• If you are having trouble changng your password please click here for help.

Colonial Pipeline System Restart

Wait a minute, BUT dominion now is China, so it belongs to the small dick communists party....
Well, yes. But, technically, Xiden has BELONGED to China since way back Hunter times and they and Dominion put him in office (supposedly with 81 million votes even though he can't draw a crowd of 10 people anywhere who don't work for him). We won't ever know the money trail back to China because this government is theirs now but I'd be willing to bet it's all been converted from the Chinese Yuan...
 
Ok then, if they paid, they know who they paid to. In another words, they know who did this. So, if they know who did it, and decided this let go without classifying the attack as an act of war, that means who else did is powerful and will do it again?
Was the money wired to DNC by any chance? :boink:
Yep, but nowadays we’re so Technified you can wire money untraceable. Our Country’s webTech enforcement seems to be a joke.
 
That pipeline has been there for more than 50 years. Was operated long before Al Gore invented the internet. It could be operated with phones and on site operators at the pumping stations. If they had an emergency plan, the public would have never even known it was down.
Plantation pipeline operates a line just a few miles from the Colonial line and largely parallel, it was not down. The “shortage” was caused by panic buyers, plain and simple. Supply would have been ample had people not gone stupid and started filling Walmart bags with gas.
Rant over
The biggest problem is that they probably got rid of 85% of their workforce when they automated. Not enough people to run it manually. I bet there were some people who put in some long hard hours.
 
So, did they air gap it? Or is it still connected to the internet?

It was probably never connected through the Internet, but through dedicated network links. It's probably never going to be air-gapped either, since that makes life incredibly difficult and usually leads to security breakdowns like infected SD cards and such if it's not enforced 100%.

Typically SCADA and control networks like this have a single logical connection to the rest of the business, heavily secured and firewalled. In a business like this, with a large geographic footprint they would probably have multiple control points for backup and redundancy.

At least that's how it should be. It sounds like they failed to separate their internal network (which was connected to the Internet) from their operational network.

IDK, but my experience with that same scenario, is that they paid the ransom. It would take months to airgap a back up and restart from a blank slate.
Company I haul exclusively for had the same thing happen to them. But they are a Global company so the scale was larger. They told them to pound sand, took them months to get back going full speed.

Yeah, starting up 'green field' is a real issue. You have to somehow recreate hundreds or thousands of (probably) poorly documented server, network and firewall configurations and then reinstall your application base from scratch. You can't really trust your backups either, since you probably don't know how long the attacker has had access to your systems.

This is a nightmare scenario for any company, and it's no surprise that they chose to pay to try and recover faster. At the end of the day $5 million is a drop in the bucket, and it's probably covered under their business interruption insurance.

It also sounds like the hackers helped them out by letting them know when they took over the system so they could go back and get clean backups from before that. That's probably the #1 reason this ended so quickly. If they couldn't restore from backups and had to do a 'green field' startup it would have been weeks at best.
 
Pipeline crosses my property and a pumping station is close enough to my house that I know when the pipeline is down because I don’t hear the pump running. Helicopter traffic has been just about non stop today. We generally get a few through here but nothing like this. May be just coincidence.
 
Back
Top Bottom