Tag: hack

Colonial Pipeline paid $5M ransom someday after hack, CEO tells Senate

Post author By
Post date June 9, 2021

Joseph Blount, JR., President and Chief Executive Officer, Colonial Pipeline is sworn in as he attends a hearing to examine threats to critical infrastructure, focusing on examining the Colonial Pipeline cyber attack at the U.S. Capitol in Washington, U.S., June 8, 2021.

Andrew Caballero-Reynolds | Reuters

WASHINGTON — Colonial Pipeline’s CEO told a Senate committee on Tuesday the company paid the $5 million ransom one day after Russian-based cybercriminals hacked its IT network, crippling fuel deliveries up and down the East Coast.

Joseph Blount Jr. told members of the Senate Homeland Security and Governmental Affairs Committee in prepared remarks that the company learned of the attack shortly before 5 a.m. on May 7, when an employee discovered a ransom note on a system in the IT network.

The note said hackers had “exfiltrated” material from the company’s shared internal drive, and it demanded approximately $5 million in exchange for the files.

The company was attacked by a ransomware program created by DarkSide, a cyber criminal group believed to operate out of Russia.

Blount said that shortly after discovering the ransom note, the employee notified a supervisor and the decision was made to immediately shut down the entire pipeline.

“At approximately 5:55 A.M. employees began the shutdown process,” Blount wrote. “By 6:10 A.M., they confirmed that all 5,500 miles of pipelines had been shut down.”

The decision to shut down the entire pipeline was driven by “the imperative to isolate and contain the attack to help ensure the malware did not spread to the Operational Technology network, which controls our pipeline operations, if it had not already.”

The shutdown caused major disruptions to gas delivery up and down the East Coast, as trucks struggled to restock gas stations, and long lines developed at pumps, especially in the Southeast. Airline operations also were disrupted.

Blount’s testimony revealed just how quickly the company decided to suspend operations, and it provided new details about the first few days after the attack.

The company believes attackers “exploited a legacy virtual private network profile that was not intended to be in use,” Blount told senators.

But he admitted that the account was not protected by multifactor authentication, which is currently the company standard in most of its operations. Blount said the password was complicated, though. “It was not a ‘Colonial 123’-type password.”

Blount also testified about the approximately $5 million in ransom that the company paid to the DarkSide hackers. He revealed that Colonial Pipeline paid the ransom one day after the attack.

“I made the decision that Colonial Pipeline would pay the ransom to have every tool available to us to swiftly get the pipeline back up and running,” Blount said in his opening statement. “It was one of the toughest decisions I have had to make in my life.”

“At the time, I kept this information close hold because we were concerned about operational security and minimizing publicity for the threat actor,” he said.

In response to a question about whether the company paid ransom to an entity under U.S. sanctions, Blount said the company checked the sanctions list maintained by the Office of Foreign Asset Control before making the payment.

The day before Blount testified, U.S. law enforcement officials announced that they were able to recover $2.3 million in bitcoin from the hacker group.

Blount also told senators that the company contacted the FBI within hours of discovering the attack.

This story will be updated throughout the Senate hearing.

Tags CEO, Colonial, Day, hack, Paid, pipeline, Ransom, Senate, tells

Business

Shares, JBS Hack and the Financial system: Dwell Enterprise Updates

Post author By
Post date June 2, 2021

Daily Business Briefing

June 2, 2021Updated

June 2, 2021, 2:49 p.m. ET

Credit…Chet Strange/Getty Images

Production began to resume at nine beef plants in the United States on Wednesday after a cyberattack on the world’s largest meat processor forced them to shut down a day earlier.

Union officials said Wednesday that certain plants were operational but were not at full capacity yet. JBS had said late Tuesday that the “vast majority” of its plants would reopen the next day.

About 400 workers were back on the job at the JBS beef plant in Souderton, Pa., versus about 1,500 who would work in a typical day, said Wendell Young IV, the president of the United Food and Commercial Workers Local 1776, which represents workers at the plant. A JBS beef plant in Cactus, Texas, canceled work for many employees scheduled for one of its shifts on Wednesday, according to a Facebook post meant for workers.

Mr. Young added that the company had told the union that the plant would be running essentially as normal by Thursday, although workers’ start times would be delayed by a few hours.

JBS did not immediately return requests for comment.

The attack has raised concerns about the vulnerability of critical American businesses. Jen Psaki, the White House press secretary, urged companies on Wednesday to increase their cybersecurity measures, saying it was “up to a number of these private-sector sector entities to protect themselves.”

Ms. Psaki declined to say whether the U.S. government was planning to retaliate. “We’re not taking any options off the table in terms of how we may respond, but of course there is an internal policy review process to consider that,” she said.

JBS had told the Biden administration on Tuesday that it was a ransomware attack, and that the ransom demand had come from “a criminal organization likely based in Russia,” a White House official said on Tuesday. Ms. Psaki did not provide more specifics on Wednesday, but she said that the administration was in direct contact with the Russians and that President Biden would bring up the issue of cyberattacks with President Vladimir Putin of Russia when they meet in two weeks.

Thousands of workers in Australia, Canada and the United States were affected as shifts were altered or outright canceled Monday and Tuesday. Some U.S. plants were still not back to regular operations on Wednesday. In Australia, factory workers and graziers have not been told when plants would reopen, local news outlets reported.

Prices could increase as a result of the cyberattack, analysts for the Daily Livestock Report said on Wednesday. And the disruption could lead to less so-called spot supplies, the analysts wrote, which could “leave little available for smaller buyers.”

Even so, the analysts said that the attack was likely to “be only a small part in the big picture” as retail meat prices continue to climb during the summer.

The attack was the second to hamper a critical U.S. business operation. Last month, a ransomware attack on Colonial Pipeline, which transports gas to nearly half the East Coast, set off fuel shortages and panic buying.

Read moreCredit…Alyssa Schukar for The New York Times

Global employment will take years to return to prepandemic levels, the United Nations’ labor organization said on Wednesday in a report that urged governments to build social protection systems to avoid the destabilizing effects of deepening economic and social inequality.

The pandemic wiped out around 144 million jobs last year, including a projected 30 million new jobs that would have been created, the International Labor Organization said in its assessment of employment and social trends.

“The hit on labor markets in terms of jobs, and in terms of the effect on people’s incomes, has been four times greater than the financial crisis,” Guy Ryder, the organization’s director general, said in an interview.

The organization expects to see significant growth in employment starting in the second half of 2021, but “this will be uneven and not enough to repair the damage caused by the crisis,” Mr. Ryder said.

Overall, the global economy is unlikely to restore those lost jobs until at least by 2023, and that will depend on progress in curbing the spread of the coronavirus, a prospect now overshadowed by its resurgence in Asia and parts of Latin America.

Rich countries, with access to vaccines and the financial resources to support wage-support plans, will recover faster. The United States is likely to face unemployment of around 5.1 percent this year, the report said, dropping to around 3.9 percent in 2022, a level marginally lower than at the start of the pandemic.

But around the world, some 205 million people will still be unemployed in 2022, up from 187 million before the pandemic started, the organization said, most of them in lower income and poor countries. “This unequal recovery risks accentuating still further inequalities in the world of work between countries and within countries,” Mr. Ryder said.

The pandemic has had a “dramatic” social impact, disproportionately hitting employment of women and youth; reversing progress in reducing forced and child labor, and sharply driving up the number of working people still trapped in poverty, Mr. Ryder said.

“It’s very difficult to make comparisons with the 1930s, but we’re in that sort of territory,” he said, referring to the Great Depression. “Unless we take care of what’s happening in the world of work and labor markets, there are some very unpleasant things that can happen in the world.”

Read moreCredit…Pete Marovich for The New York Times

The Biden administration on Wednesday moved closer to imposing tariffs on certain goods from six countries in retaliation for taxes those nations have imposed on digital services offered by companies like Facebook, Amazon and Google.

The United States finalized a list of products that would be subject to tariffs but immediately suspended the levies for 180 days while international tax negotiations proceeded.

Under the administration’s announcement, 25 percent tariffs would apply to about $2.1 billion worth of goods from Austria, Britain, India, Italy, Spain and Turkey.

The Trump administration began investigating those countries’ digital services taxes in June 2020, and the Biden administration faced a one-year deadline to take action.

The announcement comes as countries around the world are trying to reach agreement on a range of international tax issues. Those negotiations are being conducted through the Organization for Economic Cooperation and Development.

“The United States is focused on finding a multilateral solution to a range of key issues related to international taxation, including our concerns with digital services taxes,” Katherine Tai, the United States trade representative, said in a statement. “The United States remains committed to reaching a consensus on international tax issues through the O.E.C.D. and G20 processes.”

Ms. Tai added that the actions on Wednesday “provide time for those negotiations to continue to make progress while maintaining the option of imposing tariffs” if necessary at a later date.

In addition to the six countries included in the announcement, France has also been a target for potential retaliatory tariffs by the United States over its digital services tax. The Trump administration planned to put in place tariffs on $1.3 billion worth of French goods, including cosmetics and handbags, but in January, it suspended the tariffs indefinitely.

Read moreCredit…avid M. Benett/Getty Images

Depop, the fashion resale marketplace beloved by Generation Z, will be acquired by Etsy for $1.6 billion, the two companies announced on Wednesday.

The cash deal, which is expected to close by the third quarter of this year, underscores the growing influence of clothing resale platforms. More shoppers are turning to the secondhand market for something cheaper and — potentially — greener as the overproduction of clothing increasingly adds to landfills.

The trend appears to have been accelerated by the pandemic as more shoppers looked to declutter wardrobes, earn cash by selling their old clothes or set up fashion customization businesses from their bedrooms.

Investor appetite is also on the rise. Last month, Europe’s largest secondhand fashion marketplace, Vinted, raised 250 million euros in a funding round that valued the start-up at €3.5 billion ($4.26 billion), while in the United States companies such as ThredUp and Poshmark have gone public this year.

Depop, which was founded in 2011, has been particularly successful in building a marketplace for younger consumers, who are adopting secondhand fashion faster than any other group. Ninety percent of its users are under 26, with 30 million users across 150 countries. The platform is particularly known for its vintage clothes and streetwear — and for creating a new cohort of online influencers famous for selling their wares.

“We are simply thrilled to be adding Depop — what we believe to be the resale home for Gen Z consumers — to the Etsy family,” said the Etsy chief executive, Josh Silverman.

He said he believed the platform had “significant potential to further scale” and said that he saw “significant opportunities for shared expertise and growth synergies” for Etsy’s apparel sector, which was valued at $1 billion last year.

According to the Boston Consulting Group, the global market for pre-owned apparel is worth up to $40 billion a year — about 2 percent of the total apparel market. It is expected to grow 15 to 20 percent annually for the next five years.

The transaction is expected to close in the third quarter of 2021, subject to antitrust reviews in Britain and the United States.

Elsewhere in Markets

Stocks in the United States and Europe were slightly higher on Wednesday. The S&P 500 rose 0.2 percent and the Stoxx Europe 600 climbed 0.3 percent.
Oil prices climbed with futures continuing at their highest since late 2018. West Texas Intermediate, the U.S. benchmark, climbed above $68 a barrel.
Recent economic data has pointed to a strengthening economic recovery, but investors are closely watching for inflation that might require central banks to take action that could curb growth. On Wednesday, the Organization for Economic Cooperation and Development said that the annual inflation rate across its 38 member countries rose to 3.3 percent in April 2021, compared with 2.4 percent in March. The jump was fueled by an increase in energy prices of 16.3 percent, the highest rate since September 2008.

Read moreCredit…Desiree Rios for The New York Times

Veterans of the nation’s decade-long efforts to extend the broadband footprint worry that President Biden’s new infrastructure plan carries the same bias of its predecessors: Billions will be spent to extend the internet infrastructure to the farthest reaches of rural America, where few people live, and little will be devoted to connecting millions of urban families who live in areas with high-speed service that they cannot afford.

There is a political and economic logic to devoting billions of taxpayer dollars to bringing broadband to the rural communities that make up much of former President Donald Trump’s political base, which Mr. Biden wants to win over. But some critics worry that a capital-heavy rural-first strategy could leave behind urban America, which is more populous, diverse and productive, Eduardo Porter reports for The New York Times.

About 81 percent of rural households are plugged into broadband, compared with about 86 percent in urban areas, according to Census Bureau data. But the number of urban households without a connection, 13.6 million, is almost three times as big as the 4.6 million rural households that don’t have one.

Connecting urban families does not require laying thousands of miles of fiber optic cable through meadows and glens. In cities, telecom companies have already installed a lot of fiber and cable. Extending broadband to unserved urban households, most of them in low-income neighborhoods and often home to families of color, typically requires making the connection cheaper and more relevant.

The new media company that would combine WarnerMedia and Discovery has a name: Warner Bros. Discovery. David Zaslav, the executive who will run the combined companies if the merger is approved by regulators, announced the name at a town-hall-style meeting on Tuesday with WarnerMedia employees in Burbank, Calif. In his first opportunity to introduce himself to his prospective employees, Mr. Zaslav, who has been in charge of Discovery since 2007, spoke with the WarnerMedia chief executive Jason Kilar from the stage of the Steven J. Ross Theater on the Warner Bros. lot. The two executives did not mention the future of Mr. Kilar, who has retained a legal team to negotiate his exit from the company.

Credit…John Gress/Reuters

The brewing giant Anheuser-Busch said on Wednesday that it would offer Americans another incentive to get vaccinated: free beer.

The company said in a statement that it would “buy America’s next round” of beer, seltzer or nonalcoholic beverage once the country reached President Biden’s goal of having 70 percent of the adult population get at least one coronavirus vaccination by July 4. So far, 63 percent of adult Americans have received at least one dose.

“We pride ourselves on stepping up both in times of need and in times of great celebration, and the past year has been no different,” said Michel Doukeris, the chief executive of Anheuser-Busch, which will offer adults a $5 virtual credit card for beverages if the vaccination goal is met. “As we look ahead to brighter days with renewed optimism, we are proud to work alongside the White House to make a meaningful impact for our country, our communities and our consumers.”

Reaching the vaccination goal by Independence Day may not be easy. The pace of vaccinations in the United States has slowed, with the biggest gains in recent weeks made in vaccinating 12- to 15-year-olds, who are not eligible for the free beer. However, progress has been made in reaching some groups with the highest rates of vaccine hesitancy, including Latinos and people without college degrees, according to the Kaiser Foundation.

Anheuser-Busch’s offer comes as other businesses and states have introduced their own giveaways to encourage vaccinations. Gov. Jim Justice of West Virginia said on Tuesday that the state would give away guns and other prizes, including trucks and lifetime hunting and fishing licenses, to vaccinated residents.

Other states, including California, New Mexico and Ohio, have started lottery drawings to award cash prizes to those who have been vaccinated.

Russia’s Nobelium utilizing USAID’s electronic mail system for hack, Microsoft says

Post author By
Post date May 28, 2021

Annette Riedl | Picture Alliance | Getty Images

The Russian hackers believed to be behind the catastrophic SolarWinds attack last year launched another major cyberattack, Microsoft warned Thursday.

Microsoft said in a blog post that the hacking group known as Nobelium attacked over 150 organizations worldwide in the past week, including government agencies, think tanks, consultants and non-governmental organizations.

They sent phishing emails – fake messages designed to trick people into disclosing sensitive information or downloading malicious software – to more than 3,000 email accounts, the tech giant said.

At least 25% of the target organizations are involved in international development, humanitarian and human rights work, wrote Tom Burt, corporate vice president of customer security and trust at Microsoft.

“These attacks appear to be a continuation of Nobelium’s multiple intelligence-gathering efforts to target government foreign policy agencies,” Burt said.

According to Microsoft, organizations in at least 24 countries have been affected, with the US receiving the largest share of attacks.

The violation was discovered three weeks before President Joe Biden’s scheduled meeting with Russian President Vladimir Putin in Geneva.

It also comes a month after the US government explicitly stated that the SolarWinds hack was carried out by the Russian Foreign Intelligence Service (SVR), a successor to the KGB’s overseas espionage operations.

The Kremlin said Friday it had no information about the cyber attack and Microsoft needed to answer more questions, including how the attack relates to Russia, Reuters reported. The Kremlin did not immediately respond to CNBC’s request for comment.

The hack explained

According to Microsoft, Nobelium has gained access to an email marketing account used by the U.S. Agency for International Development, the federal government’s aid agency. The account is managed on a platform called Constant Contact.

Burt said Nobelium used the account to “distribute phishing emails that looked authentic but contained a link that inserted a malicious file when clicked”.

The file contains a backdoor, which Microsoft calls NativeZone, which “can enable a wide variety of activities from stealing data to infecting other computers on a network,” Burt said. Microsoft is in the process of notifying customers who have been targeted.

The SolarWinds attack uncovered in December turned out to be much worse than initially expected. It gave the hackers access to thousands of companies and government agencies that were using SolarWinds IT software.

Microsoft President Brad Smith described the attack as “the biggest and most sophisticated attack the world has ever seen”.

Earlier this month, Russia’s spy chief denied responsibility for the SolarWinds cyberattack, but said he was “flattered” by US and UK allegations that Russian foreign intelligence was behind such a sophisticated hack

Tags Email, hack, Microsoft, Nobelium, Russias, System, USAIDs

Politics

Russia Seems to Carry Out Hack By way of System Utilized by U.S. Support Company

Post author By
Post date May 28, 2021

Hackers connected to Russia’s main intelligence agency secretly seized an email system used by the Foreign Ministry’s international aid agency to dig into the computer networks of human rights groups and other organizations that President Vladimir V. Microsoft Corporation announced on Thursday that they were critical of Putin.

The breach was only discovered three weeks before President Biden’s planned meeting with Putin in Geneva and at a moment of increasing tensions between the two nations – also due to a series of increasingly sophisticated cyberattacks from Russia.

The newly uncovered attack was also particularly bold: By breaching the systems of a supplier used by the federal government, the hackers only this week sent e-mails from more than 3,000 real-looking accounts addressed to more than 150 organizations that are receiving regularly Communications from the United States Agency for International Development.

The e-mail was implanted with code that gave the hackers unrestricted access to the recipient’s computer systems, from “stealing data to infecting other computers on a network,” wrote Tom Burt, a Microsoft vice president, on Thursday evening.

Last month, Mr Biden announced a series of new sanctions against Russia and the expulsion of diplomats for an elaborate hacking operation called SolarWinds that used novel methods to injure at least seven government agencies and hundreds of large American companies.

This attack went undetected by the US government for nine months until it was discovered by a cybersecurity company. In April, Mr Biden said he could have reacted much more strongly but chose “proportionate” because he did not want to “start a cycle of escalation and conflict with Russia”.

However, the Russian response appears to have been an escalation. The malicious activity had only started for the past week. This suggests that the sanctions and any additional covert measures the White House has put in place – part of a strategy to create “seen and invisible” costs for Moscow – have not stifled the Russian government’s appetite for disruption.

A spokesman for the agency for cybersecurity and infrastructure security in the Department of Homeland Security said late Thursday that the agency is “aware of the possible compromise” with the agency for international development and is working “with the FBI and USAID to better understand it. ” Level of compromise and support for potential victims. “

Microsoft identified the Russian group behind the attack as Nobelium and said it was the same group responsible for the SolarWinds hack. Last month, the US government explicitly stated that SolarWinds was the work of the SVR, one of the KGB’s most successful Soviet-era spin-offs

The same agency was involved in the National Democratic Committee hacking attacks in 2016 and previously in attacks on the Pentagon, White House email system, and State Department unclassified communications.

It’s gotten increasingly aggressive and creative, say federal officials and experts. The SolarWinds attack was never discovered by the US government and was carried out through code implanted in network management software that is widely used by the government and private companies. When customers updated SolarWinds software – much like an iPhone would do overnight – they were unwittingly letting in an intruder.

The victims last year included the ministries of homeland security and energy, as well as nuclear laboratories.

When Mr Biden took office, he ordered a study into the SolarWinds case, and officials have been working to prevent future supply chain attacks where adversaries infect software used by federal agencies. This is similar to this case when Microsoft’s security team caught the hackers using a widely used Constant Contact email service to send malicious emails that appeared to come from real-world addresses belonging to the International Development Agency.

Updated

May 26, 2021, 9:17 p.m. ET

But the content was barely subtle at times. In an email sent through the Constant Contact service on Tuesday, the hackers highlighted a message claiming that “Donald Trump had published new emails about election fraud.” The email contained a link that, if clicked, would place malicious files on recipients’ computers.

Microsoft noted that the attack was “significantly” different from the SolarWinds hack and used new tools and craftsmanship to avoid detection. It was said that the attack was still ongoing and that the hackers continued to send spearphishing emails with increasing speed and reach. Because of this, Microsoft took the unusual step of naming the agency whose email addresses were used and posting examples of the spoofed email.

Essentially, the Russians got into the Agency for International Development’s email system by circling the agency and going straight to their software suppliers. Constant Contact manages bulk emails and other communications on behalf of the aid organization.

“Nobelium launched this week’s attacks by gaining access to USAID’s Constant Contact account,” wrote Microsoft’s Burt. Constant contact could not be reached for comment.

Microsoft, like other large cybersecurity companies, maintains a large network of sensors to search for malicious activity on the Internet and is often a target itself. It was instrumental in uncovering the SolarWinds attack.

In this case, Microsoft reported, the hackers’ goal was not to track down the State Department or the aid agency, but rather to use their connections to get into groups that work on the ground – and in many cases, Putin’s most powerful ones Critic.

“At least a quarter of the target organizations were involved in international development, humanitarian and human rights work,” wrote Burt. Although he did not name them, many such groups have exposed Russian actions against dissidents or protested the poisoning, conviction and imprisonment of Russia’s most prominent opposition leader, Alexei A. Navalny.

The attack suggests that Russian intelligence agencies are stepping up their campaign, perhaps to demonstrate that the country would not step down in the face of sanctions, the eviction of diplomats and other pressures.

Mr Biden raised the SolarWinds attack on a phone call with Mr Putin last month, telling him that the sanctions and expulsions are evidence that his government would no longer tolerate an accelerated pace of cyber operations.

Mr Putin has denied Russia’s involvement, and some Russian news outlets have argued that the United States launched the attack against itself.

At the same time, the White House also imposed a number of new sanctions on Russian individuals and assets, including new restrictions on buying Russia’s national debt that will make it difficult for Russia to raise money and support its currency.

“This is the beginning of a new US campaign against malicious behavior by Russia,” Treasury Secretary Janet L. Yellen said at the time.

Tensions over the housing of cybercriminals in Russia increased significantly this month after a ransomware group took corporate networks of the Colonial Pipeline hostage. The attack forced the company to shut down a pipeline that brings nearly half of its gasoline, diesel and jet fuel to the east coast, sparking a spike in gas prices and panic buying at the pump.

Mr Biden said two weeks ago: “We spoke in direct communication with Moscow about the need for the responsible countries to take decisive action against these ransomware networks. ”

Tags Agency, Aid, Appears, carry, hack, Russia, System

Politics

After Colonial Pipeline hack, all organizations want to spice up cyber defenses

Post author By
Post date May 16, 2021

After Colonial Pipeline hack, all organizations need to boost cyber defenses

Storage tanks at a Colonial Pipeline Inc. facility in Avenel, New Jersey on Wednesday, May 12, 2021.

Mark Kauzlarich | Bloomberg | Getty Images

The recent ransomware attack on Colonial Pipeline was an all-too-familiar story for businesses in the United States.

The pipeline, which supplies around 50 million people from the Gulf Coast to the entire east coast with fuel, was closed last Friday as a precautionary measure after a ransomware attack. The company and the US government are continuing to investigate the extent of the impact.

In the past few months, ransomware attacks have hit businesses of all sizes and hospitals in New York, Nebraska, Oregon, and Michigan, among others. Police and sheriff offices, schools, and local governments, from Atlanta to Baltimore to Fisher County, Texas, have suffered a similar fate.

A recent report from the Ransomware Task Force, a group of 60 cybersecurity experts from industry and government, highlights both the alarming increase in the frequency of these attacks and the size of the ransom they are asking for.

It is estimated that $ 350 million in ransom was paid to attackers in 2020 – an increase of more than 300 percent from the previous year – with an average payment of over $ 300,000.

According to a 2021 report, most of the industrial casualties in 2020 were in manufacturing, professional and legal services, and construction. Healthcare, manufacturing, and education companies saw significant increases. Attacks on industries like aerospace also seem to be increasing.

Organizations affected by ransomware are often faced with a very difficult decision: either have to pay a ransom and fuel a criminal market, or refuse to pay and hope that their computer systems can be restored.

If companies decide to pay the ransom to get back up and running quickly, the price can bring their business to the brink of bankruptcy. In addition, there is no guarantee that their systems will be restored.

In short, businesses in every sector and size need to take this threat seriously and take steps today to protect themselves. By the time you face an attack, it will be too late to take proactive action.

Organizations can also lose access to their protected information, including intellectual property, customer and employee data, and suffer reputational costs.

Protecting the American people and businesses from ransomware must be a top priority as a nation. We can no longer look the other way and simply treat ransomware as a nuisance. This latest attack should serve as a reminder to organizations across the country to step up their cyber defenses and stay one step ahead of future threats.

Like most cyber attacks, ransomware exploits the weakest link. Small businesses are particularly at risk as many of them are financially vulnerable and lack the resources to install cybersecurity software, ensure constant technology monitoring, provide staff training, and hire full-time information technology professionals.

It’s no surprise that small businesses make up half to three-quarters of all ransomware victims. And when these companies become targets, it can have devastating and lasting effects, forcing some to permanently close their doors.

The good news is that you don’t have to do it alone and there are affordable solutions for every budget. That’s why the departments of Homeland Security and Commerce are working together to help businesses prevent and respond to ransomware attacks.

A few simple but important steps can go a long way in protecting against this category of malicious cyber activity. Our two departments strive to work with companies and their CEOs.

The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) is well positioned to help organizations take preventative measures to increase resilience before an attack occurs.

CISA recently launched its “Reduce Your Risk of Ransomware” campaign of free public guidance and resources to help companies prepare for these attacks and assess the strength of their company’s cyber stance.

Practical guide

The CISA website also links to the practical guidance from the Department of Commerce’s National Institute of Standards and Technology (NIST), which draws on its in-depth economic and technical expertise. The National Cyber Investigative Joint Task Force has also provided guidance on how to respond to a ransomware attack.

Improving basic cybersecurity hygiene to prevent ransomware is important, but only part of the solution. The Biden Harris Administration coordinates a strategy across government to increase resilience, disrupt and investigate ransomware networks, and bring perpetrators to justice.

However, the federal government cannot fight ransomware on its own. Prevention, disruption and law enforcement require cooperation at all levels of government and in the private sector – both domestically and internationally.

Our departments will continue to advocate a comprehensive approach to combating ransomware to keep our communities safe. The requirements of malicious ransomware attacks require nothing less.

In the coming weeks, we will be stepping up our departments’ relationships with the private sector and exploring new initiatives to support businesses, healthcare systems and local governments. These public-private partnerships will continue to protect our businesses, our economy, and our national security.

Alejandro N. Mayorkas is the US Secretary of Homeland Security and Gina M. Raimondo is the US Secretary of Commerce.

Tags boost, Colonial, cyber, defenses, hack, organizations, pipeline

Business

Colonial Pipeline Hack Reveals Weaknesses in US Cybersecurity

Post author By
Post date May 15, 2021

For years, government officials and industry executives have been running in-depth simulations of a targeted cyberattack on the US power grid or gas pipeline and imagining how the country would react.

But when the real moment came when it wasn’t an exercise, it didn’t look like the war games.

The attacker was not a terrorist group or a hostile state such as Russia, China or Iran, as was assumed in the simulations. It was a criminal blackmail ring. The aim was not to disrupt the economy by taking a pipeline offline, but rather to save company data as a ransom.

The most visible impact – long lines of nervous drivers at gas stations – resulted not from a government response but from a decision by the victim Colonial Pipeline, which controls nearly half of the gasoline, jet fuel and diesel flowing on the east coast, to turn the spigot. This was done out of concern that the malware that had infected their back office functions could make it difficult to bill for the fuel delivered down the pipeline or even spread to the pipeline’s operating system.

What happened next was a vivid example of the difference between table simulations and the cascade of consequences that can follow even a relatively straightforward attack. The episode aftermath is still playing out, but some of the lessons are already clear, showing how far the government and the private sector must go to prevent and manage cyberattacks and put in place fast backup systems in case that critical Infrastructures fail.

In this case, the long-held belief that the pipeline’s operations were completely isolated from the data systems locked down by DarkSide, a gang of ransomware believed to be operating out of Russia, proved false. And the company’s decision to shut down the pipeline sparked a series of dominoes, including panic buying at the pumps and silent fear within the government that the damage could spread quickly.

A confidential assessment by the ministries of energy and homeland security found that the country could only afford three to five days if the colonial pipeline was shut down before buses and other local transport had to cut operations due to the lack of diesel fuel. Chemical plants and refineries would also be shut down as there was no way to sell what they produced, the report said.

And while President Biden’s advisors announced efforts to find alternative ways to get gasoline and jet fuel to the east coast, none were immediately available. There was a shortage of truck drivers and tankers for trains.

“Every fragility has been exposed,” said Dmitri Alperovitch, co-founder of CrowdStrike, a cybersecurity company and now chairman of the Silverado Policy Accelerator think tank. “We learned a lot about what could go wrong. Unfortunately our opponents too. “

The list of lessons is long. Colonial, a private company, may have thought it had an impermeable protective wall, but it was easy to break through. Even after paying the extortionists nearly $ 5 million in digital currency to recover their data, the company found that the process of decrypting its data and turning the pipeline back on was excruciatingly slow, which means it is still It will be days before the east coast comes back to normal.

“It’s not like flicking a light switch,” Biden said Thursday, noting that the 5,500-mile pipeline had never been shut down before.

For the administration, the event was a dangerous week in crisis management. Mr Biden told the aides it was remembered that nothing could cause political damage faster than television images of gas pipes and soaring prices, with the inevitable comparison to Jimmy Carter’s worst moments as president.

Mr Biden feared the situation would raise concerns that the economic recovery is still fragile and inflation will rise if the pipeline is not restarted, the panic subsides and the price cut is nipped in the bud.

In addition to the numerous measures to promote oil traffic on trucks, trains and ships, Mr Biden published a long-standing regulation that aims to prescribe changes in cybersecurity for the first time.

And he suggested that he was ready to take steps the Obama administration hesitated during the 2016 election campaigns – direct measures to repel the attackers.

“We will also be pursuing a measure to compromise its operability,” said Biden, a line suggesting that the United States Cyber Command, the military’s cyberwarfare force, had authority to take DarkSide out of circulation like another ransomware group in the fall before the presidential election.

Hours later, the group’s website went dark. Early Friday, DarkSide and several other ransomware groups, including Babuk, who hacked the Washington DC Police Department, announced they were getting out of the game.

Darkside alluded to disruptive actions by an unspecified law enforcement agency, although it was not clear whether this was the result of US action or pressure from Russia ahead of Mr Biden’s expected summit with President Vladimir V. Putin. And the silence could have simply expressed a decision by the ransomware gang to thwart retaliation by potentially suspending their operations.

The Pentagon’s Cyber Command referred questions to the National Security Council, which refused to comment.

The episode highlighted the emergence of a new “mixed threat” that may emanate from cybercriminals but is often tolerated and sometimes encouraged by a nation that views the attacks as serving their interests. That is why Mr Biden singled out Russia – not as the culprit, but as a nation that is home to more ransomware groups than any other country.

“We do not believe that the Russian government was involved in this attack, but we have strong reasons to believe that the criminals who carried out this attack live in Russia,” said Biden. “We spoke in direct communication with Moscow about the need for responsible countries to take action against these ransomware networks.”

With Darkside’s systems down, it’s unclear how Mr Biden’s government would take further revenge beyond possible charges and sanctions that Russian cybercriminals have not previously deterred. Fighting back with a cyber attack also carries the risk of escalation.

The government must also expect much of America’s critical infrastructure to be owned and operated by the private sector and still ripe for attack.

“This attack showed how bad our resilience is,” said Kiersten E. Todt, executive director of the nonprofit Cyber Readiness Institute. “We are rethinking the threat if we still don’t lay the foundations to secure our critical infrastructure.”

The good news, some officials said, was that the Americans received a wake-up call. Congress faced the reality that the federal government lacks the power to require a minimum level of cybersecurity from the companies that control more than 80 percent of the country’s critical infrastructure.

The bad news is that American opponents – not just superpowers, but also terrorists and cyber criminals – are learning how little it takes to wreak havoc in a large part of the country, even if they don’t break into the core of the electricity grid or the operational control systems, moving gasoline, water, and propane across the country.

Something as basic as a well-designed ransomware attack can easily do the trick while providing plausible denial to states like Russia, China, and Iran, which often appeal to outsiders for sensitive cyber operations.

It remains a mystery how Darkside first broke into Colonial’s business network. The privately owned company has said practically nothing, at least in public, about how the attack unfolded. It waited four days before having significant conversations with the administration, an eternity during a cyberattack.

Cybersecurity experts also note that the Colonial Pipeline never should have shut down its pipeline if it had had more confidence in the separation between its business network and pipeline operations.

“There should definitely be a separation between data management and the actual operating technology,” said Ms. Todt. “For a company that ships 45 percent of its gas to the east coast, frankly, it is inexcusable not to do the basics.”

Other pipeline operators in the US employ advanced firewalls between their data and their operations that only allow data to flow out of the pipeline in one direction and prevent a ransomware attack from spreading.

Colonial Pipeline did not indicate whether this level of security was provided in their pipeline. Industry analysts say many critical infrastructure operators say that installing such one-way gateways along a 5,500-mile pipeline can be complicated or prohibitively expensive. Others say the cost of providing these protections is still cheaper than the losses from potential downtime.

Detering ransomware criminals, whose number and audacity has increased in recent years, will certainly be more difficult than deterring nations. But this week made the urgency clear.

“It’s all fun and games when we steal each other’s money,” said Sue Gordon, former deputy chief director for national intelligence and longtime CIA analyst specializing in cyber issues, at a conference hosted by The Cipher Brief, an online intelligence agency Newsletter. “If we play around with the functioning of a society, we cannot tolerate it.”

Tags Colonial, Cybersecurity, hack, pipeline, Reveals, Weaknesses

Politics

F.B.I. Identifies Group Behind Pipeline Hack

Post author By
Post date May 11, 2021

According to intelligence officials, all signs indicate that it was merely an act of extortion by the group that first began delivering such ransomware in August last year and that is believed to be operating from Eastern Europe, possibly Russia. Even in the group’s own testimony on Monday, there was evidence that the group had only intended to extort money from the company and was surprised that the main gasoline and jet fuel supplies for the east coast were cut.

The attack exposed the remarkable vulnerability of a major energy channel in the US as hackers become bolder in taking over critical infrastructure such as power grids, pipelines, hospitals and water treatment plants. The Atlanta and New Orleans city governments and, in recent weeks, the Washington, DC Police Department, have also been hit.

The explosion in ransomware cases has been fueled by the rise in cyber insurance – which has made many companies and governments mature targets for criminal gangs who believe their targets will pay off – and cryptocurrencies, which make it difficult to track extortion payments.

In this case, the ransomware was not targeting the pipeline’s control systems, but rather the company’s back-office operations, said federal officials and private investigators. However, fear of greater damage forced the company to shut down the system. This created the huge security gaps in the patched network that keeps gas stations, truck stops, and airports going.

A preliminary investigation found poor security practices at Colonial Pipeline, according to federal and private officials familiar with the investigation. The mistakes most likely made it fairly easy to break into and block the company’s systems.

Tags FBI, Group, hack, Identifies, pipeline

Business

1000’s of Microsoft Prospects Could Have Been Victims of Hack Tied to China

Post author By
Post date March 6, 2021

Thousands of Microsoft Customers May Have Been Victims of Hack Tied to China

U.S. corporations and government agencies using a Microsoft email service have been compromised in an aggressive hacking campaign likely sponsored by the Chinese government, Microsoft said.

The number of victims is estimated at tens of thousands and, according to some security experts, could rise if the investigation into the breach continues. According to Volexity, the cybersecurity firm that discovered the hack, the hackers secretly attacked multiple targets in January, but their efforts escalated in recent weeks as Microsoft fixed the vulnerabilities exploited in the attack.

The US government’s cybersecurity agency issued an emergency warning on Wednesday fearing that the hacking campaign had hit a large number of targets. The warning prompted federal agencies to patch their systems immediately. On Friday, cybersecurity reporter Brian Krebs reported that the attack hit at least 30,000 Microsoft customers.

“We are concerned that there are large numbers of victims,” said White House press secretary Jen Psaki during a press conference on Friday. The attack “could have far-reaching effects,” she added.

Federal officials struggled to understand how the most recent hack compares to last year’s penetration by Russian hackers into a variety of federal agencies and corporate systems in what is known as the SolarWinds attack. In this case, the Russian hackers put code in an update to the SolarWinds network management software. While around 18,000 customers of the company have downloaded the code, so far there is only evidence that the Russian hackers have stolen material from nine government agencies and around 100 companies.

In the hack Microsoft attributed to the Chinese, it is estimated that around 30,000 customers were affected when the hackers exploited vulnerabilities in Exchange, an email and calendar server created by Microsoft. These systems are used by a wide range of customers, from small businesses to local and state agencies to some military contractors. The hackers were able to steal email and install malware to continue monitoring their targets, Microsoft said in a blog post, but Microsoft said it had no idea how extensive the theft was.

The campaign was spotted in January, said Steven Adair, founder of Volexity. The hackers quietly stole emails from multiple destinations, exploiting a flaw that allowed them to access email servers without a password.

“This is what we consider to be really secret,” Adair said, adding that the discovery sparked a frantic investigation. “It made us tear everything apart.” Volexity reported its findings to Microsoft and the US government, he added.

The attack escalated at the end of February. The hackers began weaving multiple vulnerabilities together and targeting a wider group of victims. “We knew that what we had reported and seen as very secret was now being combined and chained to another exploit,” said Adair. “It just got worse and worse.”

According to a cybersecurity researcher who investigated the U.S. investigation into the hacks and who has no authority to speak publicly about the matter, the hackers attacked as many victims as possible online, hitting small businesses, local governments and large credit unions. The errors used by the hackers, known as zero-days, were previously unknown to Microsoft.

“We are closely following Microsoft’s emergency patch for previously unknown vulnerabilities in Exchange Server software and reporting possible compromises between US think tanks and defense companies,” said Jake Sullivan, National Security Advisor to the White House.

“This is the real deal,” tweeted Christopher Krebs, former director of the US agency for cybersecurity and infrastructure. (Mr. Krebs is not related to the cybersecurity reporter who posted the number of victims.)

Mr Krebs added that companies and organizations using Microsoft’s Exchange program should assume they were hacked sometime between February 26th and March 3rd and should work on it quickly that past week Install patches published by Microsoft.

Microsoft said a Chinese hacking group called Hafnium, “a government sponsored group that operates out of China,” was behind the hack.

Since the company announced the attack, other non-hafnium hackers have started exploiting the vulnerabilities for target organizations that haven’t patched their systems, Microsoft said. “Microsoft continues to see increased use of these vulnerabilities when multiple unpatched systems are attacked by multiple malicious actors,” the company said.

Patching these systems is not an easy task. Email servers are difficult to maintain, even for security professionals, and many companies lack the expertise to securely host their own servers. For years, Microsoft has been pushing these customers to move to the cloud, where Microsoft can manage security for them. Industry experts said the security incidents could encourage customers to move to the cloud and be a financial boon to Microsoft.

Because of the scale of the attack, many Exchange users are likely to be at risk, Adair said. “Even people who fixed this asap, there is an extremely high chance that they have already been compromised.”

Nicole Perlroth contributed to the reporting.

Tags China, customers, hack, Microsoft, Thousands, Tied, victims

Politics

AG William Barr says Russia behind SolarWinds hack, contradicts Trump

Post author By
Post date December 22, 2020

WASHINGTON – Outgoing Attorney General William Barr said Monday that the massive SolarWinds hack by US government agencies “certainly” appears to be Russia’s job, which President Donald Trump contradicts.

Barr identified Russia as the likely perpetrator of the cyber attack and sided with Secretary of State Mike Pompeo and the rest of the National Security Institute, but contradicted the president.

Barr made the remarks during an impromptu press conference just two days before he was due to leave his job.

After several days of silence over the sweeping violation of government and private sector networks, Trump downplayed the severity of the attack in two tweets over the weekend. He suggested with no evidence that it could be China, not Russia, to blame.

“The cyber hack is far bigger in the fake news media than it is in reality,” wrote Trump. “I’ve been given full information and everything is well under control. Russia, Russia, Russia is the primary chant if something happens because Lamestream is petrified, for largely financial reasons, to discuss the possibility that it could be China (it can be !). “”

Trump also suggested without evidence that the hack could have affected the election software in the November presidential election. This was the latest in a series of increasingly far-fetched conspiracy theories put forward by the president in his refusal to accept that he lost the November 3rd election.

Pompeo’s first public comments on the attack came during a radio interview on Friday night on “The Mark Levin Show”.

“This has been a very significant effort and I think it is the case that we can now say fairly clearly that it was the Russians who took part in this activity,” said Pompeo.

Several news outlets have also reported that White House officials prepared a public statement on the cyberattacks late last week, transferring responsibility for the hack directly to Russia. But at the last minute they were forbidden from releasing it.

More than a week after the first breach was reported, both U.S. government agencies and private sector companies affected by the attack are still working to get a full picture of the extent of the breach and the potential harm to U.S. cyber infrastructure and critical ones Develop information systems.

The initial investigation revealed that the breach was malicious code hidden in a software update from widely used IT management company SolarWinds. Russia has denied any involvement in the attack.

The three lead agencies responsible for investigating the attack and protecting the nation from cyber threats – the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and the Office of the Director of National Intelligence – announced last week that they were one have formed joint command in response to what has been termed a “major and ongoing cybersecurity campaign” against the United States.

Trump’s refusal to acknowledge either the full extent of the attack or his likely perpetrators fits his pattern over the past four years as he downplayed Russia’s malicious actions around the world.

As part of this pattern, Trump has ignored and dismissed U.S. intelligence assessments of Russia’s guilt for several major operations, particularly the 2016 cyberattacks and disinformation campaign that harmed Trump’s then-opponent Hillary Clinton.

Tags Barr, contradicts, hack, Russia, SolarWinds, Trump, William

Politics

Billions Spent on U.S. Cyberdefenses Didn’t Detect Large Russian Hack

Post author By
Post date December 16, 2020

Billions Spent on U.S. Cyberdefenses Failed to Detect Giant Russian Hack

He urged the government to downgrade what it knows and what it doesn’t.

On Wednesday morning, Illinois Democrat Senator Richard J. Durbin called the Russian cyberattack “practically a declaration of war”.

So far, however, President Trump has not said anything, perhaps knowing that his term is beginning to end, with questions about what he knew about Russian cyber operations and when. The National Security Agency has largely remained silent and has hidden behind the classification of the secret services. Even the Cybersecurity and Infrastructure Security Agency, the group within the Department of Homeland Security tasked with defending critical networks, picked up the Russian mega-hack in a noticeably quiet manner.

Mr Blumenthal’s message on Twitter was the first official confirmation that Russia was behind the intrusion.

Trump administration officials have confirmed that several federal agencies – the State Department, the Department of Homeland Security, parts of the Pentagon, and the Treasury Department and the Department of Commerce – have been compromised. Investigators struggled to determine the extent to which the military, intelligence services and nuclear laboratories were affected.

The same questions are asked at many Fortune 500 companies that use the Orion network management tool, made by SolarWinds, based in Austin, Texas. The Los Alamos National Laboratory, which develops nuclear weapons, uses it, as does large defense companies.

“How is that not a massive secret service failure, especially since we were supposedly all Russian threat actors before the elections,” asked Robert Knake, a senior cyber officer in the Obama administration, on Twitter on Wednesday. “Did the NSA fall into a huge honey pot while the SVR” – Russia’s most sophisticated spy agency – “quietly plundered” the government and private industry?

Of course, even after placing its probes and beacons on networks around the world, the NSA is barely all-seeing. But if there is a larger investigation – and it’s hard to see how to avoid it – the responsibilities of the agency, led by General Paul M. Nakasone, one of the country’s most skilled cyber warriors, will be paramount.

Tags Billions, Cyberdefenses, Detect, Failed, Giant, hack, Russian, Spent