FBI names pipeline cyberattackers as company promises return

Russia has a policy against extradition.

Hummmm. New business model - American freelancers attacking businesses in Russia, NK, and other dictator friendly countries using malware. Why didn't I think of that before? I've had my eye on some big rims and gold teeth and a clock necklace that would make Flavor-Flav jealous.

Or better ... cracking the cracker malware groups, so they can't get any work done? Don't worry, we'd use VPNs in China. Now I'm a little curious as to how far inside someone with average skills could get? Asking for a "friend."

Burning BushToday  06:59 am JST

The group's members are Russian speakers, and the syndicate’s malware is coded not to attack networks using Russian-language keyboards.

Russian is spoken widely in over 15 different countries in the world.

About 40% of Estonia's population are Russian speakers.

Wrong on the first point. When you cyberattack a foreign business or nation, since the subject computers are in their own local languages, you must send the viruses written in their language and script.

For instance, during the Kosovo War, NATO sent a Trojan Horse to the defense network in Belgrade written in Serbo-Croatian with the Cyrillic alphabet.

When the Obama administration cyberattacked Iran's reactors, the hacking was written in the Farsi (Persian) language with Arabic script.

When China tried to hack (without success) a New England textile mill, their worm was in English with Roman script. And Russia did it successfully the same year to install the tyrant usurper traitor trump in the WH.

Its amazing that any country can attack and American infrastructure given its power and intelligence. How can this be?

Its amazing that any country can attack and American infrastructure given its power and intelligence. How can this be?

It's because the american infrastructure is in complete shambles after several decades of right-wing policies favoring tax cuts for rich people instead of repairing roads, bridges and electrical grids.

Its amazing that any country can attack and American infrastructure given its power and intelligence

Take this news with a grain of salt. Everybody knows that FBI is using a crystal ball to come up with their "intelligence"

you dont say? the hack was done by hackers. mind blowing work by the FBI.

Oh wait, its "the Russians", but of course. never mind.

as the FBI and administration officials identified the culprits as a gang of criminal hackers.

you dont say? the hack was done by hackers. mind blowing work by the FBI.

Oh wait, its "the Russians", but of course. never mind.

The pro-Trump mantra - attack the FBI, defend Russia...

This is likely the result of Trump giving the passwords to his Master Putin at one of their many secret summits...

This does bring up a very real threat - Russia and China using cyberattacks in conjunction with their disinformation operations to try to get Trump re-elected. Attack the infrastructure causing economic disruptions then blame the results on Biden.

You'll likely see this parroted across the far-right media bubble...which are nothing but the US outlets for Russian propaganda...

identified the culprits as a gang of criminal hacker

Still Russia blamed. They used Israeli code...

Just rip out the whole computer system at Colonial and install from new.

Wrong on the first point. When you cyberattack a foreign business or nation, since the subject computers are in their own local languages, you must send the viruses written in their language and script.

This is factually wrong. I've written code that ran on 15 different languages and only the GUI aspects needed anything special, not the internal code, internal symbols. A virus/malware would likely not have any GUI code. The keywords in most computer languages are English, but the variables/symbols will be 7-bit ASCII.

If I need something really fast and tight, I'll drop to assembly code, which is what gets translated to the raw machine code. All languages eventually get converted to this to run. 1 line of C code can result in 200 lines of ASM, so it isn't normal to write entire programs in ASM outside the embedded software industry. It is very common to use a profiler to determine which parts of code are taking the longest and to speed those up by creating efficient ASM for just those parts.

There are Russian speakers in the US. My next door neighbors are Ukrainian and speak Ukrainian, Russian and English. When I'm creating code, I like to mix in foreign words and abbreviations, just for fun ... more so when I'm trying to learn a language, but there are many common words shared in technology across all spoken languages when talking computers, networking or programming.

The fault for attacks are from the attackers, just like the fault in a 2-car accident is from the driver behind the other vehicle.

The Company BoD and C-suite manager also share the blame, since they are the ones who decided NOT to beef up their security. Chances are IT or their data security teams were told to stop asking for money years ago, since they've never had any incident before. Almost all businesses act that way and think it can't happen to them, until it does. The BoD and C-suite people won't be held accountable for these failures. Some middle manager, probably below director level will get fired, since he clearly didn't convey the risks appropriately up the command chain.

We're losing the (cyber)war with Russia & China while the GOP is providing great cover with their circus version of (cyber)security. Oh, the bamboo paper ballots!!! Talk about eyes off target...

Yeah, Russia isn’t a threat to the US at all.

Not in a military sense as opposed to cybercrimes. Hopefully the FBI leadership focuses and puts more resources into dealing with the real growing threat of cybercrime than to dig around in trying to oppose and topple political leaders they personally don’t like.

DarkSide has admitted to this attack. They are a Russian criminal enterprise. There is no question about those 2 facts.

https://www.schneier.com/blog/archives/2021/05/ransomware-shuts-down-us-pipeline.html

The billing systems were impacted, not the pipeline management systems. So, the gasoline can flow, but billing will have to be handled some other way, assuming they have poor malware protection.

Normal, daily, automatic, versioned, "pulled" (never pushed!), backups solve this.

If they had those, this would be a minor issue to the business, besides the embarrassment involved.

There is no question about those 2 facts.

You provide a link to a blog and claim that it's factual information? Besides, even that blog post states "a probably Russian cybercrime group"...

theFu: The Company BoD and C-suite manager also share the blame

I get the feeling that we work for the same company.

bass4funk: Hopefully the FBI leadership

You don't trust FBI leadership. You've said that something like that 100+ times.

Last time out you said the FBI were corrupt, what changed?

Nothing changed, what are you talking about?

They don't investigate crime overseas

That’s right, but internally and in the cyberspace they can and do.

You don't trust FBI leadership. You've said that something like that 100+ times

And this from the “Russia, Russia, Russia” band leaders... interesting...

Nothing changed, what are you talking about?

You have said, on multiple occasions, that you don't trust the FBI, that they are corrupt, and that anything they say is untrue.

You have said, on multiple occasions, that you don't trust the FBI

Yes, I have

So why do you trust the FBI now? Or, as zichi put it: what changed?

So why do you trust the FBI now? Or, as zichi put it: what changed?

No, Zichi gets me most of the time wrong, but No, I don't trust the FBI especially the top echelon of the branch, I am just hoping, which is a far cry from blindly trusting someone.

So, you're putting all your hopes into people you explicitly think are corrupt and untrustworthy?

OK. That sounds extremely dumb to me. But then, I'm not a Trump supporter, so I'm sure there's something I'm missing.

bass4funk: Hopefully the FBI leadership focuses and puts more resources into dealing with the real growing threat

and

bass4funk: No, I don't trust the FBI

Covered both ways. Just hop back and forth as needed.

Now as their method is known, wouldn’t it be quite easy to make an emulator gateway containing Russian, Chinese, North Korean etc. keyboard specifics and put it at all incoming or outgoing international data cables or satellite emitting stations? I mean a little hardware box or software module that simulates the existence of such a keyboard so that all the attacks are inactive. Let’s say , one such module at the ends of the Atlantic or Pacific cable and the US would have get rid of all similar cyber threats. Those dudes could of course for example ignore their Russian keyboard detected attack stopping , but then Putin will catch them and hang them higher, if the attacks also randomly go for inner-Russian plants, pipelines or whatever. They surely can afford that only once and a last time. lol