Eliana Willis

More stories

  • 175 Shares169 Views

    in Information Technology

    Get patching: US, UK, and Australia issue joint advisory on top 30 exploited vulnerabilities

    Image: Shutterstock
    At the end of almost seven months in 2021, one of the 30 most exploited vulnerabilities dates from 2017, according to the US Cybersecurity and Infrastructure Security Agency (CISA), the Australian Cyber Security Centre (ACSC), the United Kingdom’s National Cyber Security Centre (NCSC), and the US FBI. CVE-2017-11882 is the holder of the dubious honour, and it is due to a stack buffer overflow in the equation editor of Microsoft Office, which can lead to remote code execution (RCE). It is an exploit that vendors have been banging on about for years already. The quartet of agencies said on Wednesday that the easiest way to fix this hole, and the 29 others listed, would be to patch systems. “Cyber actors continue to exploit publicly known — and often dated — software vulnerabilities against broad target sets, including public and private sector organisations worldwide. However, entities worldwide can mitigate the vulnerabilities … by applying the available patches to their systems and implementing a centralised patch management system,” the quartet stated. “Malicious cyber actors will most likely continue to use older known vulnerabilities, such as CVE-2017-11882 affecting Microsoft Office, as long as they remain effective and systems remain unpatched. Adversaries’ use of known vulnerabilities complicates attribution, reduces costs, and minimises risk because they are not investing in developing a zero-day exploit for their exclusive use, which they risk losing if it becomes known.” The top 30 list is broken down into 14 historical CVEs from 2020 and earlier, and 16 from the current year. The list of historical vulnerabilities is led by four CVEs related to cloud, remote work, or VPNs.

    “Many VPN gateway devices remained unpatched during 2020, with the growth of remote work options challenging the ability of organisation to conduct rigorous patch management,” the agencies said. As well as patching, the agencies said best practice involved adhering to Australia’s Essential Eight mitigation strategies. Historical vulnerabilities Citrix: CVE-2019-19781Topping the historical list is the Citrix NetScaler RCE that appeared over Christmas in 2019. This one should hit close to home for Australia as it was used to access a Defence recruitment database. Pulse: CVE-2019-11510Taking the silver medal is a directory traversal vulnerability in Pulse Secure Connect that can result in arbitrary file disclosure and leaks of admin credentials. “Once compromised, an attacker can run arbitrary scripts on any host that connects to the VPN. This could lead to anyone connecting to the VPN as a potential target to compromise,” the agencies said. “The CVE-2019-11510 vulnerability in Pulse Connect Secure VPN was also frequently targeted by nation-state APTs. Actors can exploit the vulnerability to steal the unencrypted credentials for all users on a compromised Pulse VPN server and retain unauthorised credentials for all users on a compromised Pulse VPN server and can retain unauthorised access after the system is patched unless all compromised credentials are changed.” That sounds nice. Fortinet: CVE-2018-13379Fresh from a May warning is Fortinet’s version of a directory traversal bug that can lead to an attacker gaining usernames and passwords. “Multiple malware campaigns have taken advantage of this vulnerability. The most notable being Cring ransomware (also known as Crypt3, Ghost, Phantom, and Vjszy1lo),” the agencies warned. F5- Big IP: CVE-2020-5902When it was announced, this CVE scored a perfect 10 — so it is a big deal. It involved the traffic management user interface allowing any old user gain access; they didn’t need to be authenticated to execute arbitrary commands, create or delete files, disable services, or run arbitrary Java. “This vulnerability may result in complete system compromise,” is how the agencies understated the threat. MobileIron: CVE-2020-15505Getting sick of unprivileged attackers remotely executing code on your MobileIron kit? Well, you were warned in November. Microsoft Exchange: CVE-2020-0688Welcome to the list Microsoft Exchange — we’ve been expecting you. This vulnerability from early 2020 occurred because Exchange servers failed to create a unique cryptographic key for the Exchange control panel at install time, which resulted in attackers being able to use malformed requests to run code under the SYSTEM context. Small solace could be found in knowing authentication was needed to run this exploit. Atlassian Confluence: CVE-2019-3396If you are getting flashbacks from many vulnerabilities on this list, that’s because the NSA tried to warn people last October. Not to be left out of path traversal, and remote code execution antics of other vendors, this old Atlassian Confluence vulnerability adds a touch of server-side template injection. The big question though is do you have to log the patch to Confluence as a task in JIRA? It bears not thinking about. Microsoft Office: CVE-2017-11882This is the oldest bug on the list, related to the equation editor, mentioned at the start of this piece. Scroll up. Atlassian Crowd: CVE-2019-11580Attackers can use this vulnerability to install arbitrary plugins, which can lead to remote code execution. The agencies called out this vulnerability specifically. “Focusing scarce cyber defence resources on patching those vulnerabilities that cyber actors most often use offers the potential of bolstering network security while impeding our adversaries’ operations,” they said. “For example, nation-state APTs in 2020 extensively relied on a single RCE vulnerability discovered in the Atlassian Crowd, a centralised identity management and application (CVE-2019-11580) in its reported operations. “A concerted focus on patching this vulnerability could have a relative broad impact by forcing the actors to find alternatives, which may not have the same broad applicability to their target set.” Drupal: CVE-2018-7600Remember Drupalgeddon2? A lack of input sanitation from the hook-crazed Drupal codebase can lead to an unauthenticated attacker gaining remote code execution. Naturally, malware campaigns including monero mining and having sites used as parts of botnets quickly followed. Telerik: CVE-2019-18935A hole in the sanitisation of serialized input in the Telerik framework used by ASP.NET apps can lead to RCE. Once again, cryptojacking was not far behind. Microsoft Sharepoint: CVE-2019-0604To keep with the recent theme, Sharepoint had a vulnerability when deserializing XML due to a lack of sanitisation, which could lead to remote code execution. Microsoft Windows Background Intelligent Transfer Service: CVE-2020-0787Due to improperly handling symbolic links, an attacker could use this vulnerability to execute arbitrary code with system-level privileges. Microsoft Netlogon: CVE-2020-1472When announced, it was reported as one of the most severe bugs ever, and with a CVSS score of 10, it was little wonder. Also known as Zerologon, the vulnerability allows an unauthenticated attacker to impersonate a computer on a domain, with the potential to disable security features in the Netlogon authentication process, and gain domain administrator privileges. “Threat actors were seen combining the MobileIron CVE-2020-15505 vulnerability for initial access, then using the Netlogon vulnerability to facilitate lateral movement and further compromise of target networks,” the agencies said. “A nation-state APT group has been observed exploiting this vulnerability.” The class of 2021 Compared to the vulnerabilities from years prior, the 2021 group are nicely grouped together and mostly related to a single product, so without any further ado. Microsoft Exchange: CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065These vulnerabilities are the ones that NATO, the United States, European Union, United Kingdom, Australia, Canada, New Zealand, and Japan recently said were attributed to China, and were the exploits where the FBI decided it needed to blast away web shells on US servers. CVE-2021-26855 allowed an unauthenticated attacker, if they could connect to port 443, to exploit the Exchange control panel via a server-side request forgery that would allow them to send arbitrary HTTP requests, authenticate as the Exchange Server, and gain access to mailboxes. CVE-2021-26857 used insecure deserialization to gain RCE, while the final two used a post-authentication arbitrary file write vulnerability that could lead to RCE. Pulse Secure: CVE-2021-22893, CVE-2021-22894, CVE-2021-22899, CVE-2021-22900Appearing in March, the first CVE scored a full 10 marks for enabling a remote unauthenicated user to execute arbitrary code, while the second and third CVE were close behind on 9.9 and related to remote authenticated users being able to execute arbitrary code. In the case of CVE-2021-22894, this was as the root user. CVE-2021-22900 scored a more modest 7.2, and related to an authenticated administrator to performing a file write thanks to a maliciously crafted archive uploaded via the administrator web interface. Accellion: CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104The hacks that occurred via Accellion FTA file transfer service seem to keep coming, with victims including the Reserve Bank of New Zealand, the Australian Securities and Investments Commission, Singtel, and many other organisations around the world. In February, Accellion said it would retire the vulnerable product. VMware: CVE-2021-21985The recent vulnerability hitting vCenter Server and Cloud Foundation that allows for RCE also made the cut. When announced, VMware warned that since the attacker only needs to be able to hit port 443 to conduct the attack, firewall controls are the last line of defence for users. Fortinet: CVE-2018-13379, CVE-2020-12812, CVE-2019-5591That’s right, CVE-2018-13379 made both lists. What an honour.

    Related Coverage More

  • 75 Shares169 Views

    in Robotics

    It's time to standardize robotic surgery

    The global surgical robotics market is expanding rapidly and may soon be worth $120B. But is the medical training ecosystem ready for the shift to robot-assisted surgeries?As more surgeons use robots in the OR, the approach for training on them and using them needs to be standardized. The truth is that all surgeons aren’t approaching this innovative tech the same way. Standardized best practices are what set surgeons and patients up for success, and will help to make robotic surgery safer in the future. So how do we improve it?There are a handful of new challenges the surgical team faces with robots: how to collaborate, how to coordinate (both the physical setup and the tasks), and how to communicate. What’s needed is a concerted effort to make sure all surgeons are using the robots the way they were intended so surgery is efficient and effective. Two medtech startups that are leading the charge on this are Explorer Surgical, which is a digital playbook that walks every team member in surgery through the steps to be successful, and Osso VR, which trains surgeons using high-fidelity VR. I recently connected with Justin Barad, CEO and co-founder of Osso VR, and Dr. Alex Langerman, MD, SM, FACS and Co-founder of Explorer Surgical, about the future of robot assisted surgery and the critical need to standardize training.GN: What are some of the most difficult things for surgeons to adapt to when transitioning from traditional to robot-assisted surgery?Dr. Alex Langerman: Physicians are faced with multiple challenges when transitioning to robot-assisted surgery. Still, the most significant has to do with learning the complexities of integrating a new device into a surgical workflow and overcoming a learning curve to operate as an experienced team. 

    Robotic-assisted technology can be straightforward or very complex; there are many little things that a clinical team needs to learn when adapting to a new technique. For example, the placement of a robotic arm, the room set up, adjustment of the bed, and any registration needed for the patient and procedure. Aside from the technical setup, the complexities can also include customizing the physician’s interface and preferences for ‘must haves’ in the OR.  This preparation minimizes the potential for intraprocedural delays or disruptions. Secondly, training the surgical team is as important as training the physician as with any new device. It’s the physician’s responsibility to make sure the procedure goes well for the patient and that every team member in the room knows what their specific tasks are regarding the device and its use. A digital playbook with every step related to the procedure, specific to each role in the OR, can bring significant support to ensuring that nothing is overlooked.Justin Barad: Wow this is such a great question!  One of the most difficult things when switching to robotic surgery is that the workflow is significantly different.  It depends on the robot but using orthopedics as an example a typical joint replacement workflow will go: Patient positioning > Dissection/Approach > Bone resection > Implant Trialling > Final Implantation.Now let’s compare that with a robotic workflow: Robot setup and calibration > Patient positioning > Dissection/Approach > Registration > Planning > Robotic assisted Bone Resection > Trialing and Computer aided assessment > Final Implantation.All of the steps in bold are significantly different and even if you are doing the same surgery the various robots from different manufacturers have their own unique workflows.  Further complicating things is these skills and concepts are not commonly taught during formal training (Residency & Fellowship), so practicing surgeons often are coming in at a relatively novice state. Finally, one of the major advantages of robotics is that they are powered by software which means they can be updated and improved over time, but that poses a significant challenge. This means that from one day to the next the way that you perform a surgery can change significantly following an over the cloud update. Without a rapid way to train on demand, you can run into a situation where you can potentially not know how to advance in a given procedure despite familiarity with the system.  I’ve even heard reports of people calling “tech support” mid-surgery for this very reason.All that being said, robotics are an incredibly valuable and powerful tool that makes surgery more consistent and data driven which ultimately will drive significant value for global healthcare.GN: How much is the current perception of robot-assisted surgery shaped by misconceptions or improper preparation? Why?Justin Barad: I think on the patient side the perception of robotics is quite positive and there is accelerating demand to receive surgical care in a robotic manner if it is available. On the provider side I think there is more of a mixed opinion. Some providers feel that they can operate much faster with more traditional open techniques and view robots as “slowing them down” and being “too complicated.”  However, most surgeons who I’ve spoken to  who have overcome the significant learning curve recognize the value and repeatability of switching to robotic platforms, including the advantage that the sophistication of the technology is improving at an accelerating rate given software updates and hardware investments. One other challenge to the adoption of robotics has to do with the makeup of the surgical team. Robotic surgery requires much more coordination from the team in contrast with traditional techniques which are more surgeon driven. There are surgeons who consistently work with the same surgical teams so training and coordination doesn’t pose too much of a problem, however at many hospitals and surgery centers there is a very high level of team variability. One surgeon I spoke to recently told me he operates with 25 different surgical techs over the course of a month.  Without the ability to rapidly onboard additional team members, surgeons may be hesitant to constantly be in a situation where team members don’t have a great sense of how to execute the procedure properly.Dr. Alex Langerman: When robotic surgery was first introduced, the learning curve for adopting the technology had a substantial effect on the efficiency of the OR.  While there has been a significant effort from the industry to show that RAS can be better for the patient, there are misconceptions that it makes surgery easier for the physician.  The training of surgical teams typically happens when the device is delivered to the customer.  The time spent learning new technology can impact an OR’s efficiency because every team member has a role in the setup and preparation.  Some physicians may be hesitant to adopt new technology because they have heard about experiences where new technology was introduced, but it was such a bad experience with those initial cases, it was barely used.  Those initial experiences can be shaped by the clinical team and their preparation for getting ready to operate. Unless physicians have access to experienced, dedicated robotic nursing and scrub teams, they might never get past the slow end of the “getting ready to operate” learning curve.With a digital playbook like Explorer Live, each team member has their responsibilities mapped out before they ever do their first procedure.  It provides support throughout the entire surgery, helping them be more efficient in the learning process.  In addition, companies can provide real-time support and guidance with remote connectivity to someone dedicated to supporting cases or a peer considered an expert on the device.GN: How does communication and coordination change when a robot is in the mix?Justin Barad: As I mentioned above there are significantly more tasks for the surgical team to perform to successfully perform robotic surgery, especially for console operated robots where the surgeon is physically removed from the surgical site and relies on communication for troubleshooting and some repositioning of the equipment. For a seasoned team that works together frequently this can work quite well, however in highly variable environments such as the one mentioned above this can make the surgery extremely difficult to pull off without the surgeon and sometimes device representative running around trying to do everything themselves.Dr. Alex Langerman: In traditional surgery, the surgeon, assistant, and scrub are all right next to each other, and communication is limited for the rest of the OR. Access to the surgical field can be impacted in robotic-assisted surgeries where they need to make room for the device, or the surgeon is physically separated from the patient.  Sometimes they are working at a console across the room. This inhibits the natural verbal interactions and non-verbal communication that keeps a team working smoothly.To support efficient and effective communication and coordination in the OR, teams need to be on the same page. As the surgery progresses, everyone is working together without disruption to their workflow. With a digital platform, the physician can continue through surgery, knowing that the entire surgical team is working in tandem with a guide that is specific to their role.GN: How can surgeons become better prepared for the transition to robot-assisted procedures, and whose responsibility should that be?Justin Barad: The more training the better!  The only issue is surgeons have very little time and robots are difficult to transport and access for training purposes. In addition, surgeons need to make sure their team is always maintaining their proficiency so that they can set up and execute the procedures on a consistent basis. Virtual Reality provides an incredible opportunity to rapidly work your way up the learning curve anytime and anywhere given it’s portability.  It also serves as a great on-demand training tool for situations where you have new team members coming into the OR and you need to rapidly get them up to speed. This is backed by the evidence which shows that training with Osso VR improves surgical proficiency anywhere from 230-306% in level 1 randomized peer reviewed trials.  In addition, intraoperative remote guidance technologies also are an intriguing tool to further support smooth execution of these cases.Dr. Alex Langerman: Anytime a new technology is introduced, it has to demonstrate significant value for the patient for a physician to adopt a new way of doing a procedure and a hospital to make the financial commitment.  When a physician is transitioning to robot-assisted procedures, a learning curve is often associated with the adoption and integration into a new standard of care. In some cases, it can be significant. The responsibility falls on the manufacturer to support any training and education efforts on the proper use of new technology. Preparing their clinical team should also be a high priority. New technologies that offer simulated or virtual training have helped to provide physicians with exposure and practice environments, but it can’t replace having experience in the room.  Using a platform like Explorer Live can support and facilitate the connection with expertise on the technology and key opinion leaders for training, peer-to-peer engagements, and mentorship.  Providing these resources can help to create a solid foundation of unlimited access to resources that can help to support a shift in clinical practice. Companies that support ongoing engagement will be vital to increasing the adoption of a new technique and support generating evidence that changing the way physicians operate is in the patient’s best interest.GN: What are some of the most effective methods for training surgeons to properly use robotic technology?Justin Barad: Training on the robot is probably one of the best ways to learn but this is also the hardest to coordinate and has some of its own challenges.  Robots used for training see so much wear and tear they often break or don’t work properly which can make training difficult.  They are usually so large they are very hard and expensive to ship out to training.  In addition, there usually isn’t an easy way to objectively assess proficiency when using the real world equipment.  We are seeing more and more that in person training is being paired with some time of digital advanced training modality like virtual reality.  In this way you are able to rapidly work your way up the learning curve on your own time and then use valuable in person training time as “last mile training” rather than as introductory experiences.Dr. Alex Langerman: Physicians will always want to get hands-on experiences when considering using new technology. Still, often the practical experience doesn’t come until they are getting ready to do their first case. There are news training technologies that have made an impact in recent years that provide a simulated experience with haptic feedback. Like Osso VR, augmented and virtual reality platforms have enabled more physicians to have a realistic experience. Explorer Live complements training simulation by providing a platform to try the best practices that are shared.  For an OR team, a physician who has a comfort level with a procedure can bring their experience of procedural steps and support, creating efficiencies in the OR around setup, room configuration, and the use of supplies. Explorer Live also supports the ongoing efforts to keep an entire OR up to speed.  As their experience grows, physicians may take on more challenging cases with access to education and training content or the ability to remotely connect with peers to help minimize any downtime.GN: How can training technologies improve patient outcomes?Justin Barad: There is a groundbreaking study from Birkmeyer et al. published in the New England Journal of Medicine in 2013 titled: “Surgical Skill and Complication Rates after Bariatric Surgery.”  This study asked the question “How does surgical skill affect patient outcomes.”  What they found was illuminating and intuitive.  The more proficient the provider, the better the patient outcome, to the point where the higher skilled surgeons had a 5 times lower mortality rate than their lower skilled counterparts.  We are seeing some of this impact first hand with Osso VR.  Some of our users have been able to reduce their operating time by 50 percent (so from about 4 hours to 2 hours) which is incredibly compelling as we know generally more efficient operations will have better outcomes.  We are just starting to scratch the surface of this technology as it broadens its reach to the millions of HCPs who perform procedures around the world and the billions of patients they treat.Dr. Alex Langerman: Training technologies that improve communication and coordination among surgical teams and reduce learning curves can significantly impact patient outcomes.  Physicians may be more willing to adopt new technology sooner if their initial experience is positive, leading to broader adoption by physicians and providing more patient access to game-changing innovation. More

  • 138 Shares169 Views

    in Information Technology

    Biden: Major cyber attack could lead to a 'real shooting war'

    US president Joe Biden had some tough words over recent state-sponsored and criminal ransomware attacks, suggesting that if the US were to end up in a “real shooting war” it would be because of a major cyberattack. Biden’s comments follow this month’s REvil ransomware attack on the managed service provider (MSP) customers of US software vendor Kaseya that affected 60 MSPs and around 1,500 of their customers. 

    Special feature

    Cyberwar and the Future of Cybersecurity

    Today’s security threats have expanded in scope and seriousness. There can now be millions — or even billions — of dollars at risk when information security isn’t handled properly.

    Read More

    Cyber attacks have become central to talks between Biden and Russia’s president Vladimir Putin in recent weeks, following the Kremlin-backed supply chain attack on SolarWinds that impacted federal agencies and US cybersecurity firms, as well as criminal ransomware attacks on fuel distribution network Colonial Pipeline and meat packer JBS. Addressing the US intelligence community, he said the road to war with a major power would likely be as a consequence of a major future cyber attack on the US. “You know, we’ve seen how cyber threats, including ransomware attacks, increasingly are able to cause damage and disruption to the real world,” said Biden. “I can’t guarantee this, and you’re as informed as I am, but I think it’s more likely we’re going to end up — well, if we end up in a war, a real shooting war with a major power, it’s going to be as a consequence of a cyber breach of great consequence.  And it’s increasing exponentially — the capabilities.”He also belittled the state of Russia’s economy under Putin, who “has a real problem” that makes the Russian president dangerous.           

    “He’s sitting on top of an economy that has nuclear weapons and oil wells and nothing else.  Nothing else.  Their economy is — what? — the eighth smallest in the world now — largest in the world?  He knows he’s in real trouble, which makes him even more dangerous, in my view.”Biden added that Russia’s alleged disinformation campaign targeting the US 2022 elections as a “pure violation of our sovereignty.” Biden also warned Putin that critical infrastructure should be “off limits” in G7 talks at Geneva last month. More

  • 125 Shares99 Views

    in Networking

    Samsung pushes vRAN to take larger role in 5G networks

    Samsung Networks vice president and head of advanced system design lab Jeongho Park 
    Image: Samsung
    A Samsung executive has claimed the role of virtualised RAN (vRAN) technology in wireless networks will continue to grow even when telcos move onto 6G and beyond. The claim comes days after Verizon and Samsung announced the completion of a fully virtualised 5G data session over C-band spectrum, from 4GHz to 8GHz. Samsung is currently the network equipment provider for the US telcos’ 5G network deployment, having signed a $6.6 billion supply contract last year.”Samsung has been partners with Verizon for a long time,” Samsung Networks vice president and head of advanced system design lab Jeongho Park told ZDNet.”Some years ago, when vRAN was just beginning to gain traction, Verizon expressed their desire to shift to vRAN. When we received this request, we were already preparing to launch vRAN. We began making preparations to launch a virtualised distributed unit around 2018, having already developed a virtualised central unit prior to that for a full vRAN solution.” Samsung launched its first “fully” virtualised 5G RAN last year, which includes a virtualised distributed unit for its virtualised central unit that went into service a year prior in 2019. “vRAN requires technology, optimisation, and commercialisation experience. We believe Samsung is the only vendor that meets these three requirements, putting us ahead against other companies by 1.5 years in this space,” the Samsung lab head claimed.Samsung has been one of the more aggressive companies in rolling out vRAN solutions among the major 5G network equipment vendors. Networking powerhouse Ericsson, which calls its vRAN solution Cloud RAN, currently has plans to roll out the first stages of the service in the fourth quarter this year. Nokia, meanwhile, made its full vRAN solution commercially available last year and is trialling the technology with US telco AT&T. The company is also planning to roll out the solution with C-band support later this year. 

    Huawei, which is still the world’s largest 5G network equipment vendor despite US sanctions, has been the least active in promoting the technology. This is likely due to most carriers outside of China linking it with Open RAN, a term used loosely by different organisations and a concept that the Chinese giant has not been willing to embrace so far.’Flexibility is a big advantage of vRAN’The way vRAN operates is that it delivers network functions as software instead of hardware. Instead of using proprietary hardware-based baseband units and central units, which is what traditional RAN does, vRAN has virtualised distributed units and virtualised central units — software running on commercial off-the-shelf (COST) hardware. The core network also runs on software.  Through this software, vRAN offers the same network functions as its fully-hardware counterparts in traditional RAN, but virtually. Samsung has touted that this “full” vRAN solution, which means it offers the distributed unit, the central unit, and the core in software allows it to provide flexibility.”Before vRAN, mobile network operators received dedicated hardware from a specific vendor. In effect, operators would feel, in a way, dependent on the specific vendor. But in vRAN, operators can now use hardware from company A and software from company B as they wish like Legos. This flexibility for operators is the big advantage of vRAN,” the Samsung lab head said. According to Park, this gives operators two benefits: They can pool their network resources efficiently, which in turn, leads to lower costs.”In traditional RAN, a dedicated processor is used in the baseband unit to process the signals. But this processing power isn’t needed 24 hours a day. Some coverage areas may not need the full processing power. Processors installed on population-dense areas like Gangnam are usually made to handle the expected data traffic. But sometimes, one population-dense area may have intense data traffic while another similar area has almost no traffic. So this shows that you don’t need maximum specs for every processor. “In vRAN, software replaces the function of the processors. This software can determine when and where it wants to use its resources. We also offer an orchestrator solution that manages all the virtualised distributed units, which was previously done individually. This leads to an overall decrease in cost of ownership and operation cost,” he said. Samsung was a major part of South Korea’s 5G rollout in 2019 and has been attempting to emulate it outside of South Korea. Samsung and SK Telecom in 2019 developed a 5G SA switchboard prototype with a modular design where quantum security or high-pass filter modules could be added. 
    Image: SK Telecom
    A more ‘transparent’ network with O-RANThe purpose of vRAN, which is to give mobile operators more flexibility in choosing its vendors and managing networks, is also tied with O-RAN, Park claimed. O-RAN is a concept pushed forward by the telco industry and aimed at creating a multi-supplier RAN solution using hardware and software from different vendors that all use a common open interface. An O-RAN Alliance was formed by operators and equipment vendors in 2018 to develop this concept. The alliance sets the common specifications and standards for the concept. Chinese telcos and network equipment vendor ZTE are members, but Huawei is noticeably not part of the alliance.”Samsung’s vRAN solutions use open interface and O-RAN defined protocols. These are basically white boxes that guarantee transparency between blocks. Previously, in traditional RAN, when one specific vendor would provide its own software and hardware solution, the operator could not see what was going on inside them as the vendor would use its own protocol.”Operators believe this will increase their network security. They can now see the messages, that is the protocol, passing between the solutions provided by various vendors. So we believe vRAN’s use of O-RAN standards makes it quite attractive for operators,” the Samsung lab head said.Telcos around the world have so far shown various degrees of enthusiasm in adopting vRAN. Verizon and Rakuten Mobile in Japan have been some of the more vocal telcos that support the technology. Vodafone UK is also planning to deploy vRAN. Other telcos, meanwhile, have been more conservative in their attitude towards the technology. “Some operators believe vRAN is the right direction, while others are yet to adopt it. For now, vRAN is a very new and progressive space. I think it’s better to think of vRAN as one option among many that operators have for their network deployment, and Samsung has developed and is offering that option first compared to other companies,” Park said.At the same, the Samsung lab head said the company does expect more operators around the world to adopt vRAN.”There are operators in Asia that are showing interest in vRAN now. We feel that the overall attitude towards vRAN has turned positive over the past year. We believe that vRAN’s portion in the market will be much bigger five years down the road than it is now,” he said.vRAN present on x86, future could be GPUIt is also important to note that the global 5G network market is just beginning. In the US, though mmWave spectrum support has been deployed, telcos like Verizon are just now grouping it with C-band spectrum to expand coverage. In South Korea, telcos are yet to even deploy mmWave services. The increase in base stations and coverage will require  more computing power from networks going forward.Samsung’s vRAN solutions use x86 CPU on the COST servers, sometimes with accelerators. The Samsung lab head said while the processing needs would indeed increase for ultra-high spectrum from the wider bandwidth going forward, x86 CPU would be sufficient to handle this.”Bandwidth becomes wider and more complex as we move from C-band to mmWave. Networks will indeed need more computing power. But at Samsung, we believe CPU products launching up to next year can handle multiple times the workload of what they handle right now,””Many companies, including Samsung, are also considering applying GPU. But for now, our commercialization roadmap is drawn based on CPU. We are still looking at the pros and cons of GPU,” the Samsung lab head said.The evolution of cloud will also inevitably be tied with vRAN, Park noted. “Cloud groups processes into one place and is flexible. Its purpose corresponds with that of vRAN. We think in the future, there will be companies that offer vRAN in cloud form,” he added.RELATED COVERAGE More

  • 188 Shares179 Views

    in Information Technology

    These hackers posed as an aerobics instructor online to trick their targets into downloading malware

    Iranian hackers spent 18 months masquerading as an aerobics instructor in a cyber espionage campaign designed to infect employees and contractors working in defence and aerospace with malware in order to steal usernames, passwords and other information which could be exploited.Active since at least 2019, the campaign used Facebook, Instagram and email to pose as the fake persona “Marcella Flores”. The attackers could spend months to build up rapport with targets via messages and emails before attempting to distribute malware after trust was gained. The campaign has been detailed by cybersecurity researchers at Proofpoint who’ve linked it to TA456 – also known as Tortoiseshell – a state-backed Iranian hacking group with ties to the Islamic Revolutionary Guard Corps (IRGC), a branch of the Iranian military. The way a fake social media profile was run for so long demonstrates the amount of effort and persistence that those behind the espionage campaign went to in an effort to target individuals of interest, predominantly people working for US defence contractors, particularly those involved in supporting operations in the Middle East.Marcella’s public facing Facebook profile claimed she was an aerobics instructor in Liverpool, England – and her friends list contained several people identifying as defence contractors on their profiles. The attackers behind the fake persona used email, social media profiles, photos and even flirtatious messages to give the impression she was a genuine person while in contact with the targets. After a period of messages back and forth with the target, the attackers used a Gmail account set up as the persona to send a OneDrive link which contained a document or a video file to the victim. It’s this lure that was used to distribute malware to the victim – an updated version of Lideric malware which researchers have dubbed Lempo. 

    This malware secretly establishes persistence on the victim’s Windows computer, allowing the attackers to search for and steal sensitive information including usernames and passwords which then get sent to the back to those running the operation. Proofpoint said due to the specific targeting of victims it was not possible to say whether that attacks were successful.SEE: Cybersecurity: Let’s get tactical (ZDNet/TechRepublic special feature) | Download the free PDF version (TechRepublic)     The stolen usernames and passwords could help the attackers conduct further espionage campaigns. It’s likely that defence contractors were targeted because stealing their credentials could provide the attackers with the means of moving further up the supply chain and gaining access to the networks of defence and aerospace firms. Stolen passwords could be exploited to gain remote access to VPNs and remote software, or compromised credentials could be used to conduct further phishing attacks.”The information gathered by Lempo could be operationalized in a variety of ways including the utilization of stolen VPN credentials, exploitation of vulnerabilities in the identified software, or the customization of follow-on malware to be delivered,” Sherrod DeGrippo, senior director of threat research and detection at Proofpoint told ZDNet.   Iranian state-backed hacking and cyber espionage groups have previously engaged in this kind of social engineering, using false social media profiles of women to lure individuals into downloading malware. Like other known Iranian espionage campaigns, this one is focused on the defence industry and particularly companies providing support to military operations in the Middle East. All of this has led to Proofpoint attributing the campaign to Iranian state-linked hacking group TA456. Facebook shutdown the Marcella’s profile in July after identifying it and other accounts as working on cyber espionage operations on behalf of Tortoiseshell. Facebook has linked malware used in the campaigns to an Iranian IT company with links to the IRGC. The attackers behind the Marcella Flores persona spent at least 18 months running the account and using it for social engineering. The dedication to creating and maintaining these false personas, complete with the hands-on effort required for attackers to interact with potential victims, means it’s unlikely that this is the last time IRGC affiliated espionage and malware distribution campaigns will use these tactics.”TA456’s years-long dedication to significant social engineering, benign reconnaissance of targets prior to deploying malware, and their cross platform kill chain makes them a very resourceful threat actor and signifies that they must be experiencing success in gaining information that meets their operational goals,” said DeGrippo.The Marcella Flores operation and other espionage campaigns operating out of Iran demonstrate how effective social engineering can be as part of malicious hacking campaigns – and the importance of being mindful about what you share on public social media profiles.”It is especially important for those working within or tangentially to the defense industrial base to be vigilant when engaging with unknown individuals regardless of whether it is via work or personal accounts,” said DeGrippo.”Malicious actors will often utilize publicly available information about a target to build up a picture of their role, connections, access to information, and vulnerability to attacks – ‘over-sharing’ on social media is a particularly risky behaviour in sensitive industries, so organizations should ensure employees are properly and frequently trained in security awareness,” she added.READ MORE ON CYBERSECURITY More

  • 125 Shares169 Views

    in Information Technology

    Windows 10: Microsoft's latest update fixes printer smart card bug

    Microsoft has released an out of band non-security update to fix a bug in some business printers and scanners that use a smart card for authentication. The update, KB5005394, addresses an issue in Windows 10 version 1809 — Windows 10 Enterprise 2019 LTSC — that caused printers, scanners and multifunctional devices (MFDs) to not function. The update bumps up the OS build number to 17763.2091. 

    The issue stems from a July 13 update to harden the Windows 10 against the security vulnerability tagged as CVE-2021-33764. Printers and MFDs that were affected were not compliant with the authentication specification RFC 4556. Microsoft advised admins to verify that the latest firmware and drivers for these devices were installed and promised a mitigation, which it’s been delivering to different versions of Windows 10 over the past week.This was a separate issue to the so-called PrintNightmare bugs that Microsoft patched ahead of the July 2021 Patch Tuesday security update, and the Windows Print Spooler bug it fixed this month.  Microsoft released fixes for the same smart card authentication issue for newer versions of Windows 10 last week. “After installing updates released July 13, 2021 on domain controllers (DCs) in your environment, printers, scanners, and multifunction devices that are not compliant with section 3.2.1 of RFC 4556 spec might fail to print when using smart card (PIV) authentication,” it noted in advisories for Windows 10 20H1 and Windows 10 2004. 

    In a separate support note, Microsoft explains printers and MFDs were affected if they don’t support Diffie-Hellman for key-exchange or or advertise support for des-ede3-cbc (“triple DES”) during PKINIT Kerberos authentication. The issue affected all versions of Windows, including: Client: Windows 10, version 21H1; Windows 10, version 20H2; Windows 10, version 2004; Windows 10, version 1909; Windows 10, version 1809; Windows 10 Enterprise LTSC 2019; Windows 10 Enterprise LTSC 2016; Windows 10, version 1607; Windows 10 Enterprise 2015 LTSB; Windows 8.1; Windows 7 SP1Server: Windows Server, version 20H2; Windows Server, version 2004; Windows Server, version 1909; Windows Server, version 1809; Windows Server 2019; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1; Windows Server 2008 SP2

    Windows 10 More

  • 175 Shares119 Views

    in Information Technology

    Why you need to urgently update all your iPhones, iPads, and Macs – NOW!

    If you’ve not yet updated your iPhones, iPads, and Macs with the latest patches from Apple, then you need to take some time out of your day to do it right now, because this is a big one.Earlier this week, Apple published iOS 14.7.1, iPadOS 14.7.1, and macOS Big Sur 11.5.1. While this update contains bug fixes, the main part of this update is a security fix for a vulnerability that Apple says is “may have been actively exploited.”In other words, the bad guys are already using it.Must read: Don’t make this common, fatal iPhone or Android mistakeHere’s how Apple describes the vulnerability in relation to iOS and iPadOS:Available for: iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation)Impact: An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited.Description: A memory corruption issue was addressed with improved memory handling.CVE-2021-30807: an anonymous researcherIt’s unclear is this is the vulnerability used for jailbreaking iOS devices, or whether it is linked to the NSO Group spyware tool hack used to target journalists, activists, and government figures. To update your iPhone and iPad, go to Settings > General > Software Update and download and install any available updates. 

    For macOS, click on the apple in the top-left corner, go to System Preferences, find Software Update and download and install any updates available.I recommend carrying out these updates as soon as possible.To get immediate notifications of updates for the iPhone and iPad, I’ve been using the app iVerify. More

  • 138 Shares179 Views

    in Networking

    Telstra InfraCo opens up 'carrier-neutral data centres' in Sydney and Melbourne

    Image: Getty Images
    The veil on the Telstra monolith has been slightly lifted, with Telstra InfraCo announcing on Wednesday it would create a pair of carrier-neutral data centres in Sydney and Melbourne. While initially only available through Telstra Wholesale, the company said the centres would provide “greater flexibility for customers working with other carriers for their connectivity”. Depending on uptake of the offering, InfraCo could roll it out to another seven data centres, it added.”InfraCo data centres provide highly secure, reliable, and flexible environments for network operators and service providers, such as global carriers, internet service providers and over the top providers, to connect out to their business locations, facilities and other data centre operators,” said Telstra’s InfraCo Exchanges & Infrastructure executive Rachel Johnson-Kelly. “These Data Centres provide 100% power availability targets, which are backed by service levels and rebates. They use dual grid feeds with state-of-the-art equipment and support for high power densities, allowing customers to scale on request, without the need to re-configure powering requirements to deliver big data analytic services and peak workloads.” The company also said InfraCo would own or have renewable energy generation contracts equal to all the energy use used in its entire operations. Last year, Telstra as a whole was certified as carbon neutral, saying at the time it was difficult to purchase carbon offsets from local projects. See also: Blaming China is handy when trying to keep telco infrastructure away from Beijing

    In November, Telstra announced it would be restructuring into fixed, tower, and service entities. The service entity would gain the bulk of Telstra, owning its retail business, active electronics and radio access network, spectrum, as well as offering services and products to customers. However, the existing Telstra corporate body and its debt would sit with InfraCo Fixed. It later said it would create an arm to hold its international assets. Telstra brought forward a AU$2.8 billion sale of part of its InfraCo Towers business last month after being approached by a consortium including the Future Fund, Commonwealth Superannuation Corporation, and Sunsuper. Once the deal is closed, which is expected to happen in the first quarter of fiscal year 2022, InfraCo Towers will have no debt and a 15-year deal with extension options for Telstra to use its infrastructure. Earlier in the year, InfraCo opened up its dark fibre network, offering 250 pre-defined paths across six state capitals that connected to 68 metro data centres, 78 NBN points of interconnect, and two cable landing stations. The company recently confirmed it was approached by the Australian government to purchase Digicel Pacific, with the government set to stump up “significant funding” for any transaction. Related Coverage More