Spiceworks
US Natural Gas Facility Hit with Ransomware
by Son of Jor-El
on Feb 21, 2020 at 18:30 UTC
Breaking News Cyber Security Government IT
Next: SMBv3 Vulnerability Leaked
Photo credit: Ramsey Martin [Pexels]
Oh boy, this is NOT GOOD!!!!
US Critical Infrastructure successfully attacked – CISA Issues Warning
The Department of Homeland Security has confirmed that an unnamed US Natural Gas faciality was successfully attacked with ransomware after falling victim to a spear-phishing email campaign. The organization lacked robust segmentation between its IT networks and their Operational Technology networks allowing the ransomware to spread throughout the organization. While the specific variant of ransomware was not named, it was described as a commodity type that is easily purchased via the dark web and targeted the Windows operating system.
Unfortunately, the organizations emergency response plan focused on physical security issues and did not fully encompass cyberattacks. Because of this, the decision was made to shut down operations which lasted for two days. The Cybersecurity and Infrastructure Security Agency (CISA) generated an alert that states the location was able to obtain replacement equipment and load last-known good configurations to recover. The alert further says, "The victim cited gaps in cybersecurity knowledge and the wide range of possible scenarios as reasons for failing to adequately incorporate cybersecurity into emergency response planning."
CISA warns that critical US Infrastructure is a target for threat actors and urges them and other organizations to add cyber risk planning to their incident response strategies. Furthermore, they should practice failovers to alternate control systems, use tabletop exercises to train employees, identify technical and human points of failure for operational visibility, and recognize the implications of cyberattacks. Lastly, CISA emphasizes that physical security controls, network segmentation, multi-factor authentication, anti-phishing filters, whitelisting, traffic filtering, regular data backups, least privilege access polices, and regular patching are all important for healthy cybersecurity.
Popular Topics in Breaking News
Are you smarter than most IT pros? Take the Daily Challenge »
Solar Winds isn't alone
Google push back against paying for News
Patch all your Windows DNS servers - CVE-2020-1350 - CVSS score of 10
The help desk software for IT. Free.
Track users' IT needs, easily, and with only the features you need.
Feb 21, 2020 at 18:34 UTC
If it's NICOR I'm going to be pissed.
BiscuitKing
It was only a matter of time.
Sean (Spiceworks)
Are these relevant to the one you posted about?
https://www.zdnet.com/article/dhs-says-ransomware-hit-us-gas-pipeline-operator/
https://www.scmagazine.com/home/security-news/ransomware/cisa-issues-warns-critical-infrastructure-s...
https://www.forbes.com/sites/kateoflahertyuk/2020/02/19/us-government-issues-powerful-cyberattack-wa...
MilesB
after falling victim to a spear-phishing email campaign.
And that's why educating users on security is important.
Nic (Automox)
Brand Representative for Automox
MilesB wrote:
Users really need to be aware of the dangers that spears present
Denis Kelley
I heard of a company that we work with that got his with crypto recently and it took down all their 50 plus US offices. Staff need training, mkay.
Vito1168
This is totally unacceptable! No segmentation no security awareness etc etc. I feel its getting to the point every single organization need on prem security specialists. My fist question is why they are not NIST compliant and no real security.
BowlingGeek
I read it was probably EKANS or some variation thereof...sneaky sneaky
2300peterw Feb 21, 2020 at 19:51 UTC
Many organisations are proud to advertise their compliance with iso standards and any infrastructure organisations should be required by law to be compliant to a Cyber Security one. If the iso standard needs to be made more tougher then so be it.
Limey Feb 21, 2020 at 19:57 UTC
2300peterw wrote:
you realise that the ISO standards just mean you have a policy and follow it, more or less? 9001 certainly doesn't say "You shall not pass" or anything like that, just that if YOU say that you do X, then you must do X and document it.
Peter (Spiceworks)
Son of Jor-El wrote:
For the record, I spiced up this topic because I appreciate that this news was shared in Spiceworks ... not because I'm glad ransomware hit our infrastructure :(
@Limey. I agree that some companies pay lip service to standards. An iso standard should be the requirement against which the organisation prepares there response to meet the iso specification. That will certainly mean that they will need documented procedures or automatic actions showing how they demonstrably meet the iso requirements. The iso should not tell organisations how to do something - that how to is the responding organisation responsibility. For instance, the iso could specify that isolation/segmentation of IT system has to be done and reviews done to ensure that this is effectively done. Where those isolation breaks are is part the responding organisations decision. In fact the iso could specify many of those CISA suggestions as mandatory. In critical infrastructure organisations it should be mandatory for them to have a licence. I suspect that there may not be a satisfactory iso standard at the moment. I did have a quick search and found one consultation document in the UK. How far it has got and whether it would cover that reported ransomware attack, I don't know. https://www.itgovernance.co.uk/files/Infosec_101v1.1.pdf
NathanJCSD9
The Department of Homeland Security has confirmed that an unnamed US Natural Gas faciality was successfully attacked with ransomware after falling victim to a spear-phishing email campaign.
I was just curious what a faciality is, is that a bit like a fatality in Mortal Kombat or some sort of weird Japanese thing.
ghijkmnop
Was the perpetrator this guy?
Milerky2
I wish I could be surprised by this.
JFEB
Behind every breach is an IT person quietly saying to themselves "I told you so..."
lowell_schweickart
Once again why we need to emphasize we should have the best qualified and experienced individuals running any critical operation.
A system is only as good as its weakest link, and not planning accordingly to prepare your users inevitably causes a major incident.
lapetinap
First, the users must care. If they did, we would have fewer issues with all the publicity that is about. Secondly, the IT at these places should be ahead of the game by now, especially with all the publicity that is about. Due Diligence everyone!
Thai Pepper
Adam-H
It would be interesting to know where the fault falls. Not where the blame falls, but where the fault falls. We all know that IT will get the blame.
JFEB wrote:
Or, in facilities like this... "I don't know how that happened. When we were on Windows 3, this kind of thing never happened... but since Windows 3.1... I just don't know how this all works!"
albert17
My previous company has 'proudly' achieved the ISO 27001:2013 - Information Security. Okay, great, we have a certificate that says we safeguard our information.
All this does is ensures that an organisation follows a scope they specify. And the requirements they deem enough. Monthly backups? As long as it's in the policy.
"Strong passwords"? Sure, it's here in the point 9.1.3c. Doesn't matter that most passwords were 'CompanyName123!'.
Papers out in the open? Oh yes, but we have this very strong lock and the key is right there in the drawer in case somebody forgets the combination.
Phishing training? Oh yes, once per two years, not obligatory for 50 senior members, because it's obstruction to their daily duties and they can't spare 30 minutes for Mitnick's KnowBe4 phishing video.
And so on, and so on. I think eventually we lowered down our phish prone people count to 1 out of 70... But I bet it was 1 out of few thousands employees at that gas facility. All you need is one user that will click on the link. doesn't matter if you're in 100k company and you are five nines in phish%. You'll always have that Shawn from compliance (or legal, or accounting, or heck, even IT) that will click it.
Users.
Well albert17, at least your previous Company had done something about improving security, although as you suggest it was not enough and was not rigorous in its implementation. Perhaps they had taken other actions such as isolated parts of the system, etc, which would help if attacked. Hopefully, audits should pick up weaknesses in way the Company work and suggest improvements. If the Company were a critical infrastructure organisation, that a Country relies on for its needs, such as the "Gas Facility" hit by Ransomware then I was suggesting they should have a licence and that should be reviewed. I would also like them to have a stiff fine because of their ineptitude.
I agree that the weakest link in whatever security system you have are normally reliable people who let their guard down and take stupid actions. It is easily done. As you say Phishing Training is needed although I am not certain that watching a video is the best way of doing it. I like the idea of internally generated false phishing e-mails to check out how good an organisation is.
I like the idea of having different OS systems such as Linux in use wherever you can usefully have them to reduce the risk.
Rupesh (Lepide)
Brand Representative for Lepide
User awareness is the first step to identifying and dealing with ransom attack.
An interesting post on why humans are still an important part of the cybersecurity strategy
Backing up data is one of the information security best practices.
Super_Pallet Feb 24, 2020 at 12:51 UTC
Another day, another infection, just this one is neither in Iran nor in Ukraine.
No need to send peacekeeping forces in, they're already there.
Review and audit your security and mitigation plans, include cyber in DR plan, and get over it.