Colonial Pipeline Paid Hackers Nearly $5M in Ransom • Hacker News Board

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#441

Post by jdsalaro » Fri, May 14, 2021, 5:58 AM UTC

tw04 wrote: post #414

DevX101 wrote: post #259

Earlier quoted context omitted.

I think these ransoms are net good. I'd rather greedy hackers shake them down for money then having the country get crippled by political terrorists or enemy nation states that can't be negotiated or reasoned with. There are lots of infrastructure management teams taking security more seriously than they were a month ago. That alone is worth more than $5M

I think you're kidding yourself if you think a company that gets "hacked" by off the shelf cryptoware is going to step up their game enough to have any chance of stopping a targeted state actor. The fact they caved so quickly tells me they are years away from a reasonable security posture.

> I think you're kidding yourself if you think a company that gets "hacked" by off the shelf cryptoware is going to step up their game enough

Still, this might lead to their first solid security hire that can bring about change in the form of zero-trust principles, security in depth, etc.

> to have any chance of stopping a targeted state actor.

Given unlimited resources, interest and budget, no participant in the modern digital landscape has a significant chance of stopping motivated threat actors.

> The fact they caved so quickly tells me they are years away from a reasonable security posture.

Yes, obviously, but driving change is about incrementally tending to a desired state. Your fatalism is, quite frankly, unnecessary, not that you're not entitled to your opinion, just that disagreeing with GP or stating they are naive because this won't bring about perfect, all-encompassing change is not useful.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#442

Post by foerbert » Fri, May 14, 2021, 5:58 AM UTC

WalterBright wrote: post #435

foerbert wrote: post #433

Earlier quoted context omitted.

And rationing can address that problem. These complex issues are never so simple.

Rationing makes simple things complex. For example, rationing assumes that everyone has exactly the same need. Trying to fix that is hopelessly complicated.

I don't see how that's an argument against anti-price gouging laws though. It's not like price gouging solves that problem. Fundamentally a shortage is just never going to give perfect results.

Even simplistic rationing is at least relatively fair and can ensure at least a base level of availability. For the major necessities this can be pretty reasonably accounted for to ensure nobody suffers from some extreme deprivation.

It also lets you at least put some somewhat predictable cap on how fast resources are going out. Allowing price gouging doesn't let you predict much of anything, and I'm not sure it even slows the outflow given the uncertainty of these situations.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#443

Post by bostonsre » Fri, May 14, 2021, 5:59 AM UTC

jfoutz wrote: post #428

rcthompson wrote: post #417

Earlier quoted context omitted.

Yes, "ideally" that's what would happen. Do you really expect that to happen in practice?

Well, fines are a fixed cost, the risk can be calculated and offset against a bonus. A ransom has an unknown downside. I'd imagine most ransoms would be priced to likely get paid, but ransomers don't really know the biz inside and out, so they might guess a painful or fatal price. but that's a one time cost. the lost revenue is the killer. I'd expect there will be some serious talks about how much to pay to prevent t…

Yea, it seems like a pretty novel situation where I'm almost happy that these gangs are walking through these companies' unlocked front doors and causing enough havoc to be noticed but not enough to hurt them beyond repair. If it becomes enough of an infectious cesspool with diseases that can't be slept off to the point that these sloppy companies are forced to wear hazmat suits to exist in the environment, maybe that isn't such a bad thing in the long run. Before that tipping point, hopefully we don't just breed a large quantity of super bug diseases/ransomware gangs that laugh at decent security.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#444

Post by cutemonster » Fri, May 14, 2021, 6:00 AM UTC

Veserv wrote: post #245

beachy wrote: post #218

Earlier quoted context omitted.

> At a $5M payout there are essentially 0 commercial IT systems in the world that can stop such an attack. Even if that's true, it doesn't affect backups. Back your fucking systems up properly, and if you are attacked by ransomware, then do a scorched earth restore.

It absolutely does affect backups. If you stand to gain $5M from an attack you can also target the backup systems and still easily end up profitable. Only if you stand to gain less than $100k does the budget actually start to get tight. As for how you attack the backup system it depends. If it push based you send your payload during the push. If it is pull based you craft your payload in the data that will be backed…

> If it is in hardware you just infiltrate then silently encrypt any new data until it would be painful to revert that far back in time

What does "infiltrate" mean here? An insider?

> painfulthey regularly test their backups you just silently decrypt the data on restore until it is time to strike.

Interesting, I was just going to ask

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#445

Post by foerbert » Fri, May 14, 2021, 6:05 AM UTC

nickff wrote: post #434

foerbert wrote: post #433

Earlier quoted context omitted.

And rationing can address that problem. These complex issues are never so simple.

Then you get a black market... it's almost a cobra effect.

Sure. I'd guess it still adds enough friction to help result in a better distribution of goods in the end. The time, effort, and (legal) risk you are willing to take to acquire something should correlate decently with how much you really need those goods.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#446

Post by langitbiru » Fri, May 14, 2021, 6:05 AM UTC

kjrose wrote: post #201

The fact this was paid off, and paid off so rapidly means that targeting major infrastructure for massive payoffs is going to become more and more prominent. The next time though, it'll be $50M. I work with people in the oil fields and I know the numbers they are playing with and the fact that a single well being down can easily be $100,000 lost per hour. So obviously they want these systems back up fast. $5M for shu…

My friend who works in cyber security share this framework to deal with ransomware with me: https://securityandtechnology.org/ransomwaretaskforce/report...

This problem needs to be solved in collective level.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#447

Post by gorgoiler » Fri, May 14, 2021, 6:07 AM UTC

JohnJamesRambo wrote: post #329

kjrose wrote: post #201

The fact this was paid off, and paid off so rapidly means that targeting major infrastructure for massive payoffs is going to become more and more prominent. The next time though, it'll be $50M. I work with people in the oil fields and I know the numbers they are playing with and the fact that a single well being down can easily be $100,000 lost per hour. So obviously they want these systems back up fast. $5M for shu…

They could always just keep the "X" unplugged, it is doubtful hackers from Russia go onsite and sabotage things. Maybe this will make companies realize if they can't secure it at least just disconnect it. Everything doesn't have to be online.

The “X” may be unplugged but your day-labor contract industrial cleanup techs are hired through an Uber-for-Cleaners Hygiene-as-a-service Heroku app that’s had every backup silently deleted for a month and has just been replaced with a funny cat photo by someone claiming their name is spelled with a zero in it.

You can’t hire cleaners. Site cleanup is suspended. Your insurance is invalid if workers are onsite while hazmats are left uncleaned. You shut down on the day you were about to ship a full warehouse of product. Manufacturing grinds to a halt because the outbound warehouse is full. You have to cease goods incoming because they were misusing the day-labor app for handling delivery grunt work.

Ph0bos Security Services also hacked your email so now everyone has to use personal phones and WhatsApp but upper management won’t share their numbers with anyone except the foreman so he is now the bottleneck for everyone who needs approval to make out of budget purchases to handle the capacity overload that’s happening everywhere except for hazmat cleaning.

But the pumps were airgapped so at least they didn’t get hacked.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#448

Post by entwife » Fri, May 14, 2021, 6:08 AM UTC

This looks like market manipulation.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#449

Post by lawn » Fri, May 14, 2021, 6:13 AM UTC

drzoltar wrote: post #207

Dumb question: why can’t crypto currencies and exchanges place the ransom tokens on some kind of blocklist, thereby forever tainting those coins? As I understand, the rise of “privacy wallets” has greatly increased the anonymity of such transactions. But, at the end of the day, don’t we always have a ledger of the coin ids? I’m curious how the coins actually get laundered back into cash.

> don’t we always have a ledger of the coin ids?

Monero hides the sender, receiver and the transaction amount from the public.

While it's not a perfect system (ring signatures being the main weakness), it's extremely difficult to trace and you can for instance sell them on Kraken directly for cash.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#450

Post by WalterBright » Fri, May 14, 2021, 6:16 AM UTC

foerbert wrote: post #442

WalterBright wrote: post #435

Earlier quoted context omitted.

Rationing makes simple things complex. For example, rationing assumes that everyone has exactly the same need. Trying to fix that is hopelessly complicated.

I don't see how that's an argument against anti-price gouging laws though. It's not like price gouging solves that problem. Fundamentally a shortage is just never going to give perfect results. Even simplistic rationing is at least relatively fair and can ensure at least a base level of availability. For the major necessities this can be pretty reasonably accounted for to ensure nobody suffers from some extreme depri…

How high prices work is:

1. only those who really need it buy it

2. others are encouraged to increase supply

For example, before anti-gouging laws, when a hurricane interrupted the gas supply, people from a state over would immediately fill jerry cans with gas and drive into the disaster zone, selling gas out of the back of their pickups.

Anti-gouging laws put a stop to that. Now nobody gets gas until FEMA gets around to it.

I've talked to people who lived through WW2 gas rationing. It was a mess of mis-allocation. People who didn't need their ration turned into criminals selling it on the black market. People who needed it turned into criminals buying it on the black market. It was pure political theater.