Colonial Pipeline cyberattack
- Thread starter Grey Havoc
- Start date
- Joined
- 16 April 2008
- Messages
- 9,191
- Reaction score
- 13,169
The hacking group DarkSide has been pretty open about their involvement, I believe. Yes, likely based in Russia (or possibly Eastern Europe). Probably not working at the direction of the Russian government, in this incident. But Russia has a habit of ignoring the activities of hacking groups like this unless they are dumb enough to target a Russian entity. And it isn't shy about enlisting such groups in support of Russian government objectives from time to time.
DarkSide seems to have manufactured the tools, but someone else bought them and used them. That someone else could have been the Russian government, the Chinese government, a Jihadi terrorist organization, a supervillain, an ecoterrorist faction, one of the pipeline operators competitors, a disgruntled former employee, a politician looking to bring down fossil fuels, a politician looking to strengthen fossil fuel infrastructure, or just some Bitcoin millionaire teens doing it for the lulz. Hell, it could even be the CIA or NSA or Homeland Security checking to see how vulnerable the infrastructure really is.
- Joined
- 16 April 2008
- Messages
- 9,191
- Reaction score
- 13,169
The way I understand DarkSide's MO is that they actually conduct the hacks using their tools, but the target selection is done by someone else. And I think the communications we've seen are very consistent with it being a straight up criminal enterprise. Whoever was working with DarkSide found a target that seemed like it had money. If it were ideological, we'd have gotten a manifesto by now.
A possible scenario:
Hello. This the anonymous hacker group. We need to use your services.
"How can we help?'
We need to send untraceable cryptocurrency to an untraceable address.
"No problem. There will be a fee of 5% of the total. Agreed?"
Hello. This the anonymous hacker group. We need to use your services.
"How can we help?'
We need to send untraceable cryptocurrency to an untraceable address.
"No problem. There will be a fee of 5% of the total. Agreed?"
- Joined
- 11 February 2007
- Messages
- 2,202
- Reaction score
- 3,306
Last Friday, Colonial Pipeline. This Friday, the Irish Health Authority:
(It's the correct link, it's an entry within the Guardian's live Covid blog which is why the headline is off, there's a follow up story later in the same blog)
www.theguardian.com
ETA the second link, which declares "An international cybercrime gang behind Ireland's ransomware attack"
www.theguardian.com
Sounds like we're looking for someone who has Friday off work or (considering typical hackers) school/college.
(It's the correct link, it's an entry within the Guardian's live Covid blog which is why the headline is off, there's a follow up story later in the same blog)
Second pandemic year to be deadlier than first, warns WHO – as it happened
WHO chief asks countries to donate jabs instead of vaccinating children; India variant behind Germany decision
ETA the second link, which declares "An international cybercrime gang behind Ireland's ransomware attack"
Second pandemic year to be deadlier than first, warns WHO – as it happened
WHO chief asks countries to donate jabs instead of vaccinating children; India variant behind Germany decision
Sounds like we're looking for someone who has Friday off work or (considering typical hackers) school/college.
Last edited:
2 Actions US Must Take in Wake of Colonial Pipeline Crisis
The Colonial Pipeline crisis has taught us that we must protect our infrastructure from future cyberattacks.
dannydale
ACCESS: Top Secret
- Joined
- 13 May 2007
- Messages
- 545
- Reaction score
- 409
Darkside ransomware gang says it lost control of its servers & money a day after Biden threat
A day after US President Joe Biden said the US plans to disrupt the hackers behind the Colonial Pipeline cyberattack, the operator of the Darkside ransomware said the group lost control of its web servers and some of the funds it made from ransom payments.
Attachments
Darkside ransomware gang says it lost control of its servers & money a day after Biden threat
A day after US President Joe Biden said the US plans to disrupt the hackers behind the Colonial Pipeline cyberattack, the operator of the Darkside ransomware said the group lost control of its web servers and some of the funds it made from ransom payments.therecord.media
Yeah, I wouldn't bet large sums on that. "Oh, no, your feeble attempt to reign us in has destroyed us! I guess we're ruined and done! No need for you to bother with us anymore! it's okay to let your guard down, even for a moment!"
dannydale
ACCESS: Top Secret
- Joined
- 13 May 2007
- Messages
- 545
- Reaction score
- 409
I wouldn't bet on it either, but it's still absolutely hilarious. These clowns will be back some way or another.
- Joined
- 9 October 2009
- Messages
- 21,147
- Reaction score
- 12,277
US fuel pipeline 'paid hackers $5m in ransom'
Reports say Colonial Pipeline paid cyber-criminal gang DarkSide a ransom to prevent a data leak.
www.bbc.com
- Joined
- 16 April 2008
- Messages
- 9,191
- Reaction score
- 13,169
Yes, it is legal, except in kidnappings. And companies routinely do pay in overseas kidnappings too.
National security has not been significantly endangered here. The vast majority of the problem right now is people panic buying gas they don't need. Colonial compounded the situation by shutting down when the only thing that was compromised was their billing system. The pipeline itself was always operable.
- Joined
- 9 October 2009
- Messages
- 21,147
- Reaction score
- 12,277
Gas crunch from cyberattack intensifies in nation's capital
Gas shortages have spread from the South, almost exhausting supplies in Washington, D.C. The runs on gasoline follow a ransomware attack that forced the nation’s largest gasoline pipeline to shut down.
apnews.com
Cyberattack on Pipeline Shows How Jones Act Is Threat to National Security
The Colonial Pipeline cyberattack is a clear example of why the century-old Jones Act should be repealed by Congress.
- Joined
- 9 October 2009
- Messages
- 21,147
- Reaction score
- 12,277
Fears of another hack on fuel pipeline as communications are ‘down’
COLONIAL Pipeline was hit by a network outage on Tuesday but the company said the issue was not the result of another hack. Colonial’s communications system went down this morning, less than …
www.the-sun.com
1635yankee
Recovering aeronautical engineer
- Joined
- 18 August 2020
- Messages
- 487
- Reaction score
- 626
Cybersecurity costs money right now and every day that it's in use. This may include using one's one employees instead of overseas contractors (when I did software development for an Electric Boat sub-contractor, the sub-contractor wanted to move as much development as possible overseas. EB resisted, at least at that time, but Bath Iron Works, with the same sub-contractor, didn't), paying them more than "competitive" wages, treating them well, not as a commodity as disposable as used toilet paper, and and possibly using heavily encrypted networks, high-security operating systems, and carefully including internal firewalls as well as external. In the case of Colonial, there should have been no way for a properly designed system to permit a connection between accounting or personnel's computer systems and the pipeline's physical operations. And watch your inputs.
Primary monitoring and control: Network based, modern, computerized, great, I like it. If hacked or system is down for any other reason, manual backup for pumping and distributing fuel with radio-type communications perhaps? I in a national emergency, pump and distribute fuel by any means possible, we used to accomplish this before computers and networks decades ago, just amazing, redundancy for critical systems/infrastructure, boy, have we lost our way???
- Joined
- 9 October 2009
- Messages
- 21,147
- Reaction score
- 12,277
View: https://twitter.com/MarshaBlackburn/status/1394791971500265474
www.thetimes.co.uk
(Subscription or Registration may be required)
www.nbcnews.com
Biden sidesteps row with Russia by giving nod to Nord Stream 2 gas pipeline
President Biden has pulled back from a confrontation with Russia over its Nord Stream 2 gas pipeline to Germany, approving the project despite years of US opposition.To avoid souring relations with Germany, the Biden administration decided to waive sanctions that had been recommended on the company
www.thetimes.co.uk
Biden under fire after waiving sanctions on Russian gas pipeline firm
Republicans accused Biden of placating German Chancellor Angela Merkel and handing Russian President Vladimir Putin a geopolitical win.
www.nbcnews.com
Last edited:
The pipelines have manual controls. Switching to a manual system for segregating and directing the wide variety of fuels a pipeline carries to the right place (losing an invoice system obviously throws this into confusion) and manually inspecting for damage after a possible attack takes time.
The fuel shortages were only indirectly caused by the pipeline shutdown in any case - the increased demand of panic-buying meant that local tank farms couldn't resupply gas stations fast enough. This was exacerbated by the persistent nation-wide trucker shortage.
Last edited:
- Joined
- 16 April 2008
- Messages
- 9,191
- Reaction score
- 13,169
So, interesting to see that there were no actual cybersecurity regulations in place for pipelines. I'm quite sure the pipeline operators had pushed hard to prevent a mandate before this event. They probably still will fight to ensure that there are no regulatory "teeth" behind whatever regs are applied.
- Joined
- 9 October 2009
- Messages
- 21,147
- Reaction score
- 12,277
DHS To Issue First Cybersecurity Regulations for Pipelines After Colonial Hack - Slashdot
The Department of Homeland Security is moving to regulate cybersecurity in the pipeline industry for the first time in an effort to prevent a repeat of a major computer attack that crippled nearly half the East Coast's fuel supply this month -- an incident that highlighted the vulnerability of...
news.slashdot.org
TSA orders pipeline companies to disclose breaches after Colonial hack
The new rule underscores Biden officials’ impatience with voluntary industry partnerships and nonbinding guidance.
www.politico.com
dannydale
ACCESS: Top Secret
- Joined
- 13 May 2007
- Messages
- 545
- Reaction score
- 409
Good, they asked for it. Regulate them into a fine paste.DHS To Issue First Cybersecurity Regulations for Pipelines After Colonial Hack - Slashdot
The Department of Homeland Security is moving to regulate cybersecurity in the pipeline industry for the first time in an effort to prevent a repeat of a major computer attack that crippled nearly half the East Coast's fuel supply this month -- an incident that highlighted the vulnerability of...news.slashdot.org
TSA orders pipeline companies to disclose breaches after Colonial hack
The new rule underscores Biden officials’ impatience with voluntary industry partnerships and nonbinding guidance.
- Joined
- 9 October 2009
- Messages
- 21,147
- Reaction score
- 12,277
US To Give Ransomware Hacks Similar Priority as Terrorism - Slashdot
The U.S. Department of Justice is elevating investigations of ransomware attacks to a similar priority as terrorism in the wake of the Colonial Pipeline hack and mounting damage caused by cyber criminals, a senior department official told Reuters. From the report: Internal guidance sent on...
news.slashdot.org
US recovers most of ransom paid after Colonial Pipeline hack
The Justice Department has recovered the majority of a multimillion-dollar ransom payment to hackers after a cyberattack that caused the operator of the nation’s largest fuel pipeline to halt its operations last month.
apnews.com
- Joined
- 9 October 2009
- Messages
- 21,147
- Reaction score
- 12,277
Ransomware Struck Another Pipeline Firm -- and 70GB of Data Leaked - Slashdot
When ransomware hackers hit Colonial Pipeline last month and shut off the distribution of gas along much of the East Coast of the United States, the world woke up to the danger of digital disruption of the petrochemical pipeline industry. Now it appears another pipeline-focused business was also...
it.slashdot.org
- Joined
- 9 October 2009
- Messages
- 21,147
- Reaction score
- 12,277
France tells Brussels to shut out the City after 2025
France has escalated its battle to shut out the City of London from the EU’s financial markets, calling for British clearing houses to be barred from 2025.
www.telegraph.co.uk
- Joined
- 9 October 2009
- Messages
- 21,147
- Reaction score
- 12,277
From yesterday, via Stuart Galbraith over at TankNet:
www.securityweek.com
European Oil Port Terminals Hit by Cyberattack
Major oil terminals in some of Western Europe's biggest ports have fallen victim to a cyberattack.
1635yankee
Recovering aeronautical engineer
- Joined
- 18 August 2020
- Messages
- 487
- Reaction score
- 626
Well, we do have some oil. Certainly not enough to be completely independent of imports, but it would help if government policy hadn't encouraged profligacy for decades.
I would presume (hope!) that the US has some offensive cyber attack capability that could be deployed against some Russian pipelines, preferably showing the attack is coming from China or North Korea.
- Joined
- 3 June 2011
- Messages
- 17,929
- Reaction score
- 11,110
That was sarcasm.
www.bbc.com
Under Trump we were close to, if not entirely, energy independent. Also we were holding up Russia's Nord Stream 2 pipeline.
Nord Stream 2: Trump approves sanctions on Russia gas pipeline
The Trump administration fears the Nord Stream 2 project will increase Russia's influence in Europe.
www.bbc.com
Last edited:
It is currently completely implausible for Xi's state hackers, let alone Kims', to attack Putin's kleptocracy in any way. Too many aligning interests; not to say these actors are above double crossing anyone (think Molotov-Ribbentrop treaty) but I just can't think of what would motivate them to do so just now. Perhaps if Putin's Ukraine campaign backfires so badly that Russia has a leadership crisis (not an insignificant possibility) there will be opportunities for China but even so, impossible to say how taking advantage of those might manifest. China is not without its vulnerabilities when it comes to the availability of energy.
The US does have some very extensive capabilities but the rules of reciprocity and symmetry don't apply as well to cyber influencing operations (or even destructive acts) as other means. Oil being largely fungible complicates the proposition further; as long as Russia, as an another oil producer, remains effectively in the same market space as the US the effects of driving up prices through attacks differ somewhat for the actors involved. Putin's oligarchs (a state within a state) and Russia's national wealth funds are very dependent on both the price of oil (and natural gas) and their ability to export those; to a certain extent some mayhem benefits them. Their delivery infrastructures toward Europe and Asia, I think, are wholly separate affairs. There are reasons why Russia's attacks on US's and EU's systems have still been "plausibly deniable" (if only just, outsourcing to "ransomware gangs" which has also served as cover for actual destructive operations against Ukraine). All of this doesn't bode well for a simple tit-for-tat approach though it must be said we've already stretched the concept of strategic patience with this behavior into absurd dimensions. Biden's administration is currently hurriedly arranging for sufficient energy availability for Europe if Putin's actions warrant the truly exclusionary sanctions it now seems they will, perhaps that will simplify matters with regard to considering the ramifications of using offensive cyber operations somewhat.
Also it must be said that using cyber capabilities does also most likely expire them quickly; it's not fire and forget but "fire and rebound". One would better have a surefire defense ready for a weapon oneself deploys. Sadly in the past decades there have been many examples of latent capabilities that were not used extensively being leaked through data mismanagement, lax security protocols and, let's say, "human factors". These were soon used against western democracies themselves.
Thanks to efforts largely done under President Obama. The question of 'energy independence' is also more nuanced and indeed, the perceived drop can be attributed in part to the difference between demand and supply ramp ups. I suggest you read the likes of the following:
Is The U.S. Energy Independent?
Did we lose our energy independence under President Biden? It's complicated.
www.forbes.com
- Joined
- 3 June 2011
- Messages
- 17,929
- Reaction score
- 11,110
I read that very article, hence: "close to, if not entirely, energy independent". In either case, it's gone now. Many drilling locations in the gulf have been shut down and auctioned off (apparently drilling in the gulf is okay as long as we're not the ones doing it), Keystone pipeline - dead, and other restrictions adopted by the Biden administration to put the squeeze on oil in the US.Thanks to efforts largely done under President Obama. The question of 'energy independence' is also more nuanced and indeed, the perceived drop can be attributed in part to the difference between demand and supply ramp ups. I suggest you read the likes of the following:
Is The U.S. Energy Independent?
Did we lose our energy independence under President Biden? It's complicated.
US auctions off oil and gas drilling leases in Gulf of Mexico after climate talks
Biden administration launching auction of more than 80m acres for fossil fuel extraction that experts call ‘incredibly reckless’
I'm surprised this was not posted here:
www.politico.com
Russia arrests hacker in Colonial Pipeline attack, U.S. says
The arrests followed months of negotiations between the Biden administration and Russian officials around the ransomware attack and other cybersecurity concerns.
www.politico.com
This hits the nail on the head. The system to move the oil maybe completely untouched, but if you can't prove who bought what product at what price to be delivered on what day, then big brother will burn your house down, because most pipelines on land are regulated.
There's a lot of nuance to "energy independent", but we were independent of the Persian Gulf back before 2013 when I switched from the military to oil and gas. Western hemisphere sources, namely Canada, Mexico and Brazil could make up what the US couldn't produce. The nuance comes with the type of oils US refineries are designed to process, many are set up for mid to heavy grades (originally from the PG, more on this later) while most of the new tight (shales) production is very light and sweet. It makes more sense to export the light sweet and import mid/heavy (arbitrage) hence the "net exporter" "mostly independent" qualifications.I read that very article, hence: "close to, if not entirely, energy independent". In either case, it's gone now. Many drilling locations in the gulf have been shut down and auctioned off (apparently drilling in the gulf is okay as long as we're not the ones doing it), Keystone pipeline - dead, and other restrictions adopted by the Biden administration to put the squeeze on oil in the US.Thanks to efforts largely done under President Obama. The question of 'energy independence' is also more nuanced and indeed, the perceived drop can be attributed in part to the difference between demand and supply ramp ups. I suggest you read the likes of the following:
Is The U.S. Energy Independent?
Did we lose our energy independence under President Biden? It's complicated.
US auctions off oil and gas drilling leases in Gulf of Mexico after climate talks
Biden administration launching auction of more than 80m acres for fossil fuel extraction that experts call ‘incredibly reckless’
Now, where stuff like the Keystone Pipeline hurts is that the Canadian tar sand mixed with Alberta condensate is a great replacement for the mid/heavy PG grades that some of the newer gulf coast refineries were built to refine. Those are the ones a major European IOC had a public divorce with the Saudi's over their decision not to use Saudi oil after the JV agreement lapsed.
The politics become quite interesting when carbon intensity is considered. Shales (tight oil/gas) and tar sands are the most carbon intensive ways to extract hydrocarbons, hence why Keystone had to be stopped (they also donated their money to the ugly orange man). The mega deep water developments are the least carbon intense hydrocarbons to produce and transport. That's why it doesn't surprise to see the current admin proceed with the lease sales. As for not US companies developing the fields, only the IOC's have the deep pockets to spend $20-30 B to find, develop, produce and transport deep water assets for 20-30 years necessary to get a return on investment. So that's BP, Chevron, Exon, Shell and Total. The other reason deep water is preferable to the "shallow" offshore production is that the royalties only go to the feds, the shallow stuff gets split with the states. Even if everything went hydrogen and electric tomorrow, there would still need to be hydrocarbon production to support chemicals, plastics and other products. Even a "green" admin will tolerate production, just so long as it's the "right" production, produced by the "right" producers who will use the profits to develop "green" low carbon energy for the "people".
This BTW in no way reflects the view of my employer... Just a viewpoint from inside the industry.
As oil nears $100 a barrel, U.S. drillers get busy in costly shale basins
As U.S. oil rises toward $100 a barrel, producers in some high-cost shale basins are buying properties and adding rigs and frack crews in places that fell silent when prices crashed early in the pandemic two years ago.
