Eliana Willis

Beijing has lashed out at the US government’s decision to ban China Unicom from offering its services in the US, describing the move as baseless. It vows to safeguard the “legitimate rights and interests” of Chinese businesses operating in the US market. China’s Ministry of Industry and Information Technology (MIIT) said it strongly opposed a move by the US Federal Communications Commission (FCC) to revoke China Unicom’s licence, effectively banning the state-owned Chinese telco from providing services in the US market. In its statement, the FCC had said China Unicom posed national security risks as it was subject to exploitation and control by the Chinese government. “[China Unicom] is highly likely to be forced to comply with Chinese government requests without sufficient legal procedures subject to independent judicial oversight,” the US government agency said. MIIT said Thursday the FCC did not provide facts to back its allegations and overgeneralised national security issues to suppress Chinese businesses. Describing the US agency’s move as an abuse of state power, MIIT said the Chinese government would take necessary measures to protect the legitimate rights and interests of its organisations that invested and operated in the US. MIIT further noted that China Unicom had been operating in the US for two decades and had abided by US laws and regulations, according to a report by state-run Chinese newspaper, China Daily. It called on the FCC to reverse its decision and provide a “fair, just, and nondiscriminatory” environment for Chinese companies operating in the US market. 

On its part, China Unicom Global on Thursday said the FCC’s move was without justification, China Daily reported. The telco said its US outfit had a “good record” of complying with relevant US laws. It added that the FCC order was issued “without affording required due process”.”China Unicom Americas would act proactively to protect the rights and interests of the company and its customers,” it said. China Telecom also has been banned from operating in the US, where China Mobile currently is the remaining major Chinese telco to be allowed to provide its services.The US government in January 2021 ordered the delisting of three Chinese telcos from the New York Stock Exchange, namely, China Telecom, China Mobile, and China Unicom Hong Kong.RELATED COVERAGE More

Australia’s eSafety Commissioner Julie Inman Grant has criticised the federal government’s proposed anti-trolling legislation, outlining that it may be misused due to the lack of elements explicitly preventing cyberbullying and online abuse. “I think [the anti-trolling Bill] can lend itself to a lot of retaliation, a lot of vigilante-style justice,” Inman Grant said, who was reappointed into the eSafety commissioner post a fortnight ago. “I do worry about what that would mean in terms of giving individuals that kind of information, and that might be an IP address, or MAC address, or a device ID that the everyday person can’t do much with.” Inman Grant made these comments before the Select Committee on Social Media and Online Safety, which was set up by the federal government late last year with the intention of building on the proposed anti-trolling laws. In explaining her concerns, Inman Grant said the Bill does not contain a single element addressing “trolls”, with the proposed legislation being focused on defamation. In the leadup to the Bill’s exposure draft being released, Australian Prime Minister Scott Morrison said the proposed laws would be used to reduce online abuse and ultimately “unmask anonymous online trolls”. “There is no place for people to be anonymously going round and undertaking this horrific abuse and harassment and stalking online,” Morrison said at the time.

“Anonymous trolls are on notice, you will be named and held to account for what you say. Big tech companies are on notice, remove the shield of anonymity or be held to account for what you publish.” As currently drafted, the anti-trolling laws would require social media platforms to have a complaints scheme in place that allows victims of defamatory comments to both make complaints and request the personal information of the maker of those comments. In outlining what comments fall within the proposed laws’ scope, the Bill does not require the comments to be about cyberbullying or online abuse. Since the release of the Bill’s exposure draft, experts have been quick to flag that the laws would have a limited impact on online abuse. According to Elise Thomas, an open-source intelligence analyst at the Institute for Strategic Dialogue, social media users are already happy to make cruel comments under their own names. When asked about the doubt surrounding the Bill’s efficacy, Inman Grant said she was concerned that the proposed laws would most likely not live up to the initial expectation of “unmasking trolls”.”It’s probably a defamation reform bill. That does create some confusion with the public and what my primary concern is making sure we’re seeing the right expectations for the public so they know where to go when they experience personal harms or are a victim of online abuse,” she said. Earlier on Thursday, Facebook whistleblower Frances Haugen testified to the same committee Thursday that the platform deliberately provides less help, reporting of online abuse, and safety to Australian users to save on costs. “I’m sure on a per capita basis there is less help, less support, and less safety for Australians because Facebook knows it operates in the dark. Where they don’t have to, they don’t apologise about anything,” Haugen told the committee. Over the past few weeks, the select committee has heard from various government agencies and tech giants about social media’s role in online abuse. The committee is set to provide the inquiry’s findings later this month. Related Coverage More

Researchers have discovered 23 “high-impact vulnerabilities” affecting any vendors that adopted Independent BIOS Developers (IBV) code into their Unified Extensible Firmware Interface (UEFI) firmware.Binarly explained the vulnerabilities in a blog post this week, confirming that “all these vulnerabilities are found in several of the major enterprise vendor ecosystems” including Fujitsu, Siemens, Dell, HP, HPE, Lenovo, Microsoft, Intel and Bull Atos. CERT/CC confirmed that Fujitsu, Insyde and Intel were affected but left the others tagged as “unknown,” urging anyone affected to update to the latest stable version of firmware.According to the blog, the majority of the vulnerabilities disclosed lead to code execution with SMM privileges and had severity ratings of between 7.5 – 8.2. “The root cause of the problem was found in the reference code associated with InsydeH2O firmware framework code. All of the aforementioned vendors were using Insyde-based firmware SDK to develop their pieces of firmware,” Binarly wrote. “We had a short discussion with Fujitsu PSIRT and came to the conclusion that we should report all those issues to CERT/CC to lead an industry-wide disclosure. This is how the VU#796611 was created and how Binarly collaboration with CERT/CC began in September 2021.”They commended Fujitsu, Intel and others for responding quickly and solving the vulnerabilities. UEFI provider Insyde Software said it worked with Binarly to resolve the vulnerabilities and has released firmware updates for all the issues listed. “We are extremely thankful for Binarly’s work in discovering the items outlined in today’s published security disclosures,” said Tim Lewis, CTO at Insyde Software on Tuesday.

“We appreciated Insyde Software’s prompt and professional response to the results of our analysis on their firmware,” said Alex Matrosov, Founder and CEO of Binarly. The vulnerabilities are tracked as CVE-2020-27339, CVE-2020-5953, CVE-2021-33625, CVE-2021-33626, CVE-2021-33627, CVE-2021-41837, CVE-2021-41838, CVE-2021-41839, CVE-2021-41840, CVE-2021-41841, CVE-2021-42059, CVE-2021-42060, CVE-2021-42113, CVE-2021-42554, CVE-2021-43323, CVE-2021-43522, CVE-2021-43615, CVE-2021-45969, CVE-2021-45970, CVE-2021-45971, CVE-2022-24030, CVE-2022-24031, CVE-2022-24069.”A local attacker with administrative privileges (in some cases a remote attacker with administrative privileges) can use malicious software to perform any of the following: Invalidate many hardware security features (SecureBoot, Intel BootGuard), Iinstall persistent software that cannot be easily erased and create backdoors and back communications channels to exfiltrate sensitive data,” CERT/CC explained. Mike Parkin, engineer at Vulcan Cyber, said any vulnerabilities that let an attacker manipulate or alter a system’s BIOS can have potentially devastating consequences. “Fortunately, the attack described here requires privileged access to execute. This isn’t uncommon with BIOS attacks in that they require some level of privilege or physical access to implement. But that doesn’t mean we can ignore them. For a threat actor, the value of embedding malicious code in the BIOS makes the effort worthwhile,” Parkin said. “The issue will be identifying all the systems that are affected by these vulnerabilities and rolling out the updates once they are available from the vendor. System BIOS updates are often more involved and time consuming than a simple system patch, which makes finding and fixing them all somewhat challenging.”Viakoo CEO Bud Broomhead noted that the issue was similar to recent open source vulnerabilities like Log4j, PwnKit and others because vulnerabilities that exist within the UEFI layer from Insyde are difficult to quickly patch at scale due to the multitude of manufacturers that will each need to produce and distribute a patch to the end user. It’s then up to the end user how quickly the patch is installed, Broomhead said. Unless patched, these vulnerabilities provide a direct path for threat actors to deploy malware within the OS layer, or even brick the devices, he added. “This disclosure reinforces the need to ensure that all assets can be quickly located through an automated discovery and threat assessment solution, followed by an automated method to patch or upgrade the system firmware. The need to quickly patch multiple forms of devices (IT, IoT, OT, ICS, etc) is now way beyond any organization’s ability to manually implement security fixes,” Broomhead said. “Organizations will be dealing with this for a while; because multiple system manufacturers using Insyde UEFI are impacted by this there are likely many devices in the supply chain that will be delivered over the next few months to end users. Organizations will need to revisit how they are provisioning and onboarding new devices to ensure they are not continuing to distribute devices that can be easily exploited by cyber criminals.” More

Wormhole, a popular blockchain bridge, confirmed on Wednesday evening that hackers stole crypto-assets worth $324 million.The platform serves as a bridge between different blockchains and allows users to transfer cryptocurrency. The company confirmed in a series of Tweets that 120k wETH was stolen from the platform and the network was down for maintenance as they looked into a potential exploit.

The wormhole network was exploited for 120k wETH. ETH will be added over the next hours to ensure wETH is backed 1:1. More details to come shortly.We are working to get the network back up quickly. Thanks for your patience.— Wormhole🌪 (@wormholecrypto) February 2, 2022

The platform’s website has “Portal is Temporarily Unavailable” in block letters but no other message. Researchers found evidence of an 80,000 ETH transfer from Wormhole as well as another 40,000 of ETH being sold by the hacker on Solana. Elliptic’s Tom Robinson shared a message from Certus One, the company behind Wormhole, to the hacker offering $10 million for the exploit details and return of all the cryptocurrency. The company said the hacker exploited “the Solana VAA verification and mint tokens” in the message.”The exploit appears to have allowed the attacker to mint 120,000 wrapped ETH on the Solana blockchain, 93,750 ETH of which was then transferred to the Ethereum blockchain,” Elliptic explained. By around 8 pm EST, the company said the vulnerability was patched and the network was being restored. Multiple researchers released detailed threads explaining the vulnerability the hacker exploited. 

tl;dr – Wormhole didn’t properly validate all input accounts, which allowed the attacker to spoof guardian signatures and mint 120,000 ETH on Solana, of which they bridged 93,750 back to Ethereum.— samczsun (@samczsun) February 3, 2022

Jump Capital, which purchased Certus One in August 2021, did not respond to requests for comment. The company also invested in crypto platform AscendEX, which suffered its own $77.7 million hack on December 11. Just five days ago, Qubit Finance took to Twitter to beg hackers to return more than $80 million that was stolen from them. The recent hacks continue a run of attacks on DeFi platforms that have occurred over the last year. Chainalysis said at least $2.2 billion was outright stolen from DeFi protocols in 2021.  The attack on Wormhole is the second largest reported hack after Poly Network saw $611 million stolen from their platform in August. Bitmart lost $196 million in early December. More

Major VPN providers Surfshark and Nord Security are merging, according to a blog post from both companies. The merger is one of a number of consolidations within the VPN market, much of which is already controlled by Kape Technologies, Tesonet, and Ziff Davis. Terms of the merger were not disclosed but the two companies spent months negotiating before making the announcement. The two companies will operate as separate entities “relying on separate infrastructures and different product development plans.”

ZDNet Recommends

The best mobile VPNs

Here’s how to find an effective Virtual Private Network service for both iOS-powered iPhones and Android smartphones.

Read More

In a statement, Surfshark founder and CEO Vytautas Kaziukonis defended the VPN market’s worrisome consolidation, arguing that it indicated “the industry’s maturity.””Consolidations in the global consumer cybersecurity market indicate the industry’s maturity,” Kaziukonis said.”They also bring new competitive challenges. Nord Security and Surfshark joining forces will set the ground to scale in different digital security dimensions, which is necessary to meet the growing requirements of our customers.” See also: Best VPN 2021: Top VPN services reviewedThe companies argued that they never intended to “be only a VPN” and that both offer different products despite overlaps between the tools they sell. 

“Nothing changes concerning our brands, infrastructure, company management, employees, and product development. The idea behind the deal is to align on a tactical level in reaching mutual goals while keeping the autonomy of our operations,” the companies said. “This strategic business move will serve as a springboard towards more rapid development and innovation while maintaining the uniqueness of both brands that customers learned to appreciate over many years.”Nord Security co-founder Tom Okman said the companies believe the VPN industry requires “radical” simplification and ease of access for consumers and businesses. Neither company is changing its Terms of Service or Privacy Policy. The merger drew scrutiny from market watchers who noted that Surfshark was developed with the help of Tesonet, the same Lithuanian business incubator that helped NordVPN in its early days. The companies initially denied any connections before the merger was announced. In September, Kape Technologies bought ExpressVPN for $936 million. Kape Technologies previously bought VPN companies ZenMate and Cyberghost. 

ZDNet Recommends More

British food producer KP Snacks was hit with a ransomware attack last week.In a statement to ZDNet, the company said it discovered the ransomware attack on Friday, January 28. 

“As soon as we became aware of the incident, we enacted our cybersecurity response plan and engaged a leading forensic information technology firm and legal counsel to assist us in our investigation,” a company spokesperson said. “Our internal IT teams continue to work with third-party experts to assess the situation. We have been continuing to keep our colleagues, customers, and suppliers informed of any developments and apologize for any disruption this may have caused.”The company has more than 2,000 employees and brings in over $630 million annual revenue. The company would not confirm who launched the attack, but the Conti ransomware group added KP Snacks to its victim leak site, threatening to leak information stolen from them on February 6. Better Retailing reported that store owners received messages notifying them of the ransomware attack and saying they “cannot safely process orders or dispatch goods.” The note added that stores should “expect supply issues on base stock and promotions until further notice.”

Also: QNAP users still struggling with Deadbolt ransomware after forced firmware updatesThe outlet said the company has already told sellers that “no orders will be being placed or delivered for a couple of weeks at least, and service could be effected until the end of March at the earliest.”Order caps will be introduced so that KP Snacks can distribute the stock remaining in their warehouses. The company produces McCoys’s, Hula Hoops, Tyrell’s, Space Raiders, Skips, Butterkist, Pom-Bears, Nik-Naks, KP nuts and many other popular candies.BleepingComputer spoke with an unnamed source that said employee files and financial records were accessed during the ransomware attack.Both CISA and the FBI released a warning in September reporting that they have seen more than 400 attacks involving Conti’s ransomware targeting US organizations as well as international enterprises. The FBI has previously implicated Conti in attacks on at least 290 organizations in the US.  Conti made a name for itself after attacking hundreds of healthcare institutions — including a debilitating ransomware attack on Ireland’s Health Service Executive on May 14 — as well as schools like the University of Utah and other government organizations like the city government of Tulsa, Oklahoma and the Scottish Environment Protection Agency. They attacked digital photography company Shutterfly in late December. In December, researchers with security firm Advanced Intelligence discovered the Conti ransomware group exploiting VMware vCenter Server instances through the Log4j vulnerabilities. They noted that their research of ransomware logs shows Conti made over $150 million in the last six months.”Most importantly, AdvIntel confirmed that the criminals pursued targeting specific vulnerable Log4J2 VMware vCenter for lateral movement directly from the compromised network resulting in vCenter access affecting the US and European victim networks from the pre-existent Cobalt Strike sessions,” the researchers said. More