Is your state running out of gas?

[Tinks]

Reprinted on Yahoo Finance in its entirety.

https://finance.yahoo.com/news/colonial-pipeline-paid-hackers-nearly-141548661.html​

Such guidance provides a quandary for victims who have to weigh the risks of not paying with the costs of lost or exposed records. The reality is that many choose to pay, in part because the costs may be covered if they have cyber-insurance policies.​

​

“They had to pay,” said Ondrej Krehel, chief executive officer and founder of digital forensics firm LIFARS and a former cyber expert at Loews Corp., which owns Boardwalk Pipeline. “This is a cyber cancer. You want to die or you want to live? It’s not a situation where you can wait.”​

​

Krehel said a $5 million ransom for a pipeline was “very low.” “Ransom is usually around $25 million to $35 million for such a company. I think the threat actor realized they stepped on the wrong company and triggered a massive government response,” he said.​

There was no response. That's why it will happen again and again.

 

[mom2rtk]

There was no response. That's why it will happen again and again.

Yep. Sadly.

 

[RedAngie]

I learned that about 75% of my company’s stores in Virginia were out of gas. Most are along the I-95 corridor.

 

[DisneyHardin]

I'm in Louisville, KY and our gas supply is not from the affected pipeline, but people here are still rushing out. I have heard reports of some stations being out. Yesterday at lunch, I had to run up to Sam's Club to get a few things and there were probably at least 60 cars waiting at the gas station.

I am going to need to get gas tomorrow. Fingers crossed I can get in and out of a station quickly. Our gas prices were already high, so there really wasn't a big increase, but we were already at $3.00+/gallon around town.

 

[mamamary]

I’m in Maryland and I just got home from doing some running around today. I passed many gas stations and they are all fine.

 

[Carol_]

Northern VA here, right off I-95. Drove around a 15 miles radius this morning and not one station had any gas.

You should use gas buddy. It tells you who has gas so you don’t waste your life trying to find gas where it isn’t.

 

[GreatLakes]

Reprinted on Yahoo Finance in its entirety.

https://finance.yahoo.com/news/colonial-pipeline-paid-hackers-nearly-141548661.html​

Such guidance provides a quandary for victims who have to weigh the risks of not paying with the costs of lost or exposed records. The reality is that many choose to pay, in part because the costs may be covered if they have cyber-insurance policies.​

​

“They had to pay,” said Ondrej Krehel, chief executive officer and founder of digital forensics firm LIFARS and a former cyber expert at Loews Corp., which owns Boardwalk Pipeline. “This is a cyber cancer. You want to die or you want to live? It’s not a situation where you can wait.”​

​

Krehel said a $5 million ransom for a pipeline was “very low.” “Ransom is usually around $25 million to $35 million for such a company. I think the threat actor realized they stepped on the wrong company and triggered a massive government response,” he said.​

The choice to pay isn't always an actual choice. If the perpetrator is tied to a foreign government or known agent it is often illegal to pay.

When a company actual pays it is an indication that they don't have good backups. The preferred response for a ransomware attach, outside of prevention of course, is to find and mitigate the entry point and then back up. Paying is the worst option because it may get your data back but you still have the same opening for the next attack.

 

[Christine]

You should use gas buddy. It tells you who has gas so you don’t waste your life trying to find gas where it isn’t.

I did. Also found out that Gas Buddy is not "real time." It's dependent on people reporting if there is gas or not. So there's been some significant lag time there.

 

[bcla]

I'm in Louisville, KY and our gas supply is not from the affected pipeline, but people here are still rushing out. I have heard reports of some stations being out. Yesterday at lunch, I had to run up to Sam's Club to get a few things and there were probably at least 60 cars waiting at the gas station.

I am going to need to get gas tomorrow. Fingers crossed I can get in and out of a station quickly. Our gas prices were already high, so there really wasn't a big increase, but we were already at $3.00+/gallon around town.

That the pipeline isn’t near doesn’t really matter. Most buyers don’t understand how it works.

There’s already a shortage of available truck drivers because of so many goods being shipped. The bottleneck isn’t really getting fuel to the fuel depot, because they have enough fuel to last for weeks with alternative delivery methods. I understand they’ve been lower than normal, but certainly not even close to 50% depleted. The bottleneck is the trucks delivering fuel to the gas stations.

There isn't necessarily an overall shortage of fuel at fuel depots. What Colonial or other pipeline operators mostly do is accept a certain amount of fuel at point A (usually a refinery) and promise to have a certain amount of equivalent fuel available at point B. It's not necessarily the same fuel. It's up to Colonial to figure out how they best get such and such fuel available for the retail customer at their fuel depots. So maybe ExxonMobil has such and such an amount of fuel coming out of their Louisiana refinery that they need to deliver in North Carolina. And an independent refiner in North Carolina has the same amount of equivalent commodity fuel to be delivered (it could be traded on the open market) in Louisiana. So what a company like Colonial can do is just move that fuel from ExxonMobil to their depots in Louisiana and then move the fuel from the North Carolina refinery to its depots in North Carolina. If they can avoid moving fuel that far away, everyone is happy.

 

[JimMIA]

I did. Also found out that Gas Buddy is not "real time." It's dependent on people reporting if there is gas or not. So there's been some significant lag time there.

True, but it's probably the best option available. I haven't heard of anything better.

The other factor that we noted on our evacuation trip was that the busier things were, the more timely the Gas Buddy results were. On our evacuation route, I don't think we ever found it inaccurate because thousands of drivers were using it.

 

[tarheelmjfan]

There was no response. That's why it will happen again and again.

Yep. Sadly.

How do we know there was no response? It's not like there's going to be a press conference to tell us & the hackers what they're doing. I'm sure they're going after these people.

 

[bcla]

How do we know there was no response? It's not like there's going to be a news conference to tell us & the hackers what they're doing. I'm sure they're going after these people.

There was some government response, but this is a private company and they're generally not to keen to spill everything to the government. The reporting is that Colonial hired a private company to handle the response. There isn't that much the federal government can do about the actual vulnerabilities because these companies treat them as absolute trade secrets. The primary government response was to allow for a relaxation of certain transportation rules such as allowable trucker hours and weight limits.

But the overall issue is that Colonial is a private company and isn't obligated to let the federal government step in.

 

[mom2rtk]

How do we know there was no response? It's not like there's going to be a press conference to tell us & the hackers what they're doing. I'm sure they're going after these people.

If the only story out in the media is that the ransom was paid, then I would expect others to try something similar.

 

[tarheelmjfan]

If the only story out in the media is that the ransom was paid, then I would expect others to try something similar.

I agree with that. It's too bad they paid the ransom, but they're not going to provide details of an ongoing investigation.

 

[Julie's Haircut]

I did notice a local Wawa had short lines (2 or 3 waiting) at each pump. Usually you can drive right up or at most there may be one car ahead of you. Perhaps a bit of panic buying. But as far as I know they didn't run out of gas.

 

[DisneyHardin]

That the pipeline isn’t near doesn’t really matter. Most buyers don’t understand how it works.

There’s already a shortage of available truck drivers because of so many goods being shipped. The bottleneck isn’t really getting fuel to the fuel depot, because they have enough fuel to last for weeks with alternative delivery methods. I understand they’ve been lower than normal, but certainly not even close to 50% depleted. The bottleneck is the trucks delivering fuel to the gas stations.

There isn't necessarily an overall shortage of fuel at fuel depots. What Colonial or other pipeline operators mostly do is accept a certain amount of fuel at point A (usually a refinery) and promise to have a certain amount of equivalent fuel available at point B. It's not necessarily the same fuel. It's up to Colonial to figure out how they best get such and such fuel available for the retail customer at their fuel depots. So maybe ExxonMobil has such and such an amount of fuel coming out of their Louisiana refinery that they need to deliver in North Carolina. And an independent refiner in North Carolina has the same amount of equivalent commodity fuel to be delivered (it could be traded on the open market) in Louisiana. So what a company like Colonial can do is just move that fuel from ExxonMobil to their depots in Louisiana and then move the fuel from the North Carolina refinery to its depots in North Carolina. If they can avoid moving fuel that far away, everyone is happy.

The maps I’ve seen on the news show that none of the oil in KY comes from that pipeline. We didn’t have a shortage of fuel delivery trucks last week, and I really doubt we lost a bunch of drivers this week. The lines at KY stations are 100% caused by people panic buying.

 

[bcla]

The maps I’ve seen on the news show that none of the oil in KY comes from that pipeline. We didn’t have a shortage of fuel delivery trucks last week, and I really doubt we lost a bunch of drivers this week. The lines at KY stations are 100% caused by people panic buying.

It's not about losing drivers per se, but there has been a shortage of qualified fuel tanker drivers in the last year. It's also not simple to just hire more drivers with commercial licenses because they have to be trained on how to handle fuel deliveries.

The panic buying is draining gas stations, and there's just not enough local tanker drivers to replenish the gas stations at the rate they're being drained. But from what I heard, in the vast majority of areas with shortages, there wasn't any shortage of fuel available at fuel depots. If there were enough drivers and tanker trucks, the majority of gas stations in a particular area wouldn't have any shortages. A few might because of the way fuel is distributed. The way it works is that different sources are responsible for arranging for fuel to be available at a certain point. I've heard a few of these suppliers don't have "inventory" available at a certain point. And it could dozens of customers taking fuel from the same tank.

I guess the one thing that a lot of people don't quite understand is that fuel isn't simply moved from seller to customer. Colonial will receive custody of several deliveries of something like 87 octane regular in several states and they'll figure out how to get the equivalent amount to the delivery point (usually a tank farm). Shipments meeting the same requirements can even be mixed together. When something like 87 octane regular gets to the tank farm, it's usually just mixed with previous shipments of 87 octane regular. Moving fuel hundreds or thousands of miles is expensive.

 

[RamblingMad]

If the only story out in the media is that the ransom was paid, then I would expect others to try something similar.

Check out Solarwinds. This happens a lot.

 

[JimMIA]

Check out Solarwinds. This happens a lot.

Ransom hacking happens far more often than we know, and nobody's come up with a solution for it yet. I personally don't think it can be dealt with by the criminal justice system. I think it has to be dealt with as more of a form of terrorism.

 

[mom2rtk]

Check out Solarwinds. This happens a lot.

Does that mean we should just go with it now? Just write it into the cost of doing business and accept it as normal? Every time it succeeds it becomes more likely to happen again.