Eliana Willis

Image: Getty Images
The three local elections impacted by New South Wales’ iVote system failure last year have all been voided, the New South Wales Electoral Commission (NSWEC) said yesterday evening. “The Electoral Commissioner regrets the inconvenience caused to these councils and their councillors, but he welcomes the resolution of the matter and will now commence preparations for fresh elections,” the NSWEC said in a statement. The integrity of local elections in Kempsey, Singleton, and Shellharbour was put into doubt at the end of last year as some people in those councils were unable to cast their vote as the iVote system suffered a failure for a portion of the voting period. This led to the NSWEC submitting an application to the state’s Supreme Court for the election bungle to be reviewed. After reviewing the elections, the NSW Supreme Court decided to void the three election outcomes, which now means people in those councils will have to recast their vote. The re-election will use a separate system, as the NSWEC confirmed earlier this week that the iVote system will be parked until after next year’s state election as there is a lack of confidence it will be ready in time. “The current version of the iVote software used by the Electoral Commission will be phased out and the short runway for configuring and testing a new version before March 2023 means the Electoral Commissioner cannot be confident an updated system adapted for elections in NSW will be ready in time,” the NSWEC said on Wednesday. Prior to NSWEC’s confirmation that the iVote system would not be used in next year’s state elections, the commissioner had already shelved the iVote system for “extensive reconfiguration and testing” to resolve the issues encountered during local elections. During the system failure’s aftermath, Dr Vanessa Teague, a cryptographer with a particular interest in privacy and election security, criticised the flaws within the iVote system. “Every serious investigation of iVote found serious problems,” Teague tweeted in December in light of the iVote failure. Teague’s comments at the end of last year were not her first in warning about the iVote system’s flaws. Starting in 2015, she and her colleagues found numerous flaws in iVote, problems that NSWEC had previously downplayed.  Related Coverage More

Image: Getty Images
Proposed UK laws could see top managers at tech companies be jailed if they fail to meet the demands of regulators. The laws, coming in the form of an Online Safety Bill, were introduced to Parliament on Thursday after almost a year of consultation. The UK government commenced work on the proposed laws in May last year to push a duty of care onto social media platforms so that tech companies are forced to protect users from dangerous content, such as disinformation and online abuse. “We don’t give it a second’s thought when we buckle our seat belts to protect ourselves when driving. Given all the risks online, it’s only sensible we ensure similar basic protections for the digital age,” Digital Secretary Nadine Dorries said. Under the proposed legislation, executives of tech companies could face prosecution or jail time if they fail to cooperate with information notices issued by Ofcom, UK’s communications regulator. Through the Bill, Ofcom would gain the power to issue information notices for the purpose of determining whether tech companies are performing their online safety functions.    A raft of new offences have also been added to the Bill, including making in-scope companies’ senior managers criminally liable if they destroy evidence, fail to attend or provide false information in interviews with Ofcom, or obstruct the regulator when it enters company offices. The Bill also looks to require social media platforms, search engines, and other apps and websites that allow people to post their own content to implement various measures to protect children, tackle illegal activity and uphold their stated terms and conditions. Among these measures are mandatory age checks for sites that host pornography, criminalising cyberflashing, and a requirement for large social media platforms to give adults the ability to automatically block people who have not verified their identity on the platforms. The proposed laws, if passed, would also force social media platforms to up their moderation efforts, with the Bill calling for platforms to remove paid-for scam ads swiftly once they are alerted of their existence. A requirement for social media platforms to moderate “legal but harmful” content is also contained in the Bill, which will make large social media platforms have a duty to carry risk assessments on these types of content. Platforms will also have to set out clearly in terms of service how they will deal with such content and enforce these terms consistently. “If companies intend to remove, limit or allow particular types of content they will have to say so,” Dorries said. The agreed categories of “legal but harmful” content will be set out in secondary legislation that will be released later this year, the digital secretary added. While the UK government has framed the Online Safety Bill as “world-leading online safety laws”, law experts have criticised the Bill for its use of vague language through the “legal but harmful” classification, which they say could create unintended consequences. “The Online Safety Bill is a disastrous piece of legislation, doomed not just to fail in its supposed purpose but make it much harder for tech companies and make the internet less safe, particularly for kids,” said Paul Bernal, University of East Anglia IT law professor. The UK government hasn’t been alone in wanting to create laws regulating how social media platforms moderate content. Australia’s federal government is currently mulling over two pieces of legislation, one focusing on stopping online defamation and the other being about online privacy. The defamation laws, framed by the federal government as anti-trolling laws, seek to force social media companies into revealing the identity of anonymous accounts if they post potentially defamatory material on platforms. Australia’s proposed online defamation laws have faced similar criticism of potentially creating unintended, adverse impacts, leading to criticism from online abuse victims and privacy advocates. Related Coverage More

Image: Google
Google’s Threat Analysis Group has detailed a group it has labelled as Exotic Lily that breached a target and sold off the gained access.The preferred method for gaining targets is spear phishing, with the group sending around 5,000 emails a day, and setting up similar domains with different TLDs — such as using example.co for example.com users — in an effort to fool those on the receiving end. It also began with fake personas, but recently started ripping publicly available data from sites like RocketReach and CrunchBase to impersonate users. The group also used public file-sharing sites including TransferNow, TransferXL, WeTransfer, or OneDrive to pass payloads onto users and make it harder for defenders to detect, since the sites are legitimate. “Investigating this group’s activity, we determined they are an initial access broker who appear to be working with the Russian cyber crime gang known as Fin12 (Mandiant, FireEye) / Wizard Spider (CrowdStrike),” Google said. “Exotic Lily is a resourceful, financially motivated group whose activities appear to be closely linked with data exfiltration and deployment of human-operated ransomware such as Conti and Diavol.” The group also appears to maintain a high degree of work-life balance, as Google said the activity it has seen is typical of a 9 to 5 job in eastern or central Europe, with little activity on weekend. Although the group has relationships with ransomware gangs, Google said Exotic Lily is a separate entity that is only interested in access, with other groups doing the ransomware operations. Off the back of its discovery, Google said it would have additional Gmail warning for emails originating from website contact forms, improve its spoofing identification, and adjust the reputation of email file sharing notifications. Related Coverage More

Bluetooth trackers have been on the market for more than a decade, serving as personal spies for your keys, wallet, backpacks, and other belongings. They’re exceptionally easy to set up and even easier to use. The question is: Which Bluetooth tracker should you buy? With dozens of brands, sizes, and price points available on store shelves, finding the ideal tracker requires a bit of…information tracking. Fortunately, ZDNet’s team of subject matter experts have tested, reviewed, and compared the very best Bluetooth-enabled offerings on the market, and assembled the top picks below.Also: Best GPS trackers for kids: Tech for peace of mind

Apple AirTag

Best for Apple users

Jack Skeens/Shutterstock

The Apple AirTag hit the market in 2021 and has kept its foot on the pedal since. The coin-sized tracker only works with Apple devices like the iPhone, iPad, and MacBook, and does so seamlessly and effectively. By making use of its built-in U1 ultra-wideband chip (for Precision Finding) and Apple’s extensive Find My network, the AirTag can track down keys, wallets, bags, and anything else the trinket can fit into. The AirTag’s battery is rated to last one year and can be replaced with another CR2032 unit afterward. A pack of one AirTag sells for $29, and a four-pack for $99.More: Apple AirTag full review Pros:Precision Finding with the U1 chip is bar noneApple’s Find My network is dependableReplaceable batteryCons:Not compatible with Android devicesMust buy a key ring accessory to latch onto itemsEasily scratched

Tile Pro (2022)

Best for long-distance tracking

Image: Tile

It’s easy to get carried away with the “Pro” moniker. What exactly does that entail? For the Tile Pro (2022), it means a greater tracking range (400 feet), a loud alarm, and a new IP67 rating to keep the tag safe from splashes and rain. For reference, competing trackers like the Apple AirTag and Samsung SmartTag can be detected within 200 ft via Bluetooth — the Tile doubles that. The Tile Pro looks a lot like a key fob, and you might be okay with that. The size is warranted as it’s equipped with a larger-than-average speaker for a more discernible alarm and a replaceable CR2032 battery. A tag sells for $35, which isn’t cheap, but well worth the money if you’re an iOS or Android user who wants the furthest tracking range. Pros:400 ft range is almost double that of competitors’IP67 rating for water resistanceWorks with both iOS and AndroidCons:No ultra-wideband precision trackingSlightly larger form factor than traditional tagsPricier than competing offers

Chipolo CARD Spot

Best for wallets

June Wan/ZDNet

Chipolo’s just-released CARD Spot is shaped like a credit card, connects to Apple’s Find My network, and gets our pick for best Bluetooth wallet tracker. While traditional, coin-shaped finders can also keep your wallet in check, they often create a bulge that makes stashing the accessory cumbersome. The CARD Spot is designed to live in your wallet, measuring at a thickness of 0.09 inches — about the same as two credit cards stacked together. The other trick is Apple’s Find My network integration. By dialing into the expansive, crowdsourced ecosystem, the Chipolo can be tracked within a 200-foot range via Bluetooth, and virtually anywhere else via nearby Apple devices. A card sells for $35 and fits in most wallet types. More: Chipolo CARD Spot full reviewPros:Sleek, credit card design is ideal for walletsAlarm gets plenty loudApple’s Find My network integrationCons:No ultra-wideband for Precision FindingNon-replaceable batteryNot compatible with Android

Jiobit Smart Tag

Best for kids and pets

Image: Jiobit

Besides locating keys and wallets, Bluetooth trackers make for handy-dandy gadgets to keep your child or pet under surveillance. If you’re able to spend a little more than the standard trackers for added safety and security features, look to the Jiobit Smart Tag. The Jiobit can be clipped onto a belt, collar, or backpack, and provides always-on connectivity and real-time location tracking. This is all done via Jiobit’s dedicated cloud subscription, which does come at a per-month fee — alongside the actual tracker. At the basic level ($8.99 a month), you’ll gain access to the standard, real-time tracking features. But by paying more — especially for the Protect plan ($16.99 a month), Jiobit gives you access to location histories, phone alerts, and unlimited location-sharing with other users. Protect plan users can also take advantage of the tracker’s built-in emergency button. When pressed, your phone will receive a ping and be given the option to call 911. More: Best GPS trackers for kidsPros:Real-time location trackingPhysical panic button is helpful for urgent careCharger and accessories included in the boxCons:Must buy tracker and subscription plan to useOne week battery life requires frequent charging

Samsung Galaxy SmartTag

Best for Samsung users

Image: Samsung

Like the AirTag and iPhone, the SmartTag is at its best when paired to a Samsung Galaxy smartphone. Unlike the aforementioned picks, the SmartTag doubles as a trigger for smart home automation. You can press the tag to turn on lights, the air conditioner, or even open the garage door. But, this is limited to appliances that fall under the SmartThings ecosystem, which is more limited than what Alexa and the Apple Home Kit can work with. Still, the Galaxy SmartTag is a formidable Bluetooth tracker, with a loud speaker, a replaceable battery, and a rugged build that can take a bump or two. The tracker sells for $29 but we’ve seen it go for much less, making it a great value buy for Samsung users. Pros:Doubles as a smart home buttonLoud and audible speakerRugged design handles key scratches wellCons:Only compatible with Galaxy phonesBulkier than competing trackers

How did we choose these Bluetooth trackers?

When testing and reviewing the listed Bluetooth trackers, we considered several key factors: Precision, battery life, speaker volume, and tracking range. The best picks tick all four boxes and then some. They’re also distinguished by unique selling points that make each one ideal for a specific core of users.

Which Bluetooth tracker is right for you?

When shopping for a Bluetooth tracker, the main factor that you should consider is compatibility. The AirTag and Chipolo CARD Spot, for example, only function with Apple-made devices. For greater companionship, we’d recommend looking into Tile’s Bluetooth offerings. It also helps to know what you’re tracking. For keys and smaller items, coin-shaped trackers will do the trick. For larger belongings such as wallets and passports, consider card-shaped options.

What if my Bluetooth tracker runs out of battery?

Most Bluetooth trackers come with batteries that can either be swapped out or recharged. For offerings that don’t have replaceable batteries, manufacturers often incentivize trade-ins by offering discounted renewals. Chipolo, for one, will sell you a new CARD Spot at 50% off when you trade-in your existing tracker. 

Are there alternative Bluetooth trackers worth considering?

Besides the top five mentioned above, here are more Bluetooth trackers that will keep your belongings in check:

ZDNet Recommends More

One of Facebook’s data centres in Prineville, Oregon.
Image: Meta
After years of testing various approaches for detecting silent data corruptions (SDCs), Meta has outlined its approach for resolving the hardware issue. SDCs are data errors that do not leave any record or trace in system logs. Sources of SDCs include datapath dependencies, temperature variance, and age, among other silicon factors. Since these data errors are silent, they can stay undetected within workloads and propagate across several services. The data error can affect memory, storage, networking, as well as computer CPUs and cause data loss and corruption. Meta engineers started testing three years ago as they had a difficult time detecting SDCs once components had already gone into one of its production data centre fleets. “We [needed] novel detection approaches for preserving application health and fleet resiliency by detecting SDCs and mitigating them at scale,” Meta engineer Harish Dattatraya Dixit said in a blog post. According to tests, Meta found its most preferred way for detecting SDCs is using both out-of-production and ripple testing. Out-of-production testing is a SDC detection method that occurs when machines go through a maintenance event such as system reboots, kernel upgrades, and host provisioning among others. This type of testing piggybacks onto these events to allow for tests to have longer runtimes thereby enabling a “more intrusive nature of detection”. Ripple testing, meanwhile, occurs by running silent error detection in conjunction with workloads being active. This is done through shadow testing with workloads and injecting bit patterns with expected results intermittently within fleets and workloads, which Meta found enabled faster SDC detection than out-of-production testing. This faster type of testing “ripples” through Meta’s infrastructure, allowing for test times that are 1,000x lower than out-of-production test runtimes. Meta engineers observed, however, ripple testing could only detect 70% of fleet data corruptions, although it was able to detect them in 15 days. By comparison, out-of-production testing took six months to detect the same corruptions along with other ones. In explaining these benefits and tradeoffs, Dattatraya Dixit recommended that organisations with large-scale infrastructure should use both approaches to detect SDCs. “We recommend using and deploying both in a large-scale fleet,” Dattatraya Dixit said. “While detecting SDCs is a challenging problem for large-scale infrastructures, years of testing have shown us that [out-of-production] and ripple testing can provide a novel solution for detecting SDCs at scale as quickly as possible.” When Meta engineers used both tests for detecting SDCs, they found all SDCs could eventually be detected. Meta said 70% of SDCs were from ripple testing after 15 days, out-of-production testing caught up to 23% of the remaining SDCs in six months, while the remaining 7% was found through repeated ripple instances within its data centre fleets. To push further innovation in detecting SDCs, Meta has also announced it will provide five grants, each worth around $50,000, for academia to create research proposals in this field of research.  Related Coverage More

Ransomware causes problems no matter what brand it is, but some forms are noticeably more prolific than others, with four strains of the malware accounting for a combined total of almost 70% of all attacks. According to analysis by cybersecurity company Intel 471, the most prevalent ransomware threat towards the end of 2021 was LockBit 2.0, which accounted for 29.7% of all reported incidents. Recent victims of LockBit have included Accenture and the French Ministry of Justice.  

ZDNet Recommends

Almost one in five reported incidents involved Conti ransomware, famous for several incidents over the past year, including an attack against the Irish Healthcare Executive. The group recently had chat logs leaked, providing insights into how a ransomware gang works. PYSA and Hive account for one in 10 reported ransomware attacks each. SEE: Cybersecurity: Let’s get tactical (ZDNet special report)  “The most prevalent ransomware strain in the fourth quarter of 2021 was LockBit 2.0, which was responsible for 29.7% of all reported incidents, followed by Conti at 19%, PYSA at 10.5% and Hive at 10.1%,” said the researchers.Cybersecurity researchers at Intel 471 examined 722 ransomware attacks that took place between October and December 2021 and identified the most impacted sectors. Top of the list was consumer and industrial products, which accounted for almost a quarter of the organisations affected by ransomware attacks, up significantly compared to the previous quarter. Consumer and industrial products are a tempting target for ransomware criminals because they are services that people rely on as part of their everyday lives. If the network of the provider is encrypted, users can’t access the services they need.  One of the most high-profile instances of this issue occurred in 2020 when wearables, fitness tracker and smartwatch manufacturer Garmin was impacted by a ransomware attack, locking users out of services. It was reported that Garmin paid a multi-million-dollar ransom for a decryption key to help restore services. Manufacturing was the second-most impacted sector, accounting for 15.9% of ransomware attacks. Many manufacturing businesses work around the clock, often producing vital goods that people need every day.  Professional services and consulting was the third-most targeted sector by ransomware, accounting for 15.4% of incidents, followed by real estate with 11.4%. Life sciences and health care was the fifth-most targeted sector, following a rise in attacks against it. This includes ransomware attacks against hospitals. Hospitals make a tempting target because the nature of healthcare means that if networks are offline, patients can’t be treated, so some hospitals pay ransoms.SEE: This sneaky type of phishing is growing fast because hackers are seeing big paydaysRansomware is still a major cybersecurity issue and attacks continue to be successful because many victims choose to pay the ransom, despite being warned not to because that approach encourages more attacks. But there are actions that businesses can take to help avoid falling victim to a ransomware attack. This includes applying security patches as soon after release as possible, so hackers can’t exploit known vulnerabilities. Applying multi-factor authentication across the network is also recommended, so it’s harder for hackers to break into accounts and exploit them to lay the groundwork for ransomware or other malware attacks.  Organisations should also regularly update and test offline backups, so in the event of a successful ransomware attack, there’s a possibility of restoring the network without paying the ransom. MORE ON CYBERSECURITY More

Microsoft has revealed how the Trickbot trojan botnet has been using compromised MikroTik routers for stealthy communications with infected PCs.Trickbot, known for stealing banking credentials and delivering ransomware, seemed unstoppable once. It continued to thrive despite an effort led by Microsoft in 2020 to patch millions of infected PCs and take down most of its command and control (C2) servers, with the exception of its Internet of Things (IoT) C2 devices, until it finally shut down earlier this year. 

ZDNet Recommends

Now, Microsoft has filled in one detail about how the TrickBot gang’s IoT C2 devices, namely compromised MikroTik routers, were being used since 2018 for stealthy communication with infected PCs. SEE: Cybersecurity: Let’s get tactical (ZDNet special report)Back in 2018, when many hackers were targeting CVE-2018-14847 in MikroTik’s RouterOS software, security researchers found Tickbot was using compromised MikroTik routers for C2 infrastructure. Routers are a useful C2 tool since they allow communication between C2 and Trickbot-infected PCs in a way that standard defenses can’t detect. Microsoft security researchers say they have now cleared up exactly how the devices were being used in its infrastructure.   After gaining control of the router through a compromised password, Trickbot used RouterOS’s SSH shell to create a set of commands that RouterOS understands but which don’t make sense on normal Linux-based shells. SSH is intended to enable secure network communications over an unsecured network. The ultimate goal was to redirect the compromised router’s traffic. This command created a new network rule that redirected traffic from the infected device to a server and the redirected traffic was received from port 449 and redirected to port 80, Microsoft explains. “The said command is a legitimate network address translation (NAT) command that allows the NAT router to perform IP address rewriting. In this case, it is being used for malicious activity. Trickbot is known for using ports 443 and 449, and we were able to verify that some target servers were identified as TrickBot C2 servers in the past,” Microsoft adds. “As security solutions for conventional computing devices continue to evolve and improve, attackers will explore alternative ways to compromise target networks. Attack attempts against routers and other IoT devices are not new, and being unmanaged, they can easily be the weakest links in the network. Therefore, organizations should also consider these devices when implementing security policies and best practices,” Microsoft said. It has included details of how to find out if your routers have been affected.Despite Trickbot’s notoriety and durability, researchers at Intel 471, which was involved in the 2020 takedown, said that by February this year the Trickbot malware was on its last legs, with former developers moving on to new malware like BazarLoader and the Conti ransomware gang. “Intel 471 cannot confirm, but it’s likely that the Trickbot operators have phased Trickbot malware out of their operations in favor of other platforms, such as Emotet. Trickbot, after all, is relatively old malware that hasn’t been updated in a major way. Detection rates are high and the network traffic from bot communication is easily recognized,” its researchers wrote. More