Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US passes emergency waiver over fuel pipeline cyber-attack

bbc.com

Post reply on HN
Print view View original

451–460 of 479 posts

Re: US passes emergency waiver over fuel pipeline cyber-attack

#451

Post by panarky »

raverbashing wrote: post #328
panarky wrote: post #323

Earlier quoted context omitted.

The reason cyberattacks are proliferating is because many enterprises refuse to learn from the mistakes of others. They continue to connect ancient, unpatched Windows and Exchange servers to the public internet, they don't segment their networks, they don't secure TeamViewer and RDP, they don't use FIDO U2F, they don't have an IDS, they don't monitor logs, they don't execute email links and attachments in a sandbox,…

Yes, but this is not new. Cryptocurrency is. Also blaming the victim can only go so far

If you write the combination for your safe on a post-it note and stick it to the door of the safe, and a thief opens the safe and steals everything in it, it's still the thief's fault.

But it's not victim-blaming to observe that you shouldn't have made it so easy for the thief.

If it's just your valuables that get stolen, then that's unfortunate for you, but at least it doesn't hurt anyone else.

But when other people trust you to keep the safe secure, and are hurt because of your negligence, then it's also not victim-blaming to observe that your negligence caused harm to other people.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#452

Post by tikiman163 »

mac01021 wrote: post #317
tgsovlerkhgsel wrote: post #13

That gang may have bitten off more than they can chew. They've now gotten the US government involved officially, which means that beyond the sheer mass of resources that will go into tracking this gang, the government also has something to prove now. Being at the center of an international incident is probably not good for business.

I'm not super-knowledgable about cybersecurity, but shouldn't simply using TOR make it nearly impossible for the US government to track them down? If they want to go overkill, they can additionally use a public VPN account purchased using walmart giftcards bought on ebay using a stolen identity and then mailed overseas. They can also perform the hack using a brand new computer that they never use again afterward. It…

Tor isn't perfect. Government agencies like to create TOR endpoints/nodes that allows collection of bulk traffic data. They can't see exactlt who sent specific packets or their exact contents by looking at them individually, but they can see which mode it just came from and where it's going next. By watching traffic to entry and exit points they can create probablist models based on traffic volume that can allow them to identify where large volumes of packets most likely came from when they're already watching the destination. This is how they tend to catch drug dealers and similar illegal transactions using TOR and a similar setup that monitors crypto currency transactions that simply monitors either known bad agents (criminals, dark web sites selling illegal goods, suspects, etc) or suspected targets. By combining the two data sets they've even identified who certain crypto currency wallets belong to. The main thing to be aware of is that it's extremely difficult for them to identify anyone with low traffic levels, or that do not interact with actively monitored actors/targets.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#453

Post by frombody »

bradstewart wrote: post #51
unchocked wrote: post #10

So, a very limited state of emergency which allows fuel that is ordinarily piped to be transported by truck. Ancillarily, It's not evident this cyberattack actually compromised the industrial controls, but rather trashed the administrative system controlling the controls.

It's interesting to consider the human link between the admin systems and industrial control systems here. If we assume the controls are on an airgapped network, the attackers, in some sense, jumped the airgap and shutdown the pipeline. Obviously not as bad as an actual compromise of the control systems though, which presumably could cause leaks, explosions, etc.

I've worked on these systems, they are separate.

They likely could have kept running the pipeline without incident.

I imagine when the government stepped in they decided to dial their procedures up to 10 and they plan on making an example out of this incident and the perpetrators.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#454

Post by that_guy_iain »

vkou wrote: post #448
that_guy_iain wrote: post #445

Earlier quoted context omitted.

> By who? People who never provide evidence for their claims? By lots of countreies. The US charged 4 chinese military officers for hacking Equifax. > While it's certainly possible that the FSB is playing 59-dimensional chess, here, hoping for a true butterfly-effect sequence of causality, I think the onus is on you to demonstrate that. You seem to think that it would require multiple things to fall into place to ben…

Hacking Equifax[1] makes sense, because it directly useful for intelligence work. Find people of interest who have credit problems, and lean on them. [2] This isn't even a blip on the radar of global fuel prices. It is completely lost in the noise. [3] [1] Or the OPM, since it was kind enough to have lists of 'all spies operating abroad' on its intranet. Whoops. [2] I mean, you could also just pose as a landlord or e…

I'm just pointing out countries have been hacking each other for ages and specifically infrastructure. Which was originally stated as absurd because there is no benefit to them, which considering you don't know all the basic effects this attack is having. And who said they wanted to raise global fuel prices?

End of the story is intelligence agencies around the world have been bulking up for cyber warfare for at least a decade. Russia and China have been been fingered repeatedly for cyber attacks. It is not completely outlandish that one of them is behind it for whatever reason. I'm pretty sure the entire point of these agencies is that we don't know what do or why they do them.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#455

Post by stuffbyspencer »

wussboy wrote: post #435
christophilus wrote: post #405

Earlier quoted context omitted.

When you said “the gang”, I had an image of the gang from “It’s Always Sunny” writing their first virus and this being the result. I’d watch that episode.

When the Feds catch up to them, Dennis and Mac are loading frozen beef in to the back of his car and are legitimately confused by what the cops are saying. They moved past the virus several weeks ago and have had literally dozens of plans since then.

And then Charlie walks out and goes "Ooooh, uh oh, uh yeah, guys you know what... I think I know what they mean. Last week when everyone was talking about the virus, I had just watch this really cool cyber hacking movie on TV last night, so I kinda zoned out and didn't know what our next scheme was, so when I went home I paid someone on the darkweb for a virus just like in that movie-"

Dennis: "How the hell do you have money to pay people on the darkweb Charlie?"

Charlie: "KittenCoin"

Dennis: "Oh god dammit, KittenCoin? You did that huh? Alright, checks out. Anyways, so then what happened?"

Charlie: "Well then I didn't really know what we were doing still, so I just emailed the file the russian kid sent me to your email, but I totally messed up the address cause my fingers were all sticky with peanut butter at this point and-"

Dennis: "WHY WERE YOUR- You know what, not only do I not wanna know, but I'm also gonna take a stab at how this story ends. Charlie, are you telling me you made a scam cryptocurrency and then used the profits to pay some sketchy russian hacker for a ransomware virus which you then emailed to a random address with a subject line something along the lines of "FOR FRIEND, IMPORTANT FILE, FOR PLAN, GIVES MONEY", which obviously enticed the random receiver to open said email promptly starting a massive email worm that managed to spread its way into the government's oil pipelines?"

Charlie: "That's... Uh, yeah, yup, yup, that's pretty much spot on dude, I'm pretty sure."

Re: US passes emergency waiver over fuel pipeline cyber-attack

#456

Post by dang »

arkadiyt wrote: post #8

Colonial Pipeline precisely does keep it's control network disconnected from the internet - the only thing that was ransomwared is their corporate network. They shut the pipelines down voluntarily to prevent further spread.

We detached this subthread from https://news.ycombinator.com/item?id=27101293, which was a generic subthread, because the discussion turned more relevant at this point.

(To a first approximation, generic == less interesting and specific == more interesting on HN: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...)

Re: US passes emergency waiver over fuel pipeline cyber-attack

#458

Post by pasquinelli »

okareaman wrote: post #231
pasquinelli wrote: post #213

Earlier quoted context omitted.

where did you get this understanding?

MSNBC had a person on who purported to be someone knowledgeable. I also read the Washington Post. The act of war part was my idea. I realize I may not have the correct understanding yet, but based on the Solar Winds hack and the Mueller report, it seems to me they are attacking us. Isn't an attack an act of war?

consider washington post:

https://www.washingtonpost.com/national-security/democrats-a...

and msnbc:

https://www.msnbc.com/msnbc/watch/russia-paid-up-to-100k-bou...

in light of this:

https://abcnews.go.com/Politics/top-pentagon-officials-russi...

and this:

https://news.yahoo.com/russian-bounty-story-falls-apart-1921...

i noticed this at the time. i heard really loudly about russia paying bounties on american soldiers, and then so quietly that i might have missed it that there was no evidence for it. it's odd isn't it?

Re: US passes emergency waiver over fuel pipeline cyber-attack

#459

Post by jcadam »

nostoc wrote: post #205
wolverine876 wrote: post #141

Earlier quoted context omitted.

> That gang ... Maybe it's another government, trying to sow chaos, disrupt markets, test US response capabilities, etc.

Could be, but ransomware gangs are a dime a dozen, and many are simply financialy motivated. It's just a very profitable business model.

This was a very stupid thing to do, if it was a ransomware gang.

Re: US passes emergency waiver over fuel pipeline cyber-attack

#460

Post by jcadam »

jb775 wrote: post #357
unchocked wrote: post #10

So, a very limited state of emergency which allows fuel that is ordinarily piped to be transported by truck. Ancillarily, It's not evident this cyberattack actually compromised the industrial controls, but rather trashed the administrative system controlling the controls.

> It means drivers in 18 states can work extra or more flexible hours when transporting gasoline, diesel, jet fuel and other refined petroleum products. This means truck drivers hauling 45,500+ lbs of an extremely flammable liquid aren't required to sleep. I worked in the supply chain industry for a few years, dropping these restrictions is unheard of. My instinct tells me this issue is a lot worse than it seems now.

And I thought we were already facing a nationwide shortage of qualified tanker truck drivers.

On the bright side, these guys will be making mega-bucks on overtime, provided they can stay awake. coffee and no-doz will only take you so far.

Post reply on HN