Understanding the Colonial Pipeline Ransomware Attack
Published June 17, 2021 WRITTEN BY ED TITTEL. Ed Tittel is a long-time IT industry writer and consultant who specializes in matters of networking, security, and Web technologies. For a copy of his resume, a list of publications, his personal blog, and more, please visit www.edtittel.com or follow @EdTittel On or about May 7, 2021, Colonial Pipeline had to shut its pipelines down because of a ransomware attack. Colonial is a major fuel pipeline operator in the southern and eastern US. Its pipelines stretch from Texas to New Jersey, and reach into Louisiana, Mississippi, Alabama, Georgia, both Carolinas, Tennessee, Virginia, Maryland and Pennsylvania. After a week of downtime that saw gas shortages in many of the more eastern states just mentioned, the company announced on May 12 it was restarting pipeline operations. By May 15, those operations had more or less returned to normal. One burning question remains: What happened? Understanding The Colonial Pipeline Ransomware Attack A Word from Joseph Blount, Colonial Pipeline’s CEO In an interview with the Wall Street Journal, Blount recounted he authorized a ransom payment of $4.4 million. He did so because company executives, in the words of the WSJ story, “were unsure how badly the cyberattack had breached its systems or how long it would take to bring the pipeline back.” According to the WSJ, “Colonial Pipeline provides roughly 45% of the fuel for the East Coast…” Essentially Colonial Pipeline chose to disregard long-standing advice from the FBI and other law enforcement agencies not to pay ransom demands in such situations. Blount demurred and is quoted as saying he authorized payment because “…it was the right thing to do for the country.” More About the Attack Security experts are in agreement with US government officials who attribute the attack to a criminal gang based in eastern Europe named DarkSide. This shadowy organization builds malware to attack systems for extortion, and shares the proceeds obtained from its ransomware with affiliates who actually foist the attacks that see its ransomware take over business and government systems all over the world. As reported in the WSJ story, Colonial worked with experts who had prior experience dealing with the organization behind the attack. That said, the company declined to share details on the negotiations involved in making the payment, or how much of its losses might (or might not) be covered by its cyber insurance coverage. Once the attackers received payment, they provided a decryption tool to unlock affected systems. To underscore law enforcement advice, Colonial also disclosed that the decryption key did not provide everything needed to restore its systems to normal operation. According to CNN, and contrary to many other reports, the sponsoring Darkside organization is not “believed to be state-backed.” Instead Lior Div, CEO of cybersecurity firm Cybereason, describes DarkSide as a “private group that was established in 2020.” That said, consensus is emerging that DarkSide operates in Russia for two compelling reasons. According to CNN, “its online communications are in Russian, and it preys on non-Russian speaking countries.” Div is further quoted as saying “Russian law enforcement typically leaves groups operating within the county alone, if their targets are elsewhere.” DarkSide runs what CNN and other call a “ransomware-as-service” business. That it, it builds tools that it makes available to other criminals, who then use […]
