Cyberattack on U.S. pipeline linked to criminal gang - CBC.ca

The cyberextortion attempt that has forced the shutdown of a vital U.S. pipeline was carried out by a criminal gang known as DarkSide, which cultivates a Robin Hood image of stealing from corporations and giving a cut to charity, two people close to the investigation said Sunday.

The shutdown, meanwhile, stretched on, with the Biden administration loosening regulations for the transport of petroleum products on highways as part of an "all-hands-on-deck" effort to avoid disruptions in the fuel supply.

Experts said that gasoline prices are unlikely to be affected if the pipeline is back to normal in the next few days, but that the incident — the worst cyberattack to date on critical U.S. infrastructure — should serve as a wake-up call to companies about the vulnerabilities they face.

The pipeline, operated by Georgia-based Colonial Pipeline, carries gasoline and other fuel from Texas to the Northeast. Its pipeline system spans more than 8,850 kilometres, transporting more than 380 million litres a day.

It delivers roughly 45 per cent of fuel consumed on the East Coast, according to the company.

Colonial was hit by what it called a ransomware attack, in which hackers typically lock up computer systems by encrypting data, paralyzing networks and then demand a large ransom to unscramble it.

Colonial operates a major U.S. energy pipeline that sends petroleum products from Texas to the U.S. East Coast. (The Associated Press)

On Sunday, Colonial said it was in the process of restoring some of its IT systems. It says it remains in contact with law enforcement and other federal agencies, including the Department of Energy, which is leading the federal government response.

The company has not said what was demanded or who made the demand.

Active since August

However, two people close to the investigation, speaking on condition of anonymity, identified the culprit as DarkSide. It is among ransomware gangs that have "professionalized" a criminal industry that has cost Western nations tens of billions of dollars in losses in the past three years.

DarkSide claims that it does not attack hospitals and nursing homes, educational or government targets and that it donates a portion of its take to charity. It has been active since August and, typical of the most potent ransomware gangs, is known to avoid targeting organizations in former Soviet bloc nations.

Colonial did not say whether it has paid or was negotiating a ransom, and DarkSide neither announced the attack on its dark web site nor responded to an Associated Press reporter's queries. The lack of acknowledgement usually indicates a victim is either negotiating or has paid.

The attack on Colonial Pipeline forced the company to shut down its network on Friday. On Sunday, Colonial said it is developing a "system restart" plan. It said its main pipeline remains offline but some smaller lines are now operational.

"We are in the process of restoring service to other laterals and will bring our full system back online only when we believe it is safe to do so, and in full compliance with the approval of all federal regulations," the company said in a statement.

Commerce Secretary Gina Raimondo said Sunday that ransomware attacks are "what businesses now have to worry about," and that she will work "very vigorously" with the Department of Homeland Security to address the problem, calling it a top priority for the administration.

"Unfortunately, these sorts of attacks are becoming more frequent," she said on CBS's Face the Nation. "We have to work in partnership with business to secure networks to defend ourselves against these attacks."

She said President Joe Biden was briefed on the attack.

The Department of Transportation issued a regional emergency declaration Sunday, relaxing hours-of-service regulations for drivers carrying gasoline, diesel, jet fuel and other refined petroleum products in 17 states and the District of Columbia. It lets them work extra or more flexible hours to make up for any fuel shortage related to the pipeline outage.

One of the people close to the Colonial investigation said that the attackers also stole data from the company, presumably for extortion purposes. Sometimes stolen data is more valuable to ransomware criminals than the leverage they gain by crippling a network, because some victims are loathe to see sensitive information of theirs dumped online.

Warning to infrastructure operators

Security experts said the attack should be a warning for operators of critical infrastructure — including electrical and water utilities and energy and transportation companies — that not investing in updating their security puts them at risk of catastrophe.

Ed Amoroso, CEO of TAG Cyber, said Colonial was lucky its attacker was ostensibly motivated only by profit, not geopolitics. State-backed hackers bent on more serious destruction use the same intrusion methods as ransomware gangs.

"For companies vulnerable to ransomware, it's a bad sign because they are probably more vulnerable to more serious attacks," he said. Russian cyberwarriors, for example, crippled the electrical grid in Ukraine during the winters of 2015 and 2016.

Cyberextortion attempts in the U.S. in the past year have forced delays in cancer treatment at hospitals, interrupted schooling and paralyzed police and city governments.

David Kennedy, founder and senior principal security consultant at TrustedSec, said that once a ransomware attack is discovered, companies have little recourse but to completely rebuild their infrastructure, or pay the ransom.

"Ransomware is absolutely out of control and one of the biggest threats we face as a nation," Kennedy said. "The problem we face is most companies are grossly underprepared to face these threats."

Adblock test (Why?)

Cyberattack on U.S. pipeline linked to criminal gang - CBC.ca
Read More