Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Colonial Pipeline Paid Hackers Nearly $5M in Ransom

bloomberg.com

Post reply on HN
Print view View original

211–220 of 524 posts

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#211

Post by briandear »

monocasa wrote: post #208
briandear wrote: post #195

Earlier quoted context omitted.

The Obama administration secretly organized an airlift of $400 million worth of cash to Iran that coincided with the January 2016 release of four Americans detained in Tehran, according to U.S. and European officials and congressional staff briefed on the operation afterward. Wooden pallets stacked with euros, Swiss francs and other currencies were flown into Iran on an unmarked cargo plane, according to these offici…

To be fair, that was Iranian money in the first place that had been frozen.

It was still a ransom. “I’ll give you money, you release our hostages.”

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#212

Post by Mountain_Skies »

coldpie wrote: post #130
Mountain_Skies wrote: post #53

It should be noted that Colonial had several infosec openings at the time of the attack. While having those filled might not have prevented this attack, it also might have or at least put them in a better response position. There are lots of infosec openings across the country but compensation doesn't seem to be rising in response. It appears that companies are fine with leaving these positions open for long periods…

I mean, let's address the elephant in the room: there is no such thing as computer security. As we see with new leaks and hacks and vulnerabilities every single week, the idea that a computer that is connected to the Internet can be secure is a joke. The whole industry is built on protocols and tools that assume there will never be any bad actors, and we're reaping the rewards of that now. It will take decades of lay…

Risk cannot be eliminated but it certainly can be reduced. Also response plans for when something happens can be funded and regularly tested. You can't anticipate every possible successful attack but you can reduce the risk of being unprepared to respond to whatever attack happens.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#213

Post by generationP »

So, supposedly, Colonial paid the ransom "within hours after the attack". And, supposedly, the attack didn't even hit any ICS, just the payment infrastructure ( https://www.zdnet.com/article/colonial-pipeline-ransomware-a... ). Why are there still gas shortages 6 days later?

Not a rhetorical question at all. To me, the idea that the infrastructure we rely on is controlled by middle managers with no sense of urgency and no grasp of their domain looks like the real fridge horror story here. On the other hand, I have learnt better than to trust everything I read in the press; thus the supposedlies. Either way, "the decryption tool is slow" is not an excuse to not deliver essential supplies.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#214

Post by kingaillas »

ethbr0 wrote: post #152
nimbius wrote: post #143

Colonial is being widely lambasted for a culture of absolutely lackadaisical security. Call me callous but numerous federal agencies exist to issue security best practices and exploit announcements. numerous vendors also exist. play stupid games, win stupid prizes. Not paying the ransom would have been tantamount to complete dissolution of the company. it would have tirggered a much wider investigation into the compa…

If the US were to be serious about corporate IT security, they'd empower and indemnify DoD, NSA, private industry red teams to pentest against everything with a US point of presence or customers, using commercial available / in the wild methods. This would have the beneficial side effect of flushing all the incompetent paper-pushers / requirement-box-checkers out of the security industry. If you're found vulnerable,…

>If the US were to be serious about corporate IT security

What happened to the responsibility of corporations for corporate security? Including corporations that are the victims of attacks, and corporations that sell buggy operating systems and applications?

Why does the government have to provide the red teams? The general attitude is all government agencies are wasteful and incompetent, except in this circumstance where the wealthiest corporations in the history of the world apparently can't spend enough to fix their own crap. But the government not only can but should??

This just sounds like externalizing costs to the public while banking record private profits.

How about rather than subsidizing software corporations we talk about liability laws and fines, like any other physical industry that releases dangerous, broken products. Or an insurance system that is funded by a portion of the profits the software industry makes. Then we're actually making the software vendors feel some pain which will incentivize them to release higher quality code.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#215

Post by chubs »

comboy wrote: post #150
nneonneo wrote: post #140

Ugh. This ransomware crap doesn't stop until the money stops . At this point, ransomware operators are bribing insiders to install their custom, AV-evading ransomware directly on company servers (e.g. https://www.secureworldexpo.com/industry-news/fbi-sting-the-... ). No need to trick someone into running a malicious Word attachment when you can just wire someone $1M to do it deliberately! And, best of all, you can se…

I think ransomware is the best thing that happened in computer security in a long time. All these companies keeping lots of people data or even being relevant to national security having completely no incentive to stay secure. Now There is incentive to test their security. A single person being able to compromise your company when paid a lot is a security issue that needs to be addressed.

I know what you're getting at... but as far as I see it, all it means is that every company i've contracted to lately installs horrifically limiting corporate safety-dreck that ruins your battery and performance, it's really becoming a lot less fun working with computers nowadays. Everything is so slow and limited.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#216

Post by Mountain_Skies »

Ancapistani wrote: post #118
_tk_ wrote: post #25

Disclaimer: I work as a CISO in a large corporation. The interesting bit in this article is not necessarily the sum of the ransom, but that Colonial decided to pay quasi-immediately. It seems as if the attackers had full control over their network. Another possibility: Colonial staff could not be sure that if they used their backups, everything would be encrypted immediately again - possibly the backup servers as wel…

Having read the release by the attacker, my initial thought is that the immediacy of paying was probably due to the threat of the release of sensitive data, not the ability to restore operations. I’m sitting here wondering what exactly about the release of their financials and internal procedures prompted them to immediately pay $4-5m in the hopes of preventing it from happening?

Just spit balling here but they have had several other pipeline shutdowns in recent years. One was blamed on a third party damaging the pipeline but I believe the others were operational issues. Perhaps there's more information on those issues than the company would like the public to know? Just a wild guess.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#217

Post by mrtesthah »

lurquer wrote: post #189
sudosysgen wrote: post #145

Earlier quoted context omitted.

Realistically, ransomware will just never stop until IT systems are sufficiently hardened.

Nah. It will never stop. The problem is information density. So long as billions of records that are needed for the business exist in a device the size of a shoebox, we’re fucked. An insider can always take the shoebox, lock the shoebox, etc. Three stories of paper files in file cabinets can’t be ransomed short of a physical bomb threat. Don’t know what the solution is. But I do know the problem. Exfiltrarion is simi…

Your metaphor works both ways: the ability to fit billions of records in a shoebox means that it’s perfectly manageable to keep another shoebox as a backup, under independent control.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#218

Post by beachy »

Veserv wrote: post #142
Mountain_Skies wrote: post #53

It should be noted that Colonial had several infosec openings at the time of the attack. While having those filled might not have prevented this attack, it also might have or at least put them in a better response position. There are lots of infosec openings across the country but compensation doesn't seem to be rising in response. It appears that companies are fine with leaving these positions open for long periods…

No. The security problem is not a lack of effort or laxness, it is a fundamental inability to solve the problem. At a $5M payout there are essentially 0 commercial IT systems in the world that can stop such an attack. The absolute best of the best commercial IT systems implemented as envisioned with full support can maybe protect up to the $10M level and I am just extrapolating upwards since I have never had any secu…

> At a $5M payout there are essentially 0 commercial IT systems in the world that can stop such an attack.

Even if that's true, it doesn't affect backups.

Back your fucking systems up properly, and if you are attacked by ransomware, then do a scorched earth restore.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#219

Post by freshair »

koheripbal wrote: post #203
AbrahamParangi wrote: post #9

Paying ransom should be illegal. Ransom funds illegal activities. Not indirectly, like buying coffee or poppyseed or whatever, but literally money that is directly reinvested in criminal activity- like ransomware.

Imagine making it illegal to hand over your wallet to a mugger holding a gun to you. All you are doing is incentivizing companies to not report these attacks.

If the mugger isn't bluffing, then he'll get your money one way or the other. This makes it different from paying ransoms.

Furthermore, a corporation's bottom line is not truly comparable to a human life. However it is my understanding that paying ransoms to save human lives is technically illegal to. If paying a ransom to save your family member's life is illegal, then corporations paying ransoms to protect their finances should certainly be illegal.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#220

Post by mrastro »

ppierald wrote: post #92

I am definitely not an expert in these areas and I'm sure someone 100x smarter than I am has thought of this and discounted it already, but is there any ability to decompile the executable provided to Colonial and get to patterns of source code, then compel github to search their repositories for any patterns of that code? Not sure if that is even legal or whether a judge would authorize that fishing expedition, but…

It's unlikely their code is hosted on GitHub because the hackers wouldn't want to leave such an obvious trace there.

I think you're right that unless there is evidence code is hosted there, the judge wouldn't authorize a "fishing" exercise to search random sources for the code. In a hypothetical, what would this even give? The IP addresses of the authors? They are likely running through a proxy anyways so it wouldn't help. The private key? It might have been generated server-side or using an algorithm outside the code so might not help.

What I'm saying is getting the code source might not even be helpful depending on how it was implemented and if only the client code can be found.

Post reply on HN