www.farmonline.com.au
Open in
urlscan Pro
143.204.98.3
Public Scan
URL:
https://www.farmonline.com.au/story/7527343/cyber-attackers-told-jbs-dont-panic-were-in-business-not-war/?cs=5373
Submission: On November 26 via api from US — Scanned from DE
Submission: On November 26 via api from US — Scanned from DE
Form analysis 1 forms found in the DOM
<form class="gsc-search-box gsc-search-box-tools" accept-charset="utf-8">
<table cellspacing="0" cellpadding="0" class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<div class="gsc-input-box" id="gsc-iw-id1">
<table cellspacing="0" cellpadding="0" id="gs_id50" class="gstl_50 gsc-input" style="width: 100%; padding: 0px;">
<tbody>
<tr>
<td id="gs_tti50" class="gsib_a"><input autocomplete="off" type="text" size="10" class="gsc-input" name="search" title="search" id="gsc-i-id1" dir="ltr" spellcheck="false"
style="width: 100%; padding: 0px; border: none; margin: 0px; height: auto; background: url("https://www.google.com/cse/static/images/1x/en/branding.png") left center no-repeat rgb(255, 255, 255); outline: none;"></td>
<td class="gsib_b">
<div class="gsst_b" id="gs_st50" dir="ltr"><a class="gsst_a" href="javascript:void(0)" title="Clear search box" role="button" style="display: none;"><span class="gscb_a" id="gs_cb50" aria-hidden="true">×</span></a></div>
</td>
</tr>
</tbody>
</table>
</div>
</td>
<td class="gsc-search-button"><button class="gsc-search-button gsc-search-button-v2"><svg width="13" height="13" viewBox="0 0 13 13">
<title>search</title>
<path
d="m4.8495 7.8226c0.82666 0 1.5262-0.29146 2.0985-0.87438 0.57232-0.58292 0.86378-1.2877 0.87438-2.1144 0.010599-0.82666-0.28086-1.5262-0.87438-2.0985-0.59352-0.57232-1.293-0.86378-2.0985-0.87438-0.8055-0.010599-1.5103 0.28086-2.1144 0.87438-0.60414 0.59352-0.8956 1.293-0.87438 2.0985 0.021197 0.8055 0.31266 1.5103 0.87438 2.1144 0.56172 0.60414 1.2665 0.8956 2.1144 0.87438zm4.4695 0.2115 3.681 3.6819-1.259 1.284-3.6817-3.7 0.0019784-0.69479-0.090043-0.098846c-0.87973 0.76087-1.92 1.1413-3.1207 1.1413-1.3553 0-2.5025-0.46363-3.4417-1.3909s-1.4088-2.0686-1.4088-3.4239c0-1.3553 0.4696-2.4966 1.4088-3.4239 0.9392-0.92727 2.0864-1.3969 3.4417-1.4088 1.3553-0.011889 2.4906 0.45771 3.406 1.4088 0.9154 0.95107 1.379 2.0924 1.3909 3.4239 0 1.2126-0.38043 2.2588-1.1413 3.1385l0.098834 0.090049z">
</path>
</svg></button></td>
<td class="gsc-clear-button">
<div class="gsc-clear-button" title="clear results"> </div>
</td>
</tr>
</tbody>
</table>
</form>Text Content
It appears that you are currently using Ad Blocking software. Please consider
turning it off to support us.
* * Farm Online newsletter
* Dairy Farmer newsletter
* Rural Bookshop
* More
* Farm Online newsletter
* Dairy Farmer newsletter
* Rural Bookshop
* News
* News
* Agribusiness
* Politics
* Photos & Video
* Opinion
* Coronavirus
* More
* News
* Agribusiness
* Politics
* Photos & Video
* Opinion
* Coronavirus
* Beef
* Beef
* Studstock
* Sales
* Auctions Calendar
* More
* Beef
* Studstock
* Sales
* Auctions Calendar
* Dairy
* Australian Dairy Farmer News
* Herd Management
* Feed Management
* Business Management
* More
* Australian Dairy Farmer News
* Herd Management
* Feed Management
* Business Management
* Sheep
* Sheepmeat
* Wool
* Sales
* Studstock
* Auctions Calendar
* More
* Sheepmeat
* Wool
* Sales
* Studstock
* Auctions Calendar
* Cropping
* Grain
* Cotton
* Horticulture
* More
* Grain
* Cotton
* Horticulture
* Machinery
* More
* Property
* More
* Weather
* Forecasts
* Warnings
* Satellite
* Radar
* 6 Day Outlook
* More
* Forecasts
* Warnings
* Satellite
* Radar
* 6 Day Outlook
* Classifieds
* Place Ad
* AgTrader
* Rural Property
* Country Cars
* Livestock Connect
* Horse Deals
* Auctions Calendar
* More
* Place Ad
* AgTrader
* Rural Property
* Country Cars
* Livestock Connect
* Horse Deals
* Auctions Calendar
* Recommended
* Advertising Features
* Sponsored Content
* Special Publications
* Syngenta Growth Awards Live Stream
* Landcare
* More
* Advertising Features
* Sponsored Content
* Special Publications
* Syngenta Growth Awards Live Stream
* Landcare
* More
* Home
* News
* Beef
* Dairy
* Sheep
* Cropping
* Machinery
* Property
* Weather
* Classifieds
* Recommended
*
*
×
search
Web
Image
Sort by:
Relevance
Relevance
Date
* HOME
* Beef
* Studstock
* Sales
* Auctions Calendar
* More
* Beef
* Studstock
* Sales
* Auctions Calendar
*
*
* News
* Popular
* Report
* Sections
BEEF NEWLIVESTOCK AUCTIONS
Beef
1. Cyber attackers told JBS 'don't panic, we're in business not war'9 hours,
2 minutes ago
2. Genetics Australia looks to bright ...4 hours, 10 minutes ago
3. ADF board announces Gladigau as pre...9 hours, 10 minutes ago
4. Nutrition and agrifood experts elec...10 hours, 10 minutes ago
5. Fox hunt falls short of the million...11 hours, 10 minutes ago
6. Farmers join forces to negotiate be...12 hours, 10 minutes ago
7. NSW dairy farm profits hit 10-year ...13 hours, 10 minutes ago
8. Animal rights activist behind Aussi...14 hours, 10 minutes ago
9. Taking shape: Australia's largest g...15 hours, 40 minutes ago
10. New AWI director Georgia Hack to br...16 hours, 10 minutes ago
11. Dairy genomic testing doubles in year1 day, 4 hours ago
12. Promote and defend: Red meat's atta...1 day, 5 hours ago
13. Qld's $100 million farmland sale1 day, 7 hours ago
14. Dairy Australia appoints new board ...1 day, 8 hours ago
15. BOM flags a wet summer for the east1 day, 8 hours ago
16. Australia central to FMC plans1 day, 9 hours ago
17. RMAC vows to 'keep up the good fight'1 day, 11 hours ago
18. Crop downgrades set to be the worst...1 day, 11 hours ago
19. Shock govt probe into AWI's finance...1 day, 11 hours ago
20. A2 Milk faces second shareholder cl...1 day, 12 hours ago
CYBER ATTACKERS TOLD JBS 'DON'T PANIC, WE'RE IN BUSINESS NOT WAR'
Shan Goodwin@shangoodwinbeef26 Nov 2021, 1 p.m.
Beef
Share
Tweet
Aa
US investigation reveals how JBS cyber attack unfolded
Share
Tweet
Aa
FASCINATING insight into the cyber attack which shut down JBS meat processing
plants in the United States and Australia has been revealed at a special US
congress hearing into strategies for disrupting hackers.
The Biden administration launched an investigation into ransomware in June,
overseen by the House of Representatives Committee on Oversight and Reform, in
the wake of unprecedented cyber attacks this year.
The investigation focussed on three big attacks - that on JBS in May, the one
which occurred just weeks earlier on Colonial Pipeline Company and one in March
on CNA Financial Corporation, one of the largest insurance companies in the US.
A memo from the committee released at the hearing said the investigation found
these attacks often stemmed from minor security lapses, even at companies with
seemingly robust cyber security.
In the case of JBS, the attackers gained access to an old network administrator
account that had not been deactivated and was protected only by a weak password,
according to the memo.
The investigation also found companies faced substantial pressure to pay ransoms
quickly, and concluded that was making it harder to stop these attacks.
The committee's chairwoman Carolyn Maloney said a tipping point had now been
reached, as cyber attacks had become more common and potentially more damaging.
"Several recent attacks have used a type of malicious software known as
ransomware, which encrypts a victim's system and demands a payment in exchange
for restoring access or refraining from publishing stolen data," she said.
"This is especially dangerous because it can shut down an entire system and can
cause chaos in a community, an industry, or even the entire country. And cyber
criminals are now demanding, and receiving, more money than ever."
JBS plants across Australia were shut down for the best part of a week, while in
the US they were out of operation for a day. JBS paid the US$11 million ransom
in bitcoin to unlock their system.
CNA reportedly coughed up the largest known ransomware payment ever, a
staggering $40m and Colonial $4.4m. The US Department of Justice was able to
recover some of the Colonial payment.
The FBI have attributed the JBS attack to a Russian hacking group known as
REvil, or Sodinokibi.
Ms Maloney said given the uncertainty over how quickly systems could be restored
using backups, and whether any sensitive data was stolen, the companies appeared
to have strong incentives to pay the ransom quickly.
"This pressure was compounded by attackers' assurances that payment of the
ransom would resolve the situation and avoid negative publicity for the
company," she said.
"For instance, after the initial hack of JBS, REvil told the company: 'We can
unblock your data and keep everything secret. All we need is a ransom'."
The memo said JBS explained to the committee that in addition to the cost of
rebuilding its systems from backups, if it did not pay the ransom, it faced
other pressing concerns and potential costs, including obligations to customers
and employees, as well as the need to process meat carcasses in its facilities,
potentially totalling tens of millions of carcasses per day.
The memo also said despite launching cyber attacks on the companies, the
attackers attempted to cast themselves as business partners with, or even
consultants to, the companies.
"REvil told JBS not to panic, that it was 'in business, not in war' and offered
the company a host of supposed benefits along with the decryption tool," the
memo said.
"The REvil attackers even provided recommendations of exchanges where the
company could buy cryptocurrency, highlighting that one exchange had no need for
verification."
The memo said the companies made the decision to pay the ransom despite having
at least some system backups that were not affected by the attacks.
Indeed, JBS later revealed that at the time of payment, the vast majority of its
facilities were operational.
Colonial and CNA also had cyber insurance policies.
The memo revealed JBS had explained it paid the ransom to "mitigate any
unforeseen issues related to the attack and ensure no data was exfiltrated."
During the attacks, the cyber criminals also provided certain assurances that
they would follow through with promises to provide a decryption key and delete
their copies of the stolen data if a ransom was paid, the memo said.
They made the point it was in their interests to do as agreed.
In the case of JBS, the REvil attackers never delivered on their promise to
provide the company with proof that they had destroyed all copies of the data
they stole, the memo said.
ALSO IN BEEF: RMAC vows to keep up the good fight
Start the day with all the big news in agriculture! Sign up below to receive our
daily Farmonline newsletter.
Share
Tweet
Aa
FOLLOW US ON FACEBOOK
FROM THE FRONT PAGE
Sponsored by
GENETICS AUSTRALIA LOOKS TO BRIGHT FUTURE
Seasonal conditions across Australia were favorable leading to an improvement of
nearly $3 million on the previous financial year's sales.
Test
ADF BOARD ANNOUNCES GLADIGAU AS PRESIDENT
South Australian dairy farmer Rick Gladigau was elected the president of the
Australian Dairy Farmers board at its annual general meeting on Thursday.
Test
CYBER ATTACKERS TOLD JBS 'DON'T PANIC, WE'RE IN BUSINESS NOT WAR'
US investigation reveals how JBS cyber attack unfolded
Test
NUTRITION AND AGRIFOOD EXPERTS ELECTED TO MLA BOARD
New director elections at the 2021 MLA AGM
Test
FOX HUNT FALLS SHORT OF THE MILLION SCALP MARK
You can blame pandemic travel restrictions for Victoria falling short of one
million fox scalps collected in the only government reward scheme of its type in
Australia.
Test
FARMERS JOIN FORCES TO NEGOTIATE BETTER CARBON, BIODIVERSITY DEALS
Mutual looks to put farmers in the driving seat as carbon, bio markets emerge
Test
NSW DAIRY FARM PROFITS HIT 10-YEAR HIGH
NSW dairy farm profits hit a 10-year high in 2020/21, an industry project
released on Monday revealed.
Test
ANIMAL RIGHTS ACTIVIST BEHIND AUSSIE FARMS RUNS FOR SENATE
"We've got enough challenges out here without having to worry about activists
raids at night."
Test
MOST VIEWED
1. ARGENTINA FINALLY LIFTS CHINA BEEF EXPORT BAN
2. DON'T PANIC BUY HEIFER BULLS
3. RINGER, PILOT, DIPLOMAT . . . ALL IN A DAY'S WORK FOR BEETALOO HEAD STOCKMAN
4. NSW DAIRY FARM PROFITS HIT 10-YEAR HIGH
5. PLANT-BASED FOODS ARE ACTUALLY BAD FOR YOUR HEALTH, ANOTHER STUDY WARNS
1. CARBON COUNT REDUCING START-UP COSTS FOR SOIL CARBON PROJECTS
2. FIVE-STAR JERSEYS HIT THE MARK
3. SUPERMARKETS' ROLE IN ROSELLA COLLAPSE
4. VICTORIAN DAIRY FARM PROFIT LIFT
5. FONTERRA HITS HURDLE TO CAPITAL RESTRUCTURE PLANS
FARMONLINE NETWORK
Sponsored by
Search thousands of classified ads ONLINE
Search over 20,000 rural real estate listings online including farms, rural
property and acreage for sale.
Australia’s premier industry field day event, the 2015 Commonwealth Bank AgQuip.
Buy rural and agricultural books and DVDs online.
Connecting Livestock Buyers & Sellers: Your one-stop shop for livestock news,
reports and sale listings.
Australia's Horse Trading Magazine. Everything equine - Buy, Sell, Ride.
1. Contact Us
2. Advertising
3. Privacy Policy
4. Conditions of Use
5. Copyright © 2015. Fairfax Media.
1.