Eliana Willis

More stories

  • 200 Shares169 Views

    in Information Technology

    Ransomware is now a giant black hole that is sucking in all other forms of cybercrime

    Ransomware is so lucrative for the gangs involved that other parts of the cybercrime ecosystem are being repurposed into a system for delivering potential victims.

    ZDNet Recommends

    “The gravitational force of ransomware’s black hole is pulling in other cyberthreats to form one massive, interconnected ransomware delivery system — with significant implications for IT security,” said security company Sophos in a report. Ransomware is considered by many experts to be most pressing security risk facing businesses — and its extremely lucrative for the gangs involved, with ransom payouts increasing significantly.See also: A winning strategy for cybersecurity (ZDNet special report).Sophos said that ransomware is becoming more modular, with different groups specialising in particular elements of an attack. It also pointed to the linked rise of ‘ransomware as-a-service’, where criminal gangs are able to purchase access to tools to run their own ransomware attacks when they lack the technical ability to create those tools themselves.These so-called ransomware ‘affiliates’ don’t even have to find their own potential victims: the ransomware ecosystem has developed so that they can go to other groups who specialise in gaining access to corporate networks and who will sell that backdoor on to them.As well as doing business with these ‘initial access brokers’, would-be ransomware attackers can turn to botnet operators and malware delivery platforms to find and target potential victims. And because of the potential profit to be made, these groups are increasingly focusing on serving ransomware gangs rather than concentrating on less lucrative forms of online crime, Sophos said.

    “Established cyberthreats will continue to adapt to distribute and deliver ransomware. These include loaders, droppers and other commodity malware; increasingly advanced, human-operated Initial Access Brokers; spam; and adware,” said the security company.The idea of ransomware-as-a-service has been around for a while, and has often been a way for lower-skilled or less well-funded attackers to get started. But what has changed now, said Chester Wisniewski, principal research scientist at Sophos, is that ransomware developers are now using this as-a-service model to optimise their code and get biggest payouts, offloading to others the tasks of finding victims, installing and executing the malware, and laundering the cryptocurrencies. See also: Ransomware: It’s a ‘golden era’ for cybercriminals – and it could get worse before it gets better.Separate research has even suggested that ransomware gangs are now rich enough to start buying their own zero-day flaws, something that was previously only available to state-backed hackers.”This is distorting the cyberthreat landscape,” Wisniewski said, as common threats such as loaders, droppers, and Initial Access Brokers — which were around and causing disruption well before the ascendancy of ransomware — are now servicing the demands of ransomware gangs. More

  • 113 Shares99 Views

    in Networking

    What Cisco's Q1 earnings report is really telling us

    Cisco Systems announced its FY22 Q1 earnings this week. ZDNet posted this story covering the report, but as is often the case, the numbers don’t tell the whole story. On the surface, Cisco reported what would be considered by most analysts to be in-line first-quarter numbers, because the company’s revenues were at the midpoint of its guidance and a shade below consensus estimates. Revenue growth remained steady, up 8% year-over-year, which was certainly positive. Second-quarter guidance was also slightly below expectations as the company indicated revenue growth of 5% to 7%. 

    One might look at the quarterly results and see a company that’s struggling to meet its own targets, but as mentioned previously, the numbers can be misleading — particularly in this current macro environment. Here are the most important points gleaned from Cisco’s quarterly report:Cisco’s business has never been stronger. Despite the “meh” revenue numbers, Cisco’s business is stronger than ever. It is being held back by ongoing component shortages. Although revenue was up only 8%, order growth hit a decade-high record of 33%, up from 31% last quarter, meaning growth is accelerating. Other indicators are that annual recurring revenue (ARR) was $21.6 billion, up 10% year-over-year, and remaining performance obligations are now $30.1 billion, also up 10%. During the Q&A section of the call, CEO Chuck Robbins said: “With that RPO and the backlog that we have, the stuff (Cisco products) is going to ship. Short term, this doesn’t feel great. What we are seeing is that the customers are making decisions right now to choose our technology across the board,” indicating that Cisco’s portfolio approach is working but the component shortage is holding the company up. One more note: Cisco, despite the lower guide, did reiterate full-year guidance, indicating the back half of the year should make up for the current slight miss. A margin rebound is coming. One of the metrics that investors watch is Cisco’s margins. Gross margin this quarter was 64.5%, down 130 basis points from a year ago. It’s important to note that a 64.5% gross margin is remarkable, particularly for a company that sells products that experts said would be commoditized by now. But the fact is margins are lower, which could indicate increased competitiveness or price pressure. The reality is that Cisco has been overpaying for components, delivery, shipping, and anything else it can do to get products into its customers’ hands faster, and this has acted as a drag on margins. The company did announce it had raised prices to offset the higher costs, and customers seemed to be fine with this as they understand the current challenges. CFO Scott Herren explained that it takes a few quarters for the higher prices to make their way through the channel and procurement processes, and he indicated margins will return to normal in a couple of quarters.  Cisco has revamped its webscale business. Cisco has long been known as the 800-pound gorilla and de facto standard in networking for companies of all sizes. The one exception was webscale. In that industry, Cisco was not just a laggard but for years, not even a serious contender for the business.  A few years ago, Cisco got closer to the cloud giants by working with them to develop products, rather than assuming it knew what they wanted and developing apps without them. In a relatively short time — just a couple of years — it has turned this business around; this quarter its webscale business grew by 200%. Cisco’s differentiation in this space is in its Silicon One chips. The 11th processor in this family, the P100 chip, is capable of routing at 19.2 TB. Their custom-versus-merchant silicon debate has been an ongoing one, but Cisco has always obtained a performance advantage because it can customize a chip to a specific use case versus merchant silicon that’s more general-purpose. Its product revenue in this area was up over $1 billion year-over-year, showing Cisco’s strength in this area. Cisco is a massive software company. The company is best known for its market-leading hardware, but Cisco ranks among the biggest software companies in the world. This quarter, it delivered a whopping $3.7 billion, with 80% sold as subscriptionware. This annualizes to almost $15 billion in software revenue. At that number, Cisco is the fourth-largest software company in the world, ranking just ahead of Adobe. Software revenue comes from every part of Cisco’s business, including networking, collaboration, security, application performance, and data center. Expect Cisco to continue to push more innovation into software in the future.  Work to be done in security. Cisco’s security business was up 4% year over year and given the size of this business, that’s a healthy number. Looking back though, Cisco’s security business had a growth number of 18% in 2019, which declined to 12%, then 7%, and now 4%, indicating a deceleration of the business. Meanwhile, the security pure-play companies have been seen growth in the teens — and even 20% — range. This is partially explained by the shift in the business, because the traditionally purchased perpetual products are in decline, acting as a headwind for growth. The subscription-based business from products such as zero-trust and unified threat management grew a healthy 15%, so there’s a careful balancing act Cisco has been doing. Also, some of its security hardware products have been affected by the component shortage, which also has an impact. This partially explains the deceleration, but the reality is that the security industry is tending to a platform purchase model. In today’s network-centric world, Cisco’s dominant share in networking should enable it to dominate security — perhaps not as it does in networking, but in that ballpark. The business is transitioning to software, which is certainly impacting the company, and Cisco does have some work to do here. Robbins will make sure the work gets done. More

  • 150 Shares119 Views

    in Networking

    When NBN promo deals end, customers and telcos revert to old speeds

    The orange is shrinking
    Image: ACCC
    The latest edition of the NBN Wholesale Market Indicators Report from the Australian Competition and Consumer Commission (ACCC) has revealed the number of connections on NBN’s 250/25Mbps Superfast and 500-1000Mbps/50Mbps Ultrafast plans has dropped by nearly 200,000 lines. Combined with users continuing to leave 12Mbps and 25Mbps plans, it has left 58% of the network now on 50Mbps plans. Over the September quarter, almost 45,000 lines moved off 12Mbps plans leaving 924,000 connections, 122,000 moved off 25Mbps with 945,000 now on that speed, 171,000 lines switched from Superfast leaving 389,000 active connections, and 24,700 dropped Ultrafast tiers for under 62,000 to remain. Almost 353,000 lines shifted to 50Mbps with the total number now at 4.9 million, and over 50,000 took up 100/20Mbps plans taking the total to over 423,000. These shifts are sometimes instigated by users, but often times it can be the telcos purchasing cheaper bandwidth at higher tiers and “gifting” speed increases to customers. In the December quarter, for instance, TPG Telecom had 468,000 fewer connections on 100Mbps speed plans, but it saw an extra 335,000 lines move onto 250Mbps, and 113,000 extra 50Mbps plans. For this quarter, the telco had 282,000 fewer 250Mbps connections, 43,000 fewer Ultrafast lines, and 292,500 more 50Mbps connections and almost 63,900 100/40Mbps lines. “The 50Mbps and 100Mbps speed tiers have been very popular with consumers recently, which is understandable as extended lockdowns in several states and territories have resulted in millions of people working and learning from home,” ACCC commissioner Anna Brakey said.

    “As temporary promotions wind down and retailers adjust pricing accordingly, we strongly encourage customers to think about their internet needs and pay for a higher speed tier only if their usage demands it.” Fresh off its Exetel acquisition, Superloop has made its first entrance into the report, breaking through to be called out on its own, rather than bundled into others. Sitting around 1.5% market share with approximately 126,700 customers, Superloop has between 33,300 and 36,900 customers each on full fibre, fibre to the node, and cable technologies. “Smaller niche providers have injected competition into the market for broadband services and they now go some way to constraining the big four of Telstra, TPG, Optus, and Vocus,” Brakey added. “Smaller providers give consumers real choice in the service quality and range of products to meet their needs.” As a result of Exetel joining Superloop, the ACCC said Optus saw its wholesale market share drop by 1.1%. Overall CVC capacity across the NBN network now sits at 2.82Mbps per user. Related Coverage More

  • 88 Shares149 Views

    in Information Technology

    Palo Alto Networks raises FY22 revenue guidance

    Palo Alto Networks on Thursday published solid first quarter financial results and raised its FY 2022 revenue guidance. Non-GAAP net income for the first quarter was $170.3 million, or $1.64 per diluted share. First-quarter revenue grew 32% year-over-year to $1.2 billion. Analysts were expecting earnings of $1.57 per share on revenue of $1.2 billion.”Q1 was a strong start to fiscal year 2022, driven by strength in both our product and Next-Generation Security businesses, giving us confidence to raise our revenue and billings guidance for the year,” chairman and CEO Nikesh Arora said in a statement. “We continue to see strong customer demand and have continued to release key innovations which give us confidence in the durable growth we presented at our September Analyst Day.”   First-quarter billings grew 28% year-over-year to $1.4 billion. Remaining performance obligation (RPO) grew 37% to $6 billion.
    Palo Alto Networks
    The company highlighted the performance of Primsa SASE, noting rapid adoption of the secure access service edge (SASE) service. Prisma SASE saw 100% year-over-year ARR growth. Meanwhile, more than 25% of new Prisma SASE customers are new to Palo Alto Networks over the last 12 months. The company now has 1,756 SASE customers, up 61% year-over-year.In the area of cloud-native security, Palo Alto reported that it now has 1,676 Prisma Cloud customers up 26% year-over-year.

    For Q2 2022, Palo Alto expects revenue in the range of $1.265 billion to $1.285 billion. Analysts are expecting revenue of $1.27 billion. For the full fiscal year 2022, the company expects total revenue in the range of $5.35 billion to $5.40 billion, representing year-over-year growth of between 26% and 27%. Last quarter, the company forecast FY2022 revenue in the range of $5.275 billion to $5.325 billion.

    Tech Earnings More

  • 138 Shares99 Views

    in Information Technology

    Cloud security firm Lacework secures $1.3 billion in new funding round

    Lacework has raised $1.3 billion in a new funding round to bolster its position in the cloud security market. 

    Announced on Thursday, the Series D funding round was led by existing investors Sutter Hill Ventures, Altimeter Capital, D1 Capital Partners, and Tiger Global Management. New investors have joined, including Liberty Global, General Catalyst, Snowflake Ventures, and Morgan Stanley Investment Management.Founded in 2015, Lacework develops cloud security solutions for the cloud, containers, and DevOps teams. The Lacework Cloud Security Platform collects, analyzes, and compiles security and threat data for anomaly detection, event and alert visualization, and compliance.  The San Jose, Calif.-based company counts Cloudera, VMware, Nextdoor, and Snowflake among its customers.  Lacework says the cash injection will be used to expand go-to-market strategies in the cloud security sector and to fund product development and innovation.  In addition, the security firm says that some of the funding will be used to “pursue additional strategic acquisitions,” building upon the recent purchase of Soluble. 

    Soluble, a cloud infrastructure management company, was acquired earlier this month. The purchase price was not disclosed.  Lacework previously closed a $525 million funding round. The company has now completed five separate funding rounds since 2015. “Lacework’s Cloud Security Platform was built in the cloud, for the cloud. It’s a fundamentally different — and better — approach to security that is already dramatically reshaping the security market,” commented Mike Speiser, Managing Director of Sutter Hill Ventures. “With an outstanding platform and an exceptional team, Lacework has repeatedly exceeded every goal over the last 18 months. We continue to believe this is one of our most promising portfolio companies.” Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

  • 150 Shares149 Views

    in Information Technology

    Dark web crooks are now teaching courses on how to build botnets

    Botnets are one of the key drivers of cyberattacks, used to distribute malware, ransomware and other malicious payloads – and dark web forums are now offering lessons on how to make money from them, a move that is likely to increase the threat over time.Infected computers and devices in a cyber criminal-controlled botnet can be used to send phishing emails or malware to even more devices. It’s common for botnet operators to lease out their collection of unwittingly controlled machines – which can number in the thousands – to other cyber criminals. 

    ZDNet Recommends

    For example, TrickBot malware ropes machines into a botnet, providing the attacker with a backdoor into them. That access is often sold to cyber criminals who can then use them to deploy ransomware, using that access to encrypt files and demand a significant ransom payment. Many botnets are used to steal usernames and passwords, while others will take the processing power of the machines they control and lease them out to launch DDoS attacks in order to overflow websites with traffic and take them down. SEE: A winning strategy for cybersecurity (ZDNet special report) Botnet operators can, therefore, make significant sums of money, and now there are dark web operators who are offering online courses to train others on using botnets – and they operate much like their legitimate counterparts teaching cybersecurity and other skills in online courses. Cybersecurity researchers at Recorded Future analysed advertising and activity in a botnet school on a prominent underground forum and found that these courses are in demand – something that could be a potential issue for organisations that might be targeted by cyber criminals learning these skills. “It’s essentially like as if you’re in college,” Danny Panton, cybercrime intelligence analyst at Recorded Future told ZDNet. “You’ll have a director and they’ll be virtually teaching you – I don’t believe cameras are going to be on the person – but they have access to a platform and are taught insights into what you need to do to leverage botnets against potential victims.” 

    Those teaching the courses include individuals who run large botnets themselves. The courses aren’t cheap – they cost over $1,400 dollars – but promise to provide even novice cyber criminals with knowledge on how to build, maintain and monetise botnets.”It really is a range of cybercrime experience and levels. You might have people who are seasoned cybercrime fraudsters, but aren’t really familiar with using botnets,” Panton explained. “Then there are people who are just completely new to cybercrime as a whole and just are curious and want to become better seasoned and increase their skills,” he added.Given the nature of the cybercrime world, some might be suspicious that if they hand over money to take part in the course, they’ll be scammed and get nothing in return. But it seems like legitimate a service and the course is subject to reviews, which suggest that the botnet school really offers what it says it does. If it was a scam, it wouldn’t have lasted so long.

    Researchers don’t have the data to detail how many wannabe cyber criminals have taken the course in total, but during the time spent analysing this activity, the number of people taking the classes at any one time could vary; sometimes as few as five people, sometimes as many as 100.SEE: This mysterious malware could threaten millions of routers and IoT devicesThe course covers subjects including how to run a botnet in a way designed to avoid law enforcement attention – because, as demonstrated by the Emotet takedown, the authorities will clamp down hard on botnets when they can. And researchers warn that the existence of these courses likely leads to an increases in the threat of botnets – although by how much is hard to quantify without being able to track the activity of individual users.”It is highly likely that, as a result of these courses, more threat actors become proficient in botnet-oriented attacks,” said Panton. Botnets remain a significant threat to computer networks, but there are measures that can be taken to avoid becoming a victim. These include ensuring networks are updated with the latest security patches, making sure that default manufacturer passwords aren’t in use, and ensuring that internet-facing ports that aren’t necessary for the function of devices are closed. MORE ON CYBERSECURITY More

  • 100 Shares99 Views

    in Robotics

    What's really happening in the medical robotics market

    iStock by Getty Images

    Innovation

    According to Mordor Intelligence, the U.S. medical robotics market is expected to reach $28.34 billion by 2026. These next-generation systems promise lower costs, less hardware, smaller incisions, more precise treatment, increased levels of guidance and automation.But big market predictions are often vague on the specifics. Where specifically is the market opportunity for robotically assisted symptoms? What are the challenges manufacturers face in the highly regulated medical tools market? What are the market drivers and technological advancements behind the trends?I caught up with Darren Porras, Market Development Manager of Medical at Real-Time Innovations (RTI), for a look at what’s really happening (and what’s coming down the pike) for the medical robotics market.GN: In what procedures have medical robots become standard? Why those procedures, and what does that say about the earliest iterations of the technology?Darren Porras: Robotically-assisted systems are increasingly being used today for a broad array of procedures: General Surgeries (e.g. GI, Colorectal), Urological, Gynecological, Neurovascular, Orthopedic (hip/knee implants), and Spinal procedures. These systems provide greater control of surgical instruments and improved visualization to enable more precise and reproducible treatment.  For patients, this means less trauma and faster recovery times. Laparoscopic robotic systems that consist of surgeon-controlled instruments inserted through abdominal ports are the most commercially available systems today to surgically treat a number of cancers, including prostate, bladder, and rectal cancers. While the initial laparoscopic robotic systems expanded upon the already established minimally-invasive approach for laparoscopic procedures, these systems continue to evolve, and other form factors and device architectures are now in use and emerging. For orthopaedic and spinal procedures, robotic arms and intelligent hand-held devices are assisting surgeons in guiding tools for precise placement and treatments. Flexible robotic systems incorporate steerable catheters, bronchoscopes, and other devices to perform lung biopsies and percutaneous cardiovascular interventions. These systems provide deeper access into internal anatomy and through natural orifices. 

    GN: Given the market for medical interventions and the evolving technologies, where are the big market opportunities for medical robots, and why is that the case?Darren Porras: Market opportunity in healthcare is really about how to most effectively and efficiently improve patient care and outcomes. The role of robotics in augmenting surgical tasks during the procedure is only a part of this. The digital transformation in healthcare is redefining how patients are diagnosed, treated, and monitored. This transformation incorporates devices, intelligence, and interoperability of systems and data prior to surgery, during surgery, and for follow-up after surgery. Device manufacturers that develop robotic platforms that integrate holistically and seamlessly with the clinical workflow and leverage data-driven technologies across the device ecosystem will transform minimally invasive surgery. It’s important to note that the majority of surgeries being performed today are not robotic or even minimally invasive. There is a significant opportunity for robotics across all procedure types to improve surgical treatments and patient care. As surgical procedures increasingly utilize data and interoperable intelligent systems to realize clinical efficiencies, assist in decision-making, and automate procedural tasks, robotics will play a key role in meeting the needs of healthcare systems and patients.GN: Can you speak to some of the challenges manufacturers still face, particularly in areas like system development and issues like safety/reliability, interoperability, and cyber security?Darren Porras: These systems pose many technical challenges and new computing paradigms. Evolving technologies and increasing complexity presents a steep learning curve to development teams and a lot of risk. With many competitors entering the market and the need to accelerate feature development, companies must focus their teams on what differentiates their products and leverage state of the art technologies, tools, and reusable reference architectures.Surgical robotics are complex, distributed systems of computing nodes, cameras, sensors, instruments, and other devices that all must work as one integrated system. It’s a data connectivity challenge with a number of simultaneous and demanding requirements for reliability, performance, cybersecurity, and interoperability. Cybersecurity is a big concern. While regulatory bodies, device manufacturers, and hospitals are increasingly collaborating to improve the security of devices and hospital systems, cybersecurity breaches are now a common occurrence. The threat landscape has changed- a couple of teenagers with tools readily available on the internet can launch ransomware attacks and bring down medical devices and vulnerable hospital networks. The consequences of a breach can lead to patient harm, product recalls, and exponential costs to companies that may also include disclosure of trade secrets/IP.  Regulatory bodies are raising the bar for approval with updated cybersecurity guidance and increased scrutiny.  Device manufacturers must design secure communications into the product at the “white-board” stage across the device ecosystem to secure data components across multi-domain networks while satisfying demanding performance requirements and diverse use cases for system and data access. These challenges require new software architectures and state-of-the-art, distributed connectivity solutions that enable intelligent, secure, and real-time connectivity across devices, systems, and network domains from the edge to the cloud. Beyond APIs, connectivity frameworks are needed that enable interoperable, reliable, and flexible architectures that are scalable. Device manufacturers can’t afford to redesign their systems or update hardware whenever they release new features. Leveraging connectivity frameworks enables development teams to focus on their core competencies and application development- thereby accelerating time to market.GN: What’s on the horizon in terms of capabilities? How will AI and automation play a bigger role going forward?Darren Porras: Robotic systems will increasingly become ‘digital platforms’ that leverage data integration and intelligent connectivity across devices to enhance the surgical procedure itself while also being an integral part of a digital surgery ecosystem. By leveraging this interoperability of systems of systems, the power of the convergence of these technologies will truly transform patient care. This requires increasing integration of imaging, visualization, and intelligence through dedicated but increasingly distributed systems and networks. Device and edge-distributed processing are increasingly important for safety-critical robotics applications where key requirements are latency, reliability, and security. This distributed architecture allows systems to process data locally to execute intelligent device functionality efficiently. Remote-teleoperation is another exciting area where we are already seeing systems capable of performing remote surgeries across 5G networks. These capabilities allow surgeons worldwide to collaborate, enable greater access to expert treatments, and reach remote and underserved populations. AI algorithms will enhance the sensing capabilities of surgical instrumentation based on physiological parameters and sensor fusion (e.g. blood perfusion, temperature, pressure sensors). AI will also be leveraged to realize increasing levels of surgical precision,  autonomous functionality, and consistency of surgical procedures. Leveraging data, visualization, and intelligence across distributed devices and networks, these systems will provide real-time guidance during the procedure while also assisting in pre-operative surgical planning and post-operative device and procedure optimization. For example, data and metrics collected from the procedure may be used to provide feedback to improve the next surgery and train other surgeons. Clinical teams across the world may leverage this data to collaborate, advance, and standardize surgical treatments. This offers an incredible opportunity to provide universal access to high-quality care and patient outcomes.GN: What’s your sense of the market appetite for medical robots within both the medical and patient communities? Any pushback from healthcare workers? Any reticence among patient populations?Darren Porras: The high cost of these systems is one key barrier. With new competitors entering the market and as the designs of these systems continue to evolve, it’s anticipated that these factors will drive down costs. Another barrier is the learning curve required by the clinical teams to operate and the difficulty in incorporating these systems into the clinical workflow and hospital ecosystem. Robotically-assisted systems have made great strides in the technical arena- but that’s not sufficient to transform surgery. A system may incorporate the most innovative technology. Still, if the technology is inaccessible, whether due to cost factors, insufficiently trained staff, regulatory constraints, or unavailable due to reliability or security issues- this presents a significant hurdle. Device companies need to incorporate best practices in system design and security and evolve functionality quickly to meet the needs of the clinical teams, the hospitals, and the patients.As the utilization of robotic systems grows and these systems demonstrate value and improved patient care across the care cycle, this will continue to fuel further adoption. While there is a perception that surgeons will be “replaced”, this is not actually the way increasing automation usually plays out in a highly skilled industry. Industry professionals need to collaborate with clinical stakeholders to embrace how procedures can optimally incorporate robotics to elevate what is possible to be done in surgery today and standardize more precise surgical treatments to a greater patient population.At the end of the day, nobody resists what is best for the patient. Patients are calling for technologies that enable the most effective treatments, faster recoveries, and reduced complications. As technology continues to transform patient care, medical device manufacturers must adapt to the needs of the patient, the procedures, and the clinical teams. Surgeons are already taking advantage of the benefits of improved ergonomics, greater visibility, and the ability to treat patients earlier and with higher precision. These systems will continue to improve the automation of surgical tasks and the clinical workflow. By leveraging intelligent and distributed connectivity, it will be difficult to imagine surgeries without robots in the not-too-distant future.  More

  • 150 Shares129 Views

    in Information Technology

    US, UK, and Australia pin Iran for exploiting Fortinet and Exchange holes

    Image: Fortinet, ZDNet
    Cyber authorities across the US, UK, and Australia have called for administrators to immediately patch a quartet of vulnerabilities — CVE-2021-34473, 2020-12812, 2019-5591, and 2018-13379 — after attributing some attacks that used them to attackers backed by Iran. “FBI and CISA have observed this Iranian government-sponsored APT group exploit Fortinet vulnerabilities since at least March 2021, and a Microsoft Exchange ProxyShell vulnerability since at least October 2021 to gain initial access to systems in advance of follow-on operations, which include deploying ransomware,” a joint release stated. “ACSC is also aware this APT group has used the same Microsoft Exchange vulnerability in Australia.” Rather than going after a certain sector of the economy, the authorities said the attackers were simply focused on exploiting the vulnerabilities where possible and, following operation, they then tried to turn that initial access into data exfiltration, a ransomware attack, or extortion. Using the Fortinet and Exchange holes for access, the attackers would then add tasks to the Windows Task Scheduler and create new accounts on domain controllers and other systems to look like existing accounts to maintain access. The next step was to turn on BitLocker, leave a ransom note, and get the data out via FTP. In April, the FBI and CISA issued warnings of the vulnerabilities in Fortinet gear being actively exploited, and the full quartet of authorities placed Fortinet on the top 30 exploited vulnerabilities in July. Separately on Wednesday, Microsoft issued its own warning of six Iranian groups using vulnerabilities in the same pair of products to drop ransomware.

    The Exchange vulnerabilities cited, known as ProxyShell, were initially exploited by Beijing-backed hackers. ASD is confident it can remain on top of technology Speaking in Canberra on Thursday, the director-general of the Australian Signals Directorate, of which the Australian Cyber Security Centre (ACSC) is a part, Rachel Noble, said the Five Eyes were ready to handle new technology such as quantum cryptography. “A lot of planning is going ahead now among the Five Eyes for quantum-resistant cryptography, so we’ll be ready when quantum computing is out there [and] encryption keys that protect our military and government secrets will be resistant to that,” she said. “We’ve always sort of stayed on top of technology in that regard, and we love to be first to have that and I’m sure we’ll continue to do that in the future. I think quantum computing has an enormous ability to assist us with our signals intelligence and cyber defensive missions. “So of course, we’re investing in making sure we’re ready to go when the world delivers it to us.” The director-general said there were times previously when the ASD believed intelligence-gathering avenues could go dark, but that has not come to pass. “I recall at the time the conversations in ASD about how difficult this would be for us. The irony now is that we feared the lack of communications on the airways and yet now most of us will connect to the Internet by Wi-Fi,” Noble said. “That’s not to say that the change didn’t bring huge challenges for us. Through a mastery of our business and innovation — the people of ASD prevailed.” Noble said efforts last year to take down COVID-19 scammers saw ASD resort to offensive cyber operations because trying to get local telcos to block each IP was not working and became a game of whack-a-mole. “We used our covert online operations and computer network attack capabilities to infiltrate the syndicate and tear it down from the inside. I am proud to say that to this day, that syndicate has not been able to restart their vile business and we’ll be there if they try,” she said. “In cyberspace, ASD is increasingly becoming the first and last line of digital defence that protects our country from cyber attacks, and thwarts those who seek to attack Australia by launching offensive cyber operations of our own. And we are right now fighting that battle with criminals — state actors and serious and organised crime.” Earlier this year, Noble revealed a nationally-known company resisted approaches from the ASD after being hacked, and called in the lawyers. Speaking on Thursday, Noble said ASD could bring signals intelligence expertise to bear in such situations. “It is this intelligence, the decades of investment in capabilities, and the expertise of our people that give us a cutting edge as cybersecurity experts over and above any private company and any other governments in the world,” she said. “So when we ring you and tell you we think you’ve got a problem, and give you some advice about what you might want to do about that, I implore you to take that advice and understand that it might be coming from some of the most top secret and sensitive insights in the world. “We might not be able to tell you the details of what those insights are and in the end you can take your own chances for not listening. “But in the national interest, we would prefer that you didn’t take that chance.” Related Coverage More