CasesS=1:500S=1:100
Colonial Pipeline ransomware attack: how the attacker got in
An old VPN profile that was no longer meant to be in use, protected only by a password, let the attacker in.
1 Summary
On May 7, 2021, Colonial Pipeline found ransomware on its IT systems and shut down the largest fuel pipeline on the US East Coast as a precaution. Restart began on May 12. The CEO told the Senate that the attacker used a legacy VPN profile that was not meant to be in use and that had only single-factor authentication.
Probable cause: An old VPN profile that was no longer meant to be in use, protected only by a password, let the attacker in.
Source: US Senate Committee on Homeland Security and Governmental Affairs Testimony of Joseph Blount, President and Chief Executive Officer Colonial Pipeline Company
Reports that the password had appeared in a leaked-password batch come from a security firm via the press, not from Colonial, and are left out here.
S=1:100 2 Factual information
2.1 The way in
CEO Joseph Blount, in written Senate testimony: "we believe the attacker exploited a legacy virtual private network (VPN) profile that was not intended to be in use." At the hearing he confirmed the account did not require multi-factor authentication.
Source: US Senate Committee on Homeland Security and Governmental Affairs Testimony of Joseph Blount, President and Chief Executive Officer Colonial Pipeline Company
- Product
- Not stated
- CVE
- Not stated
2.2 After entry
Ransomware hit the company's IT systems. Colonial shut down pipeline operations on its own initiative to contain the attack.
2.3 Damage
The pipeline stopped for about five days. The company paid a ransom; the US Justice Department later recovered part of it.
2.4 Sequence of events
| Time | Actor | Event | Source |
|---|---|---|---|
| 2021-05-07 | Company | Ransomware found; pipeline operations shut down; FBI contacted that morning. | BankInfoSecurity |
| 2021-05-12 | Company | Pipeline restart begins. | US Senate Committee on Homeland Security and Governmental Affairs |
| 2021-06-08 | CEO | Testifies to the Senate: a legacy VPN profile was the likely way in. | US Senate Committee on Homeland Security and Governmental Affairs |
S=1:100 3 Analysis
| Point | Finding | Source |
|---|---|---|
| The VPN profile was a legacy one not intended to be in use. | Stated | US Senate Committee on Homeland Security and Governmental Affairs |
| The account did not require multi-factor authentication; the CEO said its password was complex. | Stated | BankInfoSecurity |
| How the attacker got the credentials. The company said it was still trying to determine this. | Unknown | US Senate Committee on Homeland Security and Governmental Affairs |
S=1:100 4 Conclusions
The CEO testified that the attacker most likely used a legacy VPN profile with single-factor authentication, and that how the credentials were obtained was still under investigation.
S=1:100 5 Recommendations
Recommended or carried out by: Company (measures taken)
- Shut down the legacy VPN profile.
- Add further layers of protection across the company.
Source: BankInfoSecurity Colonial CEO at Senate Hearing Details Ransomware Attack
Sources
Source: US Senate Committee on Homeland Security and Governmental Affairs Testimony of Joseph Blount, President and Chief Executive Officer Colonial Pipeline CompanyBankInfoSecurity Colonial CEO at Senate Hearing Details Ransomware Attack