Advertisement

Age of the cyber-attack: US struggles to curb rise of digital destabilization

<span>Photograph: Sean Rayford/Getty Images</span>
Photograph: Sean Rayford/Getty Images

It’s been 40 years since Lisa Donnan has queued for gas. But last month the cybersecurity expert found herself joining the long lines of cars across the east coast of the US looking for fuel after the latest in a series of cyber-attacks had shut down the pipeline that provides fuel to 45% of the region.

“The last time I did that was in the Iran crisis,” she said. “My dad had to wait with me.”

Related: World’s biggest meat producer JBS pays $11m cybercrime ransom

The hack of the Colonial Pipeline was just one of a series of cyber-attacks that have hit the US and elsewhere recently. Hackers have taken down JBS, the world’s largest meat processor, disrupting the global meat market, closed schools in Iowa and hit hospitals in Ireland in what experts say is a dangerous escalation of a crime wave that has swelled from the small-scale blackmail operations of a few years ago to major assaults that threaten the livelihoods – and potentially lives – of millions.

Many of the recent attacks have been sourced to operations in Russia and US officials say that Russia’s responsibility for ransomware attacks carried out from its territory would be a central issue when Joe Biden meets Vladimir Putin in Geneva next Wednesday.

“One of the things that President Biden will make clear to President Putin, when he sees him, is that states cannot be in the business of harboring those who are engaged in these kinds of attacks,” the secretary of state, Tony Blinken, told Congress this week.

Eric Green, the senior director for Russia and central Asia in the national security council, said that one of the expected outcomes from the Geneva summit was a routine dialogue between senior US and Russian officials aimed at bringing greater stability and predictability to the relationship. One of the issues in the dialogue would be ransomware attacks.

“When we talk about strategic stability cyber will also certainly be on the agenda,” Green said in a recent discussion organised by the Centre for a New American Security. “The recent ransomware attacks remind us that the cyber domain is prone to misperceptions and that there are dangerous escalation risks.”

US officials say America will be pushing for Nato to expand its involvement in cyberdefence at the alliance summit in Brussels. But the unanswered question is how to respond to ransomware attacks by criminal groups for whom their host countries deny responsibility.

“Putin will deny interfering in US politics or conducting cyber-attacks, asserting that Washington has no proof, while rejecting the legitimacy of US concerns about what happens within Russia,” said Steven Pifer, former deputy assistant secretary of state for European and Eurasian affairs and now a senior fellow at the Brookings Institution.

Joe Biden will raise the issue of ransomware attacks, some allegedly perpetrated by Russia-based hackers, at a summit with Vladimir Putin in Geneva this week.
Joe Biden will raise the issue of ransomware attacks, some allegedly perpetrated by Russia-based hackers, at a summit with Vladimir Putin in Geneva this week. Photograph: Sergei Ilyin/Tass

“Biden should not waste time arguing. He should aim instead to ensure that Putin has a clear understanding of what conduct is out of bounds.”

The pressure for Biden to act is rising. There has been a 62% increase in ransomware globally since 2019, and 158% spike in North America, according to the 2021 SonicWall Cyber Threat Report. Alongside that rise, the nature of the crimes and their targets are also changing.

“We are seeing more attacks, more sophisticated attacks, bigger attacks and the scary thing is we are seeing them more on supply chains,” said Donnan. “It used to be about financial exfiltration, stealing money, and reputational damage. It’s now in a life-threatening environment. That is a dramatic change.”

Now a partner at the cybersecurity private equity investor Option3Ventures, Donnan says she doesn’t expect to see any let-up in attacks. Nation states including Russia, China and North Korea are getting more ambitious in their attacks and the criminal enterprises that operate under their wings are getting more brazen.

“The landscape is ripe and ready for attack from a perfect storm of hackers, nation states and the average cybercriminal,” she said.

Part of the recent surge is down to the pandemic, which has helped the hackers by accelerating the digitization of business and giving them more access points as people and businesses have moved to work remotely.

On top of that there has been an explosion in software development, much of which was not built with security in mind from the beginning, said Donnan. “We still have a culture of get to market, be first. We are designing code without security in mind,” she said.

Lastly there are few consequences to cybercrime. Cryptocurrencies are the preferred payment for ransoms and are as hard to track as the origins of the hack. With the authorities unlikely to crack the case anytime soon – if ever – for many targets not paying is a difficult choice. Joseph Blount, Colonial’s chief executive, told Congress last week that he decided to pay the $4.4m bitcoin ransom to get the pipeline back online after he saw “pandemonium going on at the markets”.

Politicians hit out at Blount for the company’s failure to stop the hack. But the government itself has also failed to stop numerous hacks and not paying the ransom can be more expensive than paying up and potentially leave companies open to further assaults. JBS paid $11m in bitcoin to its hackers, even though it had mostly fixed its problems, hoping the payment would prevent further issues arising from the attack.

Joseph Blount, president and CEO of Colonial Pipeline, explains to the Senate homeland security and government affairs committee why his company paid a $4.4m ransom.
Joseph Blount, president and CEO of Colonial Pipeline, explains to the Senate homeland security and government affairs committee why his company paid a $4.4m ransom. Photograph: REX/Shutterstock

In 2019 Baltimore was hit with a cyber-attack that seized control of parts of its government. The hackers demanded $760,000 in bitcoin but the mayor, Bernard “Jack” Young, refused to pay. The cost of rebuilding its systems has now reached $18.2m.

Publicly the FBI advises victims not to pay a ransom in order to discourage perpetrators from targeting more victims. But privately they will tell targets that they understand if they feel the need to pay.

In the Colonial case the FBI managed to seize the majority of the bitcoin payment – a hopeful sign that may discourage some attackers, according to experts – but the fact remains that most of these crimes go unpunished.

“It’s very difficult to prosecute, it takes a long time, it takes cooperation geopolitically because most of these attacks come from offshore,” said Donnan. “The government only has so many resources. It doesn’t take a lot of tools or brain capacity to do these things,” she said. “You can buy a tool kit on the dark web.”

One irony of the current wave of hacks is that the US is under attack by tools developed by its own National Security Agency (NSA). In 2016 an online group called the Shadow Brokers claimed to have infiltrated the Equation Group, the NSA’s own private hacking group, and obtained malware used by the US to target its enemies.

The Shadow Brokers claimed responsibility for the release of NSA software that facilitated May 2017’s WannaCry ransomware attack, which triggered more than 45,000 attacks in 99 countries and crippled parts of Britain’s National Health Service. Researchers believe that attack originated in North Korea.

In June 2017 the same cyber-attack tool developed by the NSA, called EternalBlue, was used to launch a series of attacks on Ukraine, affecting the government, banks and transportation systems and taking the radiation monitoring system at Chernobyl offline. That attack then spread around the world, hitting companies that had offices in Ukraine including FedEx, the advertising agency WPP, pharmaceutical company Merck and consumer goods maker Reckitt Benckiser.

The US, UK and other researchers blamed Russia for that attack, arguing it was not designed to make money but to damage Ukraine’s economy.

The escalation in cases comes even as spending on security is rising dramatically. The US is the number one country for cybercrime and also spends the most on cybersecurity.

In 2015 the US Office of Personnel Management (OPM) announced it was hacked in 2015, one of the largest data thefts in history. Since then the US has spent $115bn on cybersecurity and the White House is asking Congress to commit roughly $10bn to civilian government cybersecurity next year – a jump of nearly 14%. Industry spent $41bn on cybersecurity in 2019 and is expected to have spent $53bn in 2020.

JBS, the world’s largest meat processing company, recently paid ransomware hackers $11m.
JBS, the world’s largest meat processing company, recently paid ransomware hackers $11m. Photograph: Jeff Kowalsky/AFP/Getty Images

Even after all that money has been spent, said Donnan “we are still exposed because there is no consequence.”

But there are rewards.

Three years ago Paul Ferrillo, a partner at New York law firm Seyfarth Shaw who specialises in cybersecurity, says he was settling ransomware hacks for five bitcoin (about $6,000 per bitcoin then and currently around $36,000 each). “Now you are lucky if it’s 75 bitcoin or 100. I heard of one demand recently for $140m,” he said.

“If this is the new normal, they are winning,” he said. “These criminal actors are well-funded and smart whether they are state-funded or not. We need to be as smart as they are.”

Ferrillo said there was no silver bullet that would solve the crisis and that everyone from the government to the private citizen had to play a part. Companies have to get better at managing their data, storing backups offline and making sure it is harder to get into their systems.

He also wants to see more transparency from industry. Companies have often hidden hacks because they don’t want to look like “doofuses”, he said. “But when industry shares information, we all get smarter. We understand where we should look and how we should do better.”

But tackling this explosion in hacking will take action from everyone, he said, from government to private citizens. “Cybersecurity is a shared responsibility. We are all in this together,” he said.