Jump to content

Pipeline Problem Potentially Problematic, production possibly paralyzed


Wally Fairway

Recommended Posts

10 minutes ago, Judge Roybeanbag said:

Most of the successful phishing attacks I've seen over the past few years have been that - board of director types and senior management, who either don't get cybersecurity training or don't pay attention when they do.  

CSIO customer of mine from a previous job once told me the former CEO of their company got hit with ransom ware. He responded to their email and told them he didn't know what bitcoin was, but gave them his corporate Amex number. 

  • Like 1
Link to comment
Share on other sites

Likely this came from a phishing campaign and some internal user clicked on a linked and provided credentials to the ransomware criminals.  The VAST majority of these "hacks" are just caused by employees doing something stupid like clicking on a link in an email that looks legit.

they were probably paid in Monero or some other privacy coin that is not easily tracked.

The pipeline company needs to have a full forensic and security audit done and should contact an IT firm that specializes in this sort of thing (In my experience they will be require to by their insurance company). or they run the risk of the same people trying again (low hanging fruit)

Link to comment
Share on other sites

32 minutes ago, AUS-97HORN said:

we are gonna hear about a lot of immolation issues in the next few days   soooo many videos already posted here, and on twitter, reddit and youtube of these fucking idiots picking any plastic container and filling it up.

Funny that the holy grail image of immolation to me was the monk, in a demonstration of selflessness.  Vs these selfish narcissistic assholes.

Link to comment
Share on other sites

On 5/12/2021 at 3:20 PM, Johnny Sack said:

spacer.png

Already answered but I'll add that DOT, when they do check, will look for red diesel* in your filter housing**

 

 

 

* off-road/tax-free diesel is dyed rec

** most diesel vehicles, if they dont have a clear filter housing, will have a drain so it isn't that hard to check.

Link to comment
Share on other sites

4 minutes ago, GringoSalado said:

Already answered but I'll add that DOT, when they do check, will look for red diesel* in your filter housing**

 

 

 

* off-road/tax-free diesel is dyed rec

** most diesel vehicles, if they dont have a clear filter housing, will have a drain so it isn't that hard to check.

Yes, marine diesel is dyed red.  

Link to comment
Share on other sites

17 minutes ago, GringoSalado said:

Already answered but I'll add that DOT, when they do check, will look for red diesel* in your filter housing**

 

 

 

* off-road/tax-free diesel is dyed rec

** most diesel vehicles, if they dont have a clear filter housing, will have a drain so it isn't that hard to check.

Life is fraught with risk.

  • Hook 'Em 1
  • Haha 1
Link to comment
Share on other sites

Guest Lobo

Maybe they're not hoarding fuel to gouge people with for quick cash.  Maybe they're stockpiling for yet another attempt by the South to 'Rise Again.'  

Maybe these are patriots dammit!  

Okay, I admit...it is gonna be funny when one of them blows up their meth lab with this extra fuel. 

Link to comment
Share on other sites

Guest Lobo

CEO Tim Felt, "Our system is secure.  You email them back and tell them that Colonial does not negotiate with cyber terrorists." 

CTO, "Okay sir.  Way to stand tough!  I'll just click on this link they said to use to communicate with them."

(lights flicker)

CEO Tim Felt (in George Bluth voice), "I have the worst fucking technicians."  

Edited by Lobo
Link to comment
Share on other sites

Looks like they paid $5 million ransom?
Bloomberg: Colonial Pipeline Paid Hackers Nearly $5 Million in Ransom.
https://www.bloomberg.com/news/articles/2021-05-13/colonial-pipeline-paid-hackers-nearly-5-million-in-ransom
Fucking lovely...

Yep. They must have been pretty fucked considering they probably had every resource helping them
Link to comment
Share on other sites

32 minutes ago, atomheartbevo said:

Wow, that's some shitty IT if they didn't have backups of backups of backups, and no way to roll back far enough.

It's being reported that most of their restore was from backups.

 

 

Link to comment
Share on other sites

4 hours ago, GringoSalado said:

Already answered but I'll add that DOT, when they do check, will look for red diesel* in your filter housing**

 

 

 

* off-road/tax-free diesel is dyed rec

** most diesel vehicles, if they dont have a clear filter housing, will have a drain so it isn't that hard to check.

I’ve still never met someone who’s been checked, and I know quite a few people who still run it.  

Link to comment
Share on other sites

We're not far off when it comes to secrets management from the days of post it notes on your monitor with passwords. Come to think of it, post it notes on your monitor is more secure than where most credentials are stored today.  At least with post it notes you would have to gain access to the building (or now someones house). 

When this is studied I think we will find the vulnerability exploited was some long lived credential these guys found.  Maybe six months ago a vendor got access to a DB to do XYZ for a week and that credential just lived on and got out.

Y'all want to come to my webinar?

  • Like 1
Link to comment
Share on other sites

2 hours ago, bigbevo76 said:

We're not far off when it comes to secrets management from the days of post it notes on your monitor with passwords. Come to think of it, post it notes on your monitor is more secure than where most credentials are stored today.  At least with post it notes you would have to gain access to the building (or now someones house). 

When this is studied I think we will find the vulnerability exploited was some long lived credential these guys found.  Maybe six months ago a vendor got access to a DB to do XYZ for a week and that credential just lived on and got out.

Y'all want to come to my webinar?

1QFHD.png

  • Hook 'Em 1
  • Like 1
Link to comment
Share on other sites

3 hours ago, bigbevo76 said:

We're not far off when it comes to secrets management from the days of post it notes on your monitor with passwords. Come to think of it, post it notes on your monitor is more secure than where most credentials are stored today.  At least with post it notes you would have to gain access to the building (or now someones house). 

 

Make sure you put tape over your webcam lol*

 

 

 

* (checks webcam) I have tape over my webcam

Link to comment
Share on other sites

Has anyone seen any figures on the business impact of this to CP? Gas demand is pretty inelastic, and it’s not like people can just go get gas somewhere else. They lost some temporary income but it will get made up in sales before and after.

Link to comment
Share on other sites

10 hours ago, atomheartbevo said:

Wow, that's some shitty IT if they didn't have backups of backups of backups, and no way to roll back far enough.

It's incredibly common for big/old IT shops to have a backup solution in place, but to have never actually tested it or restored a backup to exercise their ops runbook. Turns out, just having copies of the data doesn't do you any good if nobody knows how to restore it from archive

Link to comment
Share on other sites

10 hours ago, Buzzrock said:

Turns out my company met with them two years ago and urged them to stop managing vulnerabilities in Excel. The CISO said “it’s always worked fine for us, we don’t see a need for your solution.”

Whoops.

What was the proposed solution? While that sounds like an "oh shit, lulz" story, without knowing what your company was trying to push on these guys there is no way to know if it was actually a bad decision on Colonial's part.

 

Link to comment
Share on other sites

6 hours ago, Buzzrock said:

Has anyone seen any figures on the business impact of this to CP? Gas demand is pretty inelastic, and it’s not like people can just go get gas somewhere else. They lost some temporary income but it will get made up in sales before and after.

 

it's much greater than $5mil 

Link to comment
Share on other sites

14 hours ago, Buzzrock said:

Turns out my company met with them two years ago and urged them to stop managing vulnerabilities in Excel. The CISO said “it’s always worked fine for us, we don’t see a need for your solution.”

Whoops.

This is the mentality of most companies. They will do "just enough" on cyber security. It's costly to secure companies networks for which they will receive no revenue to offset the cost. All CEOs and CFOs see is cost driving down margin. Most everyone including customers assume that companies are adequately protecting themselves which couldn't be further than the truth. I don't trust anyone with my data, even companies who's business is an app to securely store passwords.

If/when we get into the next global war, we'll quickly find out how much of our core infrastructure is hacked when it is instantly taken offline.

  • Hook 'Em 1
Link to comment
Share on other sites

1 minute ago, NeverMarryAStripper said:

The Pentagon is going to find it difficult to fight a global war with no computer networks, communications, or GPS

russia is already circumventing ways US based technologies. i remember reading about how US based GPS systems do not work around red square. obviously is a means to thwart gps based weapons systems.

i'm just hoping our military is just as diligent in mitigating their mitigations and how to operate in a dark world, meaning no power grid.

Link to comment
Share on other sites

16 hours ago, atomheartbevo said:

Wow, that's some shitty IT if they didn't have backups of backups of backups, and no way to roll back far enough.

blinking light syndrome.  with 1000% certainty i guarantee there is a senior it executive at patriot that derives his power from hosting monolithic legacy onsite and controls a massive budget for iron and people that run it.  when the title VP of IT exists in the year 2021, it is guaranteed the management of that company has a clue about IT measured in negative numbers.

Link to comment
Share on other sites

16 hours ago, Buzzrock said:

Turns out my company met with them two years ago and urged them to stop managing vulnerabilities in Excel. The CISO said “it’s always worked fine for us, we don’t see a need for your solution.”

Whoops.

this.  american senior management, especially long-tenured lifers, have almost zero understanding of how the IT industry works today.  they think software is magic, you buy it, it runs itself, and the people that run it are an expense for the CEO to shoot when the board is up his ass about $.

  • Hook 'Em 1
Link to comment
Share on other sites

I'm losing my mind. I see a couple of photos every day that require the participants to be so galactically stupid that they me be photoshopped bullshit. Yet I now accept there's a 50/50 chance they are 100% real. We've reached the event horizon of human stupidity.

Link to comment
Share on other sites

What was the proposed solution? While that sounds like an "oh shit, lulz" story, without knowing what your company was trying to push on these guys there is no way to know if it was actually a bad decision on Colonial's part.
 


I’m not gonna dox myself or my company, but it was an industry leading vulnerability management solution and I found out we quoted them $75K for it. Not worth it, apparently. No guarantees it would have prevented whatever happened here, but undoubtedly a better option than Excel.
Link to comment
Share on other sites

11 minutes ago, Buzzrock said:

 


I’m not gonna dox myself or my company, but it was an industry leading vulnerability management solution and I found out we quoted them $75K for it. Not worth it, apparently. No guarantees it would have prevented whatever happened here, but undoubtedly a better option than Excel.

 

Doubtful it would have made any difference. Selling a VMS tool to a company without a Vulnerability Management Program is kind of pointless. It's about as useless as selling a SIEM solution to a company without a SOC.

 

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...