We begin with the brazen cyberattack that has shut down the biggest pipeline in the
United States.
This is the biggest attack that involves vital infrastructure.
There are increasing concerns over the possibility of shortages of gasoline and diesel.
It’s a pipeline that moves 45% of the east coast diesel, gas, and jet fuel from Texas,
all the way up to New Jersey.
On the night of May 6th, 2021, a critical piece of American energy infrastructure was
crippled by Russian hackers.
The victim of the attack was the Colonial Pipeline, which helps carry 3 million barrels
of fuel per day between Texas and New York.
One day later, executives at Colonial Pipeline sent the hackers $5 million dollars in Bitcoin.
The story of this particular hack is incredibly interesting, but not for the reason you might
think.
There’s actually a lot more going on here.
The Colonial Pipeline cyberattack is a harbinger of things to come, and the United States is
woefully underprepared.
Major technological and economic forces have shifted to make these attacks easier to execute
and much more profitable, and this is really only the beginning.
So let’s dig in and figure out what’s going on.
In order to understand what makes this attack so unique, it’s important to examine the
role that oil pipelines play in the American economy.
The U.S. is the third largest country in the world, and the number one consumer of oil.
Despite electric vehicles becoming increasingly popular, 97% of cars still run on gasoline,
and the process of transporting that fuel all across the country relies on a massive
network of pipelines.
The Colonial Pipeline is the biggest of them all and millions of Americans rely on it to
get gasoline from refineries in Texas up the east coast to cities like New York.
The pipeline has been active since the 1960s and, as you can guess, they don’t exactly
operate like a modern technology company.
Computer systems are outdated and a report from 2018 found glaring deficiencies in their
security systems.
In fact, the consultant who led the investigation said that “an eighth grader could have hacked
into the Colonial Pipeline system.”
So when a group of Russian hackers set their sights on the company, it looked like a gold
mine.
Colonial had plenty of resources to pay a bounty and little security to fight back against
an attack, so they went to work.
We still don’t know exactly how the hackers got access to the Colonial network, but once
they did, the hackers quickly exported nearly 100Gb of data before encrypting everything
on the network.
This strategy is at the core of every modern ransomware attack: steal the data and then
encrypt everything on the network to lock your victim out of their own systems.
This creates an impossible choice for victim companies, and this is the first reason why
these ransomware attacks are becoming so prevalent: attackers give victims no good options.
The hackers weren’t actually able to exfiltrate all 100 gbs of data.
They couldn’t just send the data to Russia directly, so they had to route through a string
of proxy servers.
US Officials from the National Security Agency noticed the unusual activity and were able
to intervene and shut down key servers while the data was in still transit, but enough
of the data made it to Russia that the Colonial Pipeline team was still stuck between a rock
and a hard place.
By stealing at least some of the data and then encrypting the network, hackers trap
companies in a lose-lose situation.
If they try and restore their data or buy new computers, the hackers can leak the stolen
data onto the darkweb, which will allow other hackers to take advantage of customer information
or competitors to steal intellectual property.
This is a terrible scenario, but the alternative is sometimes worse.
If your company refuses to pay to decrypt the data, valuable information could be lost
forever and that can cause huge financial losses.
Rudimentary ransomware attacks do things as simplistic as just renaming files, or altering
them slightly to try and corrupt them, but modern attacks like the one perpetrated against
the Colonial Pipeline take a much more technologically advanced approach.
They employ state-of-the-art encryption methods to ensure that it’s impossible for data
to be recovered.
The only option is often to simply pay the ransom.
And that leads to the second reason why these attacks are becoming more common: cryptocurrency
has enabled semi-anonymous payment across borders.
Viruses and malware have been around for decades, but only in the past few years has it become
possible to get a victim to pay you during a ransomware attack and actually walk away
with anything of value.
Before bitcoin became popular, sending a wire transfer across borders would require coordination
with a foreign bank, and US government agents could easily arrange to catch the perpetrator
when they went to receive the payment.
Banks that consistently aided criminals in international schemes would be sanctioned
and eventually removed from the global payment network.
But crypto changes all of this.
Victims can now easily buy bitcoin through exchanges and transfer to the hacker’s wallet
without leaving a significant paper trail.
Sometimes all a victim needs is a credit card and a web browser.
In a funny twist, sometimes this winds up benefiting the victim.
A few years ago, when a major law firm was the victim of a ransomware attack, they assumed
they would have no option but to pay up, so they bought several hundred thousand dollars
in bitcoin.
But they also retained a cyber security team to investigate the incident.
This team figured out that the attacker was based in the United States and worked with
the FBI to apprehend him.
They didn’t need to pay the ransom but they still had the bitcoin, and in the few weeks
that they were working to fight the hack, they had made over a million dollars in profit.
The Colonial Pipeline folks weren’t quite so lucky.
Within hours of the attack, they instantly understood how serious the situation was and
knew that they had to pay, so they bought $5 million dollars in bitcoin and prepared
to send it to the hackers.
Now, big companies like Colonial have cyber insurance policies, which will often reimburse
ransoms like this one, but there is an interesting cat and mouse game going on that is making
these ransoms skyrocket in value recently.
Here’s how it works:
Companies are worried about ransomware attacks, so they go out and buy cybersecurity insurance.
But hackers know that companies have insurance, so they get more aggressive about targeting
companies.
Additionally, when a hacker breaches a corporate network, they have access to all of the company's
files, including their cyber insurance policy.
The first thing some hackers do when they infiltrate a company is search for documents
relating to cyber insurance to find out exactly what the company can afford to pay.
If the hacker sees that the insurance company will pay up to $5 million in ransomware fees,
then they will demand exactly $5 million.
I’m generally a big fan of cryptocurrencies, but it’s clear that they are a big reason
why ransomware attacks are growing in popularity.
Hackers love that they can deploy these hacks from the safety of a country like Russia and
still get paid quickly and discreetly without drawing the attention of authorities.
But there’s still one more big reason why these attacks are spreading like wildfire.
And this is reason number there: ransomware has become a product.
When you think of a typical hacker, you probably think of a lone wolf coding long into the
night in some basement, but that’s all changing.
American authorities have identified a hacker group by the name of DarkSide as the party
responsible for the Colonial Pipeline attack, but it’s unlikely that they were directly
responsible.
That’s because DarkSide is primarily focused on developing ransomware, they leave the actual
attacks up to independent hackers.
This model has been called “Ransomware as a Service” and it’s completely changing
the economics of hacking.
Instead of finding individual targets and hacking them directly, DarkSide develops ransomware
that other hackers can use and then turns them loose.
Just as all major tech companies have moved from selling their software as a one time
fee to now insisting on a subscription.
DarkSide takes a service fee on whatever profits are generated from using their ransomware.
They typically charge 25% for ransom fees less than $500,000, but lower that fee to
10% for ransoms greater than $5 million.
And there’s that $5 million dollar figure again.
It could be a coincidence, but I wouldn’t be surprised if the hackers that use DarkSide’s
Ransomware as a Service see $5 million as a nice sweet spot.
That amount is likely to be covered by insurance and it reduces the fee paid to DarkSide for
their software.
The Ransomware as a Service business model insulates DarkSide from the risk of being
caught actually using these illegal tools, but still allows them to make tons of money
as armies of hackers deploy their ransomware in companies across the world.
These hackers have adopted all of the best practices from modern tech companies and are
now set to disrupt businesses at an alarming rate.
But as we’ve seen with the Colonial Pipeline hack, these tools can have far reaching effects,
often beyond what the hackers initially intended.
When DarkSide lets other hackers use their ransomware, there is a real risk that they
might target the wrong organization and cause an international incident.
And this has happened before:
39 hospital trusts and GPs in Scotland and across England have had to cancel routine
operations, send patients home.
Cyber security experts are warning that the rogue regime could be behind that global cyberattack
that held at least 300,000 computers hostage in over 150 countries.
In 2017, North Korean hackers launched the WannaCry ransomware attack, which targeted
older computers that hadn’t been patched recently.
Unfortunately, a lot of those older computers were used in hospitals, like the United Kingdom’s
National Health Service.
Shutting down computers in a hospital can have life-threatening effects, and some hospitals
had to turn away ambulances during the attack.
Hacks like that have real-world impact, and draw way more attention than merely demanding
payment for some corporate files.
When DarkSide began selling their ransomware, they made it clear that they didn’t want
to draw too much negative attention, and even went so far as to issue a statement saying:
“that they would not target hospitals, schools, or governments.”
Cyber attacks generally fall into two categories: espionage and sabotage.
Espionage involves sneaking into a system and stealing information, or in the case of
ransomware attacks, stealing data and then encrypting everything.
Sabotage is much more aggressive, since it involves actually trying to cause physical
damage to equipment or buildings.
Sabotage focused hacks are usually perpetrated by governments, since once you destroy your
targets equipment, there isn’t much financial gain to be had.
But sabotage and espionage are increasingly starting to overlap.
Sometimes hackers break into a company’s network in order to just steal data, but wind
up crippling critical infrastructure in the process.
And that’s exactly what happened with the Colonial Pipeline.
The hackers seem to have been entirely money motivated and focused just on the ransomware
scheme, but because of how various systems are connected within Colonial’s network,
the company had no choice but to shut the pipeline down as a precaution.
See, more and more, complex machinery is being connected to computers through what are called
industrial control systems.
Instead of turning valves manually, computers are now used to flip switches and save human
operators time.
But connecting these industrial machines to computers means, of course, that they can
be hacked, and there is one particularly interesting case where a state actor was able to sabotage
physical infrastructure using only code.
It was December of 2015, and an elite team of Russian hackers known as “Sandworm”
had set their sights on Ukraine’s power grid.
They broke into the network using phishing emails to steal administrator passwords, and,
once they were in, they started remotely disabling power substations to cause blackouts.
This was the first time that a power grid had ever been successfully targeted in a cyberattack,
and it had some pretty significant consequences.
As you can imagine, turning off the power can cause real harm to people in the affected
area.
Hospitals and critical life support equipment can go offline and people can die.
Fortunately, in this case, workers from the Ukrainian power companies were able to manually
override the malicious code and restore power, but you can see how these acts of sabotage
can have a real impact.
DarkSide wants to avoid these types of incidents.
Extorting a few million dollars from a big company makes for much milder headlines than
shutting down a hospital and they know that sabotage attacks will lead to an international
response.
But even though they try and sell their ransomware only to hackers who will use it exclusively
for financial gain, there is always the risk of cascading effects.
We are going to see more ransomware attacks.
The technology is simply too easy to deploy and the probability of real financial gain
is simply too high.
Hackers will continue to target companies and these hacks will have unintended effects.
So what’s the solution?
The best approach will be multi-faceted: First, the US needs to pressure foreign governments
to stop protecting hackers.
Second, we all need to improve our cybersecurity, which means recruiting more technologists
into the field.
At the time of the hack, the Colonial Pipeline had multiple cybersecurity related job openings,
but it looks like they were unable to fill them.
If you’re interested in cybersecurity, now is a great time to get into the field, I can
guarantee you there will be a lot more work to do in the future.
If you want to chat about the Colonial Pipeline hack, just leave me a comment below or DM
me on Twitter, and please check out this recommended video, the YouTube algorithm thinks you’ll
really like it.