Eliana Willis

More stories

  • 150 Shares169 Views

    in Information Technology

    This cryptocurrency miner is exploiting the new Confluence remote code execution bug

    The z0Miner cryptojacker is now weaponizing a new Confluence vulnerability to mine for cryptocurrency on vulnerable machines. 

    Trend Micro researchers said on Tuesday that the cryptocurrency mining malware is now exploiting a recently-disclosed Atlassian Confluence remote code execution (RCE) vulnerability, which was only made public in August this year.  Tracked as CVE-2021-26084, the vulnerability impacts Confluence server versions 6.6.0, 6.13.0, 7.4.0, and 7.12.0.  Issued a CVSS severity score of 9.8, the critical security flaw is an Object-Graph Navigation Language (ONGL) injection vulnerability that can be exploited to trigger RCE — and is known to be actively exploited in the wild.  The vulnerability was reported by Benny Jacob through Atlassian’s bug bounty program. z0Miner, a Trojan and cryptocurrency mining bundle, has been updated to exploit the RCE, as well as Oracle’s WebLogic Server RCE (CVE-2020-14882) an ElasticSearch RCE (CVE-2015-1427), Jenkins, and other code execution bugs in popular server software.   Once a vulnerable server has been found and the vulnerability has been used to obtain remote access, the malware will deploy a set of webshells to install and execute malicious files, including a .dll file disguised as a Hyper-V integration service, as well as a scheduled task that pretends to be a legitimate .NET Framework NGEN task. 

    The task will attempt to download and execute malicious scripts from a repository on Pastebin, but as of now, the URL has been pulled.  These initial actions are aimed at maintaining persistence on an infected machine. In its second-stage payload deployment, z0Miner will then scan and destroy any competing cryptocurrency miners installed on the server, before launching its own — a miner that steals computing resources to generate Monero (XMR). A patch has been released to resolve CVE-2021-26084, and as threat actors will always seek to exploit new bugs for their own ends — the Microsoft Exchange Server attacks being a prime example — vulnerable systems should always be updated with new security fixes as quickly as possible by IT administrators. Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

  • 100 Shares179 Views

    in Information Technology

    Microsoft Autodiscover abused to collect web requests, credentials

    A “design flaw” in the Microsoft Autodiscover protocol was subject to an investigation by researchers who found they were able to harvest domain credentials. 

    On Wednesday, Guardicore Labs’ AVP of Security Research Amit Serper published the results of an analysis of Autodiscover, a protocol used to authenticate to Microsoft Exchange servers and to configure client access.  There are different iterations of the protocol available for use. Guardicore explored an implementation of Autodiscover based on POX XML and found a “design flaw” that can be exploited to ‘leak’ web requests to Autodiscover domains outside of a user’s domain, as long as they were in the same top-level domain (TLD).  To test out the protocol, the team first registered and purchased a number of domains with a TLD suffix, including Autodiscover.com.br, Autodiscover.com.cn, Autodiscover.com.fr, and Autodiscover.com.uk, and so on.  These domains were then assigned to a Guardicore web server, and the researchers say they “were simply waiting for web requests for various Autodiscover endpoints to arrive.” The “back-off” procedure is described as the “culprit” of the leak as failures to resolve URLs based on parsed, user-supplied email addresses will result in a “fail up”: “Meaning, the result of the next attempt to build an Autodiscover URL would be: http://Autodiscover.com/Autodiscover/Autodiscover.xml,” the researchers explained. “This means that whoever owns Autodiscover.com will receive all of the requests that cannot reach the original domain. […] To our surprise, we started seeing significant amounts of requests to Autodiscover endpoints from various domains, IP addresses, and clients.”

    In total, Guardicore was able to capture 372,072 Windows domain credentials and 96,671 unique sets of credentials from sources including Microsoft Outlook and email clients between April 16 and August 25, 2021. Some sets were sent via HTTP basic authentication.
    Guardicore
    Chinese companies, food manufacturers, utility firms, shipping and logistics organizations, and more were included.  “The interesting issue with a large amount of the requests that we received was that there was no attempt on the client’s side to check if the resource is available or even exists on the server before sending an authenticated request,” the team explained.  Guardicore was also able to create an attack method based on an attacker controlling relevant TLD domains which downgraded credentials sent to them in alternative authentication systems — such as NTLM and OAuth — to HTTP basic authentication. Serper told ZDNet, “the protocol flaw isn’t new; we were just able to exploit it at a massive scale.” Past research conducted by Shape Security and published in 2017 explores Autodiscover and its potential for abuse (.PDF). However, the paper focuses on Autodiscover implementations in mobile email clients. Guardicore says it has “initiated responsible disclosure processes with some of the vendors affected” by the latest discovery.In order to mitigate this issue, Guardicore says that Autodiscover TLD domains should be blocked by firewalls, and when Exchange setups are being configured, support for basic authentication should be disabled — as this is “the same as sending a password in clear text over the wire.” Update 20.39 BST: “We are actively investigating and will take appropriate steps to protect customers,” Jeff Jones, Sr. Director at Microsoft said in a statement. “We are committed to coordinated vulnerability disclosure, an industry standard, collaborative approach that reduces unnecessary risk for customers before issues are made public. Unfortunately, this issue was not reported to us before the researcher marketing team presented it to the media, so we learned of the claims today.”  Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

  • 88 Shares169 Views

    in Robotics

    How a drone-in-a-box can help fight wildfires

    Percepto
    The alarming increase in the occurrence of wildfires isn’t going away. In fact, fire frequencies are projected to increase by approximately 27% globally by 2050. Areas such as North America, Northern Eurasia, and Australia are deemed to be most susceptible to wildfires, making finding effective methods to respond to them increasingly more important.Increasingly, fire departments across the globe have started to deploy first responder drones to ensure firefighter safety as well as enhance operational effectiveness when tackling a wide range of emergency sites including oil wells, high rises, and wildfires.In response to a recent forest fire that broke out in Athens, Defense Minister Nikolaos Panagiotopoulos said that the armed forces would strengthen their capabilities in fire prevention, deploying drones over other vulnerable sites across the country to obtain accurate data. Drone deployment in a fire emergency ensures the protection of personnel, gathers situational awareness speedily and accurately, and provides a cost-effective helicopter replacement and enables fast mapping for incident response and recovery.Having successfully helped Verizon secure the first BVLOS to fly drones into wildfires in the US through a landmark waiver, leading drone-in-a-box manufacturer Percepto is keen to raise awareness about the positive impact of quickly responding to natural disasters as a result of global warming through the deployment of drones. I caught up with Percepto CEO Dor Abuhasira to learn how.GN: How are drones being used to prevent wildfires?Dor Abuhasira: Drones can be used to prevent the occurrence of wildfires in a similar way they are used to prevent disaster at industrial sites. They can boost inspection frequency to inspect and monitor sensitive forest areas regularly, especially during times of year that wildfires are most likely to occur. As manual data reviews don’t catch all failures, drones can use AI powered solutions to collate data from all sources such as cameras, and SCADA systems. Drones can be operated remotely to help prevent a huge failure even in the midst of a pandemic or natural disaster with the ability to monitor facilities remotely. Autonomous drones ensure sites comply with local regulations, frequently monitoring refineries for gas leaks, and power plants for high water temperatures, reducing their environmental footprint. 

    They respond to emergencies first, eliminating the need for first responders to go in blind to events, and providing engineers and technicians with the information they need to quickly perform repairs. By performing frequent, high-quality inspections, autonomous drones ensure faults are detected early on, preventing massive failures that can pose harm to employees and the environment. GN: Why is Percepto’s drone-in-a-box Sparrow ideally suited to fly in the most severe climate conditions?Dor Abuhasira: Percepto’s advanced autonomous drone solution is the first to pass Level 5 hurricane testing at a wind speed of up to 155mph, making it the most rugged drone-in-a-box system on the market. The industrial Percepto base allows their Sparrow drone to safely charge outdoors during the most extreme weather events. The drone itself is also highly ruggedized and can takeoff, fly and land in severe wind, rain, snow and heat.Percepto’s technology can assess their customers’ sites immediately after a storm, allowing customers like Florida Power and Light (FPL) to react immediately in the aftermath of a hurricane, assessing and fixing any damage without endangering their staff when the weather is still very challenging where the most residents per year experience outages in the state.”As soon as the storm passes, we can have this up…inspecting our plant and knowing immediately what sort of damage we have so we’re able to get our power back on that much sooner… for a utility to be able to see our infrastructure in areas where we can’t get to safely; to quickly fly over it and understand what our conditions are…the safety of our crews is paramount.” – Michael Dorr, lead pilot for Florida Power & Light’s Drone in a Box system.Last year, the FAA granted Skyward, a Verizon company, a temporary waiver that allowed company pilots to fly the Percepto Sparrow drone from their homes to inspect critical communications infrastructure near the Big Hollow wildfire in Washington. The waiver permitted operations 24 hours a day, with less than 3 miles of visibility, and no pilot or observer on site. This is the first time a Beyond the Visual Line Of Sight waiver was granted to allow pilots to control the drone from home. It was a landmark for the industry and a testament to the standard of the Percepto Sparrow. The Percepto drone was designed with the needs of an industrial site’ as the core, underlying principle. The drone is made of a composite carbon fiber, fiber-glass material, tailored to accommodate a wide range of temperatures. The extremely durable material is of the sort used in naval industries, able to withstand salt, water, dusk and direct sunlight. Our maintenance philosophy is centered around how industrial sites operate, i.e. maintenance equipment checks occuring every few weeks or months. This caters for the drone to stay unattended for a long time, on the site, ready to launch for emergency. High flight performance enables flying in strong winds with superior sealing and resilience to precipitation, dust, sand, coupled with a heavy, stable Percepto Base. This can open in one piece on an axis in a manner that avoids snow or dust falling into the pad from which the drone is launching (as opposed to the two-piece mechanisms opening sideways which most drone-in-a-box providers feature). The drone’s temperature can be monitored and controlled via air-conditioning within the weather station for further protection from the elements.GN: How will upcoming regulations significantly increase the adoption of drones?Dor Abuhasira: In June 2021, the FAA announced the new BVLOS Aviation Rulemaking Committee (ARC) – a large-scale collaboration between the drone industry and regulators, over 80 organizations including six drone manufacturers (of which Percepto is one).In the next 6 months, ARC will make their first round of recommendation to the FAA for a new BVLOS regulation, removing the current need for a drone pilot to monitor each drone that flies. Until now, the FAA has yet to fully enable commercial BVLOS flight.The new BVLOS regulation will change everything. Fully autonomous drone flights. No pilots. No human involvement. That means we will finally see drones implemented at scale as a network of robots providing various vital services for us. In the next few years, you should expect to see autonomous drones flying around delivering packages, inspecting power lines, solar farms, cell towers and bridges. The many applications enabled are demonstrated by the range of drone companies who work closest with the FAA. For Amazon, BVLOS regulation means fully autonomous consumer deliveries. For other drone delivery companies like Zipline, BVLOS regulation means fully autonomous delivery of vital medical supplies. And for industrial drones like Percepto’s, it means fully autonomous monitoring of the country’s most risky, complex facilities. On a larger scale, it offers companies responsible for our critical infrastructure the promise of employing a fleet of drones to manage and maintain all of their infrastructure from anywhere in the country. This new regulation will revolutionize industries and change lives when it comes into effect in the next few years. And in the meantime, the industry will continue to move forward within the existing regulatory framework. GN: How will the drone industry evolve over the next decade with regards to environmental issues?Dor Abuhasira: Companies traditionally thought of as not environmentally-friendly now have the tools to more carefully adhere to regulations, and prevent catastrophes, e.g. oil spills.Companies can completely change the way they approach safety and their environmental impact, working towards their ESG goals to enhance their reputation –  e.g. drones are used to monitor a power plant or solar farm.Preventing catastrophes creates significant impact to the bottom line, helps companies meet environmental and safety objectives and mitigates any reputational damage. More

  • 150 Shares179 Views

    in Information Technology

    DDoS attacks are becoming more prolific and more powerful, warn cybersecurity researchers

    There’s been a rise in distributed denial of service (DDoS) attacks in recent months in what cybersecurity researchers say is a record-breaking number of incidents. According to a report by cybersecurity researchers at Netscout, there were 5.4 million recorded DDoS attacks during the first half of 2021 – a figure that represents an 11% rise compared with the same period last year. 

    ZDNet Recommends

    A DDoS attack is a crude but effective form of cyberattack that sees attackers flood the network or servers of the victim with a wave of internet traffic that’s so large that the infrastructure is overwhemed by the number of requests for access, slowing down services or taking them fully offline and preventing legitimate users from accessing the service at all.  Often, the machines being used to launch DDoS attacks – which can be anything that connects to the internet and so can range from servers and computers to Internet of Things products – are controlled by attackers as part of a botnet. The real owners of the devices are unlikely to know that their device has been hijacked in this way.  SEE: Cybersecurity: Let’s get tactical (ZDNet special feature) In some cases, DDoS attacks are simply designed to cause disruption with those behind the attacks just launching them because they can. However, in other instances there’s also an extortion element at play, with attackers threatening to launch a DDoS attack against a victim if they don’t give into a demand for payment. But it isn’t just the rise in DDoS attacks that makes them disruptive; cyber criminals are adapting new techniques to evolve their attacks in order to help them bypass cloud-based and on-premise defences. 

    “The tooling behind these attacks has matured over the years,” Hardik Modi, Netscout area vice president of engineering, threat and mitigation products, told ZDNet.  For example, cyber criminals are increasingly leveraging multi-vector DDoS attacks that amplify attacks by using many different avenues to direct traffic towards the victim, meaning that if traffic from one angle is disrupted or shut down, the others will continue to flood the network of the target. In many cases, the attackers will specifically tailor these to exploit vulnerabilities of the target. 

    Researchers note that multi-vector attacks are getting more diverse (a vector is essentially a method or technique that is used in the attack like DNS reflection or TCP SYN floods). In 2020, the largest one of these attacks used 26 vectors. During the first half of 2021, there have been a number of attacks using between 27 and 31 different vectors, plus an attacker can switch between them to make the attack harder to disrupt. SEE: Four months on from a sophisticated cyberattack, Alaska’s health department is still recoveringDDoS attacks have become more effective during the past year due to the added reliance on online services. Disruption to services that people are relying on in both their professional and personal lives has the potential to have a significant impact.  However, in the majority of cases it’s possible to defend against DDoS attacks by implementing the industry’s best current practices to maintain availability of services in the face of an incident. These practices include setting specific network access policies as well as regularly testing DDoS defences to confirm they can protect the network from attacks. MORE ON CYBERSECURITY More

  • 150 Shares159 Views

    in Information Technology

    This phishing-as-a-service operation is responsible for many attacks against businesses, says Microsoft

    Microsoft is shining a light on a phishing-as-a-service operation that’s selling fake login pages for cloud services like OneDrive that help non-technical cybercriminals steal business user passwords and usernames. Phishing kits are nothing new, but this phishing-as-a-service service caught the attention of Microsoft’s security teams because it lowers the bar to quality phishing even more. 

    ZDNet Recommends

    The best cyber insurance

    The cyber insurance industry is likely to go mainstream and is a simple cost of doing business. Here are a few options to consider.

    Read More

    That business, called BulletProofLink and a few other names, provides email and web site templates as phishing kits do, but also offers email delivery, hosting services, credential theft. It also claims to provide ‘fully undetected’ (FUD) links and logs and is available for purchase as a weekly, bi-weekly, monthly, or annual subscription. SEE: Half of businesses can’t spot these signs of insider cybersecurity threatsAs Microsoft outlines, phishing service providers are one link in the chain that can help ransomware gangs unload file-encrypting ransomware pain on targets, chiefly by providing passwords to attackers who can try them out on compromised networks. If the ransomware buyer is lucky, the credentials can include passwords for high-value admin accounts, allowing for greater movement within a compromised network. “These [FUD] phishing service providers host the links and pages and attackers who pay for these services simply receive the stolen credentials later on. Unlike in certain ransomware operations, attackers do not gain access to devices directly and instead simply receive untested stolen credentials,” the Microsoft 365 Defender Threat Intelligence Team notes in a blogpost.   Microsoft is concerned about businesses like these because they offer dozens of templates for the login pages of popular web services and allow anyone on a small budget to beat a path to theft or extortion. It currently offers “login scam” pages for Microsoft OneDrive, LinkedIn, Adobe, Alibaba, American Express, AOL, AT&T, Dropbox, and Google Docs. 

    It’s also worried about “double theft”, where the phishing service provider captures the credentials on behalf of one customer and then sells the credentials to other customers.BulletProofLink markets itself openly on the web and on underground forums, and is also known as BulletProftLink or Anthrax. It’s even published ‘how-to’ videos on YouTube and Vimeo to help customers use its fraud tools. Microsoft published its research into this operation to help customers refine email-filtering rules and adopt security technologies it offers. While phishing kits are sold once in a ZIP file with phishing templates to set up a bogus login page or emails, phishing-as-a-service includes the whole package. The company caught Microsoft’s attention while it was investigating a phishing campaign that was using BulletProofLink services. The campaign used a whopping 300,000 subdomains with a technique Microsoft calls “infinite subdomain abuse”, which is where an attacker has compromised a website’s domain name system server (DNS) or when a compromised site is configured with a DNS that allows wildcard subdomains.

    These subdomains “allow attackers to use a unique URL for each recipient while only having to purchase or compromise one domain for weeks on end”, Microsoft says. They’re useful before the attacker can simply compromise the DNS of a site and not bother with hacking the site itself. It also allows phishing businesses to create a ton of unique URLs that are hard to detect. SEE: Four months on from a sophisticated cyberattack, Alaska’s health department is still recoveringRansomware service provider models are also influencing how phishing businesses operate. One notable ransomware technique is to steal data before encrypting it and then either sell that data or use it as leverage during extortion attempts. “We have observed this same workflow in the economy of stolen credentials in phishing-as-a-service,” Microsoft says. “With phishing kits, it is trivial for operators to include a secondary location for credentials to be sent to and hope that the purchaser of the phish kit does not alter the code to remove it. This is true for the BulletProofLink phishing kit, and in cases where the attackers using the service received credentials and logs at the end of a week instead of conducting campaigns themselves, the PhaaS operator maintained control of all credentials they resell.”    More

  • 138 Shares169 Views

    in Information Technology

    RCE is back: VMware details file upload vulnerability in vCenter Server

    Image: Shutterstock
    If you haven’t patched vCenter in recent months, please do so at your earliest convenience. Following on from its remote code execution hole in vCentre in May, VMware has warned of a critical vulnerability in the analytics service of vCenter Server. “A file upload vulnerability that can be used to execute commands and software on the vCenter Server Appliance. This vulnerability can be used by anyone who can reach vCenter Server over the network to gain access, regardless of the configuration settings of vCenter Server,” the company said in a blog post. Handed the label CVE-2021-22005, the vulnerability hit a CVSSv3 score of 9.8, and means a malicious actor only needs to access port 443 and have a file to upload that is capable to exploiting an unpatched server. The vulnerability hits versions 6.7 and 7.0 of vCenter Server Appliances, with builds greater than 7.0U2c build 18356314 from August 24 and 6.7U3o build 18485166 released on September 21 patched. The exploit does not impact vCenter 6.5 versions. For those looking for a workaround instead of applying a patch, VMware has issued instructions. The workaround will be reverted once the server instance is patched. VMware said users should patch immediately.

    “The ramifications of this vulnerability are serious and it is a matter of time — likely minutes after the disclosure — before working exploits are publicly available,” it said. Other vulnerabilities addressed in VMware’s advisory included CVE-2021-21991, a CVSSv3 8.8 local privilege escalation involving session tokens that would see users gain administrator access; CVE-2021-22006, a CVSSv3 8.3 reverse proxy bypass that could allow access to restricted endpoints; and CVE-2021-22011 that could allow for unauthenticated VM network setting manipulation. All up, of the 19 vulnerabilities listed in its advisory, 10 were found by George Noseevich and Sergey Gerasimov of SolidLab. Elsewhere, Claroty Team 82 detailed how it chained together a number of vulnerabilities in Nagios XI to gain a reverse shell with root remote code execution. Although 11 vulnerabilities were found — four of which were handed a CVSSv3 score of 9.8 and included an SQL injection — only two were needed for the reverse shell: CVE-2021-37343, a path traversal vulnerability that allows for code to be executed as the Apache user; and CVE-2021-37347 that allows for local privilege escalation. The auto login feature of Nagios XI that allows for read-only access to the Nagios dashboard without credentials greatly expanded the attack surface, Team 82 said. “While this feature might be useful for NOC purposes, allowing users to easily connect to the platform and view information without the need for credentials also allows attackers to gain access to a user account in the platform, thus rendering any post-auth vulnerability exploitable without authentication,” they said. Patched versions of vulnerable Nagios XI products were released in August.One reverse root shell coming up
    Image: Claroty
    Related Coverage More

  • 125 Shares99 Views

    in Networking

    StarHub pushes Singapore broadband share to 40% with MyRepublic buyout

    StarHub is forking out up to $162.8 million to acquire a 50.1% stake in MyRepublic’s broadband business in Singapore, taking out the latter’s 6% share in the local market. This will see the MyRepublic business unit subsumed as a StarHub subsidiary when the transaction is finalised. MyRepublic carved out a new entity, called MyRepublic Broadband, for the transaction, which would encompass its consumer and enterprise customers in the city-state. StarHub Online, which comprises the telco’s broadband business, would acquire the MyRepublic shares. The acquisition would push StarHub’s share of the local broadband market to 40%, the two companies said in a joint statement Wednesday. MyRepublic currently has a 6% share of the market. 

    In an email reply to ZDNet, MyRepublic’s chief investor relations officer Jeannie Ong confirmed the deal would only cover its broadband business in Singapore, and would not impact its mobile business here, as well as its platform business and other overseas entities. Its franchise partnership with Indonesia’s Sinar Mas Group also remains unchanged. “We continue to retain 100% ownership of these,” Ong said. “Naturally, the transaction impacts all our businesses favourably, as the capital raised will be used to accelerate our plans in all markets and also for our platform business.”In a June 2021 report, MyRepublic told ZDNet it was looking for new revenue in Singapore’s enterprise space, with plans to ramp up its service offerings with particular focus on cybersecurity, where it might look to make acquisitions to plug product gaps. It also had eyes on growing its enterprise business, where it saw large margins and growth potential. MyRepublic then had some 6,000 enterprise customers including small and midsize businesses and large organisations, as well as 85,000 broadband subscribers in Singapore. As at May 2021, it also had 70,000 mobile subscribers. It launched its mobile business here in 2018.

    The Singapore market remains the main revenue source for the operator, which also offers broadband services in Australia and New Zealand. StarHub’s investment would include an initial consideration of $70.8 million for the 50.1% stake and a $92 million deferred consideration dependent on future financial performance. The Singapore telco also would refinance $74.2 million of debt for MyRepublic over a span of three years, upon completion of the transaction. The latter would retain 49.9% share, with its senior management team including co-founder and CEO Malcolm Rodrigues remaining in his role. The acquisition was slated to be completed by end-December, subject to the usual regulatory approvals. The acquisition would provide MyRepublic customers access to StarHub’s range of consumer and business offerings, including over-the-top content and online games. The two companies added that they also would achieve cost savings, scale, and synergies through joint go-to-market opportunities and wholesale service offerings. StarHub CEO Nikhil Eapen said in the statement: “We intend to scale up and deliver better and faster services to our customers, while realising high-quality earnings accretion. We stand to mutually benefit from StarHub’s digital-first technology platforms, our challenger mindset in innovation and customer-centricity, and MyRepublic’s lean operating model and experiences in regional markets.”Rodrigues said: “This milestone propels us forward in MyRepublic’s journey towards IPO. With StarHub onboard as a key investor, we are charting a new course for the long-term direction of the industry.”In a note to MyRepublic’s broadband customers in Singapore, Rodrigues described the deal as a “historical moment” for the company, after a decade of operations here. He said the investment put the company in “a stronger financial position” for IPO and enable it to scale up operations.”In due course, more details will be released on the additional access for myRepublic broadband customers as a result of this partnership,” he added.  MyRepublic earlier this month suffered a third-party security breach that compromised personal data of 79,388 mobile subscribers. The mobile operator had declined to reveal further details about how the data breach was discovered, saying only that it was informed of the incident by “an unknown external party” on August 29. When asked, Ong said it would work closely with StarHub as part of the due diligence process under the acquisition agreement. She added that they would work to gather information about MyRepublic’s data privacy and security compliance as well as to safeguard StarHub’s interests as an investor. “The recent data breach incident affects MyRepublic’s mobile business in Singapore and MyRepublic has taken all the necessary steps to respond to the incident appropriately,” she said, noting that it still was working with the relevant authorities on the investigations. “Our data breach incident has had no bearing on the partnership with StarHub, which follows comprehensive due diligence, review, and evaluation of the relevant synergies between both parties.”RELATED COVERAGE More

  • 125 Shares179 Views

    in Networking

    How Rakuten Mobile, Cisco CX plan to disrupt mobile services

    Japan-based Rakuten Mobile introduced its mobile virtual network operator (MVNO) service back in 2014. The carrier has since built a fully virtualized, 5G-ready, cloud-native mobile network through a partnership with the Cisco Customer Experience (CX) group. Rakuten Mobile created a new type of mobile service that didn’t exist prior to the partnership, which is still going strong today. For those not familiar with Cisco CX, it is the services team at Cisco. It’s branded “CX” because the services are designed around customer outcomes versus traditional infrastructure services, which are more technology-centric.  

    In 2018, Rakuten Mobile called on Cisco CX to play a program management role in its network buildout. Together, Rakuten Mobile and Cisco architected and deployed an efficient infrastructure for networking, storage, and computing. This helped Rakuten Mobile provide a variety of new services without placing additional strain on the network. Cisco worked with its multi-domain teams — distributed across Rakuten Mobile’s 10 locations — to come up with a software-only solution that boosted the usage of edge hardware resources from 30% to 90% for application workloads. Cisco also collaborated closely with other vendors to ensure compliance with their workloads. Next-generation mobile is multi-cloud “The orchestration of these workloads on any cloud is a daunting challenge already, whether it’s Amazon Web Services or Google Cloud. The fact that you could take a cloud workload and move it to any cloud does not automatically mean you have achieved productivity and efficiency,” Rakuten Mobile’s chief technology officer Tareq Amin said during a recent call with analysts. “It’s important to have a good software foundation. With Cisco, we were able to migrate traffic in less than a second without sending anyone to any of our data centers.”Three factors differentiate Rakuten Mobile, Amin said:How it orchestrates and automates application workloads: Rakuten Mobile’s technology runs near real-time, latency-sensitive workloads on a virtualized infrastructure across a vast number of distributed data centers.How it drives artificial intelligence: Rakuten Mobile’s platform has built-in conversational and engagement AI services.Compelling private cloud solutions: Many customers continue to have a preference for private cloud deployments, in which both Rakuten Mobile and Cisco specialize. This year, Rakuten Mobile began deploying Cisco’s segment routing over IPv6 (SRv6) equipment, enabling fixed-mobile convergence on Rakuten Mobile’s existing internet protocol (IP) backbone. Rakuten Mobile has been optimizing its mobile network to support 5G services, including standalone services with network slicing capabilities. The renewed partnership will allow the carrier to launch enterprise-focused private 5G and Internet of Things (IoT) services.Private 5G is coming to enterprises 

    “We have a compelling offering for Cisco as they contemplate how to make private 5G successful. We want to combine Cisco’s enterprise private 5G know-how with Rakuten Mobile’s technology,” said Amin.Rakuten Mobile is taking lessons learned in Japan and expanding globally. The carrier wants to bring its technology stack to Europe, which is well-positioned for a networking overhaul. In the next phase, Rakuten Mobile and Cisco would once again work together to provide unified cloud network functions (radio, core, intelligent operations) and a customer-centric billing experience offered through a market store, according to Amin.Meanwhile, both companies are also pursuing opportunities in the private 5G space in the U.S. Amin envisions having small cell access nodes with 5G capabilities connected to highly reliable 802.11ax sixth-generation Wi-Fi, coupled with software that manages the network. The combination of 5G/Wi-Fi 6/software would make networks easier to deploy and operate — and also lower the cost trajectory for connectivity.”Our partnership with Cisco CX isn’t just about a project or a small period of time,” said Amin. “We have a complimentary technology stack and complementary skills. We will continue to find ways to challenge each other and collaborate.”One of the interesting aspects of this partnership was Rakuten’s choice of Cisco for program management because this wasn’t a typical role for Cisco at the time. In a briefing with analysts, I asked Amin why he used Cisco in that role. He answered that one of his goals was to minimize the number of vendors, so he was going to choose from the group of vendors he was using. “Although this was a new service offering for the Cisco CX team, I liked how they looked at the project from a customer point of view,” Amin said. “They were fully engaged with our team, and it often felt like the team was not wearing a Cisco badge but a Rakuten one. I want to be clear that there were problems along the way, and there always are. What’s important is how the vendor responds and Cisco CX, and we continue to find ways of challenging each other and collaborating. Ultimately, it was Cisco’s willingness to be a partner that is why we picked them. Now it’s not just Japan where we will use them; there are other global opportunities”. From an industry perspective, the model Rakuten and Cisco CX have put in place should be something all large enterprises seek. Digital technologies are significantly more complex than previous generations, creating implementation and adoption challenges. Technology vendors need to be open, multi-vendor and outcome-focused because this will help their customers succeed.

    Smartphones More