Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Colonial Pipeline Paid Hackers Nearly $5M in Ransom

bloomberg.com

Post reply on HN
Print view View original

451–460 of 524 posts

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#451

Post by cheese_van »

at-fates-hands wrote: post #432
joe_the_user wrote: post #350

Earlier quoted context omitted.

Company: Well this is a painful lesson Me: Only if you learn it. Penetration testing is part of a security program. If you don't have a security program, penetration "testing" isn't useful whether it's painful or not. Haves the careers or investments of anyone significant who brought things to this point been screwed? If not, nothing will change.

>> Me: Only if you learn it. As someone with a lot of friends and co-workers who are on the info-sec side, the stories I repeatedly hear of how many times they visit the same company year/year and little if anything is done to harden their networks, and impose stricter security on their users is way more common than it should be. Most, if not all of these networks should be taken offline and siloed, but you know that…

1. Any system can be hacked. We don't know enough to judge Colonial's infosec posture.

2. Agree that paying leads to bad outcomes. But I also suspect the feds put some pressure on Colonial. Voters remember gas lines and the pump prices.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#452

Post by p1necone »

femto wrote: post #302
p1necone wrote: post #283

Earlier quoted context omitted.

The difference in actual value between the two for me at least is much smaller than the difference in numerical value. Both amounts are enough for me to never work another day in my life, and instead focus on building what I want to build. Past that massive increase in quality of life extra money is relatively meaningless (to me) . This is the same reason that people who decry spending money on lottery tickets as a s…

Off topic, but I'm curious: What do you want to build and why can't you start building it now?

Mostly software - games and related tooling, learning more about type systems and applying it in a homebrew language.

I can start building it now. But after already spending 40 hours a week writing code at my day job and having those problems swimming around in my head all the time it's hard to find the motivation to do more, even when what I do for my day job isn't as creatively fulfilling.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#453

Post by devwastaken »

QuarterReptile wrote: post #376
an_opabinia wrote: post #341

Earlier quoted context omitted.

I don’t know. Did any of it matter? It was bad when people started hoarding gas. Just a few unfathomably stupid people - as always in this country. If idiots didn’t hoard gas, nothing would really have gone wrong. The preppers are the other side of the same coin. The only thing they seem to never run out of is toilet paper. Who the fuck cares? Pentesters have the same energy. They tell you about what software not to…

You know what's way more effective at stopping gas hoarding so it's available for someone who really wants/needs it? Doubling the price per gallon. Anti-price gouging laws caused the shortage, just like with toilet paper and PPE last year.

Price of gold and silver is at its peak and people are buying it more than ever convinced it will somehow become extinct. The people who have money to hoard gas are also the people who have the money to hoard gas at double the price. These are not individuals with any knowledge of economics - theyre not doing it for trade, they're doing it out of belief.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#454

Post by foerbert »

WalterBright wrote: post #450
foerbert wrote: post #442

Earlier quoted context omitted.

I don't see how that's an argument against anti-price gouging laws though. It's not like price gouging solves that problem. Fundamentally a shortage is just never going to give perfect results. Even simplistic rationing is at least relatively fair and can ensure at least a base level of availability. For the major necessities this can be pretty reasonably accounted for to ensure nobody suffers from some extreme depri…

How high prices work is: 1. only those who really need it buy it 2. others are encouraged to increase supply For example, before anti-gouging laws, when a hurricane interrupted the gas supply, people from a state over would immediately fill jerry cans with gas and drive into the disaster zone, selling gas out of the back of their pickups. Anti-gouging laws put a stop to that. Now nobody gets gas until FEMA gets aroun…

This is not the whole story, by any means.

Those who buy it are those who can afford it. They also (think) they need it, for some reason. That can include the intention to legally resell it. Buying suddenly comes with even more time pressure. Buying now becomes both a hedge and speculation, with zero legal risks.

Sure, people bringing in supplies on their own sounds good. It can even be good. But how much does it actually bring in? Does it come with other problems, like additional stress on infrastructure? If this really is such a great thing, I don't see how it should be wholly incompatible with anti-price gouging laws. If you want to specifically incentivize private transport of goods from out of the area, you don't have to allow them to be sold for any price, nor do you have to allow it for goods already in the area.

As for the black market, I'm not sure that's a bug. It makes it harder, and adds some risk, to acquiring more. If you actually need it enough, you'll do it. There some be some correlation between actual need and willingness to participate in the black market. With proper use of the discretion available to law enforcement, maybe this even enhances how well the goods end up distributed. That's a big "with" but still.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#455

Post by bayesian_horse »

DevX101 wrote: post #259
kjrose wrote: post #201

The fact this was paid off, and paid off so rapidly means that targeting major infrastructure for massive payoffs is going to become more and more prominent. The next time though, it'll be $50M. I work with people in the oil fields and I know the numbers they are playing with and the fact that a single well being down can easily be $100,000 lost per hour. So obviously they want these systems back up fast. $5M for shu…

I think these ransoms are net good. I'd rather greedy hackers shake them down for money then having the country get crippled by political terrorists or enemy nation states that can't be negotiated or reasoned with. There are lots of infrastructure management teams taking security more seriously than they were a month ago. That alone is worth more than $5M

These ransoms are funding the work of enemy nation states trying to cripple western nation states...

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#456

Post by DrScump »

DevX101 wrote: post #259
kjrose wrote: post #201

The fact this was paid off, and paid off so rapidly means that targeting major infrastructure for massive payoffs is going to become more and more prominent. The next time though, it'll be $50M. I work with people in the oil fields and I know the numbers they are playing with and the fact that a single well being down can easily be $100,000 lost per hour. So obviously they want these systems back up fast. $5M for shu…

I think these ransoms are net good. I'd rather greedy hackers shake them down for money then having the country get crippled by political terrorists or enemy nation states that can't be negotiated or reasoned with. There are lots of infrastructure management teams taking security more seriously than they were a month ago. That alone is worth more than $5M

This is not like paying bug bounties to white hats who isolate and report exploits before they are utilized in the wild.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#457

Post by WalterBright »

foerbert wrote: post #454
WalterBright wrote: post #450

Earlier quoted context omitted.

How high prices work is: 1. only those who really need it buy it 2. others are encouraged to increase supply For example, before anti-gouging laws, when a hurricane interrupted the gas supply, people from a state over would immediately fill jerry cans with gas and drive into the disaster zone, selling gas out of the back of their pickups. Anti-gouging laws put a stop to that. Now nobody gets gas until FEMA gets aroun…

This is not the whole story, by any means. Those who buy it are those who can afford it. They also (think) they need it, for some reason. That can include the intention to legally resell it. Buying suddenly comes with even more time pressure. Buying now becomes both a hedge and speculation, with zero legal risks. Sure, people bringing in supplies on their own sounds good. It can even be good. But how much does it act…

> As for the black market, I'm not sure that's a bug.

Rationing implies a black market must be illegal. Besides, it enriches random people who don't need gas, at the expense of the people who went to the effort to supply it.

If that isn't a topsy-turvy unjust, inefficient and inequitable way to run an economy, I don't know what is.

Rationing suffers from the delusion that bureaucratic rules can distinguish who needs something and who doesn't, and denial of the existence of normal human motivations.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#458

Post by brobdingnagians »

jdsalaro wrote: post #441
tw04 wrote: post #414

Earlier quoted context omitted.

I think you're kidding yourself if you think a company that gets "hacked" by off the shelf cryptoware is going to step up their game enough to have any chance of stopping a targeted state actor. The fact they caved so quickly tells me they are years away from a reasonable security posture.

> I think you're kidding yourself if you think a company that gets "hacked" by off the shelf cryptoware is going to step up their game enough Still, this might lead to their first solid security hire that can bring about change in the form of zero-trust principles, security in depth, etc. > to have any chance of stopping a targeted state actor. Given unlimited resources, interest and budget, no participant in the mod…

No single participant has a significant chance, but if each target becomes more expensive on average, then state actors can only afford less targets, which makes the society as a whole more resilient.

And if one target is so critical that it could take out a society, perhaps it would be better to either 1. Make it so minimalistic that it can be fully audited and secured or 2. Broken into smaller pieces and decentralised so they can either qualify for #1 or increase the total cost and complexity of compromise.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#459

Post by gonehome »

kjrose wrote: post #201

The fact this was paid off, and paid off so rapidly means that targeting major infrastructure for massive payoffs is going to become more and more prominent. The next time though, it'll be $50M. I work with people in the oil fields and I know the numbers they are playing with and the fact that a single well being down can easily be $100,000 lost per hour. So obviously they want these systems back up fast. $5M for shu…

Moneystuff had a good post that touched on this today.

Even if they don’t pay, the scammers buy puts on the public stock for the companies they’re ransoming so they profit off of blowing them up too.

I’d imagine that’s easier to track and stop, but it’s interesting.

Re: Colonial Pipeline Paid Hackers Nearly $5M in Ransom

#460

Post by brobdingnagians »

devwastaken wrote: post #453
QuarterReptile wrote: post #376

Earlier quoted context omitted.

You know what's way more effective at stopping gas hoarding so it's available for someone who really wants/needs it? Doubling the price per gallon. Anti-price gouging laws caused the shortage, just like with toilet paper and PPE last year.

Price of gold and silver is at its peak and people are buying it more than ever convinced it will somehow become extinct. The people who have money to hoard gas are also the people who have the money to hoard gas at double the price. These are not individuals with any knowledge of economics - theyre not doing it for trade, they're doing it out of belief.

We have to wait and see if future results justify current actions, when the action is preparation for some future event. It is only in hindsight that we can truly point out if someone's risk/reward calculation for the future was flawed.

I'm not buying gold, but the odd thing is that Russian and Chinese central banks are. I would assume those people know a thing or two about economics. I'm curious to see what the future holds.

Post reply on HN