Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Colonial Pipeline Paid Hackers Nearly $5M in Ransom

bloomberg.com

Post reply on HN
Print view View original

371–380 of 524 posts

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#371

Post by unclebucknasty »

DevX101 wrote: post #259
kjrose wrote: post #201

The fact this was paid off, and paid off so rapidly means that targeting major infrastructure for massive payoffs is going to become more and more prominent. The next time though, it'll be $50M. I work with people in the oil fields and I know the numbers they are playing with and the fact that a single well being down can easily be $100,000 lost per hour. So obviously they want these systems back up fast. $5M for shu…

I think these ransoms are net good. I'd rather greedy hackers shake them down for money then having the country get crippled by political terrorists or enemy nation states that can't be negotiated or reasoned with. There are lots of infrastructure management teams taking security more seriously than they were a month ago. That alone is worth more than $5M

>These ransoms are net good...There are a lot of infrastructure teams taking security more seriously.

Nonsense. This is not an academic exercise. Our country is being attacked by "nation states" (do more research) and we need to respond accordingly, treating it as the national security threat it is and making the perpetrators pay a heavy price. If they'd bombed our critical infrastructure, no one would be sitting around saying, "oh this is good for improving our defense. Thank you for dropping bombs on us."

The idea that they are doing us some kind of service and we should just play a game of defensive cat and mouse, hoping for 100% effectiveness (which we know is impossible) is absurd.

Wake up. We're at war.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#372

Post by RyanHamilton »

bumbledraven wrote: post #343
tgsovlerkhgsel wrote: post #276

Earlier quoted context omitted.

The bigger the difference between the cost of the downtime and the ransom, the most likely it is to be paid. Assuming you were in a TV show, and offered two options: Spin wheel 1 with a 95% chance of winning $5M, or spin wheel 2 with a 50% chance of winning $50M, which one are you going to spin? The EV is higher on the second one, sure, but taking the near-certain 5M may still be a better choice - a bird in the hand…

Which option maximizes the long-term rate of growth of your wealth depends on how much money you already have. The Kelly Criterion takes this into account and handles a wide range of situations including this one. Example: Say you have $10⁵, and you have the option to play game 1, which offers a 95% chance of a $5×10⁶ prize, or game 2, which offers a 50% chance of a $5×10⁷ prize. By the Kelly Criterion, the value of…

Great example. It is worth emphasising your model will capture the game from the ransom attackers perspective since for them it is repeated many times. It won't give the EV for the attacked as their number of ransom incidents will hopefully be very small rather than tend to infinity. Which likely means the EV will be based on their own personal utility function.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#373

Post by Aperocky »

nikanj wrote: post #231
generationP wrote: post #213

So, supposedly, Colonial paid the ransom "within hours after the attack". And, supposedly, the attack didn't even hit any ICS, just the payment infrastructure ( https://www.zdnet.com/article/colonial-pipeline-ransomware-a... ). Why are there still gas shortages 6 days later? Not a rhetorical question at all. To me, the idea that the infrastructure we rely on is controlled by middle managers with no sense of urgency a…

All you need for gas shortages is the rumor of gas shortages. Remember how we ran out of TP last year, for absolutely no reason whatsoever?

On the other hand, a pipeline not running at all is another solid reason.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#374

Post by Aperocky »

drzoltar wrote: post #207

Dumb question: why can’t crypto currencies and exchanges place the ransom tokens on some kind of blocklist, thereby forever tainting those coins? As I understand, the rise of “privacy wallets” has greatly increased the anonymity of such transactions. But, at the end of the day, don’t we always have a ledger of the coin ids? I’m curious how the coins actually get laundered back into cash.

Dumb question 2: How do you taint tokens when a "coin" is divided arbitrarily? As in, there are no minimum unit of a "coin"?

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#376

Post by QuarterReptile »

an_opabinia wrote: post #341
bostonsre wrote: post #275

Earlier quoted context omitted.

Yea, I think I tend to agree with you. It may cause a lot of pain in the short term, but being forced to pay penetration testers seems like it could be a net good in the long term for security in general. I don't think nation state attackers would be so kind as to un-fuck your system after they cripple it, even for a massive fee.

I don’t know. Did any of it matter? It was bad when people started hoarding gas. Just a few unfathomably stupid people - as always in this country. If idiots didn’t hoard gas, nothing would really have gone wrong. The preppers are the other side of the same coin. The only thing they seem to never run out of is toilet paper. Who the fuck cares? Pentesters have the same energy. They tell you about what software not to…

You know what's way more effective at stopping gas hoarding so it's available for someone who really wants/needs it? Doubling the price per gallon. Anti-price gouging laws caused the shortage, just like with toilet paper and PPE last year.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#377

Post by publicola1990 »

nodesocket wrote: post #327
kjrose wrote: post #201

The fact this was paid off, and paid off so rapidly means that targeting major infrastructure for massive payoffs is going to become more and more prominent. The next time though, it'll be $50M. I work with people in the oil fields and I know the numbers they are playing with and the fact that a single well being down can easily be $100,000 lost per hour. So obviously they want these systems back up fast. $5M for shu…

This was extremely poor (I'd say weak) leadership by Colonial Pipeline. While continuing to be down is painful, it puts a spotlight on the issue and forces hands of critical infrastructure to improve security and reach out to security companies for audits and consulting. Also, they could have gotten additional support from the US government and political support by continuing to stay down instead of the back alley pa…

It appeared that they informed the government that they are paying the ransom, Government's view was that it was a private sector matter so it is prerogative of Colonial to act.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#378

Post by janmo »

cwkoss wrote: post #308

I love the idea of sprinkling bitcoin private keys in text files around your infrastructure, so any hacker that gets access can take the funds, but you'll be alerted to it and can quarantine the box and investigate the intrusion. Maybe include "Email us with a write up of how you got in and a bitcoin address, and we'll send more bitcoin based on how helpful it was" Rotate the keys periodically and sweep all unstolen…

I am doing exactly that on a personal level. I have an unencrypted BTC wallet and one that is encrypted, the unencrypted one contains not that much and will tell me if my device has been compromised.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#379

Post by publicola1990 »

I hear online that the ransomware had no effect on the Colonials ability to physically pump the oil, it affected only its billing systems, but they stopped pumping anyway because it would have been difficult to reconcile the accounting/billing if they continue to operate without the billing system being live.

Is this true?

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#380

Post by acherion »

whall6 wrote: post #83

In Cambodia, people buy dirt to increase their property’s elevation so that their neighbor’s house floods when the monsoon comes. Then the neighbor has to pay for more dirt and so on throughout the whole neighborhood. It seems like the attackers are finding the paths of least resistance. Beefing up security at each organization isn’t fixing the underlying problem. It’s just making the next entity the more likely targ…

> Beefing up security at each organization isn’t fixing the underlying problem. It’s just making the next entity the more likely target.

This reminds me of the old saying about locking your bicycle on the street. It won't 100% prevent yours from being stolen, but if the other bikes around yours has less secure means of locking, then the thief will likely take those bikes instead of yours.

Post reply on HN