Pipeline Problem Potentially Problematic, production possibly paralyzed

[crash_davis 23096]

please tell me that is shopped. i know it 99% is but people are stupid, so just need the confirmation.

[Pescado_Rojo 19412]

10 minutes ago, Judge Roybeanbag said:

Most of the successful phishing attacks I've seen over the past few years have been that - board of director types and senior management, who either don't get cybersecurity training or don't pay attention when they do.  

CSIO customer of mine from a previous job once told me the former CEO of their company got hit with ransom ware. He responded to their email and told them he didn't know what bitcoin was, but gave them his corporate Amex number. 

[crash_davis 23096]

57 minutes ago, Michael Knight said:

 

glad to see that god hasn't lost his sense of humor.

[High Plains Drifter 11024]

1 hour ago, Michael Knight said:

 

 

 

[High Plains Drifter 11024]

 

 

 

[Armybrat 40818]

[Johnny Sack 8397]

Holy shit that's dangerous.

[BabaYaga 15286]

Likely this came from a phishing campaign and some internal user clicked on a linked and provided credentials to the ransomware criminals.  The VAST majority of these "hacks" are just caused by employees doing something stupid like clicking on a link in an email that looks legit.

they were probably paid in Monero or some other privacy coin that is not easily tracked.

The pipeline company needs to have a full forensic and security audit done and should contact an IT firm that specializes in this sort of thing (In my experience they will be require to by their insurance company). or they run the risk of the same people trying again (low hanging fruit)

[BabaYaga 15286]

9 minutes ago, Johnny Sack said:

Holy shit that's dangerous.

[clapclapclap 9000]

 

 

Edited May 13, 2021 by clapclapclap
Not shopped, Crash Davis.

[immortal13 4059]

What could go wrong?

[Judge Roybeanbag 11819]

2 hours ago, BabaYaga said:

 The VAST majority of these "hacks" are just caused by employees upper-level managers doing something stupid like clicking on a link in an email that looks legit.

 

FIFY, at least 75% of the time.

[AUS-97HORN 11756]

we are gonna hear about a lot of immolation issues in the next few days   soooo many videos already posted here, and on twitter, reddit and youtube of these fucking idiots picking any plastic container and filling it up.

[Sbbruin 21828]

2 hours ago, crash_davis said:

glad to see that god hasn't lost his sense of humor.

[Judge Roybeanbag 11819]

32 minutes ago, AUS-97HORN said:

we are gonna hear about a lot of immolation issues in the next few days   soooo many videos already posted here, and on twitter, reddit and youtube of these fucking idiots picking any plastic container and filling it up.

Funny that the holy grail image of immolation to me was the monk, in a demonstration of selflessness.  Vs these selfish narcissistic assholes.

[Bash Riprock 1695]

Holy fuck people are stupid.

[Guadaloopy 10954]

4 hours ago, Michael Knight said:

 

[GringoSalado 1651]

On 5/12/2021 at 3:20 PM, Johnny Sack said:

Already answered but I'll add that DOT, when they do check, will look for red diesel* in your filter housing**

 

 

 

* off-road/tax-free diesel is dyed rec

** most diesel vehicles, if they dont have a clear filter housing, will have a drain so it isn't that hard to check.

[Sbbruin 21828]

4 minutes ago, GringoSalado said:

Already answered but I'll add that DOT, when they do check, will look for red diesel* in your filter housing**

 

 

 

* off-road/tax-free diesel is dyed rec

** most diesel vehicles, if they dont have a clear filter housing, will have a drain so it isn't that hard to check.

Yes, marine diesel is dyed red.  

[Parliament 14229]

17 minutes ago, GringoSalado said:

Already answered but I'll add that DOT, when they do check, will look for red diesel* in your filter housing**

 

 

 

* off-road/tax-free diesel is dyed rec

** most diesel vehicles, if they dont have a clear filter housing, will have a drain so it isn't that hard to check.

Life is fraught with risk.

[Guest Lobo]

Maybe they're not hoarding fuel to gouge people with for quick cash.  Maybe they're stockpiling for yet another attempt by the South to 'Rise Again.'  

Maybe these are patriots dammit!  

Okay, I admit...it is gonna be funny when one of them blows up their meth lab with this extra fuel. 

[phdhorn 6224]

Looks like they paid $5 million ransom?

Bloomberg: Colonial Pipeline Paid Hackers Nearly $5 Million in Ransom.
https://www.bloomberg.com/news/articles/2021-05-13/colonial-pipeline-paid-hackers-nearly-5-million-in-ransom

Fucking lovely...

[Guest Lobo]

CEO Tim Felt, "Our system is secure.  You email them back and tell them that Colonial does not negotiate with cyber terrorists." 

CTO, "Okay sir.  Way to stand tough!  I'll just click on this link they said to use to communicate with them."

(lights flicker)

CEO Tim Felt (in George Bluth voice), "I have the worst fucking technicians."  

Edited May 14, 2021 by Lobo

[Updawg 2266]

Looks like they paid $5 million ransom?
Bloomberg: Colonial Pipeline Paid Hackers Nearly $5 Million in Ransom.
https://www.bloomberg.com/news/articles/2021-05-13/colonial-pipeline-paid-hackers-nearly-5-million-in-ransom
Fucking lovely...

Yep. They must have been pretty fucked considering they probably had every resource helping them

[atomheartbevo 89619]

57 minutes ago, Updawg said:

Yep. They must have been pretty fucked considering they probably had every resource helping them

Wow, that's some shitty IT if they didn't have backups of backups of backups, and no way to roll back far enough.

[Updawg 2266]

Wow, that's some shitty IT if they didn't have backups of backups of backups, and no way to roll back far enough.

A lot of places think they do until the shit really hits the fan.

[mchookem 16319]

4 hours ago, Bash Riprock said:

Holy fuck people are stupid.

 

[F250 28762]

32 minutes ago, atomheartbevo said:

Wow, that's some shitty IT if they didn't have backups of backups of backups, and no way to roll back far enough.

It's being reported that most of their restore was from backups.

 

 

[Buzzrock 14901]

Turns out my company met with them two years ago and urged them to stop managing vulnerabilities in Excel. The CISO said “it’s always worked fine for us, we don’t see a need for your solution.”

Whoops.

[fattyflattie 4639]

4 hours ago, GringoSalado said:

Already answered but I'll add that DOT, when they do check, will look for red diesel* in your filter housing**

 

 

 

* off-road/tax-free diesel is dyed rec

** most diesel vehicles, if they dont have a clear filter housing, will have a drain so it isn't that hard to check.

I’ve still never met someone who’s been checked, and I know quite a few people who still run it.  

[bigbevo76 64]

We're not far off when it comes to secrets management from the days of post it notes on your monitor with passwords. Come to think of it, post it notes on your monitor is more secure than where most credentials are stored today.  At least with post it notes you would have to gain access to the building (or now someones house). 

When this is studied I think we will find the vulnerability exploited was some long lived credential these guys found.  Maybe six months ago a vendor got access to a DB to do XYZ for a week and that credential just lived on and got out.

Y'all want to come to my webinar?

[tx 3 putt 76862]

2 hours ago, bigbevo76 said:

We're not far off when it comes to secrets management from the days of post it notes on your monitor with passwords. Come to think of it, post it notes on your monitor is more secure than where most credentials are stored today.  At least with post it notes you would have to gain access to the building (or now someones house). 

When this is studied I think we will find the vulnerability exploited was some long lived credential these guys found.  Maybe six months ago a vendor got access to a DB to do XYZ for a week and that credential just lived on and got out.

Y'all want to come to my webinar?

[GringoSalado 1651]

3 hours ago, fattyflattie said:

I’ve still never met someone who’s been checked, and I know quite a few people who still run it.  

Same

[GringoSalado 1651]

3 hours ago, bigbevo76 said:

We're not far off when it comes to secrets management from the days of post it notes on your monitor with passwords. Come to think of it, post it notes on your monitor is more secure than where most credentials are stored today.  At least with post it notes you would have to gain access to the building (or now someones house). 

 

Make sure you put tape over your webcam lol*

 

 

 

* (checks webcam) I have tape over my webcam

[Buzzrock 14901]

Has anyone seen any figures on the business impact of this to CP? Gas demand is pretty inelastic, and it’s not like people can just go get gas somewhere else. They lost some temporary income but it will get made up in sales before and after.

[Captainant 27621]

10 hours ago, atomheartbevo said:

Wow, that's some shitty IT if they didn't have backups of backups of backups, and no way to roll back far enough.

It's incredibly common for big/old IT shops to have a backup solution in place, but to have never actually tested it or restored a backup to exercise their ops runbook. Turns out, just having copies of the data doesn't do you any good if nobody knows how to restore it from archive

[F250 28762]

10 hours ago, Buzzrock said:

Turns out my company met with them two years ago and urged them to stop managing vulnerabilities in Excel. The CISO said “it’s always worked fine for us, we don’t see a need for your solution.”

Whoops.

What was the proposed solution? While that sounds like an "oh shit, lulz" story, without knowing what your company was trying to push on these guys there is no way to know if it was actually a bad decision on Colonial's part.

 

[tx 3 putt 76862]

6 hours ago, Buzzrock said:

Has anyone seen any figures on the business impact of this to CP? Gas demand is pretty inelastic, and it’s not like people can just go get gas somewhere else. They lost some temporary income but it will get made up in sales before and after.

 

it's much greater than $5mil 

[crash_davis 23096]

14 hours ago, Buzzrock said:

Turns out my company met with them two years ago and urged them to stop managing vulnerabilities in Excel. The CISO said “it’s always worked fine for us, we don’t see a need for your solution.”

Whoops.

This is the mentality of most companies. They will do "just enough" on cyber security. It's costly to secure companies networks for which they will receive no revenue to offset the cost. All CEOs and CFOs see is cost driving down margin. Most everyone including customers assume that companies are adequately protecting themselves which couldn't be further than the truth. I don't trust anyone with my data, even companies who's business is an app to securely store passwords.

If/when we get into the next global war, we'll quickly find out how much of our core infrastructure is hacked when it is instantly taken offline.

[NeverMarryAStripper 21869]

1 hour ago, crash_davis said:

If/when we get into the next global war, we'll quickly find out how much of our core infrastructure is hacked when it is instantly taken offline.

The Pentagon is going to find it difficult to fight a global war with no computer networks, communications, or GPS

[crash_davis 23096]

1 minute ago, NeverMarryAStripper said:

The Pentagon is going to find it difficult to fight a global war with no computer networks, communications, or GPS

russia is already circumventing ways US based technologies. i remember reading about how US based GPS systems do not work around red square. obviously is a means to thwart gps based weapons systems.

i'm just hoping our military is just as diligent in mitigating their mitigations and how to operate in a dark world, meaning no power grid.

[Hagbard Celine 10848]

16 hours ago, atomheartbevo said:

Wow, that's some shitty IT if they didn't have backups of backups of backups, and no way to roll back far enough.

blinking light syndrome.  with 1000% certainty i guarantee there is a senior it executive at patriot that derives his power from hosting monolithic legacy onsite and controls a massive budget for iron and people that run it.  when the title VP of IT exists in the year 2021, it is guaranteed the management of that company has a clue about IT measured in negative numbers.

[Hagbard Celine 10848]

16 hours ago, Buzzrock said:

Turns out my company met with them two years ago and urged them to stop managing vulnerabilities in Excel. The CISO said “it’s always worked fine for us, we don’t see a need for your solution.”

Whoops.

this.  american senior management, especially long-tenured lifers, have almost zero understanding of how the IT industry works today.  they think software is magic, you buy it, it runs itself, and the people that run it are an expense for the CEO to shoot when the board is up his ass about $.

[crash_davis 23096]

[atomheartbevo 89619]

It's Florida.

[Blotto 23486]

I'm losing my mind. I see a couple of photos every day that require the participants to be so galactically stupid that they me be photoshopped bullshit. Yet I now accept there's a 50/50 chance they are 100% real. We've reached the event horizon of human stupidity.

[Buzzrock 14901]

What was the proposed solution? While that sounds like an "oh shit, lulz" story, without knowing what your company was trying to push on these guys there is no way to know if it was actually a bad decision on Colonial's part.
 

I’m not gonna dox myself or my company, but it was an industry leading vulnerability management solution and I found out we quoted them $75K for it. Not worth it, apparently. No guarantees it would have prevented whatever happened here, but undoubtedly a better option than Excel.

[Buzzrock 14901]

Oh and it was the award-winning CIO, not the CISO (they don’t have a CISO).

[F250 28762]

11 minutes ago, Buzzrock said:

 

I’m not gonna dox myself or my company, but it was an industry leading vulnerability management solution and I found out we quoted them $75K for it. Not worth it, apparently. No guarantees it would have prevented whatever happened here, but undoubtedly a better option than Excel.

 

Doubtful it would have made any difference. Selling a VMS tool to a company without a Vulnerability Management Program is kind of pointless. It's about as useless as selling a SIEM solution to a company without a SOC.

 

[Buzzrock 14901]

Anyone who sells software without the services to build out the program doesn’t know what they are doing.