Web creator Sir Tim Berners-Lee’s young company, Inrupt, which aims to steer the web away from oligopoly, has announced five key hires, including cryptography expert Bruce Schneier.  Inrupt is the company that’s backing the open-source project, Solid, which was launched in late 2018 to address the problem of large corporations controlling most of the world’s […] More

Singapore will begin issuing COVID-19 contact tracing wearables to all residents and introducing additional safety measures, as it looks to resume more public activities in the coming weeks. These new measures will include the mandatory use of the TraceTogether Tokens or contact tracing app TraceTogether to facilitate digital check-in procedures at some locations where ‘higher-risk activities” are held.
A new “Self-Check” service and SMS service also would be rolled out on Thursday to alert people if they had visited the same venues at the same time as COVID-19 cases, said the Health Ministry and Smart Nation and Digital Government Office in a joint statement Wednesday. Both services would be based on data from individuals’ SafeEntry check-ins.

The government agencies said the new measures were necessary to support the country’s further opening of the economy “by ensuring more effective contact tracing for the community”.
To date, its TraceTogether app has topped 2.4 million downloads, accounting for about 40% of the local population. 
An initial batch of 10,000 Bluetooth-enabled TraceTogether Tokens were distributed to the elderly in June, days after the country’s plans to introduce the wearables sparked public outcry amongst individuals concerned about their privacy. It prompted the government to reveal that the contact tracing devices did not contain a GPS chip and would not have internet or cellular connectivity, so the data collected could only be extracted when the devices were physically handed over to a health official. 
The government had explained that the wearable devices were essential to plug gaps within the community where, for instance, children or individuals who did not have a smartphone would not be able to download the TraceTogether contact tracing app. It said the TraceTogether Tokens also offered an option for others who preferred to use a separate device to facilitate Singapore’s digital contact tracing efforts. 
The wearable devices would be distributed nationwide from September 14, with the government targeting to issue the token for free to all residents by November. The device’s battery has an estimated lifespan of six months and will not require any additional charging.  
Records of proximity data of close contacts are encrypted and stored locally in the token for up to 25 days. This data can be accessed only by the relevant authorities and only if a user is confirmed to be a COVID-19 case. 
Plans were underway to further pilot the mandatory use of the TraceTogether app or wearable to facilitate SafeEntry check-ins at selected venues that held higher-risk activities, such as larger-scale business-to-business events. This would be further expanded over time as the distribution of the wearables widened, the Singapore government said. These could include venues such as hotels, which often were used for weddings, F&B outlets, cinemas, gyms, and some workplaces. 
“As such settings have the potential to spark off large outbreaks from a single positive COVID-19 case that spread beyond the activity or venue, the use of TraceTogether can facilitate rapid and comprehensive contact tracing to stem onward spread,” the government said. 
SafeEntry currently already is compulsory at several locations including all workplaces, shopping malls, hotels, schools and educational institutes, healthcare facilities, supermarkets, and hairdressers. Since its launch, the digital check-in system has clocked an average of 9 million check-ins a day and tapped by more than 2.2 million unique users across 200,000 locations.
The system collects data that can be used to facilitate contact tracing should an individual who visited the location test positive for COVID-19. QR codes are displayed at the entry and exit points of a venue, which visitors must scan and input their name, national identification number, and mobile number. Alternatively, they can use any identification card that carries a barcode such as their driver’s licence, work permit, or student pass, which is then scanned by staff stationed at the venue’s entry point. 
With the launch of the “Self-Check” service, individuals will be able to refer to their SafeEntry records to check if they have been in close proximity to COVID-19 cases. 
The new SMS notification alerts also will be sent to groups of individuals who were at locations assessed to pose a higher risk of transmission, such as dining places and gyms where people do not wear masks for extended periods of time. Those whose SafeEntry check-in and check-out times that overlap with COVID-19 cases in such locations will receive an SMS alert. 
From October, Singapore is permitting bigger exhibitions and conferences comprising up to 250 participants to resume on a trial basis, where organisers will have to apply to pilot such Meetings, Incentives, Conventions, and Exhibitions (MICE). 
The country today confirmed 75 new COVID-19 cases, including 14 that were imported. It has just over 57,160 cases in total and 27 fatalities, with the most recent death recorded on July 14.

(Source: Singapore’s Smart Nation and Digital Government Office)

×
tracetogether-singapore-covid.png

RELATED COVERAGE More

Facebook has agreed to pay $550 million to settle claims in Illinois that the company violated local laws on facial recognition technologies.  The results of the lawsuit were made public on Wednesday and have been described as the “largest cash settlement ever resolving a privacy-related lawsuit.” Launched by law firms Edelson, Robbins Geller, and Labaton […] More

file photo
As most experts predicted last month, the fallout from the SolarWinds supply chain attack is getting bigger as time passes by, and companies had the time to audit internal networks and DNS logs.
This week, four new cyber-security vendors — Mimecast, Palo Alto Networks, Qualys, and Fidelis — have added their names to the list of companies that have installed trojanized versions of the SolarWinds Orion app.
Mimecast hack linked to SolarWinds software
The most important of this week’s announcements came from Mimecast, a vendor of email security products.
Two weeks ago, the company disclosed a major security breach during which hackers broke into its network and used digital certificates used by one of its security products to access the Microsoft 365 accounts of some of its customers.
In an update on its blog today, Mimecast said it linked this incident to a trojanized SolarWinds Orion app installed on its network.
The company has now confirmed that the SolarWinds hackers are the ones who abused its certificate to go after Mimecast’s customers.
Palo Alto Networks discloses Sep & Oct 2020 incidents
Another major security vendor who came forward to disclose a SolarWinds-related incident was Palo Alto Networks, a vendor of cyber-security software and network equipment.

Speaking to Forbes investigative reporter Thomas Brewster this week, Palo Alto Networks said it detected two security incidents in September and October 2020 that were linked to SolarWinds software.
“Our Security Operation Center […] immediately isolated the server, initiated an investigation and verified our infrastructure was secure,” Palo Alto Networks told Forbes on Monday.
However, the company said it investigated the breaches as separate solitary incidents and didn’t detect the broader supply chain attack, which would be spotted only months later when hackers breached fellow security vendor FireEye.
Palo Alto Networks said the investigation into the September and October SolarWinds-linked intrusions didn’t yield much and concluded that “the attempted attack was unsuccessful and no data was compromised.”
Qualys: It was only a test system
But the Forbes report also cited the findings of Erik Hjelmvik, founder of network security company Netresec, who published on Monday a report detailing 23 new domains that were used by the SolarWinds hackers to deploy second-stage payloads into infected networks they deemed as high value.
Two of these 23 new domains were “corp.qualys.com,” suggesting that cybersecurity auditing giant Qualys might have been targeted by the attackers.
However, in a statement to Forbes, Qualys said that the intrusion was not as big as it appears, claiming that its engineers installed a trojanized version of the SolarWinds Orion app inside a lab environment for testing purposes, separate from its primary network.
A subsequent investigation did not find any evidence of further malicious activity or data exfiltration, Qualys said.
However, some security researchers are not buying the company’s statement, suggesting that the “corp.qualys.com” domain suggested that hackers did get access to its primary network and not a laboratory environment, as the company claims.
Fidelis also discloses second-stage targeting
The fourth and latest major disclosure came today from Fidelis Cybersecurity in the form of a blog post from the company’s CISO, Chris Kubic.
The Fidelis exec said they, too, had installed a trojanized version of the SolarWinds Orion app in May 2020 as part of a “software evaluation.”
“The software installation was traced to a machine configured as a test system, isolated from our core network, and infrequently powered on,” Kubic said.
Fidelis said that despite efforts from the attacker to escalate their access inside the Fidelis internal network, the company believes that the test system was “sufficiently isolated and powered up too infrequently for the attacker to take it to the next stage of the attack.”
This week’s disclosures bring the total number of cyber-security vendors targeted by the SolarWinds hackers to eight. Previous disclosures came from FireEye (initial intrusion which uncovered the entire SolarWinds supply chain attack in the first place), Microsoft (intruders accessed some of the company’s source code), CrowdStrike (failed intrusion), and Malwarebytes (attackers accessed some of the company’s email accounts).

SolarWinds Updates More

Yuichiro Chino / GettyImages While the internet has undoubtedly brought new benefits, it’s also brought new problems as cyber criminals look to exploit our seemingly ever-growing reliance on connectivity. Special Feature Phishing emails, malware and ransomware attacks, or getting your bank details, passwords and other personal information stolen – the internet has provided malicious hackers with […] More