Attack on Transnet was an act of cyber war — expert

Hanno Labuschagne

Journalist
Staff member
Joined
Sep 2, 2019
Messages
2,578
Attack on Transnet was an act of cyber war — expert

The ransomware attack on Transnet's IT infrastructure that caused activity at South Africa's ports to slow to a crawl was an act of cyberwarfare, Rapport and its sister paper City Press reported.

The papers quoted Noëlle van der Waag-Cowling, cyber programme lead at the Security Institute for Governance & Leadership in Africa at Stellenbosch University, who said that ransomware gangs often acted on behalf of other states or third parties.

Van der Waag-Cowling said that the attack might have been launched from within South Africa.
 

etienne_marais

Honorary Master
Joined
Mar 16, 2008
Messages
11,697
Rockefeller anticipated mass Cyber-attack on the horizon, new states of emergency and law alteration/government control to be expected.
 

Sarg3_ZN

Expert Member
Joined
May 17, 2010
Messages
2,186
This wasn't a cyber attack, they took the advice given on every failed login attempt and set the password word as "incorrect"
 

Kawak

Senior Member
Joined
Mar 14, 2007
Messages
863
So what does SSA have to say about that? Who is the third party or state? Time to flex our muscle? Do we have any that can actually be used? Or are they only useful against our beach goers?
 

j4ck455

Executive Member
Joined
Jan 2, 2006
Messages
6,811
She said that the major difference is that the attack on Transnet was a systemic cyberattack.

It caused a cascading, systemic failure at a regional and national level, including economic damage and food insecurity, which could lead to societal instability.

For these reasons, the Transnet attack is not a mere cybercrime, said Van der Waag-Cowling.
There are no reasons quoted there, only the effects of what has been reported as a ransomware attack.

The effects and extent of the attack are a cybercrime, but nothing stated there points to "an act of cyber war".
 

das Toktokken

Honorary Master
Joined
Jul 18, 2008
Messages
53,986
There are no reasons quoted there, only the effects of what has been reported as a ransomware attack.

The effects and extent of the attack are a cybercrime, but nothing stated there points to "an act of cyber war".
Agree, though it appears targeted... and when you target national infrastructure...
 

j4ck455

Executive Member
Joined
Jan 2, 2006
Messages
6,811
Agree, though it appears targeted... and when you target national infrastructure...
If the Transnet incident was one of several that could be linked to the same criminals, there would be no doubt that the Transnet incident was more than a cybercrime of opportunity and instead "an act of cyber war".

Reading (into) this:
According to her, the attack on Transnet was in a different class to similar attacks seen in South Africa on healthcare institutions, City Power, and the Civil Aviation Authority.
She is attributed there with having stated that the attack on Transnet was significantly different to attacks on other entities, she does not specify how she came to that conclusion.

Maybe it is based on information that she has access to, that has not been made public.

And if that's the case why did she tell the media anything at all, was it for publicity?
 

das Toktokken

Honorary Master
Joined
Jul 18, 2008
Messages
53,986
If the Transnet incident was one of several that could be linked to the same criminals, there would be no doubt that the Transnet incident was more than a cybercrime of opportunity and instead "an act of cyber war".

Reading (into) this:

She is attributed there with having stated that the attack on Transnet was significantly different to attacks on other entities, she does not specify how she came to that conclusion.

Maybe it is based on information that she has access to, that has not been made public.

And if that's the case why did she tell the media anything at all, was it for publicity?
Perhaps she agreed to keep details under wraps until investigations are complete.
 

fritzm

Well-Known Member
Joined
Dec 4, 2007
Messages
135
There's an interesting development on this story on Transnet's tender portal today : a letter of cancellation for an RFP which reads as follows :

"We regret to inform you that this RFP has been cancelled and as such has been declared a Non – Award of business due to the following reason:
▪ Due to the cyber-attack on the Transnet portal, a material irregularity in the process has compromised the fairness/integrity of the bid."

Does this mean that the attackers exfiltrated data relating to current tenders ? I've attached the copy of the full letter, which is publicly available on the tender portal https://www.transnetportterminals.net/Supplier/Pages/Request for_Quotation.aspx?View={f65ea6e0-ea3e-45e0-9585-e1ec03eb2241}&SortField=Modified&SortDir=Desc .
 

Attachments

  • Letter for Cancellation of bid iCLM HQ 492 TPT.pdf
    246.3 KB · Views: 1

eg2505

Honorary Master
Joined
Mar 12, 2008
Messages
25,927
There's an interesting development on this story on Transnet's tender portal today : a letter of cancellation for an RFP which reads as follows :
somebodies not getting their BMW.
 
Top