On Monday, US officials announced that they had identified a virtual wallet which they suspect is related to DarkSide, the hacking group responsible for last month’s Colonial Pipeline debacle. As a result, they managed to retrieve the 63.7 bitcoin ransom, currently worth about $2.3m.
The Colonial Pipeline, America’s largest fuel pipeline, was shut for five days after the pipeline was confronted on 7 May with a ransomware attack by Darkside. The hacking group is believed to have Russian ties.
Once DarkSide encrypted Colonial’s data, it demanded cryptocurrency payments as ransom in exchange for giving Colonial Pipeline a decryption tool to unlock the systems that DarkSide hackers had brought to a standstill. Colonial Pipeline paid almost $5m to the hackers as a result.
Try 6 free issues of MoneyWeek today
Get unparalleled financial insight, analysis and expert opinion you can profit from.
Start your trial
Sign up for MoneyWeek’s free twice-daily newsletter.
Join more than 165,000 subscribers and keep yourself informed with latest financial news, insights and expert analysis to help you understand what really matters when it comes to your finances.
Join more than 165,000 subscribers and keep yourself informed with latest financial news, insights and expert analysis to help you understand what really matters when it comes to your finances.
The hack was one of the worst infrastructure attacks in US history. The 5,500 mile-long pipeline which runs from Texas to America's east coast is important because it provides more than 45% of the east coast’s fuel, including home heating oil, jet fuel, petrol and diesel.
Latest Videos FromMoneyWeek
Given the volume of fuel that flows through the pipeline, the closure unsurprisingly wrought havoc, propelling panic buying across both petrol and gas markets.
How can the US prevent future attacks?
The good news for Colonial is that the FBI did manage to get some of the money back. The Department of Justice is unlikely to boast of exactly how they did it. But we do know that the FBI obtained access to the “private key” belonging to the hacker’s Bitcoin wallet, according to an affidavit. Once they got the key, the FBI simply logged in with a password and diverted digital coins away from the hacker’s wallet.
The bad news for the rest of us is that this is unlikely to be the last such cyberattack. Infrastructure in both the US and globally has already been subject to a number of high-profile attacks that extend well beyond the energy industry.
For example, the Colonial Pipeline hack came just months after hackers broke into SolarWinds, a Texas-based company. The hackers flooded the company’s software system with malicious code, affecting up to 18,000 customers. Most recently, JBS USA, the world’s largest meat supplier, was the target of an “organised cybersecurity attack”, threatening meat supplies.
As Forbes points out, unless companies and governments take measures to boost cybersecurity, “a future hack could target civilian infrastructure, disrupting hospital systems or the air traffic control frequencies”.
President Joe Biden’s $2trn “American Jobs Plan” has pencilled in $20bn for state, local and tribal governments to improve their energy systems and ensure they meet cybersecurity standards. The plan proposed an extra $2bn for “grid resilience in high-risk areas that will be contingent on meeting cybersecurity targets,” reports Bloomberg.
Basic hygiene would help a lot
But this isn’t just about increased spending. Companies need to get better at doing very simple things such as practising basic “security hygiene” to reduce the likelihood of future attacks, Philip Reiner, chief executive of nonprofit group the Institute for Security and Technology notes in The Verge.
These include things such as ensuring multi-factor authentication is in place (whereby you are asked to verify your identity via more than one route), and that response plans are ready so that firms are prepared to cope with attacks and have robust backup systems in place.
These measures may seem obvious, but Reiner points out that a lot of cyber crime is down to companies’ failure to practise basic security hygiene, rather than uber-intelligent hacking. Indeed, Colonial Pipeline chief executive Joseph Blount said this week that DarkSide was able to hack the system using a single password, due to a lack of multifactor authentication.
Alternatively, as the BBC points out, the simplest way to protect operational technology from such attacks “is to keep it offline, with no link to the internet at all”.
The trouble is, as cybersecurity expert Jon Niccolls at IT security firm CheckPoint tells the BBC, all devices used to run a modern oil and gas pipeline are controlled by computers rather than people, and any device which is connected to an organisation’s internal network leaves the pipeline “vulnerable to malicious attacks”.
Which cybersecurity stocks may be worth buying?
Ransomware and cybersecurity attacks are rising for a host of reasons: widespread working from home in particular makes IT systems harder to protect, while the largely anonymous nature of cryptocurrencies gives hackers a bigger incentive to conduct attacks.
Given the spate of publicity and the clear sense that this is a growing problem, you’d expect cyber stocks to have risen in recent months. Yet along with the wider tech sector, software and cybersecurity stocks have underperformed.
Goldman Sachs was upbeat on prospects last month: “As we heard from management teams after the SolarWinds attack, we believe that most security software vendors will likely benefit from greater long-term demand and growth, as opposed to a near-term acceleration in demand,” the bank said, reports CNBC.
Investors Daily highlights stocks including Fortinet (Nasdaq: FTNT), CrowdStrike Holdings (Nasdaq: CRWD), Proofpoint (Nasdaq: PFPT) and Palo Alto Networks (NYSE: PANW).
But if you are looking for a broad way to invest in the sector, then an exchange-traded-fund could be one way in. Most are US-based, but there are a few UK funds, including the Rize Cybersecurity Data Privacy ETF (LSE: CYBP), the Legal & General Cybersecurity ETF (LSE: ISPY), the iShares Digital Security ETF (LSE: LOCK), and the WisdomTree Cybersecurity ETF (LSE: WCBR).
