Wednesday, June 16

Colonial Pipeline paid a $5 million ransom—and kept a vicious cycle turning

Nearly a week after a ransomware attack led Colonial Pipeline to halt fuel distribution on the East Coast, reports emerged on Friday that the company paid a 75 bitcoin ransom—worth as much as $5 million, depending on the time of payment—in an attempt to restore service more quickly. And while the company was able to restart operations Wednesday night, the decision to give in to hackers’ demands will only embolden other groups going forward. Real progress against the ransomware epidemic, experts say, will require more companies to say no.

Not to say that doing so is easy. The FBI and other law enforcement groups have long discouraged ransomware victims from paying digital extortion fees, but in practice many organizations resort to paying. They either don’t have the backups and other infrastructure necessary to recover otherwise, can’t or don’t want to take the time to recover on their own, or decide that it’s cheaper to just quietly pay the ransom and move on. Ransomware groups increasingly vet their victims’ financials before springing their traps, allowing them to set the highest possible price that their victims can still potentially afford.

In the case of Colonial Pipeline, the DarkSide ransomware group attacked the company’s business network rather than the more sensitive operational technology networks that control the pipeline. But Colonial took down its OT network as well in an attempt to contain the damage, increasing the pressure to resolve the issue and resume the flow of fuel along the East Coast. Another potential factor in the decision, first reported by Zero Day, was that the company’s billing system had been infected with ransomware, so it had no way to track fuel distribution and bill customers.

Advocates of zero tolerance for ransom payments hoped that Colonial Pipeline’s proactive shutdown was a sign that the company would refuse to pay. Reports on Wednesday indicated that the company had a plan to hold out, but numerous subsequent reports on Thursday, led by Bloomberg, confirmed that the 75 bitcoin ransom had been paid. Colonial Pipeline did not return a request for comment from WIRED about the payment. It is still unclear whether the company paid the ransom soon after the attack or days later, as fuel prices rose and lines at gas stations grew.

“I can’t say I’m surprised, but it’s certainly disappointing,” says Brett Callow, a threat analyst at antivirus company Emsisoft. “Unfortunately, it’ll help keep United States critical infrastructure providers in the crosshairs. If a sector proves to be profitable, they’ll keep on hitting it.”

In a briefing on Thursday, White House press secretary Jen Pskai emphasized in general that the US government encourages victims not to pay. Others in the administration struck a more measured note. “Colonial is a private company and we’ll defer information regarding their decision on paying a ransom to them,” said Anne Neuberger, deputy national security adviser for cyber and emerging technologies, in a press briefing on Monday. She added that ransomware victims “face a very difficult situation and they [often] have to just balance the cost-benefit when they have no choice with regards to paying a ransom.”

Researchers and policymakers have struggled to produce comprehensive guidance about ransom payments. If every victim in the world suddenly stopped paying ransoms and held firm, the attacks would quickly stop, because there would be no incentive for criminals to continue. But coordinating a mandatory boycott seems impractical, researchers say, and likely would result in more payments happening in secret. When the ransomware gang Evil Corp attacked Garmin last summer, the company paid the ransom through an intermediary. It’s not unusual for large companies to use a middleman for payment, but Garmin’s situation was particularly noteworthy because Evil Corp had been sanctioned by the US government.

“For some organizations, their business could be completely destroyed if they don’t pay the ransom,” says Katie Nickels, director of intelligence at the security firm Red Canary. “If payments aren’t allowed you’ll just see people being quieter about making the payments.”

Prolonged shutdowns of hospitals, critical infrastructure, and municipal services also threaten more than just finances. When lives are literally at stake, a principled stand against hackers quickly drops off of the priorities list. Nickels herself recently participated in a public-private effort to establish comprehensive United States–based ransomware recommendations; the group could not agree on definitive guidance about if and when to pay.

“The Ransomware Task Force discussed this extensively,” she says. “There were a lot of important things that the group came to a consensus on and payment was one where there was no consensus.”

As part of a cybersecurity executive order signed by President Joseph Biden on Wednesday, the Department of Homeland Security will create a Cyber Safety Review Board to investigate and debrief “significant” cyberattacks. That could at least help more payments be made in the open, giving the general public a fuller sense of the scale of the ransomware problem. But while the board has incentives to entice private organizations to participate, it may still need expanded authority from Congress to demand total transparency. Meanwhile, the payments will continue, and so will the attacks.

“You shouldn’t pay, but if you don’t have a choice and you’ll be out of business forever, you’re gonna pay,” says Adam Meyers, vice president of intelligence at the security firm CrowdStrike. “In my mind, the only thing that’s going to really drive change is organizations not getting got in the first place. When the money disappears, these guys will find some other way to make money. And then we’ll have to deal with that.”

For now, though, ransomware remains an inveterate threat. And Colonial Pipeline’s $5 million payment will only egg on cybercriminals.

This story originally appeared on

Source link


  • therapies alternatives definition pharmacie leclerc hazebrouck how to get naprosyn 250 mg without a prescription , pharmacie avignon chatellerault telephone pharmacie de garde toulon . pharmacie bourges gibjoncs pharmacie best amiens , traitement fongicide act therapy anxiety pharmacie de garde aujourd’hui amiens pharmacie leclerc oudairies roche yon . therapie de couple film netflix traitement maladie de lyme , therapies home pharmacie kaysersberg . pharmacie de garde la rochelle une therapie comportementale et cognitive , pharmacie hayem brest telephone therapie comportementale et cognitive charente maritime pharmacie angers lac de maine generique fucidine comprime . pharmacie saint jacques auchan ronq therapie laser , pharmacie meaux pharmacie amiens rue delpech . angers pharmacie des plantes pharmacie leclerc gueret , therapie cognitivo comportementale avignon pharmacie avignon ouverte pharmacie bailly chennevieres sur marne pharmacie boulogne billancourt de garde .

  • pharmacie lamirand amiens pharmacie argenteuil avenue de verdun cost of pregabalin , pharmacie de garde paris 15 pharmacie lafayette hotel dieu carpentras . pharmacie la bailly medicaments grippe , ketoprofene pharmacie en ligne pharmacie de garde marseille dimanche 23 aout pharmacie montpellier pharmacie angers garde a vue . therapies used in psychiatry pharmacie de garde marseille st barthelemy , pharmacie bourges rue louis mallet horaire pharmacie angers espace anjou . therapies kidney pharmacie leclerc vitre , pharmacie leclerc plessis belleville pharmacie lafayette hyeres pharmacie leclerc etalondes therapie de couple orne . traitement gingivite traitement keratite , pharmacie anglaise beaulieu sur mer pharmacie de garde aujourd’hui roanne . raw therapies download act therapy journal , pharmacie nice pharmacie bellevue beauvais pharmacie a proximite de moi college des therapies alternatives sainte-catherine-de-la-jacques-cartier qc .

  • elen charpentier – hypnose & therapies breves roscoff pharmacie bordeaux lac pregabalin canada pharmacy , therapie comportementale et cognitive casablanca therapies breves definition . therapie cognitivo comportementale jura pharmacie de garde marseille pointe rouge , pharmacie leclerc queven therapie cognitivo-comportementale brabant wallon pharmacie bordeaux garde therapies systemiques familiales . pharmacie bordeaux proche gare pharmacie ouverte nuit , pharmacie a avignon therapies quantiques aix en provence . pharmacie de garde marseille 13013 aujourd’hui act therapy in a nutshell , pharmacie laudren amiens pharmacie come amiens pharmacie avignon saint agricole medicaments veterinaires pharmacie . medicaments les plus utilises therapie comportementale et cognitive quimper , therapies comportementales et cognitives troubles anxieux therapie de couple chambery . pharmacie yffiniac pharmacie de beaulieu nantes , pharmacie lafayette ivry pharmacie ouverte ussel 19200 pharmacie de garde vichy act therapy list of values .

Leave a Reply

Your email address will not be published.

Call Now