During April 2021, cybercriminals were able to log onto the databases of Colonial Pipeline and install ransomware that led to the shutdown of a fuel pipeline system that provides service to the entire eastern Eastern Seaboard of the USA.
This resulted in a lot of panic buying of fuel by Americans on the East Coast as fuel supplies were threatened. The knock-on effect of this was local fuel shortages and a surge in the price of gasoline to their highest level since 2015. There was a 4.6 million barrels drop in the level of stockpiles of gasoline on the East Coast.
The DarkSide ransomware-as-a-service operation was blamed for the attack and has now been taken down. Before it was shut down, Colonial Pipeline handed over a $4.4 million ransom to remove the encryption from their files. They took the decision to pay the ransom due to the danger facing the fuel supplies. Colonial Pipeline provided almost half (45%) of fuel to the East Coast. Though handing over the ransom was a difficult move to make, it had to be done due to the threat to fuel supplies. Another consideration was the length of time that it might take to retrieve the files without having the attacker-supplied decryption keys.
This attack should not have been allowed to gain access to such a critical infrastructure. The subsequent review into the cyberattack showed that all it took for the attack to be successful was the use of one compromised password to remotely access the database. The account that was compromised was not secured using multi-factor authentication.
According to Charles Carmakal, senior vice president at cybersecurity firm Mandiant which was involved in the investigation, the compromised password was for a virtual private network account. The account may have been dormant but it was still possible to use the login credentials to gain access to Colonial Pipeline’s network.
As of yet it remains unknown how the cybercriminals came to be in possession of this password. The password has since been located in a database of breached passwords that was made available via the dark web. There is a chance that an individual had created a password for the account and it was also in use on a separate account that was infiltrated. It is typical for passwords from data breaches to be used in brute force attacks as password reuse is commonplace. Phishing campaigns are used to obtain passwords also.
Mandiant searched for anything to suggest how the password was stolen by the cybercriminals. The cybersecurity experts found no evidence of hacker activity prior to April 29, 2021 nor any proof of phishing attempts. At this point in time it appears that how the password was obtained and the username determined may never come to be known.
Is it quite obvious that this hack could have been stopped using cybersecurity best practices including carrying out audits of accounts and closing down dormant accounts, creating setting unique and complex passwords for every account, configuring multi-factor authentication to prevent stolen compromised passwords from being used for access, and installing a robust anti-spam solution.