2nd Largest Liquefied Natural Gas Producer Knocked Offline In Malware Attack

chicksdaddy writes "Securityledger reports that, days after Saudi Aramco said it had cleansed its network of a malware infection, Qatari firm RasGas, the world's second largest producer of liquefied natural gas, has been knocked offline in a similar attack. RasGas's corporate web site was offline late Thursday and a RasGas spokesman, speaking to the website arabianoilandgas.com acknowledged that 'an unknown virus has affected' the company's office systems since Monday, August 27. The company has notified its suppliers by fax that the company is 'experiencing technical issues with its office computer systems,' ArabianOilandGas.com reported. However, a company spokesperson said that the company's LNG production and distribution operations were unaffected."

Comments

Here's an idea

[Anonymous Coward]

Don't plug the those things into the Internet. Don't run a system where silly things like "install on insertion" are enabled. When the software needs updating, have a tech drive over there and stick an update CD in a drive. That oughta cover it. (Remember, I said no autorun).

Re:Here's an idea

[Anonymous Coward]

Hmm if only had this idea. Oh wait they did. The company's website and office computers were affected. boo hoo, the gas trains keep on humming along as if nothing happened.

Re:Here's an idea

[Anonymous Coward]

Maybe, but most importantly, what OS did this malware run on?

Re:Here's an idea

[TheGoodNamesWereGone]

No, it isn't of paramount importance. I say this as a Linux user. If this is indeed cyberwarfare by another government then the belligerent will have the resources to create a bug targeting any platform. Yes, *nix security is far more robust, but the weakest link is and always will be the user. PEBKAC.

Leveling the field

[gmuslera]

Once cyberattacks got "legalized" by governments using Stuxnet, it became ok to launch them if you feel that you have a reason. And you don't need millons of dollars and an army to launch cyberattacks, even by competing firms, hacker groups (including the "for hire" ones) and individuals could do so.

Re:Leveling the field

[fustakrakich]

Yep, just like torture, if you approve, then you approve it for everybody.

But what this will lead to is that powerful computers will be tagged and require a license to operate, like in Burma. The rest of us will use iPods and Kindles, like it or not.

Re:Leveling the field

[Shoten]

Yeah...because there were *never* cyberattacks or worms before Stuxnet. Damn you, Obama, for giving rise to hacking and malware!

Re:Leveling the field

[cpu6502]

I think he meant *U.S. sanctioned attacks*. When Egypt was rounding-up and tossing people in jail w/o trial, they pointed to the U.S. and said, "The Americans do it, so it must be okay." Now other powers like Iran, Israel, Turkey, etc are saying the same thing about cyberattacks: "The Americans did it so it must be okay."

America sets the example of how a human rights-protecting Republic should act, and lately we've been setting a very bad example by Not respecting basic individual rights.

Re:Leveling the field

[Mashiki]

I'm pretty sure that China and Russia along with countries like Venezuela have done a very fine job of setting an example of not respecting individual basic rights.

Re:Leveling the field

[cpu6502]

But they aren't America. People don't expect China or Russia to be "good guys" or protective of basic rights. America has fulfilled that role for the las 200 years, so if we do something like shoot guns at a crowd, other think it must be okay. "The world's symbol of democracy is doing it, so we can do it too."

Re:Leveling the field

[girlintraining]

America sets the example of how a human rights-violating Republic should act, and lately we've been setting a very bad example by Not respecting basic individual rights.

FTFY

Re:Leveling the field

[flyingsquid]

Now other powers like Iran, Israel, Turkey, etc are saying the same thing about cyberattacks: "The Americans did it so it must be okay."

That's not even remotely close to being true- countries have been launching cyberattacks a long time before Stuxnet was discovered. Russia launched cyberattacks against Estonia in 2007 and then against Georgia in 2008 during the war over South Ossetia. North Korea allegedly launched a massive attack on U.S. government sites in 2009. In 2007, the Israelis used a cyberattack to disable Syria's air defenses so they could bomb the Syrian nuclear program. And China's supposedly been planting logic bombs and backdoors that would, in the event of a war, allow them to take down U.S. infrastructure. Cyberwarfare was happening long before Stuxnet became known in 2010.

Re:Leveling the field

[flyingsquid]

We should demand that the U.S. behave in an ethical fashion, but I'm not sure what is supposed to be unethical about Stuxnet or Flame. The Iranians have secretly launched a program that will allow them to enrich uranium to weapons grade. Since Iran is swimming in oil and natural gas, this is a pretty clear signal that the regime wants to build a nuclear bomb, or at the very least, they want that option on the table. Rather than bomb the facility, and putting American pilots and Iranian civilians at risk, the U.S. and the Israelis blew up their centrifuges with a virus. That's a hell of a lot more humane than dropping bunker-busters from a B-2. As for Flame, it spies on people... and yeah, espionage is sort of a dirty business, but it's always been that way, long before the internet. I don't see how spying digitally makes it any more unethical than planting a bug in their office. There are weapons that are by their nature unethical- nuclear, chemical, and biological weapons, which are indiscriminant and cause a lot of suffering. But cyberwarfare isn't like that, it's capable of being extremely targeted and can neutralize a target without any loss of life or suffering.

Richard Clarke writes about this in his book Cyber War, and it's actually a pretty insightful take on the situation. His argument is that there's no point in some kind of blanket treaty against cyberwarfare. But, he argues, it makes sense to have policy and treaties that prohibit certain kinds of cyberwarfare. He argued that the banking system should be off limits. Civilian targets should be off limits. Attacking power grids and other infrastructure should be off limits, unless you'd already entered into a shooting war. So far, the U.S. appears to have restrained from these sort of attacks. You can't really say the same thing about certain other countries. North Korea has been involved in attacks against banks; Russia has attacked civilian sites, and China has supposedly spent years planting logic bombs that would allow them to turn off the lights in the U.S.

I think this view makes a lot of sense. Talking about banning cyberwarfare is sort of like looking at the Wright Brother's plane and saying that we should ban the use in aircraft in war because civilians might be targeted. First off, it's a legitimate tool of war. Second of all, it's gives you a tremendous military advantage, so it's going to happen, the only question is how. As a good rule of thumb, I think you could argue that if you'd be justified in dropping a bomb on a target, you're certainly justified in taking it out with a piece of code. Likewise, if it's not okay to bomb it, it's not okay to take it out with a logic bomb.

Re:Leveling the field

[cusco]

The Iranians have secretly launched a program that will allow them to enrich uranium to weapons grade.

So far the only 'evidence' of that is unverifiable stories from paid informants and some blatantly forged documents. Every competent investigation has come up empty, including those whose stated goal from the beginning was to find a nuclear weapons program.

Iran has three large energy deposits, oil, gas and uranium, and only one of them is entirely unexploited at this time. With the worldwide boom in nuclear power plant construction Iran would be foolish to ignore that huge market for fuel. I think that Stuxnet was aimed at delaying Iran's entry into the fuel market more than anything else.

Re:Leveling the field

[symbolset]

Exxon and BP are nations unto themselves in this regard. Worse, even, as they're accountable to nobody.

Re:Leveling the field

[MobileTatsu-NJG]

So... you're saying that before Stuxnet Iran wouldn't perform a cyber-attack?

Re:Leveling the field

[skids]

It doesn't take a powerful computer to make and distribute a virus. That would be pointless. Any such crippling would probably be more effectively done by restricting protocol usage (e.g. number of connections per second, etc.) given that the biggest threat consumer devices pose to industry is in their DDoS and botnet potential.

Just be glad the thieves over on Wall Street don't seem to have figured out how to make enough money of prior knowlege of a corporate security incident to justify the assumed risk in comitting IT sabotage. Once that crime^H^H^H^H^Hbusiness model rears its head things are going to get a bit ugly.

Re:Leveling the field

[poity]

"America sets the example"? I can bet if we were talking about some positive aspect, you wouldn't use such egotistical US-centric rhetoric. The fact is those countries you listed would have done what they did no matter what, and used whatever excuse was convenient to them.

Re:Leveling the field

[poity]

What makes you think people don't expect China or Russia to be "good guys" or that people expect the US to be "good guys"? Chinese, Russian, and American politicians all claim their country to be beacons of some sort, leaders in progress, yet you only hold one of them to that claim.

Re:Leveling the field

[poity]

Don't forget, once slavery got "legalized" by tribes in Africa, it became ok to trade slaves across the Atlantic. Oops, that reasoning doesn't work.

Re:Leveling the field

[DarkOx]

Yes they would have however it could have made them pariahs on the world stage. Now if we ever condim such an attack or take umbridge It's gonna ring a bit hollow, the first reachion is going to be "well you are not exactly above that sorta thing either". It's not how you build coalitions and reliable partners

Re:Leveling the field

[DarkOx]

Not sure what history you read but yea people pretty much decided it was okay after that for the better part of century. They even defended that position with their lives.

Re:Leveling the field

[houghi]

America has fulfilled that role for the las 200 years, so if we do something like shoot guns at a crowd, other think it must be okay.

Uh, sorry? You might believe that you are the bestest country. You might shout it every day and wave the flag all you want, but it isn't 200 years.
If anything, perhaps from the 60-ies till the 90-ies. That is about one generation.
And I am being generous.

I have never expected the USofA to be the good guys. Not anymore then I expect that from China or Russia or any country. If it happens it is great. If not, it is business as usual.

Some periods countries are the bad guys. Sometimes they are the good guys.

And you are NOT the worlds symbol of democracy. You are the laughing stock with your two-party system and the power to the companies.

Re:Leveling the field

[Anonymous Coward]

*sigh*... this again?

The Iranians have secretly launched a program that will allow them to enrich uranium to weapons grade.

Really. I thought that they've publicly launched a program that will allow them to enrich uranium, as they are legally entitled to as a signatory of the NPT. At least that's what the IAEA says, and they're the ones that have been regularly monitoring the program. I suppose it is possible that you have some inside source that knows otherwise, whose cover you're willing to blow by posting this on slashdot, but I find that unlikely.

Since Iran is swimming in oil and natural gas,

Iran has very limited oil refining infrastructure. They actually [net] import gasoline and other refined petroleum products. I'm not sure how their natural gas infrastructure looks, however it is quite feasible that they're doing exactly what they claim: seeking energy independence. Also, oil and gas aren't exactly great long-term bets as far as energy sources go. Also

this is a pretty clear signal that the regime wants to build a nuclear bomb, or at the very least, they want that option on the table.

While this couldn't be much further from the truth, let's for the sake of argument assume that it's a spot-on assessment. Why is this a problem? They're surrounded by nuclear-armed states, at least one of which is openly hostile and regularly threatening a war of aggression (and has a history of waging such wars). History shows that MAD works rather well, but only if both sides have nukes. Finally, assuming you're from the USA, it's quite a bit of hypocrisy to complain that you believe other states seek nuclear weapons, as we ourselves are the only ones to have ever actually deployed nuclear weapons in war. On a civilian population, on urban centers, nonetheless.

Attacking power grids and other infrastructure should be off limits, unless you'd already entered into a shooting war.

Well, then it's a good thing that Stuxnet didn't target the infrastructure that will fuel Iran's nuclear power industry. Oh, wait...

So far, the U.S. appears to have restrained from these sort of attacks.

Indeed, I don't think it's even remotely possible that the USA had anything to do with Stuxnet, or Flame, or any other seemingly state-sponsored cyberattacks. It was probably Benin that was behind it all.

Likewise, if it's not okay to bomb it, it's not okay to take it out with a logic bomb.

Some might argue that it's not okay to drop bombs on people. According to your own logic, it would make sense that people that think this way will similarly look at cyberattacks with disdain. The import point here, which you don't seem to address at all, is that dropping bombs on people is an act of war, with real diplomatic consequences. Cyberattacks, with plausible deniability, lower the barrier for committing such acts.

For a proud nation that spends so much on its critically acclaimed and globally unrivaled military, we sure do seem comfortable with being little weasels, hiding behind computers, and rationalizing away our lack of basic morality.

Re:Leveling the field

[Anonymous Coward]

condemn
umbrage
reaction

Re:Leveling the field

[couchslug]

" America has fulfilled that role for the last 200 years, so if we do something like shoot guns at a crowd, other think it must be okay."

Pointing to an example doesn't equate to actually giving a fuck about that example. Symbols are invoked as window dressing, that is all.

The world is NOT made up of simple "natives" who look up, wide-eyed, to what the White Colonial does then attempt to ape his ways.

Re:Leveling the field

[poity]

What I meant was that slavery by Africans had no effect on the general progression of slavery in the world, because institutionalized slavery is ancient and it had tremendous inertia. The US was going to be a part of the Atlantic slave trade with or without African slave lords, in the same way that cyberattacks were going to happen with or without Stuxnet

Re:Leveling the field

[cpu6502]

>>>The Iranians have secretly launched a program that will allow them to enrich uranium to weapons grade

False claim made w/o ANY evidence to support it. At least when Idiot Bush attacked Iraq for having WMDs, he had some evidence (photos) to back him up. The current president has nothing and yet he's attacking anyway. That would be like if I said, "I don't know if you have a meth factory in your basement, and have zero evidence to back it up, but I'm going to start attacking your PCs with viruses anyway. I automatically presume guilt w/ no evidence."

Office Computers Infected, Film At 11

[Anonymous Coward]

The fact that it's specifically an 'Oil Production' company doesn't seem relevant here, unless I'm missing something.

Re:Office Computers Infected, Film At 11

[Anonymous Coward]

In this day and age, anything that affects energy producers is considered news. Have you seen the gas stations raising prices before Isaac even came onshore from the Gulf of Mexico?

Re:Office Computers Infected, Film At 11

[couchslug]

But, OIL! Shit! Fuck! (runs in circles screaming in terror).

Imagine the fapulent esplody pyroconsequences!

And yes, I've heard of this:

http://en.wikipedia.org/wiki/Siberian_pipeline_sabotage

Sensationalism at its finest

[Cinder6]

So, office computers got infected with viruses, and the headline makes it sound like their entire production was shut down. Yawn.

Re:Sensationalism at its finest

[TWX]

If the digital equivalent of ripping a poster off of the wall also took down their office computers, then there's no reason to expect that their production network isn't also integrated poorly.

I always subscribe to the public/DMZ/private method of network design. The three only meet through the routers, and from the private side, the DMZ is just as untrusted as the public side. In this company's case, apparently either the office computers are able to more directly reach the DMZ segment than they should be, or else they're just one segment.

Re:Sensationalism at its finest

[timeOday]

The blurb first says it's their website, but then says it's their office computers, which is more serious. Then it says they're notifying their suppliers of this by fax, which sounds bad. Not "wells are exploding" bad, but if email is down, things like payroll or maintenance records might also be down, and indirectly affect production.

Re:Sensationalism at its finest

[Anonymous Coward]

Not necessarily intended to be sensationalist. "Offline" means different things in different contexts, but often people (even we humble nerds) get stuck in whatever context they're used to using. It might not have occurred to submitter or the editor at all.

Re:Sensationalism at its finest

[tqk]

The blurb first says it's their website, but then says it's their office computers, which is more serious.

Really?!? Some office drones (finance, lawyers, secretaries, perhaps geologists & geophysicists) have stuffed up Win* boxes. Big deal.

Then it says they're notifying their suppliers of this by fax, which sounds bad. Not "wells are exploding" bad, but if email is down, things like payroll or maintenance records might also be down, and indirectly affect production.

You mean petroleum production companies put critical production and maintenance data in MS-SQL or Oracle or MySQL running on Windows servers which can be taken down by malware?

Boo. Hoo. I've worked most of my life with O&G prospecting and production companies. They are *stupid* rich and *stupid* cheap. If this happened to any of them, they asked for it. It's not like they can't afford the best of the best.

I told Strickland propane not to use MySpace

[Joe_Dragon]

I told Strickland propane not to use MySpace and now I need to call dale's dead bug they do pc work now as well.

Who benefits...

[mill3d]

from doing all these electronic raids over the Middle-East?

Some think the rising tension these 'accidents' are causing will build up to a nasty conflict between US/Russia/China...

http://www.youtube.com/watch?v=beonoKiVYzY

How about setting up some solar panels instead?

Re:Who benefits...

[Anonymous Coward]

If you look at the recent news, you could probably see that there is already a proxy war being waged in the middle east. Whilst I'm sure people actually did rebel in Syria, it's not actually helped by a lot of foreign fighters and weapons flowing in (and probably seing from the news being pushed in for months if not years). It's actually quite worrying as it seems to be turning into some sort of religious war as well, and everyone else seems to be pretending no external forces are intervening. Can't really explain who is behind these and their motivations but I suspect most of the big middle eastern countries have their fingers in the pie.

I'm looking at you...

[Lord_of_the_nerf]

....1st Largest Liquefied Natural Gas Producer, Qatargas!

"Quatari" [sic]????

[mattack2]

Argh.

Re:I ate at Chipotle's and I am producing natural

[pspahn]

If it is also liquefied, then you may wish to consult a specialist.

Blackboard time.

[girlintraining]

I will not connect industrial control systems to the internet.
I will not connect industrial control systems to the internet.
I will not connect industrial control systems to the internet.
...

Okay. Good. Now, onto the next set... I will not allow anyone to connect outside storage devices to any networked system.
I will not allow anyone to connect outside storage devices to any networked system.
I will not allow anyone to connect outside storage devices to any networked system.
...

Sigh. How effing hard is it to understand the concept of an "air gap"? Air -- something that doesn't conduct electricity or data. Gap -- a space between two other things. Jeez.

Re:Blackboard time.

[cbiltcliffe]

Waaaaah!
  But that's not convenient...
Waaaah!!

Re:Blackboard time.

[Anonymous Coward]

It's not just slightly inconvenient you know.... I run an aquaculture facility with computers I can access remotely. Being able to see why an alarm is going off and maybe mitigate things without driving ten miles at three in the morning is a godsend. I can only assume companies with a few hundred miles of pipe would feel even more strongly about this. I would have hoped that anything that valuable would have been more thoroughly secured though. Besides that, what good is an air gap if stuxnet was able to get to an isolated computer anyway? (supposedly)

Re:Blackboard time.

[ColdWetDog]

Sigh. How effing hard is it to understand the concept of an "air gap"? Air -- something that doesn't conduct electricity or data. Gap -- a space between two other things. Jeez.

I'm not so sure about electricity (Do NOT try this at home, kids) but I am reasonably sure that the vast majority of 'air gaps' that I come in contact with (the ones between people's ears) don't conduct data well.

Which seems to be the crux of the problem.

Re:Blackboard time.

[currently_awake]

If you don't want usb drives plugged into your office computers then block them. Or have an alarm go off and the network shuts down or something. Telling people not to use usb drives from home is like telling people not to speed.

Re:Blackboard time.

[symbolset]

Like Stuxnet, these computers will be found to be Windows computers. But the reports almost always leave that out for some reason.

Re:Blackboard time.

[tqk]

I will not connect industrial control systems to the internet.

Actually (though I did not RTFA), it appears they got that bit right. Production was unaffected, though their website, office, and backroom (email & db) systems were compromised. Somebody there's cognizant of the concept of air gap, methinks.

Re:Blackboard time.

[Anonymous Coward]

Wifi seems to transfer data pretty well over air gaps.

Re:Blackboard time.

[Anonymous Coward]

Evidentially much easier to understand than the concept of reading RTFS. The Summary man. No need to even click off Slashdot to realise that their control systems were unaffected.

Give it a few months and we'll all be shouting Read The Fucking Headline.

Re:Blackboard time.

[sjames]

Then connect the industrial control systems to a system that presents a limited API to an intranet that you can get to by VPN. Make sure that chokepoint machine requires strong authentication and that nobody gets to load external storage devices on it for any reason.

Most SCADA equipment seems to be designed assuming that everything on the network is trustworthy no matter what marketing might claim.

Know that this solution is a compromise and that you are increasing the odds that you'll find the tanks high and dry one day.

Re:Blackboard time.

[omglolbah]

Easy to understand, not easy to convince management that they do not need live production stats from sites all around the world on their office computers.

Sometimes the specification of what the system "MUST DO" rules out air gaps... It is stupid, but if the customer signs off on the security implications fuck it... Their problem, not mine.

Re:Blackboard time.

[majid_aldo]

Read the article. the attack was restricted to office computers.

*facepalm*

[Kabuthunk]

Enough with the oversensationalized titles.

No. No, Rasgas was not knocked offline. Rasgas's WEBSITE was knocked offline. Their facilities or production were not affected even slightly.

Who the fuck even goes to corporate webpages anyway?!?

Re:*facepalm*

[tqk]

Who the fuck even goes to corporate webpages anyway?!?

Investors, regulators, competitors, and job hunters.

Re:*facepalm*

[1s44c]

Who the fuck even goes to corporate webpages anyway?!?

Investors, regulators, competitors, and job hunters.

And crackers apprently.

A better question is who the fuck runs internet facing webservers on production networks? You crack my webservers you get the webservers, that's it. you don't get keys to the entire company.

Re:I ate at Chipotle's and I am producing natural

[reboot246]

Maybe he's producing something liquefied and needs some Imodium A-D.

i will say this ONLY once

[Anonymous Coward]

these attacks are done by govts NOT hacker groups any more mention in articles blaiming us we will begin to target bad news posters
the fucking leader of the largest hacker group on earth.
CHRoNo
p.s. smarten the fuck up you wankers

Re:reply

[tqk]

http://www.sandmaker.biz
http://www.shunkycrusher.com/
http://www.jaw-breaker.org/
http://www.jawcrusher.hk/
http://www.c-crusher.net/
http://www.sandmakingplant.net/
http://www.vibrating-screen.biz/
http://www.mcrushingstation.com/
http://www.cnstonecrusher.com/
http://www.cnimpactcrusher.com/
http://www.vibrating-screen.cn/
http://www.stoneproductionline.com/
http://www.hydraulicconecrusher.net/

Gee, a whole bunch of potential targets for Anonymous or LulzSec. Thanks! No, I'm not affiliated.

Screw that

[Anonymous Coward]

Don't give them CD drives. Or USB ports. Or wifi. Hardwire everything, remove holes, and lock everything the fuck down.

Do your fucking job, I shouldn't have to do it for you

Segregate the dam network!

[1s44c]

Split your internet network into seperate sub-networks and put firewalls in between. Stop being 'tards oil companies and let your IT people do the job you are paying them to do!

Re:Quatari?

[1s44c]

There is no letter U in Qatar.

http://en.wikipedia.org/wiki/Qatar

That's right. Most of slashdot are in the US.

Sorry. Could not resist.

Obligatory XKCD

[ryzvonusef]

http://xkcd.com/932/

Not to mention the damn network

[Anonymous Coward]

But if you have a network controlling a dam, then really segregate that too!

Said it before

[ThatsNotPudding]

I'll say it again; this and the Saudi attack aren't ideologically driven, unless you consider greed an ideology. Who did this? Follow the money and check the futures market.