Why the Colonial Pipeline Hack is Just the Beginning

We begin with the brazen cyber attack that has shut down the biggest pipeline in the United States. This is the biggest attack that involved vital infrastructure. There are increasing concerns over the possibility of shortages of gasoline and diesel. It's a pipeline that moves 45% of the east coast diesel, gas, and jet fuel from Texas all the way up to New Jersey. On the night of May 6, 2021, a critical piece of American energy infrastructure was crippled by Russian hackers. The victim of the attack was the Colonial Pipeline, which helps carry 3 million barrels of fuel per day between Texas and New York. One day later, executives at Colonial Pipeline sent the hackers $5 million in Bitcoin. The story of this particular hack is incredibly interesting, but not for the reasons that you might think. There's actually a lot more going on here. The Colonial Pipeline cyberattack is a harbinger of things to come, and the United States is woefully underprepared. Major technolog and economic forces have shifted to make these attacks easier to execute and much more profitable. And this is only the beginning. In order to understand what makes this attack so unique, it's important to examine the role that oil pipelines play in the American economy. The US Is the third largest country in the world and the number one consumer of oil, despite electric vehicles becoming increasingly popular, and 97% of cars still run on gasoline. And the process of transporting that fuel all across the country relies on a massive network of pipelines. The Colonial Pipeline is the biggest of them all, and millions of Americans rely on it to get gasoline. From refineries in Texas up the east coast to cities like New York, the pipeline has been active since the 1960s. And as you can guess, they don't exactly operate like a modern technology company. Computer systems are outdated, and. And a report from 2018 found glaring deficiencies in their security systems. In fact, the consultant who led the investigation said that an eighth grader could have hacked into the Colonial Pipeline system. So when a group of Russian hackers set their sights on the company, it looked like a gold mine. Colonial had plenty of resources to pay a bounty and little security to fight back against an attack. So they went to work. We still don't know exactly how the hackers got access to the Colonial Network, but once they did, the hackers quickly exported nearly 100 gigs of data before encrypting everything on the network. This strategy is at the core of every modern ransomware attack. Steal the data and then encrypt everything on the network to lock your victim out of their own Systems. This creates an impossible choice for victim companies. And this is the first reason why these ransomware attacks are becoming so prevalent. Attackers give victims no good options. The hackers weren't actually able to exfiltrate all 100 gigs of data. They couldn't just send the data to Russia directly, so they had to route through a string of proxy servers. US Officials from the National Security Agency noticed the unusual activity and were able to intervene to shut down key servers while the data was still in transit. But enough of the data made it to Russia that the Colonial Pipeline team was still stuck between a rock and a hard place. By stealing at least some of the data and then encrypting the network, hackers trap companies in a lose lose situation. If they try and restore their data or buy new computers, the hackers can just leak the stolen data onto the dark web, which will allow other hackers to take advantage of customer information or competitors to steal their intellectual property. This is a terrible scenario, but the alternative is sometimes worse. If your company refuses to pay to decrypt the data, valuable information could be lost forever. And that can cause huge financial losses. Rudimentary ransomware attacks do things as simplistic as just renaming files or altering them slightly to try and corrupt them. But modern attacks, like the one perpetrated against the Colonial pipeline, take a much more technologically advanced approach. They employ state of the art encryption methods to ensure that it's impossible for data to be recovered. The only option is often to simply pay the ransom. And that leads to the second reason why these attacks are becoming more common. Cryptocurrency has enabled semi anonymous payment across borders. Viruses and malware have been around for decades, but only in the past few years has it become possible to get a victim to pay you during a ransomware attack and actually walk away with anything of value. Before Bitcoin became popular, sending a wire transfer across borders would require coordination with a foreign bank. And US Government agents could easily arrange to catch the perpetrator when they went to receive the payment. Banks that consistently aided criminals in international schemes would be sanctioned and eventually removed from the global payment network. But crypto changes all of this. Victims can now easily buy Bitcoin through exchanges and transfer to the hacker's wallet without leaving a significant paper trail. Sometimes all a victim needs is a credit card and a web browser. In a funny twist, sometimes this winds up benefiting the victim. A few years ago, when a major law firm was the victim of a ransomware attack, they assumed that they would have no option but to Pay up. So they bought several hundred thousand dollars in Bitcoin. But they also retained a cybersecurity team to investigate the incident. This team figured out that the attacker was based in the United States and worked with the FBI to apprehend him. They didn't need to pay the ransom, but they still had the Bitcoin. And in the few weeks that they were working to fight the hack, they had made over a million dollars in profit. The Colonial Pipeline folks weren't quite so lucky. Within hours of the attack, they instantly understood how serious the situation was and knew that they had to pay. So they bought $5 million in Bitcoin and prepared to send it to the hackers. Now, big companies like Colonial have cyber insurance policies, which will often reimburse ransoms just like this one. But there is an interesting cat and mouse game going on that is making these ransoms skyrocket in value recently. Here's how it works. Companies are worried about ransomware attacks, so they go out and buy cybersecurity insurance. But hackers know that companies have insurance, so they get more aggressive about targeting companies. Additionally, when a hacker breaches a corporate network, they have access to all of the company's files, including their cyber insurance policy. The first thing some hackers do when they infiltrate a company is to search for documents relating to cyber insurance to find out exactly what the company can afford to pay. If the hacker sees that, the insurance company will pay up to $5 million in ransomware fees, and then they will demand exactly $5 million. I'm generally a big fan of cryptocurrencies, but it's clear that they are a big reason why ransomware attacks are growing in popularity. Hackers love that they can deploy these hacks from the safety of a country like Russia and still get paid quickly and discreetly without drawing the attention of the authorities. But there's still one more big reason why these attacks are spreading like wildfire. And this is reason number three. Ransomware has become a problem product. When you think of a typical hacker, you probably think of a lone wolf coding long into the night in some basement. But that's all changing. American authorities have identified a hacker group by the name of Darkside as the party responsible for the Colonial Pipeline attack. But it's unlikely that they were directly responsible. That's because Darkside is primarily focused on developing ransomware. They leave the actual attacks up to independent hackers. This model has been called ransomware as a service, and it's completely changing the economics of hacking. Instead of finding individual targets and hacking them directly. Darkside develops ransomware that other hackers can use and then turns them loose. Just as all major tech companies have moved from selling their software as a one time fee and now insist on a subscription, Darkside takes a service fee on whatever profits are generated from using their ransomware. They typically charge 25% for ransoms less than $500,000, but lowered that fee to just 10% for ransoms greater than 5 million. And there's that $5 million figure again. It could just be a coincidence, but I wouldn't be surprised if the hackers that use DarkSide's ransomware see $5 million as a nice sweet spot. That amount is likely to be covered by insurance, and it reduces the fee paid to Darkside for their software. The ransomware as a service business model insulates Darkside from the risk of being caught actually using these illegal tools, but it still allows them to make tons of money. As armies of hackers deploy their ransomware in companies across the world, these hackers have adopted all of the best practices from modern tech companies and are now set to disrupt businesses at an alarming rate. But as we've seen with the Colonial pipeline hack, these tools can have far reaching effects, Often beyond what the hackers initially intended. When Darkside lets other hackers use their ransomware, There's a real risk that they might target the wrong organization and cause an international incident. And this has happened before. 39 hospital trusts and GPs in Scotland and across England have had to cancel routine operations send patients home. Cybersecurity experts are warning that the rogue regime could be behind that global cyber attack that held at least 300,000 computers hostage in over 150 countries. In 2017, North Korean hackers launched the WannaCry ransomware attack, which targeted older computers that hadn't been patched recently. Unfortunately, a lot of these older computers were used in hospitals, like the United Kingdom's National Health Service. Shutting down computers in a hospital can have life threatening effects, and some hospitals had to turn away ambulances during the attack. Hacks like that have real world impact and draw way more attention than merely demanding payment for some corporate files. When Darkseid began selling their ransomware, they made it clear that they didn't want to draw too much negative attention, and even went so far as to issue a statement saying that they would not target hospitals, schools, or governments. Cyber attacks generally fall into two Espionage and sabotage. Espionage involves sneaking into a system and stealing information, or in the case of ransomware attacks, stealing data and then encrypting Everything. Sabotage is much more aggressive, though, since it involves actually trying to cause physical damage to equipment or buildings. Hacks that focus on sabotage are usually perpetrated by governments, since once you destroy your target's equipment, there isn't much financial gain to be had. But sabotage and espionage are increasingly starting to overlap. Sometimes hackers break into a company's network in order just to steal data, but wind up crippling critical infrastructure in the process. And that's exactly what happened with the Colonial pipeline. The hackers seem to have been entirely money motivated and focused just on the ransomware scheme. But because of how various systems are connected within Colonial's network, the company had no choice but to shut the whole pipeline down as a precaution. See, more and more complex machinery is being connected to computers through what are called industrial control systems. Instead of turning valves manually, computers are now used to flip switches and save human operators time. But connecting these industrial machines to computers means, of course, that they can be hacked. And there's one particularly interesting case where a state actor was able to sabotage physical infrastructure using only code. It was December of 2015, and an elite team of Russian hackers known as Sandworm had set their sights on Ukraine's power grid. They broke into the network using phishing emails to steal administrator passwords. And once they were in, they started remotely disabling power substations to cause blackouts. This was the first time that a power grid had ever been successfully targeted in a cyber attack. And it had some pretty significant consequences. As you can imagine, turning off the power can cause real harm to people in the affected area. Hospitals and critical life support equipment can go offline, and people can actually die. Fortunately, in this case, workers from the Ukrainian power companies were able to manually override the malicious code and restore power. But you can see how these acts of sabotage can have real world impact. Darkside wants to avoid these types of incidents. Extorting a few million dollars from a big company makes for much milder headlines than shutting down a hospital. And they know that sabotage attacks will lead to an international response. But even though they try and sell their ransomware only to hackers who will use it exclusively for financial gain, there is always the risk of cascading effects. We're going to see more ransomware attacks. The technology is simply too easy to deploy, and, and the probability of real financial gain is simply too high. Hackers will continue to target companies, and these hacks will continue to have unintended effects. So what's the solution? The best approach will be multifaceted first, the US needs to pressure foreign governments to stop protecting hackers. Second, we all need to improve our cybersecurity, which means recruiting more technologists into the field. At the time of the hack, the Colonial Pipeline had multiple cybersecurity related job openings, but it looks like they were struggling to fill them. If you're interested in cybersecurity, now is a great time to get into the field. I can guarantee you that there will be a lot more work to do in the future. If you want to chat about the Colonial Pipeline hack, just leave me a comment below or DM me on Twitter and please check out this recommended video. The YouTube algorithm thinks that you'll really like it.