The Biden administration is struggling to find an effective, robust counter to the cyberattackers who have repeatedly caught the U.S. flat-footed and disrupted Americans’ lives from the gas pump to the police station.

Cybersecurity leadership selected by President Biden last month remains uninstalled, and a federal cyber agency said Tuesday that it does not yet have the information it needs to prevent further attacks such as the one that hit a major fuel pipeline last week.

The Colonial Pipeline shut down while working to overcome a ransomware attack, which involves malicious software holding data or computer systems hostage until victims pay the attackers in exchange for restored access.

The federal government has joined the company in trying to prevent a major gasoline shortage from the shutdown of the pipeline, which runs from Houston to New York and provides nearly half of all fuel consumed on the East Coast.

The Cybersecurity and Infrastructure Security Agency (CISA), the federal civilian agency tasked with preventing and fighting cyberattacks, told the Senate that it is waiting to receive technical information necessary to protect others from similar attacks.

“You still don’t have the information you need to be able to be responsive and provide support to critical infrastructure. Is that what you’re saying?” Sen. Rob Portman, Ohio Republican, asked the top CISA official, who appeared Tuesday before the Homeland Security and Governmental Affairs Committee.

“Yes, but that is not surprising given that it’s, they’ve only been working on the incident response since over the weekend and it’s fairly early,” said Brandon Wales, the agency’s acting director. “We … have had historically good relationship[s] with both Colonial as well as the cybersecurity firms that are working on their behalf. We do expect information to come from that, and when we have it, we will use it to improve cybersecurity more broadly.”

He said Colonial Pipeline did not contact his agency and likely would not have reached out if the FBI had not brought in the agency to assist with the response to the attack.

Alongside issues with information flow, the Biden administration is beleaguered with personnel problems. Top cybersecurity posts have stalled in the Senate confirmation process. Mr. Portman said senators are waiting for paperwork to be finalized for Mr. Biden’s nominee for the nation’s first national cyber director, John C. Inglis, who previously served as deputy director of the National Security Agency.

The nomination of Jen Easterly, another former NSA official, to run CISA also is pending.

Senate Democrats are mum about the holdup.

As the administration works to overhaul cybersecurity policy, victims of cyberattacks are stacking up across sectors that affect Americans’ day-to-day lives. In March, Buffalo Public Schools canceled classes for a day because of a “cybersecurity outage” reported to be a ransomware attack.

Late last year, the FBI detected an uptick in ransomware complaints that coincided with cyberassaults on hospitals and medical centers as the COVID-19 pandemic raged.

More recently, ransomware has afflicted law enforcement. Police departments of varying sizes from the District of Columbia to Presque Isle, Maine, have been hit with ransomware attacks since the start of April.

The full list of cyberintrusions in recent months is long and not limited to ransomware. Last month, CISA warned that hackers had breached Pulse Connect Secure products in government agencies, the private sector and critical infrastructure starting at least as far back as June.

Early indications suggest that five federal agencies were compromised in that hack, Mr. Portman said.

Nine federal agencies were compromised through the hack of SolarWinds computer network management software that was publicly disclosed late last year. Federal agencies are still working to recover from the intrusion. Microsoft Exchange servers have suffered from a large-scale hack. The company said China-based hackers were responsible.

The hacks look to have been espionage campaigns, and the Biden administration imposed sanctions on Russia in response to the SolarWinds hack. On Tuesday, Sen. Ron Johnson, Wisconsin Republican, wondered whether any evidence suggested that the pipeline cyberattack relied on information gathered from the SolarWinds espionage.

“My concern about what happened with Colonial Pipeline is it’s just a shot across the bow,” Mr. Johnson said. “These hacks, what was achieved with SolarWinds, is it is gathering information to be used at some point in time. Are we looking seriously in terms of how they may use that information and whether or not this might have been connected to Colonial Pipeline?”

“We are looking hard at the information that the adversary gleaned from SolarWinds, looking at reflections in intelligence, and the FBI is actively investigating the Colonial Pipeline incident,” Mr. Wales said.

The FBI has attributed the Colonial Pipeline cyberattack to DarkSide ransomware. The cybercriminals behind the pipeline attack are believed to be in Eastern Europe, and the Biden administration said the attackers look to be a criminal crew instead of a government.

The cyberintrusion against the pipeline could be felt most acutely by drivers along the East Coast in the coming days. AAA said the shutdown will exacerbate rising pump prices that already climbed 6 cents a gallon over last week.

Energy Secretary Jennifer Granholm warned gas station operators against price gouging in areas affected by the Colonial Pipeline outage. She also said there is no reason for drivers to start hoarding gasoline, just as she said there was no cause to hoard toilet paper at the onset of the COVID-19 pandemic last year.

The White House said the administration is monitoring fuel supply shortages, and Environmental Protection Agency Administrator Michael Regan waived vapor pressure rules on fuel sold in the District of Columbia, Maryland, Pennsylvania and Virginia to solidify the supply of gas through May 18.

To show their attention to the cyberattacks hitting the country, Democrats noted the increased spending of taxpayer money on cybersecurity.

At Tuesday’s hearing, Sen. Gary C. Peters, Michigan Democrat, touted his work helping to secure $650 million for the cyberagency as part of a larger COVID-19 relief package.

His Republican counterpart, Mr. Portman, questioned the effectiveness of that expenditure, but the price tag for government spending on cybersecurity is set to go up regardless.

Last month, Rep. Jim Langevin, Rhode Island Democrat, and Rep. Mike Gallagher, Wisconsin Republican, wrote to appropriators that $400 million more was needed for CISA urgently on top of the $650 million the agency already collected.

“Despite all the increased funding appropriated for cybersecurity and the bipartisan legislation we’ve worked on here in this committee, not one of these federal intrusions was discovered by the federal government,” Mr. Portman said.

—

Tom Howell Jr. and Ben Wolfgang contributed to this report.

Ryan Lovelace | AP News

Find your latest news here at the Hemet & San Jacinto Chronicle

The post Biden administration stumbles on cyberattack as fear of gas shortage grows appeared first on The Hemet & San Jacinto Chronicle.

WASHINGTON (AP) — Hit by a cyberattack, the operator of a major U.S. fuel pipeline said Monday it hopes to have services mostly restored by the end of the week as the FBI and administration officials identified the culprits as a gang of criminal hackers.

Colonial Pipeline, which delivers about 45% of the fuel consumed on the East Coast, halted operations last week after revealing a ransomware attack that it said had affected some of its systems. On Monday, U.S. officials sought to soothe concerns about price spikes or damage to the economy by stressing that the fuel supply had so far not been disrupted, and the company said it was working toward “substantially restoring operational service” by the weekend.

Nonetheless, the attack underscored the vulnerabilities of the nation’s energy sector and other critical industries whose infrastructure is largely privately owned. Ransomware attacks are typically carried out by criminal hackers who scramble data, paralyzing victim networks, and demand large payments to decrypt it.

The Colonial attack was a potent reminder of the real-world implications of the burgeoning threat. Even as the Biden administration works to confront organized hacking campaigns sponsored by foreign governments, it must still contend with difficult-to-prevent attacks from cybercriminals.

“We need to invest to safeguard our critical infrastructure,” President Joe Biden said Monday.

The attack came as the administration, still grappling with its response to massive breaches by Russia of federal agencies and private corporations, works on an executive order aimed at bolstering cybersecurity defenses. The Justice Department, meanwhile, has formed a ransomware task force designed for situations just like Colonial Pipeline, and the Energy Department on April 20 announced a 100-day initiative focused on protecting energy infrastructure from cyber threats. Similar actions are planned for other critical industries.

Despite that, the challenge facing the government and the private sector remains immense.

In this case, the FBI moved with unusual speed to pinpoint blame, saying the criminal syndicate whose ransomware was used in the attack is named DarkSide. The group’s members are Russian speakers, and the syndicate’s malware is coded not to attack networks using Russian-language keyboards.

Anne Neuberger, the White House deputy national security adviser for cyber and emerging technology, said at a briefing that the group emerged just months ago. She said its business model is to demand ransom payments from victims and then split the proceeds, relying on what she said was a “new and very troubling variant.”

She declined to say if Colonial Pipeline had paid any ransom, and the company has not given any indication of that one way or the other. Though the FBI has historically discouraged victims from making payments for fear of promoting additional attacks, she acknowledged “the very difficult” situation that victims face and said the administration needs to look “thoughtfully at this area” of how best to deter ransomware.

Neuberger said the administration is committed to leveraging the government’s massive buying power to ensure that software makers make their products less vulnerable to hackers.

“Security can’t be an afterthought,” Neuberger said at a conference on national security Monday. “We don’t buy a car and only then decide if we want to pay for seatbelts and airbags.”

The U.S. sanctioned the Kremlin last month for a hack of federal government agencies that officials have linked to a military intelligence unit and described as an intelligence-gathering operation. In this case, though, the hackers are not known to be working at the behest of any foreign government.

The group posted a statement on its dark web site describing itself as apolitical. “Our goal is to make money, and not creating problems for society,” DarkSide said.

Asked Monday whether Russia was involved, Biden said, ”“I’m going to be meeting with President (Vladimir) Putin, and so far there is no evidence based on, from our intelligence people, that Russia is involved, although there is evidence that the actors, ransomware, is in Russia.

“They have some responsibility to deal with this,” he added.

U.S. officials have sought to head off anxieties about the prospect of a lingering economic impact and disruption to the fuel supply, especially given Colonial Pipeline’s key role in transporting gasoline, jet fuel, diesel and other petroleum products through 10 states between Texas and New Jersey.

Colonial is in the process of restarting portions of its network. It said Monday that it was evaluating the product inventory in storage tanks at its facilities. Administration officials stressed that the company proactively took some of its systems offline, as opposed to hackers doing it, and that its operating systems were spared.

In response to the attack, the administration loosened regulations for the transport of petroleum products on highways as part of an “all-hands-on-deck” effort to avoid disruptions in the fuel supply.

“The time of the outage is now approaching critical levels and if it continues to remain down we do expect an increase in East Coast gasoline and diesel prices,” said Debnil Chowdhury, IHS Markit Executive Director. The last time there was an outage of this magnitude was in 2016, he said, when gas prices rose 15 to 20 cents per gallon. But the Northeast had significantly more local refining capacity at that time, potentially intensifying any impact.

If the pipeline outage persists, the industry may want to turn to barges to transport fuel, but that could require a waiver of the Jones Act, a U.S. maritime law that requires products shipped between U.S. ports to be moved by American-flagged ships.

The pipeline utilizes both common and custom technology systems, which could complicate efforts to bring the entire network back online, according to analysts at Third Bridge.

Gasoline futures ticked higher Monday. Futures for crude and fuel, prices that traders pay for contracts for delivery in the future, typically begin to rise anyway each year as the driving season approaches. The price you pay at the pump tends to follow.

The average U.S. price of regular-grade gasoline has jumped 6 cents over the past two weeks, to $3.02 per gallon, which is $1.05 higher than a year ago. The year-ago numbers are skewed somewhat because the nation was going into lockdown due to the pandemic.

The attack on the Colonial Pipeline could exacerbate the upward pressure on prices if it is unresolved for a period of time.

___

Associated Press writer Frank Bajak contributed from Boston.

Find your latest news here at the Hemet & San Jacinto Chronicle

The post FBI names pipeline cyberattackers as company promises return appeared first on The Hemet & San Jacinto Chronicle.