Caber Attack Leads to Shut Down of the US Fuel Pipeline
> All About the Caber-attack on the US Oil and Gas Pipeline A caber-attack on May 7 involving ransomware has led to the top US oil and gas pipeline operator.
Updated
On this page
Key takeaways
All About the Caber-attack on the US Oil and Gas Pipeline A caber-attack on May 7 involving ransomware has led to the top US oil and gas pipeline operator; Colonial Pipeline shut its entire network.
- Meanwhile, DarkSide has acknowledged the incident in a public statement after they took a major US fuel pipeline offline over the weekend.
- This incident contributed to the tight supplies and gasoline price hikes in the United States after the hurricane forced several Gulf refineries to shut down.
All About the Caber-attack on the US Oil and Gas Pipeline
A caber-attack on May 7 involving ransomware has led to the top US oil and gas pipeline operator; Colonial Pipeline shut its entire network. The Colonial Pipeline fuels through 5,500 miles of pipelines that connect their refiners on the Gulf Coast to the east and south of the US. This is one of the most disruptive digital ransom operations ever reported that sheds light on the vulnerability of the US energy infrastructure to hackers.
Managing director of the Climate Policy Lab and Research Professor, Amy Myers Jaffa says,?This is as close as you can get to the jugular of infrastructure in the United States and it is not a major pipeline, and just the pipeline.?
This ransomware attack on the major US fuel pipeline could be one of the most expensive attacks on an economy. It is the latest reminder of the increasing frequency and severity of the catastrophic digital shocks on critical infrastructure.
The growing digitalization in critical infrastructures such as water, oil, and gas increases the risks of caber threats and attacks. With digitalization driving the growth and transition to net-zero emissions, the ecosystem of the energy sector has become increasingly decentralized and complex.
As per the 2021 Global Risks Report, cybersecurity failures are among the top mid-term threats for the world. According to a recent survey run by The World Economic Forum among the Cybersecurity Leadership Community members, about 80% of senior cybersecurity leaders view ransomware as a dangerous growing threat to public safety. Also, 97% of them have expressed that continuity in business is a major risk when it comes to ransomware attacks.
As the Colonial Pipeline, a US fuel pipeline operator, is shut down post a ransomware attack, it is estimated that a prolonged shutdown would cause prices to rise at the gasoline pumps across the country. This could be a potential blow to US consumers and the economy.
This caber incident has shown how essential service providers are more vulnerable to widespread caber threats. That’s why cybersecurity is becoming a corporate strategic challenge that requires the highest level of oversight in the complex global industrial environment.
About Colonial Pipeline #
It is a privately held, Georgia-based company that is owned by the CDPQ Colonial Partners L. P., IFM (US) Colonial Pipeline 2 LLC, Koch Capital Investments Company LLC, KKR- Keats Pipeline Investors L. P., and Shell Midstream Operating LLC. The firm serves some of the country’s largest airports, including Atlanta’s Hartsfield Jackson Airport, the world’s busiest by passenger traffic.
Update After Caber Attacks on The Pipeline #
Colonial Pipeline is taking steps to understand and resolve this issue so they can efficiently and safely restore their services to normal.
A former official says that the US government investigators are looking at a professional cybercriminal group dubbed ‘DarkSide?, which is renowned for deploying ransomware and extorting the victims while avoiding targets in post-Soviet states. Ransomware is a type of malware that’s designed to lock down the systems by encrypting data and demanding payment to regain access.
Colonial states that a cybersecurity firm is helping them with the investigation and contacted the law enforcement and federal agencies. Sources from the cybersecurity industry say that FireEye?, a cybersecurity firm headquartered in California, was brought in to respond to this caber-attack.
President Joe Biden was briefed on this ransomware attack, and the government has been working to help the Colonial to restore its operations and prevent their supply disruptions. Mr. Biden said that the government agencies acted promptly to lessen any impact on the fuel supply caused by this attack. Further, they are actively preparing extra steps depending on how quickly the firm restores its normal operations.
Three days later after the incident, the Federal Bureau of Investigation (FBI) officially confirmed that a caber-criminal gang, ‘DarkSide?, was responsible for compromising Colonial Pipeline’s networks.
The Department of Energy said it was monitoring the potential impacts on the nation’s energy supply, while both the US Cybersecurity and Infrastructure Security Agency (CISA) and the Transportation Security Administration were working on the situation. Executive Assistant Director of the Cybersecurity Division at CISA, Eric Goldstein said,?We are engaged with the firm and our interagency partners regarding the incidence that emphasizes the ransomware threat to businesses and organizations irrespective of the size or sector.?
Colonial did not say how long its pipeline would be shut or did not give further details about the situation.
Caber Strategy Lead of the Center for Cybersecurity at the World Economic Forum, Algirde Pipikaite said,?Cybersecurity vulnerabilities have become a systemic issue. Unless embedding the cybersecurity measures during technology’s development phase, there is a higher risk to see such frequent attacks on the industrial systems.?
How Did The Caber-attack Occur? #
Cybersecurity sources said this ransomware attack was likely caused by a cybercriminal gang called DarkSide. They infiltrated the network of this operator and locked the data on some of their computers and servers, and are now demanding a ransom from the Colonial Pipeline.
Digital Shadows, a cybersecurity firm in England thinks the Colonial attack was helped by the coronavirus pandemic, as more engineers remotely access the control systems for the pipeline from their homes. The co-founder of this cybersecurity firm, James Chappell believes that DarkSide could have bought account login details from remote working software such as Microsoft Remote Desktop and TeamViewer.
He adds anyone can look up the login portals for the computers connected to the internet on search engines like Shoran, and then have hackers try username and passwords until they get some to work. Mr. Chappell said there is an increase in the number of cybercrime victims and the number of small businesses falling prey to cybercrimes is becoming a big problem for the economy worldwide.
The research by Digital Shadows shows that DarkSide is probably be based in a Russian-speaking country because it avoids attacking companies in Ukraine, Russia, Armenia, Azerbaijan, Belarus, Kyrgyzstan, Georgia, Turkmenistan, Kazakhstan, Uzbekistan, and Tajikistan.
More Details On This Incident #
Meanwhile, DarkSide has acknowledged the incident in a public statement after they took a major US fuel pipeline offline over the weekend. Colonial pipeline carries about 45% of the East Coast’s supply of gasoline and other fuels. After the caber-attack, the fuel operator took itself offline and is working to restore its service.
Their website shows, ‘Our goal is to make money, and not create any issues for society. From today, we introduce moderation and check each company that our partners want to encrypt for evading any social consequences in the future.?
How Did They Deal With This Ransomware Attack? #
The FBI and other government agencies worked with private cybersecurity firms to respond to this caber-attack. They took down the cloud computing system the hackers used for collecting the stolen data on Saturday. Colonial stated that although its four main pipelines remained offline, some smaller lines between terminals and delivery points were now operational.
They said after learning of the attack, they took certain systems offline which temporarily stopped all the pipeline operations. It also affected some of their IT systems that are being in the process of restoring. They further said they will bring its full system back online only when they believe it is safe to do so, and in full compliance with the approval of all federal regulations.
Ransomware as a Service #
This incident highlights the risk of ransomware to not just the businesses but critical national industrial infrastructure. The victims of a caber-attack by DarkSide receive an information pack notifying their servers and computers are encrypted.
This cybercriminal gang has listed all the types of data they have stolen and sends the URL of a ‘personal leak page? to the victims, where the data is locked and waiting to be automatically published if the organization or company doesn’t pay before the deadline. They also inform their victims sharing the proof of the data it has obtained, and they are prepared to delete all of it from the target’s network.
According to Digital Shadows, this cybercriminal gang operates as a business- develop the software used for encrypting and steal data from the companies. Then provides ransomware to affiliates who pay them a percentage of their earnings from any successful attacks.
After releasing a new software in March this year, the gang issue a press release and invited journalists to interview them about how this program could encrypt data faster than before. DarkSide has a website on the dark web listing all the companies they have hacked, details of what was stolen, and has an ’ethics? page stating which organizations they will not attack.
Worries on the Increasing Pump Prices #
As per the American Automobile Association, a prolonged outage of the line could trigger increases in gas prices at the pumps, which is worrying for consumers ahead of the summer driving season. Andrew Lipow, President of Consultancy, Lipow Oil Associates said, ‘A shutdown lasting four or five days could lead to sporadic outages at the fuel terminals along the US East Coast that depends on the pipelines for deliveries.?
Post shutdown, the gasoline futures on the New York Mercantile Exchange gained 0.6% while diesel futures rose 1.1%, both overtaking gains in crude oil. Gulf Coast cash prices for both gasoline and diesel edged lower on the prospects that the supplies could accrue in the region. Oil refining companies said that their operations had not yet been impacted by this caber-attack and remain in full service.
How to Increase Cybersecurity? #
Businesses and governments must reimagine how we use and manage our critical infrastructure to harness the value offered by digitalization and mitigate potential risks. They should understand the effects of our individual actions to establish frameworks for shared responsibility. We are more likely to see such frequent attacks on industrial sectors like the water treatment plants or the oil and gas pipelines unless we embed cybersecurity into the corporate or industrial sectors.
Based on the recommendations developed by the World Economic Forum and a mufti-stakeholder oil and gas community, here are the six principles to guide the critical infrastructure and industry stakeholders to improve their cybersecurity:
Create a comprehensive cybersecurity governance model
Promote security and resilience-by design culture
Increase the visibility of risk position by the third parties and consider broader ecosystem model
Implement holistic risk management and defense mechanisms with effective prevention, monitoring, response, and recovering capabilities.
Prepare and tests resilience plan based on a list of pre-defined scenarios to mitigate the impact of an attack
Reinforce international public-private collaboration between all stakeholders in the industry
Wrap Up #
The American Petroleum Institute, a top oil and gas industry trade group in the US is monitoring the situation. This cyberattack is a wake-up call for US lawmakers as it shows our lack of preparedness to deal against caber-attacks on critical infrastructures.
In 2017, Colonial Pipeline had to shut down its gasoline and distillate lines when Hurricane Harvey hit the Gulf Coast. This incident contributed to the tight supplies and gasoline price hikes in the United States after the hurricane forced several Gulf refineries to shut down.
Related reading
- AI-Driven Cybersecurity - Attack Detection & Prevention
- Cloud Security Solutions: 5 Common Causes of Cyber-Risk
- Data Backups: Critical Part of Cyber Strategy.
Questions and answers
How Did The Caber-attack Occur? #
Cybersecurity sources said this ransomware attack was likely caused by a cybercriminal gang called DarkSide. They infiltrated the network of this operator and locked the data on some of their computers and servers, and are now demanding a ransom from the Colonial Pipeline.
How Did They Deal With This Ransomware Attack? #
The FBI and other government agencies worked with private cybersecurity firms to respond to this caber-attack. They took down the cloud computing system the hackers used for collecting the stolen data on Saturday.
How to Increase Cybersecurity? #
Businesses and governments must reimagine how we use and manage our critical infrastructure to harness the value offered by digitalization and mitigate potential risks. They should understand the effects of our individual actions to establish frameworks for shared responsibility.