Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Colonial Pipeline Paid Hackers Nearly $5M in Ransom

bloomberg.com

Post reply on HN
Print view View original

281–290 of 524 posts

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#281

Post by windexh8er »

charlesju wrote: post #240
kjrose wrote: post #201

The fact this was paid off, and paid off so rapidly means that targeting major infrastructure for massive payoffs is going to become more and more prominent. The next time though, it'll be $50M. I work with people in the oil fields and I know the numbers they are playing with and the fact that a single well being down can easily be $100,000 lost per hour. So obviously they want these systems back up fast. $5M for shu…

Yeah, but now there is also a massive bounty out for these hackers. Money needs to get out at some point and that's when they'll get nailed.

Unfortunately these types of breaches don't net the culprits nearly as expeditiously as we'd all like. Given that they're likely based in a country that could care less or may be adversarial to the US this may even be lauded.

In the grand scheme of things it's very low likelihood we'll see any level of prosecution for this incident in the next year or two, if ever. And even then it will likely only result in attribution in a random report a year from now with no actual consequences for the attackers.

The final thing is the amount of money isn't extraordinary. As others have said it's mostly a rounding error in annual revenue that passes books of a company like this.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#282

Post by Veserv »

alasdair_ wrote: post #258
Veserv wrote: post #142

Earlier quoted context omitted.

No. The security problem is not a lack of effort or laxness, it is a fundamental inability to solve the problem. At a $5M payout there are essentially 0 commercial IT systems in the world that can stop such an attack. The absolute best of the best commercial IT systems implemented as envisioned with full support can maybe protect up to the $10M level and I am just extrapolating upwards since I have never had any secu…

> The absolute best of the best commercial IT systems implemented as envisioned with full support can maybe protect up to the $10M level And yet Apple still manages to keep its private signing keys secure. Even from the FBI. It’s doable.

What are you going to do with private signing keys? Compromise an iPhone? Unlock an iPhone?

Like how the FBI paid $900,000 to do so and get exactly what they wanted (at least with respect to the phone) in the San Bernardino case which you are referencing? Or how the going price for a iOS zero-click remote code execution with persistence, which basically gives you the ability to arbitrarily compromise any iPhone at any time, on Zerodium is $2M? You can get effectively the same outcome as stealing their signing keys for $2M or less in a way that is far less traceable or detectable. There are so many ways in and to get what you want that the fact that one of them, which is not even clearly the best or easiest way, being untouched is not exactly a cause for celebration or indicative of the quality of that defense. The cash register being untouched because the safe door was wide open is not exactly a very compelling security story. So, no, they do not reach the $10M level. Not even close.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#283

Post by p1necone »

tgsovlerkhgsel wrote: post #276
kjrose wrote: post #201

The fact this was paid off, and paid off so rapidly means that targeting major infrastructure for massive payoffs is going to become more and more prominent. The next time though, it'll be $50M. I work with people in the oil fields and I know the numbers they are playing with and the fact that a single well being down can easily be $100,000 lost per hour. So obviously they want these systems back up fast. $5M for shu…

The bigger the difference between the cost of the downtime and the ransom, the most likely it is to be paid. Assuming you were in a TV show, and offered two options: Spin wheel 1 with a 95% chance of winning $5M, or spin wheel 2 with a 50% chance of winning $50M, which one are you going to spin? The EV is higher on the second one, sure, but taking the near-certain 5M may still be a better choice - a bird in the hand…

The difference in actual value between the two for me at least is much smaller than the difference in numerical value.

Both amounts are enough for me to never work another day in my life, and instead focus on building what I want to build. Past that massive increase in quality of life extra money is relatively meaningless (to me) .

This is the same reason that people who decry spending money on lottery tickets as a stupid thing to do based on the EV alone are thinking far too simplistically.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#284

Post by whitexn--g28h »

elliekelly wrote: post #277
Veserv wrote: post #245

Earlier quoted context omitted.

It absolutely does affect backups. If you stand to gain $5M from an attack you can also target the backup systems and still easily end up profitable. Only if you stand to gain less than $100k does the budget actually start to get tight. As for how you attack the backup system it depends. If it push based you send your payload during the push. If it is pull based you craft your payload in the data that will be backed…

I can’t speak for other industries but in the financial industry (in the US at least) periodic backups are required on physical tapes both off- and on-site. Barring a Mr. Robot hack of the institution and Iron Mountain to burn the tapes the absolute worst-case scenario in a ransomeware attack on a financial institution is an afternoon of data lost.

If you knew in advance of the timing of the data loss you could do billions in damage to a bank.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#285

Post by tgsovlerkhgsel »

socialist_coder wrote: post #135
lawnchair_larry wrote: post #78

Earlier quoted context omitted.

The issue is less about people unwilling to take those wages, and more about a lack of people whose breath can even fog a security mirror so to speak. I work in security and have been involved with hiring at several “brand name” companies including FAANGs in hot tech markets, and it’s always been a talent pipeline issue more than anything. Given how difficult it is for the biggest players to keep security staffed up,…

Is being a "good" security person really more involved than: * making sure you have all your ports locked down * limit connectivity between all instances to only the bare minimum * any public access is via protocols such as ssh which have zero-to-none vulnerabilities * any 3rd party software you dont know is secure should never be public * routinely run employee training on how not to let themselves get hacked via so…

Yes, it is a lot more involved.

In particular, "routinely run training" might reduce the probability of a breach due to social engineering, but it probably won't.

You also didn't really cover client machine security, which is how compromises often happen. Your awesome security isn't worth much if the admin's machine is compromised.

Your employees need to use computers to do their job. As part of that, they will need to browse the web, which they will do with one of the major browsers. This browser has unknown 0-day vulnerabilities. Whatever security measures you implement must not disrupt business.

They may also need to plug in USB drives. These can come with malware. Whatever security measures you implement must not disrupt business.

They may also need to open documents, possibly with macros. Whatever security measures you implement must not disrupt business.

Your "basic rules" will at best prevent the - still extremely common - social engineering based attacks, but they still won't reliably keep an attacker out of your network. The attacker will compromise a random person, find some company-wide writeable shared network drive (that you didn't even know about) where a team shares their executables, replace one of those, compromise more machines, escalate to domain admin credentials through one of the many ways that exist, then use your own fleet management system to push their backdoor to your entire fleet.

For good security, you need for example:

- an overview of what assets (computers etc.) you actually have

- a decent way to manage these assets

- monitoring so you can hopefully detect when (not if) a compromise happens

- many layers of defense in depth that slow down attackers and limit what they can do once they've compromised one part of your company

- technical barriers to prevent social engineering attacks (binary whitelisting, strong multi-factor authentication)

- protection against insider risks

- physical security

and that's just a few things that popped into my head, the actual list would probably not fit whatever post length limits HN has. And of course all of this needs to be implemented with the limited budget the company is willing to give you, without disrupting the business, etc.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#286

Post by ironman1478 »

I don't have much to add here, but I've been going to Def Con and the other Las Vegas security conferences for a few years. Every year there is a section for infrastructure security (factories, refineries, etc). Its always the smallest section and the least populated. But its simultaneously the "most important" in terms of how much damage can be done from a single attack. Every year I went and was always terrified by all the stuff I saw because all the people hosting booths were like "yeah its dead simple to get in and break things." I feel like so many people could see this coming and there are just no consequences for the companies to incentivize them to do better.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#287

Post by Gaelan »

ineedasername wrote: post #273
jimmydorry wrote: post #262

Earlier quoted context omitted.

The crypto still interfaces directly with the financial system on all ends. The company move money to an exchange (using the financial system), and the hacker cashes in the crypto eventually (using the financial system).

It's not the company side that matters. It's that it's a lot easier for the criminals to pull a few tricks to obscure their side of things significantly. Bitcoin mixers/tumblers for example so that what comes out the other end can't easily be tracked back to the crime. I'd be extremely surprised if groups making these attacks didn't use that type of thing. If it was all bank wires etc. then law enforcement could trac…

The issue is that a tumbler doesn't make the dirty money go away, quite the opposite; it gives a bunch of other people little bits of dirty money. If I were a non-criminal, or even a smaller-time criminal, it wouldn't be in my best interests to use a tumbler that might give me this dirty money.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#288

Post by killingtime74 »

whall6 wrote: post #83

In Cambodia, people buy dirt to increase their property’s elevation so that their neighbor’s house floods when the monsoon comes. Then the neighbor has to pay for more dirt and so on throughout the whole neighborhood. It seems like the attackers are finding the paths of least resistance. Beefing up security at each organization isn’t fixing the underlying problem. It’s just making the next entity the more likely targ…

So when I do it I’m flood proofing my house, when the Cambodians do it they’re “buying dirt“?

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#289

Post by aledalgrande »

ARandomerDude wrote: post #280
DevX101 wrote: post #259

Earlier quoted context omitted.

I think these ransoms are net good. I'd rather greedy hackers shake them down for money then having the country get crippled by political terrorists or enemy nation states that can't be negotiated or reasoned with. There are lots of infrastructure management teams taking security more seriously than they were a month ago. That alone is worth more than $5M

In 20 years Edward Snowden Jr will reveal to us that it was the Department Of Energy the whole time...

Or a dev testing the chaos monkey...
Post reply on HN