-Cyber attack shuts down top U.S. fuel pipeline network

news.trust.org

Ransomware Cyberattack Forces Major US Pipeline Company to Halt Operations - Slashdot

"Colonial Pipeline, which accounts for 45% of the East Coast's fuel, said it has shut down its operations due to a cyberattack," reports ZDNet. "The attack highlights how ransomware and other cyberattacks are increasingly a threat to real-world infrastructure. "The company delivers refined...

it.slashdot.org

US fuel pipeline hackers 'didn't mean to create problems'

The US has relaxed rules on fuel transport after a ransomware cyber-attack took the pipeline offline.

www.bbc.co.uk

Colonial hack: How did cyber-attackers shut off pipeline?

Attacks on critical national infrastructure are an increasing concern, experts say.

www.bbc.com

Biden declares emergency after hackers shut down major US pipeline

Ransomware attack blames on DarkSide, an Eastern European-based criminal gang

www.telegraph.co.uk

Colonial Hackers Stole Data Thursday Ahead of Shutdown

(Bloomberg) -- The hackers who caused Colonial Pipeline to shut down the biggest U.S. gasoline pipeline on Friday began their blitz against the company a day earlier, stealing a large amount of data before locking computers with ransomware and demanding payment, according to people familiar with...

finance.yahoo.com

Gas Stations Run Dry as Pipeline Races to Recover From Hacking

(Bloomberg) -- Gas stations along the U.S. East Coast are beginning to run out of fuel as North America’s biggest petroleum pipeline races to recover from a paralyzing cyberattack that has kept it shut for days.From Virginia to Florida and Alabama, stations are reporting that they’ve sold out of...

news.yahoo.com

U.S. Gas Stations Run Dry As Pipeline Races To Recover From Hacking

Oil tanker charter rates skyrocketing in the U.S. with refiners scrambling for ships to store fuel that has nowhere to go. By Joe Carroll (Bloomberg) –Gas stations along the U.S. East Coast...

gcaptain.com

U.S. Blames Criminal Group in Colonial Pipeline Hack

DarkSide, a ransomware organization that researchers say is likely based in Eastern Europe, says it has no connection to foreign governments. The hack has led to the shutdown of the main pipeline supplying gasoline to the U.S. East Coast.

www.wsj.com

Colonial Hacker Group Seeks to Shift Blame for Ransomware

(Bloomberg) -- The Federal Bureau of Investigation attributed the massive Colonial Pipeline breach to ransomware created by a relatively new gang called DarkSide on Monday as new details emerged about the group accused of carrying out the attack.“The FBI confirms that the DarkSide ransomware is...

finance.yahoo.com

Pipeline Hackers Say They're 'Apolitical,' Will Choose Targets More Carefully Next Time - Slashdot

The criminal hacking group suspected of being behind the ransomware attack on the Colonial Pipeline, which was shut down as a precaution in response, has published a new statement on its dark web site saying it is "apolitical." From a report: "We are apolitical, we do not participate in...

news.slashdot.org

 

[edwest4]

If the United States wants to protect critical infrastructure from this then install some equipment to prevent this or take them offline and put them on a dedicated, monitored system.

 

[dannydale]

Or make an example of any company that approaches cybersecurity as a joke to be relentlessly defunded and laughed off the budget. There is no excuse whatsoever for this shit other than greed and laziness on the part of Colonial Pipeline's management and ownership.

People have gone to prison for life without parole for negligence that caused far less damage than this. It's time we apply this standard to cybersecurity and corporate management in general.

 

[Lc89]

Maybe I'll piss off many now, but how would this lockdown be handled if the Keystone XL canceled in January was currently up and running? (Obviously, without a hacker attack even on that pipeline and its plants)

 

[Archibald]

Dax is a quiet town of 20 000 souls in south-west France not too far from where I grew up. Recently some criminal arseholes paralyzed its hospital via a cyber attack. It was quite devastating and they are still recovering from it. All the patients digitalized files, the hospital complete network was wiped down for the count.
...
I suggest bringing back middle-ages "burning at the stake" for these hackers. Main problem: rotten shit surrounded by scum doesn't burn very well, plus the smell of it would poison the air and make people vomit for hundred of kilometers.

 

[TomS]

Maybe I'll piss off many now, but how would this lockdown be handled if the Keystone XL canceled in January was currently up and running? (Obviously, without a hacker attack even on that pipeline and its plants)

No impact. Colonial is a product pipeline delivering refined petroleum products to distribution centers. Keystone XL was a crude oil pipeline carrying unrefined petroleum to refineries.

 

[Orionblamblam]

I suggest bringing back middle-ages "burning at the stake" for these hackers.

While we can all agree with this, the reality is that the hackers are almost certainly nowhere that the cops could get to them even if the cops know where they are. Hacking is something that can be done on the far side of the planet.

Lets say you find out that the hackers are in, say, Kurdistan. Or Moscow. Or New Delhi. Whatcha gonna do about it?

What *might* eventually happen is that the worldwide internet breaks down into firewalled separate regional nets. Unlikely, apart from certain nations walling themselves off.

 

[Orionblamblam]

Maybe I'll piss off many now, but how would this lockdown be handled if the Keystone XL canceled in January was currently up and running? (Obviously, without a hacker attack even on that pipeline and its plants)

No impact. Colonial is a product pipeline delivering refined petroleum products to distribution centers. Keystone XL was a crude oil pipeline carrying unrefined petroleum to refineries.

This is true... but it also shows the *importance* of pipelines. When Colonial went down, the response was to start trucking fuel around. And it has clearly been wholly inadequate, and if it keeps going you'll see spills and crashes and fires. Keystone would have provided equivalent safety and efficiency over existing crude delivery systems.

 

[edwest4]

This is a national security issue. I suggest putting all critical infrastructure into a secure system under military supervision.

 

[dan_inbox]

What will it take to call up the federal governement on crass incompetence?
Just imagine what would happen if the Israeli govt was this bad...

Edit: I don't mean Trump or Biden, I mean the whole freaking institution with its zillions of generals

 

[TomS]

So, you know that right now, all the Feds are allowed to do for civilian cyber security is issue recommendations, right? They're actually forbidden from requiring specific cyber security measures from private companies, even in critical infrastructure sectors.

 

[Grey Havoc]

How did a cyber-attack lead to long queues for petrol in the US?

How did a cyber attack lead to a shortage of petrol in the US?

www.bbc.com

US petrol supplies tighten after Colonial Pipeline hack

Some petrol stations run out of fuel in the US southeast as the Colonial Pipeline remains shut.

www.bbc.com

 

[Grey Havoc]

Colonial Faces Deadline to Decide on Hacked Pipeline Restart

(Bloomberg) -- Colonial Pipeline Co. told federal officials it will know by late Wednesday whether it’s safe to restart gasoline and diesel flows that have been on hold since criminal hackers targeted the company last week.The promise comes as frustration grows among political leaders over scant...

finance.yahoo.com

 

[dannydale]

How did a cyber-attack lead to long queues for petrol in the US?

How did a cyber attack lead to a shortage of petrol in the US?

www.bbc.com

US petrol supplies tighten after Colonial Pipeline hack

Some petrol stations run out of fuel in the US southeast as the Colonial Pipeline remains shut.

www.bbc.com

Problem + Stupid People = Self-intensifying Problem. It's very rare that life really is this simple.

 

[PMN1]

There are videos floating around of people filling plastic bags with fuel....and at least one photo of a boot full of plastic bags filled with fuel.

The US Consumer Product Safety Commission put out this curt tweet four hours ago 'Do not fill plastic bags with gasoline.'

 

[Orionblamblam]

Stupid people filling their cars with gasoline fumes *and* liquid gasoline in bags that the gasoline will dissolve would seem to be both a problem *and* a solution all in one.

 

[edwest4]

Though undereported, the pipeline is partially operational after using manual controls.

 

[PMN1]

Though undereported, the pipeline is partially operational after using manual controls.

And physical inspection instead of remote monitoirng from what i have read.

 

[edwest4]

Why pay a human being anything when remote, computer connected controls can be used? And which can be hacked. Leaving manual controls in working order and sending in a human being to operate the line manually is the quick answer to such problems.

 

[TomS]

There are videos floating around of people filling plastic bags with fuel....and at least one photo of a boot full of plastic bags filled with fuel.

The US Consumer Product Safety Commission put out this curt tweet four hours ago 'Do not fill plastic bags with gasoline.'

And that video is at least a year old, unrelated to the current situation.

 

[Grey Havoc]

Florida, Virginia, Georgia, North Carolina declare emergency over fuel

The worst shortages were in North Carolina, where 9.7% of all stations were without fuel, according to Gas Buddy Tracker. Virginia was second hardest-hit, followed by Georgia.

www.dailymail.co.uk

Biden team moves swiftly to tackle pipeline political peril

The Biden administration swung aggressively into action after a primary gasoline pipeline fell prey to a cyberattack.

apnews.com

Colonial Pipeline restarts after hack, but supply chain won't return to normal for a few days

The Colonial Pipeline has restarted operations, after the system shut down on Friday in the wake of a ransomware attack.

www.cnbc.com

Colonial Pipeline has no plan to pay ransom to hackers -sources

USA-PRODUCTS/COLONIALPIPELINE-RANSOM (UPDATE 1):UPDATE 1-Colonial Pipeline has no plan to pay ransom to hackers -sources

news.trust.org

 

[Grey Havoc]

Hacker Group Behind Colonial Pipeline Attack Claims It Has Three New Victims - Slashdot

PolygamousRanchKid shares a report from CNBC: The hacker group DarkSide claimed on Wednesday to have attacked three more companies, despite the global outcry over its attack on Colonial Pipeline this week, which has caused shortages of gasoline and panic buying on the East Coast of the U.S...

it.slashdot.org

 

[sferrin]

I suggest bringing back middle-ages "burning at the stake" for these hackers.

While we can all agree with this, the reality is that the hackers are almost certainly nowhere that the cops could get to them even if the cops know where they are. Hacking is something that can be done on the far side of the planet.

Lets say you find out that the hackers are in, say, Kurdistan. Or Moscow. Or New Delhi. Whatcha gonna do about it?

What *might* eventually happen is that the worldwide internet breaks down into firewalled separate regional nets. Unlikely, apart from certain nations walling themselves off.

The toughest thing is not getting fooled. An attack could appear to come from Russia but actually originate in China. Don't know if it's possible to trace it all the way back to the source with certainty. If it is then tell the country it was launched from that going forward this kind of crap will be considered an attack on our country and respond accordingly. Don't care if some script kiddie flew to China and launched from there. Eventually these "hackers" would be so widely hated they'd probably be executed out of hand.

 

[Orionblamblam]

The toughest thing is not getting fooled. An attack could appear to come from Russia but actually originate in China. Don't know if it's possible to trace it all the way back to the source with certainty. If it is then tell the country it was launched from that going forward this kind of crap will be considered an attack on our country and respond accordingly. Don't care if some script kiddie flew to China and launched from there. Eventually these "hackers" would be so widely hated they'd probably be executed out of hand.

Then the thing to do would be for the MSS to hire a Russian hacker to launch a cyberattack on Wall Street from Murmansk. US retaliates against Russia, China sits back and receives praise and adulation from Disney.

 

[edwest4]

Ah... yes, of course.

In the alternative, add a function to Homeland Security, like securing critical infrastructure. Meanwhile, I doubt the NSA has this problem, and I suspect that they continue to monitor all electronic communications.

 

[riggerrob]

If this cyber-ransom was directed at Israeli gov't facilities, the guilty bastards would be quietly warned off and if they persisted would die untraceable deaths. See Nazi war criminals, Munich Olympics terrorists, Dr. Gerald Bull, etc. Mossad would leave zero evidence linking them to the assassinations.

 

[Grey Havoc]

Colonial Pipeline paid $5m ransom to cyberhackers

Fuel operator paid the ransom in untraceable cryptocurrency within hours of the attack despite reports it would not do so

www.telegraph.co.uk

 

[sferrin]

Colonial Pipeline paid $5m ransom to cyberhackers

Fuel operator paid the ransom in untraceable cryptocurrency within hours of the attack despite reports it would not do so

www.telegraph.co.uk

That stampeding sound you hear is every "hacker" group on the planet rushing to repeat this.

 

[sferrin]

The toughest thing is not getting fooled. An attack could appear to come from Russia but actually originate in China. Don't know if it's possible to trace it all the way back to the source with certainty. If it is then tell the country it was launched from that going forward this kind of crap will be considered an attack on our country and respond accordingly. Don't care if some script kiddie flew to China and launched from there. Eventually these "hackers" would be so widely hated they'd probably be executed out of hand.

Then the thing to do would be for the MSS to hire a Russian hacker to launch a cyberattack on Wall Street from Murmansk. US retaliates against Russia, China sits back and receives praise and adulation from Disney.

Yeah. Personally I think they should air-gap anything important from the internet. This would stop all but the most determined adversary. (See Iranian centrifuges.)

 

[edwest4]

The lack of imagination I'm seeing from this is staggering. If it's "Oh well, we'll just pay the money. It's still a better deal than keeping everything offline and manual." then they deserve the loss. It's their fault and the so-called hackers.

Meanwhile, the NSA has no idea about what's going on... And that $5 million went to a nonexistent address/location...

 

[QuadroFX]

Russians did it!

 

[TomS]

So, as I'm reading more, it's interesting that what seems to have been hacked is strictly the billing side of their system; there's no indication of a hack against the SCADA or control infrastructure. The pipeline shutdown was strictly precautionary (or because Colonial wasn't sure who and how much to bill for deliveries, if you're more cynical).

Air gapping sounds obvious, but it makes system operations really hard and expensive. The cost of building out and maintaining a dedicated network just to run a set of valves and pumping stations is non-trivial, compared to the cost of plugging those nodes into existing internet services. The more reasonable system would be to tunnel all that through a VPN and actually secure the VPN. Not cheap, but cheaper than a dedicated hardline network for each infrastructure system.

 

[edwest4]

Or perhaps it was launched from Ubombistan...

 

[dannydale]

Colonial Pipeline paid $5m ransom to cyberhackers

Fuel operator paid the ransom in untraceable cryptocurrency within hours of the attack despite reports it would not do so

www.telegraph.co.uk

Then they must be fined $500m, the bloody f███ing stupid fools!

 

[Grey Havoc]

Meanwhile, the NSA has no idea about what's going on

Congress wanted a blinded NSA. Well, they got it. (Note the echo of a gutted CIA in the 1970s.)

 

[edwest4]

I have no reason to believe that.

 

[Grey Havoc]

Biden says East Coast fuel shortages to end in days as pipeline reopens

U.S. President Joe Biden on Thursday reassured U.S. motorists that fuel supplies should start returning to normal this weekend, even as more filling stations ran out of gasoline across the Southeast nearly a week after a cyber attack on the nation's top fuel pipeline.

www.reuters.com

 

[_Del_]

Air gapping sounds obvious, but it makes system operations really hard and expensive

Seems like it would have potentially saved Colonial $5M this week alone.., and then we'll add up the economic disruption up and down the east coast. And paying it guarantees we'll be seeing more of this.

Sometimes, the straightest way is through the mud. For critical infrastructure and systems, I cannot see any cost savings being worth the exposure risk.

As an aside, I don't really want to live in a society where I wake up every day and wonder if the power and gas will work tomorrow because the utilities make it clear they would rather pay ransoms than pay for security.

 

[Grey Havoc]

U.S. retail gasoline shortages worsen as pipeline attempts restart

Shortages of gasoline at retail stations in the U.S. Southeast became more widespread on Thursday after days of panic buying triggered by a major pipeline shutdown that is now in the early stages of an attempted restart.

www.reuters.com

 

[drejr]

If this cyber-ransom was directed at Israeli gov't facilities, the guilty bastards would be quietly warned off and if they persisted would die untraceable deaths. See Nazi war criminals, Munich Olympics terrorists, Dr. Gerald Bull, etc. Mossad would leave zero evidence linking them to the assassinations.

So untraceable Steven Spielberg makes movies about them...

Israel may blow up a hacker's apartment in Gaza or retaliate in kind against Iran but these kinds of tactics have severe weaknesses.