Zachary Weaver<\/p>\n\n\n\n
Professor Arif<\/p>\n\n\n\n
CS462<\/p>\n\n\n\n
1 August 2025<\/p>\n\n\n\n
Colonial Pipeline Ransomware Attack:<\/p>\n\n\n\n
In May of 2021, the Colonial Pipeline was attacked and shut down by a ransomware attack that had been provided by a gang known as DarkSide. This pipeline delivered nearly half of the East Coast\u2019s fuel at the time of the attack. Darkside is known for utilizing an affiliate-based model that loans ransomware attacks and infrastructure to their criminal clientele. In return, they receive a portion of the ransoms collected by the client. After the Colonial Pipeline attack, DarkSide released public statements claiming they are \u201capolitical\u201d and \u201ctheir goal is to make money, not create problems for society.\u201d They went on to promise to moderate their clientele by researching the target company of the ransomware attack prior to loaning the required software and infrastructure to their partners (Newman, 2021).<\/p>\n\n\n\n
The idea that a group of malicious actors would actively police their criminal clients is absurd. It makes for a self-aggrandizing statement to endear DarkSide to the sections of society desperate for a Robin Hood-type vigilante to protect them and redistribute wealth. The reality is that their statement only thinly veils their own greed. A criminal enterprise policing other criminals prior to assisting them with a crime is futile. DarkSide\u2019s clients could easily lie about their intended target, and it seems highly unlikely that DarkSide would punish their clients when ransoms are paid. There have even been reports that DarkSide affiliates have not received their share of the ransom (Dudley, 2021).<\/p>\n\n\n\n
There is no genuine incentive for ransomware groups to be so discerning with their targets outside of public sentiment. Considering they are criminal organizations, they are unlikely to generate substantial goodwill. In fact, it is more likely that they issued such a statement to reduce governmental urgency to act. Such a high-profile attack, causing the issuance of emergency declarations in several states, is more likely to spur governments to action more quickly. This reduces the likelihood of DarkSide being able to operate without capture for an extended period of time. The more governmental resources assigned to track down groups like DarkSide, the more likely it is that they will be caught and dismantled.<\/p>\n\n\n\n
Newman\u2019s article goes on to explain that the Federal Government had been ramping up its efforts to address ransomware attacks in the weeks leading up to the Colonial Pipeline attack (Newman, 2021). Many would argue that this effort was far too late, considering that the attack could have been prevented or resolved more quickly if the government had acted more proactively. The article also elaborates on the White House\u2019s response to the attack. Statements were given discussing intense investigation and calls on foreign governments, specifically Russia, to stop harboring cybercriminals (Newman, 2021). Perhaps, if the government had taken a proactive and preventative approach, this attack could have been averted altogether. Even in the present day, it seems that governments worldwide are failing to generate genuine urgency to combat the ever-changing cybersecurity landscape.<\/p>\n\n\n\n
Governments are not the only entities attempting to combat cyberthreats. Private sector companies are also developing techniques to provide robust defenses against cybercriminals. However, in the case of the Colonial Pipeline attack, one company was too overzealous with their defenses. On January 11, 2021, the antivirus company Bitdefender announced a breakthrough discovery of a flaw in DarkSide\u2019s ransomware attack (Dudley, 2021). They offered the ability to download a free tool designed to utilize this flaw to neutralize DarkSide attacks. This announcement and release of the countermeasure alerted DarkSide to their weakness.<\/p>\n\n\n\n
This gave the criminal enterprise the ability to repair the flaw in their attack and make it even more formidable. Specifically, the discovery involved DarkSide reusing the same keys to lock and unlock their victims\u2019 encrypted data. DarkSide even went so far as to publicly thank Bitdefender for alerting them to this design flaw (Dudley, 2021). To make matters worse, two other researchers, Fabian Wosar and Michael Gillespie, had discovered the attack\u2019s flaw prior to Bitdefender making the discovery. These two researchers had been discreetly providing help to DarkSide victims to avoid alerting the attackers. If Bitdefender had followed the same thought process, the Colonial Pipeline attack could have been stopped immediately and severe damage avoided.<\/p>\n\n\n\n
As a result of the attack, there were many negatively affected parties. Colonial Pipeline was forced to pay $4.4 million in Bitcoin to unlock its files. The shutdown of the pipeline also led to a rapid increase in gasoline prices, panic buying of gasoline by consumers, and the closing of thousands of gas stations (Dudley, 2021). Dudley and Golden\u2019s article discusses the likelihood that even discreet distribution of ransomware countermeasures will ultimately end up alerting the attackers. This is because payments from victims will diminish over time, leading to a reevaluation by the attackers of their programming and the recognition and resolution of flaws. It cannot be stated conclusively how much longer DarkSide\u2019s attack flaw would have remained a secret to them. However, the timing does seem to indicate that Colonial\u2019s shutdown could have been avoided with discretion on Bitdefender\u2019s behalf.<\/p>\n\n\n\n
The way this attack was carried out was well thought out. The attackers were able to acquire an exposed VPN password from a Colonial Pipeline employee. The investigation revealed the likelihood that the user had used the same password for a different location that was compromised as part of a separate data breach. This is a key detail because many organizations have a policy of not reusing previous passwords. While it is possible to create password rules preventing this, it is nearly impossible to avoid reuse from a separate system. The success of this initial system penetration provides a textbook illustration of why password reuse is so dangerous. Once inside the system, DarkSide was able to steal 100 gigabytes of data within a two-hour window. Following the theft, DarkSide then infected Colonial Pipeline\u2019s system with ransomware. This causes the encryption of many system and company files. This included billing and accounting (Kerner, 2022). As the encryption began to spread, Colonial was forced to shut down the pipeline to prevent it from spreading any further. This led to payment by Colonial for the encryption key, bringing a swift end to the crisis.<\/p>\n\n\n\n
This attack also created a shortage of jet fuel. Because of rising fears over gas shortages, communities rushed to gas pumps as quickly as they could. They formed long lines and overpurchased beyond their typical needs. This surplus buying led to the feared shortage and accelerated its arrival. One of the most dangerous activities was to put gasoline in plastic bags (Kerner, 2022). An easily spilled container filled with highly flammable liquid was a recipe for disaster. There was some optimism in the aftermath of the attack.<\/p>\n\n\n\n
The Department of Justice was able to find the digital address for the wallet used by the attackers. They were then able to get a court order to seize the bitcoin. They were able to recover sixty-four out of seventy-five bitcoins. This was the majority of the ransom, but still a large loss (Kerner, 2022). It was clear that this attack, which only lasted eight days, had caused massive damage that far exceeded the recovered sixty-four bitcoins. This attack made it clear that the United States was not ready to resolve major cyberattacks with any speed or decisiveness. These facts made it clear that the U.S. would have to upgrade its cyber-readiness significantly. In May 2021, the Biden Administration issued an executive order to direct government agencies to bolster their defenses as quickly as possible.<\/p>\n\n\n\n
The Colonial Pipeline is a cautionary tale on several fronts. It starts with one of the simplest security measures: avoid password reuse. Then, it demonstrates the speed with which these attacks can take place. The data stolen acted as ransom insurance, as the system data in place was encrypted. The stolen data could be used as leverage if leaked publicly, while the encryption required the decryption key to be removed. If one vector was fixed, they still could ask for ransom, knowing solutions to both issues were unlikely. It demonstrated an almost na\u00efve faith in a criminal organization to keep its word. The CEO of Colonial believed the decryption key would be returned if he complied quickly. While DarkSide proved him right in this instance, it was also likely that an attacker wouldn\u2019t provide the key regardless of whether the ransom was met or not. Finally, it demonstrated how a single resource can quickly cripple large sections of the United States. This is an essential issue to recognize the gravity of. DarkSide\u2019s attack did so much to demonstrate how effective severing a commercial artery can be at destabilizing a region. While it spurred action in the government to vastly improve cybersecurity, there is a lingering sentiment that we are still behind the curve. That is because cyberthreats grow more complex with every passing day, and the US was too slow to react in the beginning. This has put them squarely behind the curve, barring a massive surge in threat mitigation.<\/p>\n\n\n\n
Companies and government agencies have a responsibility to place high priority and investment into more robust cybersecurity systems. It is a common sight to find headlines about yet another data breach in a major company. These companies are trusted with sensitive data of all kinds. Careless mistakes can lead to crippled critical systems and resources. Only through diligence and a tolerance for inconvenience can this cyberthreat begin to be adequately defended against. The more secure a system is, the more tedious it is to navigate. So, cybersecurity experts are tasked with finding the balance between security and convenience. This can lead to gray areas in security that may be too easily exploited. Hence, cyberspace is in a constant tug of war between malicious and defensive forces attempting to attack and defend the world\u2019s most valuable asset, information.
<\/p>\n\n\n\n
References:<\/p>\n\n\n\n
I will be using MLA9 citation format and parenthetical citation for my references.<\/em><\/p>\n\n\n\n Dudley, Renee, and Daniel Golden. \u201cThe Colonial Pipeline Ransomware Hackers Had a Secret Weapon: Self-Promoting Cybersecurity Firms.\u201d Nextgov.Com<\/em>, ProPublica, 10 July 2023, www.nextgov.com\/cybersecurity\/2021\/05\/colonial-pipeline-ransomware-hackers-had-secret-weapon-self-promoting-cybersecurity-firms\/174253\/<\/a>.<\/p>\n\n\n\n Easterly, Jen. \u201cThe Attack on Colonial Pipeline: What We\u2019ve Learned & What We\u2019ve Done over the Past Two Years.\u201d Cybersecurity and Infrastructure Security Agency<\/em>, 23 Aug. 2024, www.cisa.gov\/news-events\/news\/attack-colonial-pipeline-what-weve-learned-what-weve-done-over-past-two-years<\/a>.<\/p>\n\n\n\n Kerner, Sean Michael. \u201cColonial Pipeline Hack Explained: Everything You Need to Know.\u201d TechTarget<\/em>, 26 Apr. 2022, www.techtarget.com\/whatis\/feature\/Colonial-Pipeline-hack-explained-Everything-you-need-to-know<\/a>. <\/p>\n\n\n\n Newman, Lily Hay. \u201cDarkside Ransomware Hit Colonial Pipeline and Created an Unholy Mess.\u201d Wired<\/em>, 11 May 2021, www.wired.com\/story\/darkside-ransomware-colonial-pipeline-response\/<\/a>.<\/p>\n\n\n\n Ethernet Network Design Project<\/strong><\/p>\n\n\n\n This project required me to research the necessary equipment to establish a Local Area Network for a multi-story school. Each section lists the necessary equipment with hyperlinks guiding you to the products I identified as being suitable for the parameters of the assignment. <\/p>\n\n\n\n Disclaimer: Prices as of Spring 2025. Prices may have changed when viewing this page at a later time. <\/p>\n\n\n\n For this project, I would need:<\/p>\n\n\n\n 1 Router\/Firewall to establish an ISP connection and provide network security. <\/p>\n\n\n\n Cost: $400<\/p>\n\n\n\n 4 total managed switches, 1 for each telecommunications closet and the equipment room. These switches have 48 ports each, which will provide more than enough coverage for the number of rooms on each floor.<\/p>\n\n\n\n Cost: $400 per switch for a total of $1600.<\/p>\n\n\n\n 8 patch panels with 24 ports each (2 per floor): These panels will be used to establish connections from the switches in the equipment room and the telecommunications closets to each room on each floor.<\/p>\n\n\n\n Cost: $40 per patch panel for a total of $320<\/p>\n\n\n\n Punch down tool for cabling:<\/p>\n\n\n\n Cost: $10<\/p>\n\n\n\n RJ45 Connectors (100 pack) x3: I would order a surplus of connectors to ensure I have enough for now and future needs.<\/p>\n\n\n\n Cost: $14 per 100 for a total of $42.<\/p>\n\n\n\n Cable crimper:<\/p>\n\n\n\n Cost: $50<\/p>\n\n\n\n Wire loom: 90 spools 50ft long each.<\/p>\n\n\n\n Cost: $24 per 50ft for a total of $2160.<\/p>\n\n\n\n 15 ft Cat 6 Patch cables for individual room connections, 2 packs of 50 cables.<\/p>\n\n\n\n Cost: $133 for a pack of 50 for a total of $266.<\/p>\n\n\n\n Approximately 10km or 33,000 ft of Cat6 cable. I calculated this by subtracting the furthest connection of 98.17 m from the shortest connection of 11.32 m and taking the average distance between each room on each floor, with adjustments for the number of rooms per floor, and adding all of the distances together then doubling that to account for two cables per room. I also added a 10% buffer, allowing for cabling going between the equipment room and the telecoms closets and other potential cabling needs. This cable is rated for plenum space, such as ceilings.<\/p>\n\n\n\n Cost: $110 per 1000 ft of cable for a total of $3700 for Cat 6 cabling.<\/p>\n\n\n\n Wall plates for Cat 6 Ethernet connections: 74 plates, one for each room.<\/p>\n\n\n\n Cost: $8 per plate for a total of $592.<\/p>\n\n\n\n Equipment Rack Enclosures: One for each closet and the equipment room. The one I have selected allows for room to grow with the needs of the school.<\/p>\n\n\n\n Cost: $150 per rack for a total of $600.<\/p>\n\n\n\n 1 Server to manage the network and establish different server needs for the school, including mail, DHCP, DNS, etc. This will also be used to manage the Software Defined Networking aspects of the router and managed switches by the system administrator.<\/p>\n\n\n\n Cost: $2800<\/p>\n\n\n\n Based on the equipment I have identified as necessary for this project, I have established a cost of approximately $12,500.<\/p>\n\n\n\n <\/p>\n\n\n\n The assignment below demonstrates my understanding of Subnetting when establishing and managing an IT network. <\/p>\n\n\n\n Networking Basics – Subnetting<\/strong><\/p>\n\n\n\n Fill in the following tables for Network, broadcast, first IP, last IP, and maximum hosts in the<\/p>\n\n\n\n network.<\/p>\n\n\n\n The column for IP address should be in Decimal format for each, except number of hosts.<\/p>\n\n\n\n Working in Linux<\/strong><\/p>\n\n\n\n Task A: Practice with the Basic Linux Commands<\/p>\n\n\n\n Step 1:<\/p>\n\n\n\n Above is the network configuration of the Kali Linux Cyber Range VM. I used the command \u201cifconfig\u201d to check this configuration and it returned an IP address of \u201c10.1.172.184\u201d.<\/p>\n\n\n\nCategory<\/td> IP Address<\/td> Binary Format<\/td><\/tr> Address<\/td> 192.168.100.4<\/td> 11000000.10101000.01100100.00000100<\/td><\/tr> Netmask<\/td> 28<\/td> 11111111.11111111.11111111.11110000<\/td><\/tr> Network Address<\/td> 192.168.100.0<\/td> 11000000.10101000.01100100.00000000<\/td><\/tr> Broadcast Address<\/td> 192.168.100.255<\/td> 11000000.10101000.01100100.11111111<\/td><\/tr> First IP<\/td> 192.168.100.1<\/td> 11000000.10101000.01100100.00000001<\/td><\/tr> Last IP<\/td> 192.168.100.14<\/td> 11000000.10101000.01100100.00001110<\/td><\/tr> Maximum Host in the Network<\/td> 14<\/td> <\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Category<\/td> IP Address<\/td> Binary Format<\/td><\/tr> Address<\/td> 170.1.0.0<\/td> 10101010.00000001.00000000.00000000<\/td><\/tr> Netmask<\/td> 26<\/td> 11111111.11111111.11111111.11000000<\/td><\/tr> Network Address<\/td> 170.1.0.0<\/td> 10101010.00000001.00000000.00000000<\/td><\/tr> Broadcast Address<\/td> 170.1.0.127<\/td> 10101010.00000001.00000000.01111111<\/td><\/tr> First IP<\/td> 170.1.0.1<\/td> 10101010.00000001.00000000.00000001<\/td><\/tr> Last IP<\/td> 170.1.0.126<\/td> 10101010.00000001.00000000.01111110<\/td><\/tr> Maximum Host in the Network<\/td> 62<\/td> <\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n ![\"\"](\"https:\/\/sites.wp.odu.edu\/zweav004\/wp-content\/uploads\/sites\/35270\/2025\/08\/image.png\")
<\/a><\/figure>\n\n\n\n
![\"\"](\"https:\/\/sites.wp.odu.edu\/zweav004\/wp-content\/uploads\/sites\/35270\/2025\/08\/image-1.png\")
<\/a><\/figure>\n\n\n\n![\"\"](\"https:\/\/sites.wp.odu.edu\/zweav004\/wp-content\/uploads\/sites\/35270\/2025\/08\/image-2.png\")
<\/a><\/figure>\n\n\n\n