US declares emergency after ransomware shuts oil pipeline that pumps 100 million gallons a day
- Reference: 1620605713
- News link: https://www.theregister.co.uk/2021/05/10/colonial_pipeline_ransomware/
- Source link:
The Colonial Pipeline, which [2]says it carries 100 million gallons a day of refined fuels between Houston, Texas, and New York Harbor, or 45 percent of all fuel needed on the USA’s East Coast. The pipeline carries fuel for cars and trucks, jet fuel, and heating oil.
It’s been offline since May 7th, according to a [3]company statement , due to what the outfit describes as “… a cybersecurity attack [that] involves ransomware.”
[4]
[5]
[6]
“In response, we proactively took certain systems offline to contain the threat, which has temporarily halted all pipeline operations, and affected some of our IT systems.”
Third-party experts were engaged to probe and remediate the situation and by Saturday the company said it was “actively in the process of restoring” its technology operations.
The Federal Motor Carrier Safety Administration's emergency declaration was issued on Sunday evening, US time, and states it is necessary to relieve shortages.
[7]
Reuters [8]reports that the DarkSide ransomware gang is thought to be behind the attack. DarkSide is thought to both encrypt victims’ data and exfiltrate it to gain leverage in ransom negotiations. The gang has also shared evidence that it has made charitable donations, and said it feels an obligation to share some of the ransoms it wins.
At the time of writing the pipeline remained closed, although a Sunday evening (US time) update to Colonial’s announcement said some “smaller lateral lines between terminals and delivery points” have been restored.
[9]Malware attack that crippled Mumbai's power system came from China, claims infosec intel outfit Recorded Future
[10]REvil ransomware gang publishes 'Elexon staff's passports' after UK electrical middleman shrugs off attack
[11]'Critical' Israel power grid attack was just boring ransomware
[12]World's electrical grids open to attack
Exactly what the incident will mean for supply is not known. The Register has encountered conflicting reports, some saying reserves should mean little disruption, others suggesting shortages may be imminent.
Whatever comes next, the incident validates the many predictions that attacks on critical infrastructure as having the potential for enormous harm.
Despite such warnings not being novel, Colonial Pipeline appears not to have worked towards short recovery time objectives.
[13]
The US Justice Department two weeks ago established a Ransomware and Digital Extortion Task Force to fight the scourge. ®
Get our [14]Tech Resources
[1] https://www.fmcsa.dot.gov/emergency/esc-ssc-wsc-regional-emergency-declaration-2021-002-05-09-2021
[2] https://www.colpipe.com/about-us
[3] https://www.colpipe.com/news/press-releases/media-statement-colonial-pipeline-system-disruption
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YJiv2kYlaYF8Ghsh5ywbegAAAMQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YJiv2kYlaYF8Ghsh5ywbegAAAMQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YJiv2kYlaYF8Ghsh5ywbegAAAMQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YJiv2kYlaYF8Ghsh5ywbegAAAMQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.abc.net.au/news/2021-05-10/cyber-attack-fuel-pipeline-united-states-DarkSide-colonial-pipe/100127554
[9] http://www.theregister.com/2021/03/01/statesponsored_chinese_group_attacked_india/
[10] http://www.theregister.com/2020/06/01/elexon_ransomware_was_revil_sodinokibi/
[11] http://www.theregister.com/2016/01/28/israel_power_grid_attack_boring_ransomware/
[12] http://www.theregister.com/2008/09/25/abb_critical_bug/
[13] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YJiv2kYlaYF8Ghsh5ywbegAAAMQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[14] https://whitepapers.theregister.com/
One word:
Airgap.
Re: One word:
Easily defeated by any old idiot using sneakernet. And usually is.
Lessons learnt? I doubt it.
But it’s still a scary event, because attacks on critical infrastructure have long been identified as having the potential for enormous harm. This one has halted operations of infrastructure that impacts the lives of millions of people, every day.
What lessons were learnt? Nothing.
If "critical infrastructure" are deemed critical then take them off the f**king internet.
NOTE: I am not going to talk about "patching" or "updates" because there are custom-made applications that cannot be updated or patched.
Re: Lessons learnt? I doubt it.
But we do patch and/or update them. Just not by clicking a link in email.
Re: Lessons learnt? I doubt it.
It depends on who does the learning, and who does the managing of what has been learned. Usually there is a village missing its idiot, who is to be found wearing a suit and tie.
One time I had a brief chat with a fellow who worked for Big Oil, and he said his main job was to play "hide the (huge) profits." It's not like these companies lack resources, they lack managers who will do the job they were hired to do.
I'm guessing that the whole PC network got infected, and then it doesn't matter that the actual controllers are fine. The PCs are the machines that are used to communicate with the critical infrastructure. Even if a PC is used just for its browser, if you can't use the browser, then the PC is toast.
It's past time to move back to punch cards and paper tape! Let the miscreants try to take over OS/360 and a stack of punch cards!
Stick that it your pipe
But please, don’t smoke it!
It’s an oil pipeline after all.
Hey - at least they didn't reverse the flow from one end... I mean, a few million bucks to buy off a ransom is cheap compared to the Valdez.
Meanwhile, over in DarkSide Land, the would-be Robin Hood malefactors are shitting very large bricks and trying to figure out if they can actually send an anonymous decryption key to Uncle Sam, or if it would be better to just emit their cryptography keys required to decrypt anything they've hit with this shit.
And if this is something that can't be decrypted, they're shitting masonry bricks and booking plane tickets to somewhere they can book more plane tickets.
Uncle Sam will quite happily drop JDAMs on houses for THIS shit, and frankly, it's about time the ransomware crook gang started getting their houses exploded for attacks that will be taken as attacks on national security interests and responded-to as if they'd flown a plane into the pipeline.
Presumably the fuckwits in charge ...
... had the pipeline's SCADA connected the TehIntraWebTubes at large, so management could impress their friends when fondling their iFad down at the club.
It's going to get worse, until said fuckwits in charge realize that when an actual IT professional tells them "that is not today, has never been, and cannot ever be made safe, UNLESS we re-design The Internet from the ground up, from scratch!" it's actually the truth, not an excuse to get out of working.