Eliana Willis

More stories

  • 125 Shares109 Views

    in Information Technology

    Password-stealing and keylogging malware is being spread through fake downloads

    Cyber criminals are using online adverts for fake versions of popular software to trick users into downloading three forms of malware – including a malicious browser extension with the same capabilites as trojan malware – that provide attackers with usernames and passwords, as well as backdoor remote access to infected Windows PCs.  The attacks, which distribute two forms of seemingly undocumented custom-developed malware, have been detailed by cybersecurity researchers at Cisco Talos who’ve named the campaign ‘magnat’. It appears the campaign has been operating in some capacity since 2018 and the malware has been in continuous development.  

    ZDNet Recommends

    Over half of the victims are in Canada, but there have also been victims around the world, including in the United States, Europe, Australia and Nigeria. SEE: A winning strategy for cybersecurity (ZDNet special report)  Researchers believe that victims are tricked into downloading the malware via malvertising – malicious online adverts – that trick them into downloading fake installers of popular software onto their systems. The users are likely to be looking for the legitimate versions of the software, but get directed to the malicious versions by advertising.  Some of the software that users are tricked into downloading includes fake versions of messaging apps such as Viber and WeChat, as well as fake installers for popular video games like Battlefield.   The installer doesn’t install the advertised software but instead installs three forms of malware – a password stealer, a backdoor and a malicious browser extension, which enables keylogging and taking screenshots of what the infected user is looking at. 

    The password stealer being distributed in the attacks is known as Redline, a relatively common malware that steals all the usernames and passwords it finds on the infected system. Magnat previously distributed a different password stealer, Azorult. The switch to Redline likely came because Azorult, like many other forms of malware, stopped working correctly after the release of Chrome 80 in February 2020.  While the password stealers are both commodity off-the-shelf malware, the previously undocumented backdoor installer – which researchers have called MagnatBackdoor – appears to be a more bespoke form of malware that has been distributed since 2019, although there are times where distribution has stopped for months.  MagnatBackdoor configures the infected Windows system to enable stealthy remote desktop protocol (RDP) access, as well as adding a new user and scheduling the system to ping a command and control server run by the attackers at regular intervals. The backdoor allows attackers to secretly gain remote access to the PC when required.  The third payload is a downloader for a malicious Google Chrome extension, which researchers have named MagnatExtension. The extension is delivered by the attackers and doesn’t come from the Chrome Extension Store. SEE: Hackers are turning to this simple technique to install their malware on PCs This extension contains various means of stealing data directly from the web browser, including the ability to take screenshots, steal cookies, steal information entered in forms, as well as a keylogger, which registers anything the user types in the browser. All of this information is then sent back to the attackers.   Researchers have likened the capabilities of the extension to a banking trojan. They suggest the ultimate aim of the malware is to obtain user credentials, either for sale on the dark web or for further exploitation by the attackers. The cyber criminals behind MagnatBackdoor and MagnatExtension have spent years developing and updating the malware and that’s likely to continue.  “These two families have been subject to constant development and improvement by their authors – this is likely not the last we hear of them,” said Tiago Pereira, a security researcher at Cisco Talos.  “We believe these campaigns use malvertising as a means to reach users that are interested in keywords related to software and present them links to download popular software. This type of threat can be very effective and requires that several layers of security controls are in place, such as endpoint protection, network filtering and security awareness sessions,” he added. 
    MORE ON CYBERSECURITY More

  • 125 Shares169 Views

    in Information Technology

    Twitter removes another 3,000 state-backed accounts linked to six countries

    Image: Nikolas Kokovlis/NurPhoto via Getty Images
    Twitter has removed another 3,465 state-backed accounts as part of efforts to limit the influence of information manipulation campaigns on the web. The social media platform explained in a blog post that the account sets that have been removed include eight “distinct operations” that can be attributed to China, Mexico, Russia, Tanzania, Uganda, and Venezuela. “Every account and piece of content associated with these operations has been permanently removed from the service,” Twitter said. Listing out the operations, the majority of accounts removed in this round of purges were linked to China, with over 2,000 of them amplifying Chinese Communist Party narratives related to the treatment of the Uyghur population in Xinjiang. Another network of around 100 accounts were connected to “Changyu Culture”, a private company backed by the Xinjiang regional government. Rounding out the top three governments that had their linked accounts removed was the Ugandan government, which had 418 of its linked accounts that used inauthentic activity to support having the Ugandan presidential incumbent Museveni removed, while 277 Venezuelan accounts amplifying accounts and content that supported the presiding government were removed. In addition to banning these accounts and the content shared by them, Twitter has shared relevant data from this disclosure with the Australian Strategic Policy Institute, Cazadores de Fake News, and the Stanford Internet Observatory.

    The disclosure comes during a week where Twitter’s founder Jack Dorsey resigned from the company’s CEO post. Twitter on Wednesday also announced the expansion of its private information policy to include the sharing of private media, such as photos and videos, without permission from the individuals that are depicted in them. Related Coverage More

  • 163 Shares189 Views

    in Networking

    How Myanmar coup forced International School of Yangon to change its critical comms

    Image: Getty Images
    Just as The International School of Yangon (ISY) in Myanmar was preparing to reopen and return to face-to-face learning following COVID-19 lockdowns, the country was forced to grapple with widespread political unrest after military forces seized control in a coup d’état on February 1.For an initial period, it was relatively peaceful, but that all changed when the army was deployed, John Whalen, director of health, safety and security at ISY, told ZDNet, describing how he periodically heard gunfire and explosions from his house in Yangon.”It was almost like the gloves were off and that’s when there were nighttime raids, shootings at checkpoints, lots of arrests … it was bad. [The military] was cracking down on the actual protests, so you had an armed army going after unarmed civilians,” he said.In the wake of the military coup, the ISY was forced to reconsider the way its 200-plus faculty and staff would communicate during such emergencies.”For the past couple of years, we have been, as a school, discussing various mechanisms to communicate in case of emergency and had never really come up with [one]. We’ve come up with a lot of solutions, but not really the ideal solution,” said Whalen, who was formerly head of the Office for the US Drug Enforcement Administration in Yangon.”At the time, and up until the coup happened, our solution was a WhatsApp group. It’s very simple and the level of security on it is not great … of course, we also have school emails and we put out email blasts. “But what we were really looking for was something that we could get something out and not only be able to broadcast out, but also have some sort of accountability as well. Knowing where people are was important and knowing whether or not people are in trouble was important.”

    The other consideration as part of this upgrade, according to Whalen, was to look for an alternative that was not dependent on the internet. Following the military coup, the country suffered internet and phone disruptions. The country’s telco giant Telenor Myanmar then confirmed it was ordered by the Myanmar Ministry of Transport and Communications to temporarily shut down its data network in Myanmar, while voice and SMS services remained open. “Initially, when the coup happened, the internet was up and running … but at some point, they took mobile data down because the military realised everybody was communicating on Facebook, WhatsApp … but [the faculty] still had access to the internet using foreign SIM cards … and our school still had fixed fibre,” Whalen said.While leveraging mesh networking could have been an option, Whalen said getting the right equipment would have been “almost impossible”. The other solution, which was what ISY opted for, was Blackberry’s AtHoc critical event management platform that coincidentally was also a system that was used by his former workplace, the US Embassy, in Yangon. “I’m sitting having lunch with a friend of mine from the US Embassy and he starts getting an alert on his phone and the US Embassy was using that system, so he showed it to me and so that kind of sold me on the demonstration,” he said. ISY rolled out the system just as ISY staff were being evacuated out of the country in March. “We didn’t have a chance to really use it that much, but it did give me an opportunity to test it with our local staff, which we continue to do,” Whalen said. “Even though I’m [in the US] at the moment, we’re using it now for … informational news segments of what’s actually happening within the country, so that when our local staff returns there, they have some situational awareness of what’s going on.”Using the AtHoc system, the messages are being delivered in various formats, including email, SMS, through the AtHoc app, and as phone calls. These messages are also being sent in Burmese, Whalen added. With hopes that ISY will see all faculty return to Yangon and in-person learning resume by January, Whalen wants to incorporate the AtHoc system to be able to track student school buses.”When everybody is back, and with everything that’s going on, we’re going to be very attentive to making sure that we can account for everybody all the time,” he said.Related Coverage  More

  • 163 Shares169 Views

    in Networking

    Cisco Australia restates 2020 as loss, now says back in profit for 2021

    Image: Shutterstock
    The AU$79.7 million in net profit that Cisco Australia claimed last year has been shown in its most recent financials to have had no basis in reality, with the local arm of the networking giant actually posting a AU$16.7 million loss. On 31 January 2020, Cisco Australia purchased Zomojo, which traded under the Exablaze label and designed and built field programmable gate array network devices, for AU$118 million. It included four entities — Zomojo, Zomojo Services, Exablaze, and Zomojo Staff Holdings — which became subsidiaries of Cisco Australia. On 18 November 2020, Zomojo Staff Holdings was deregistered from Australian Securities and Investment Commission, and Zomojo Services followed on 25 March 2021. In stating its latest earnings, Cisco said it needed to restate the carrying value of Zomojo as of its 2020 year end. “During the period it was discovered that impairment charges over the carrying value of the investment in subsidiaries had not been recorded appropriately and accordingly the carrying value of investment in Zomojo of has been restated from AU$116,206,000 to AU$28,037,000 as at 25 July 2020,” it said. “Additional impairment charges of AU$88,168,000 recognised in the comparative period have resulted in the net profit for the period ended 25 July 2020 of the Parent entity being restarted from AU$68,467,000 to a net loss for the period of AU$19,701,000.” That was not the only restating Cisco Australia needed to make for 2020, as a review of its transfer pricing policies found incorrectly values there as well. Consequently, Cisco Australia restated its 2020 revenue was AU$5.7 million lower, had AU$39.6 million increase in cost of sales, and paid AU$13.6 million less in income tax. For its 2021 fiscal year that ended on July 31, Cisco Australia reported revenue was down by AU$121 million to AU$1.87 billion, consisting of AU$1.08 billion in product revenue, which was down from AU$1.21 billion, and service revenue of AU$466 million which represents a AU$31 million increase on 2020.

    With much lower impairment expenses in 2021, pre-tax profit was reported as AU$55 million and after a AU$17 million income tax charge, gave net profit of AU$37.8 million. Cisco Systems Australia has an immediate parent of Cisco Systems Netherlands Holding B.V. before reaching its ultimate parent Cisco Systems Inc in the United States. In 2021, Cisco Australia paid a AU$70 million dividend to its owners, compared to AU$43.4 million paid out last year. Over the course of the year, Cisco Australia was charged a total of AU$1 billion in service fees and cost of sales expenses by its parents and related parties, with AU$299 million flowing in the opposite direction to the Australian arm, both numbers are down on last year. The company said it also purchased over AU$45 million in “various goods and services” from its ultimate parent and related entities throughout the fiscal year. As of July 25, Cisco Systems Australia had 1,392 employees, a mild increase on last year’s 1,378, however its wages and salaries line item grew from AU$395 million to AU$410 million. Related Coverage More

  • 138 Shares189 Views

    in Information Technology

    Federal government refreshes digital transformation strategy and expands cyber hub trial

    The federal government has released an updated digital government strategy as part of its goal to make Australia one of the top three digital governments in the world by 2025. It has been working on the refresh for more than a year, and the culmination of consultation is an updated 28-page digital government strategy. Under the strategy, the government has set out three priorities for its services in trying to achieve that goal. These priorities are making all government services digitally available, easily accessible, and people and business-centric.The updated priorities do not steer far from those in the government’s previous digital strategy, which had set out priorities of making government easier to deal through the adoption of myGovID and informing citizens about government’s use of data.On a practical level, delivering the new strategy will entail uplifting digital ecosystems, reusing certain technologies to deliver value for money, and expanding the government’s digital workforce, said Stuart Robert, the minister responsible for whole-of-government data and digital policy.The strategy refresh comes days after a Senate committee blasted the federal government for its lack of progress in auditing its IT capabilities. The Senate Standing Committee on Finance and Public Administration on Monday said progress on an “urgent audit” that government agreed to undertake was lagging, which has caused delays for its IT advancement. The audit was agreed to based on recommendations made in an independent review of federal government agencies.The committee also noted that the federal government currently has no central data collection process related to IT expenditure across government.  Addressing the independent review, Robert said it uncovered that government needed to approach uplifting digital capabilities differently.

    “We need to better align the approaches of agencies to address common challenges, reducing the duplication of effort,” he said. “We need to make data more readily available and accessible to inform evidence-based decision making.”Alongside the strategy refresh, Robert announced a slew of other digital government movements, which included a new whole-of-government architecture, re-use policy and catalogue, whole-of-government digital and IT oversight framework, and trials of cyber hubs. The new whole-of-government architecture consists of standards, guidance, products, and tools to support federal government agencies for designing digital capability and implementing and operating technologies, Robert said.He also claimed the architecture would also give industry guidance on the federal government’s IT direction, including the digital capabilities it wants to be built in a reusable way.”Through the whole-of-government architecture, the DTA has worked in concert with government departments and agencies to map out all the strategic capabilities that we require as a government. They are now working towards identifying the existing digital and ICT assets across whole of government and the capability gaps we need to fill,” Robert said.The architecture will be complemented by a re-use policy and catalogue designed to provide government agencies a more informed view of emerging or existing government platforms and what could potentially be reusable platforms.”Reuse of core tech is now a Cabinet mandated requirement,” Robert said.Outlining the whole-of-government digital and IT oversight framework, Robert said all future digital and IT spending proposals put forward by agencies would be required to comply with various government policies, ranging from its digital service standards to cybersecurity guidelines to the re-use catalogue.In addition, all digital and IT proposals must contain an assurance plan signed off by the Digital Transformation Agency (DTA) and the relevant department as part of this new oversight framework.”[This] provides an important institutional lever for the government to monitor high cost or high risk digital and ICT-enabled investment proposals, and ensures these proposals align with whole-of-government digital policies from the earliest point in the policy development process,” Robert said.Turning to Robert’s announcement about trials of cyber hubs, he explained that the federal government would develop four cyber hubs that will be tasked with protecting all departments and agencies. The cyber hubs will be modelled off Services Australia’s 24/7 Cyber Ops Centre.The trial is an expansion of the DTA’s cyber hub pilot from earlier this year where Home Affairs, Defence, and Services Australia were providers in the pilot.Services Australia, Tax, Defence, and Home Affairs will each be a provider for one cyber hub in the trial, Robert said. RELATED COVERAGE More

  • 138 Shares99 Views

    in Networking

    Huawei wants to tap green opportunities with carved out power business

    Huawei Technologies is keen to tap growing demand for clean energy and IT sustainability, as organisations and nations across the globe set carbon neutrality goals. The Chinese technology giant has carved out a new subsidiary with dedicated resources to develop low-carbon systems, which can be deployed in various market segments such as data centres and electric vehicles.Set up in June 2021, Huawei Digital Power Technologies is tasked with driving clean energy and the digitalisation of traditional energy, It will work to build products that integrate digital and power electronics technologies, said Sun Bohan, Asia-Pacific president of Huawei Digital Power, in a video interview with ZDNet.He noted that carbon neutrality had become a shared target for more than 140 markets, of which 12 had issued new laws to achieve their goals, while four had proposed similar legislations and another 37 had issued related policies. 

    Singapore puts budget focus on transformation, innovation

    After tilting last year’s budget towards ’emergency support’ in light of the global pandemic, Singapore’s government will spend SG$24 billion ($18.1 billion) over the next three years to help local businesses innovate and build capabilities needed to take them through the next phase of transformation.

    Read More

    These global targets as well as market demand had guided Huawei Digital Power to work on products that facilitated low-carbon environments across different scenarios, including green data centres, cities, campuses, buildings, and factories,  Sun said. He noted that 60% of Huawei’s overall research and development (R&D) team are part of Digital Power. Setting up a separate business unit enabled the vendor to establish specific R&D work and integrate product features that catered to specific deployment requirements across various markets, so they could better meet their carbon neutrality targets, he said. Asked about the subsidiary’s revenue and customer base since its inception in June, the Huawei executive declined to provide details, but said he hoped to provide some indicative figures next year.  Speaking at COP26 last month, Huawei Digital Power’s vice president and CMO Fang Liangzhou said technology advancements were integral to combating climate change and decarbonisation. 

    He noted that electricity and transportation were amongst the main sources of global carbon emissions, accounting for 40% and 21%, respectively, of total emissions. Citing figures from International Energy Agency, Fang added that the ICT industry consumed 4% of global electricity. This underscored the importance of low-carbon power generation and electric energy consumption in achieving carbon neutrality, he said, adding that Huawei Digital Power aimed to drive clean power generation. This included smart photovoltaic (PV) systems designed for renewable energy technologies such as solar, wind, and energy storage. According to Sun, the Chinese vendor currently is working with several customers in this region on the development of smart PV farms. In Singapore, for example, Huawei’s string inverters were installed on Sunseap Group’s floating solar platform, next to the PV panels, which bypassed the need for a direct current (DC) cable line and DC combiner boxes. This reduced costs and deployment time, Huawei said. The five-hectare Sunseap floating solar farm comprises 13,312 panels, 40 inverters, and more than 30,000 floats. It is projected to generate up to 6.02 million kWh of energy per year, enough to power 1,250 four-room HDB flats in Singapore and offset  an estimated 4,258 tons of carbon dioxide. Huawei Digital Power also recently inked a deal with Thai conglomerate Charoen Pokphand (CP) to install PV panels on the rooftops of 1,300 7-Eleven stores. CP is the sole operator of the convenience stores in Thailand. Towards zero-carbon data centresAsked what were key barriers to achieving carbon neutrality, Sun said the long process of developing and replacing traditional energy with clean energy alternatives would prove challenging for many markets, especially developing nations. He added that the cost of producing clean energy components, especially solar and wind, would need to be reduced to accelerate adoption. Noting that the cost of materials had increased recently, he said the price of PV panels, for instance, had more than doubled year-on-year and this had a significant impact on the industry. He also pointed to the need to bring down the cost of energy storage systems, so the industry could move from unstable to stable power, which was an important component for clean energy materials. Developing low-carbon energy sources and technologies that consumed less power were key to achieving carbon neutrality targets, Sun said, adding that this drove much of Huawei Digital Power’s research efforts. Data centres, in particular, was a key focus, as these facilities consumed large amounts of electricity and more would need to be built to support growing adoption of online services, he said. Power tariffs and energy consumption account for more 60% of the overall cost of running a data centre, he added.Responding to ZDNet’s question on whether it was possible to operate zero-carbon data centres, Sun said the key catalyst for this would be the ability to power these facilities completely on clean energy such as solar or wind. However, he noted that Huawei’s internal research revealed it currently would require significantly large hectares of PV plants just to power one data centre. While existing technology meant it would be challenging to run zero-carbon data centres, he said this might be possible in future as the technology continued to advance. Overall efficiencies of operating these sites and system-level capabilities also would need to be improved, he added. Artificial intelligence (AI), for instance, should be tapped to help enhance operational efficiencies and reduce energy consumption. He noted that telcos currently use AI to better optimise their base stations to user demand, hence, reducing power consumption and cutting their annual electricity tariffs by 15% to 17%. In addition, systems deployed in data centres could be more compact, with higher density, so the overall efficiencies of a data centre could be improved. According to Huawei, as of June 2021, it helped its customers generate 403.4 billion kWh of green power, save 12.4 billion kWh of electricity, and reduce carbon emissions by 200 million tons.RELATED COVERAGE More

  • 163 Shares169 Views

    in Information Technology

    Colorado energy company loses 25 years of data after cyberattack, still rebuilding network

    Colorado’s Delta-Montrose Electric Association (DMEA) is still struggling to recover from a devastating cyberattack last month that took down 90% of its internal systems and caused 25 years of historic data to be lost. In an update sent to customers this week, the company said it expects to be able to begin accepting payments through its SmartHub platform and other payment kiosks during the week of December 6.”We also tentatively estimate we will be able to resume member billing the week of December 6 – 10. We recognize this will result in members receiving multiple energy bills close together. As a reminder, we will not disconnect services for non-payment or assess any penalties through January 31, 2022,” the company said on a page that has been updated repeatedly over the last month. The company said it began noticing issues on November 7, and the cyberattack eventually brought down most of its internal network services. The attack affected all of the company’s support systems, payment processing tools, billing platforms and other tools provided to customers. DMEA said the hackers were targeting specific parts of the company’s internal network and corrupted saved documents, spreadsheets, and forms, indicating it may have been a ransomware incident. The attack even affected the company’s phone and email systems, but DMEA said the power grid and fiber network were not touched during the attack. The energy company hired cybersecurity experts to investigate the incident, but nearly a month later they are still having issues recovering. 

    “We are currently operating with limited functionality and are focused on completing our investigation and restoring services as efficiently, economically, and safely as possible. We are committed to restoring our network and getting back to normal operations, but that will take time and requires a phased approach,” the company explained. They created temporary payment arrangements to deal with the outages and have suspended all penalty fees and disconnections for non-payment through January 31, 2022.Despite the damage to their system, DMEA claimed no sensitive data from customers or employees was breached. But they now have to work through a “phased restoration approach” as they rebuild their systems. DMEA CEO Alyssa Clemsen Roberts said the impact on their systems was “extensive” and that a good portion of their saved data, such as forms and documents, was corrupted. “The path to full restoration will take time, and it may result in many of our members receiving back-to-back energy bills. With colder weather approaching and the holiday season already here, we recognize this incident has come at an unfortunate time,” Roberts said. “This isn’t how we hoped to close out the year, and on behalf of all of us at DMEA, I am grateful for your patience, support, and understanding as we navigate this incident.”Saryu Nayyar, CEO at cybersecurity firm Gurucul, said utilities tend to have complex networks that often comingle enterprise operations with mission control.”It’s a bit of a surprise that we haven’t seen more attacks on public utilities, but there is no question that more are coming,” Nayyar explained. The headline-grabbing ransomware attack on Colonial Pipeline earlier this year involved similar issues. Attackers brought down the company’s business technology networks, forcing the energy producing side to struggle as well. SecurityGate CISO Bill Lawrence added that while the term ‘ransomware’ is not in any of the reporting or DMEA’s explanation of events, they had a large portion of their data corrupted and their internal phone system went down too. “It will be interesting to learn a motive behind this attack if there are no ransom demands,” Lawrence said. “Co-ops are owned by their local communities, so the local folks will be dealing with increased costs due to response and recovery from the attack.” More

  • 125 Shares169 Views

    in Information Technology

    DHS: Cybersecurity coordinators and vulnerability assessments mandatory for rail companies

    The Department of Homeland Security (DHS) announced two new cybersecurity directives handed down by the Transportation Security Administration (TSA) on Thursday designed to better protect freight railroads and passenger rail transit in the US.

    TSA said rail services are “higher risk” and that the new rules “need to be issued immediately to protect transportation security.”The new rules make it mandatory for rail company owners and operators to have a cybersecurity coordinator, report cybersecurity attacks to CISA in 24 hours or less, and create a cybersecurity incident response plan. The rules also require owners to complete cybersecurity vulnerability assessments.DHS also detailed voluntary measures to improve cybersecurity across the transportation sector following a series of attacks over the last two years. “These new cybersecurity requirements and recommendations will help keep the traveling public safe and protect our critical infrastructure from evolving threats,” said Secretary of Homeland Security Alejandro Mayorkas. “DHS will continue working with our partners across every level of government and in the private sector to increase the resilience of our critical infrastructure nationwide.” These are just the latest cybersecurity directives handed down by DHS this year, as the agency seeks to charge government-adjacent industries to improve their cybersecurity measures. Following multiple attacks on critical infrastructure in the US this year — including oil pipelines, transportation companies, and agricultural organizations — DHS has regularly provided new guidance and mandatory rules. 

    Congress is also mulling a variety of bills related to incident reporting and other cybersecurity measures. While previous administrations sought to promote cybersecurity hygiene through voluntary measures, the Biden Administration has handed down more stringent measures as ransomware incidents continue. DHS has faced backlash from some private sector companies and Republican members of Congress over the cybersecurity rules, with many arguing that they are being forced on companies without advance guidance. In its statement on Thursday, DHS made a point of saying TSA worked with “industry stakeholders,” “federal partners,” and CISA to create the directives. Victoria Newhouse, a TSA deputy assistant administrator, confirmed to Congress on Thursday that private industry experts were consulted on the new rules. Newhouse said she and other officials met with rail companies to discuss the range of threats facing their industry. One of the criticisms Republican lawmakers have levied against DHS is that the directives are being handed down in the absence of detailed, specific threats. On Thursday, DHS said CISA “provided expert guidance on cybersecurity threats to the transportation network and countermeasures to defend against them.”TSA suggested “all other lower-risk surface transportation owners and operators” also institute the rules, although it would be voluntary. TSA already released guidance for aviation industry operators, pipelines, and other enterprises. A DHS official told The Wall Street Journal that Thursday’s directives will affect 90% of passenger rail systems in the US and 80% of freight rail systems that they consider high risk. More