How Was the US “Colonial Pipeline” Brought Down by Seizing a Single Password?

In April and May 2021, Colonial, America’s largest oil pipeline company, had to shut down after an attack by hackers.

The company carries about 2.5 million barrels of fuel a day from the Gulf Coast in the south to the East Coast. The attack caused fuel shortages at petrol stations, long queues of vehicles and rising fuel prices.

According to a Reuters report of 9 June 2021, after the attack the company’s chief executive Joseph Blount told US senators in testimony that the attackers had brought down the pipeline simply by obtaining a single password and using one of the company’s old VPN systems.

So is it that easy to bring down such an important system?

In the past, in a ransomware attack, hackers would encrypt systems and demand a sum as ransom from the system owner. But recently, especially in developed countries, laws have been passed imposing very high penalties on organisations or institutions thought to have failed to take the measures required to protect personal data. This has both given hackers a very good source of motivation and made it harder for them to take over a system.

It became a source of motivation because, when a ransomware attack is carried out, information can be accessed almost everywhere in that system. This means that all the data held by that system can be backed up elsewhere without the consent of its legitimate user, and finally, when the ransom is demanded, the target company or institution can be threatened more forcefully with the release of this data.

The reason it made the hackers’ job harder is that companies have been forced to invest much more against cybersecurity threats. These investments can deter hackers if their motivation is not high enough.

According to Dragos, a cybersecurity company specialising in SCADA (Supervisory Control and Data Acquisition) and ICS (Industrial Control Systems), the Russian cybercrime organisation DarkSide was behind this attack.

According to the blog post Dragos published on 5 November 2021, ransomware groups like DarkSide behave opportunistically. These groups find easy targets, assess whether they can obtain a good ransom and carry out cyber attacks. Unfortunately, most companies using SCADA systems are among the foremost of these targets.

Because when these companies want to reach system units at different locations, they connect through internet-facing services secured with weak passwords and not properly protected. Sometimes these services have very critical security vulnerabilities, which whets the hackers’ appetite for these companies.

As for the details of the incident, investigations suggest that the hackers caused the shutdown of this largest fuel pipeline in the US by obtaining just one password.

According to an article published in Bloomberg on 4 June 2021, the hackers entered the company’s network on 29 April 2021 through a virtual private network (VPN) that company employees also used to access the network. Although it was no longer in use at the time of the attack, this VPN could still provide access to Colonial’s network.

It emerged that the password of this account had leaked together with a batch of passwords on the so-called dark web, used for both legal and illegal purposes. This means that one of the company’s employees very probably used a password he used on another platform for the account that should have had a separate one for the company.

Another striking detail of the attack is that the company VPN operated without multifactor authentication (MFA), one of today’s indispensable security layers. This made the attackers’ access to the network even easier. It is also worth noting that knowing only the password is not enough to enter the company’s network; a username is also needed, and how the hackers determined it is not yet known.

As for the shutdown of the pipeline, on 7 May 2021, at around 5 a.m., one of the employees saw a ransom note on a computer screen demanding cryptocurrency. With the operations manager informed, the pipeline began to be shut down, and by 6:10 a.m. it had been completely closed.

As a result of the investigations, it was concluded that the attack was limited to the company’s IT systems, and it was thought that the company’s SCADA systems had not been damaged.

The attackers also stole about 100 gigabytes of data, greatly strengthening their threats to make Colonial’s management pay the ransom. The company paid a ransom of 4.4 million dollars.

As for the perpetrators, although about 2.3 million dollars of the ransom paid was recovered by the US Department of Justice in June 2021, because the ransom was in cryptocurrency it is not known exactly to whom and where it went. For this reason, the perpetrators are most likely busy identifying new targets.

As for the answer to the question in the title, infiltrating these systems and rendering them inoperable is not impossible, and can sometimes even be very easy. After all, these systems are used by people. And when we look at the cyber attacks carried out so far, we see that systems are generally first entered by exploiting human weaknesses, and that the attack’s reach is then identified and expanded through the vulnerability.

On the other hand, technologically too, SCADA/ICS systems are not yet secure enough against simple cyber attacks, because when these systems first emerged they were developed to perform the function the system required, while their security dimensions were pushed into the background.

In conclusion, when national infrastructure projects requiring maximum security, such as dams, oil pipelines and water treatment systems where SCADA systems are used, are developed, cybersecurity must be given top priority. Training to give those who will work there the necessary security awareness must be provided without neglect.