Eliana Willis

Image: Getty Images/iStockphoto
The New South Wales Police Force is in the process of bringing its back-end into the 21st century, turning to Microsoft and its Azure cloud platform for help.According to Microsoft, the force is retiring, re-architecting, or replacing over 200 legacy systems with cloud-based systems. Part of this transformation is changing the way the force analyses CCTV footage.Labelled as the “AI/ML-infused Insights policing platform”, the system essentially speeds up the processing of data. In one example, NSW Police collected 14,000 pieces of CCTV as part of a murder and assault investigation and analysed it in a manner faster than it previously could.”The AI/ML infused Insights platform ingested this huge volume in five hours and prepared it for analysis by NSW Police Force investigators, a process that would otherwise have taken many weeks to months,” Microsoft said in a case study prepared alongside NSW Police.”Detectives were able to then within days piece together the time sequence of events, movements, and interactions of the person of interest as well as overlay this onto a geospatial platform, visualising the data for detectives and aiding in the preparation of the brief of evidence for Courts.”Leveraging Microsoft Azure cognitive technologies, machine learning, and deep learning capabilities, NSW Police has been able to train the system on image classification allowing it to interpret petabytes of CCTV footage automatically and at speed provide rapid access to leads that officers can pursue to ultimately solve crime faster.”Must read: Human Rights Commission calls for a freeze on ‘high-risk’ facial recognition

The platform can also turn voice to text, allowing for the speedy transcription of police interviews, and can also stitch together CCTV with dash cam footage and then search for objects, including overlaying this on a geospatial solution, the pair added.”Using computer vision it can search to recognise objects, vehicles, locations, such as a backpack, or a tie, or type of shoes a person of interest might be wearing,” NSW Police CITO and executive director of digital technology and innovation Gordon Dunsford said.”The system has been designed with ethics front and centre, and in consultation with privacy experts with a particular focus on avoiding bias,” Microsoft added.Insights is currently hosted internally, but will “shortly” migrate to the cloud. NSW Police, however, is already using a containerisation strategy to parcel up data that needs to be interpreted rapidly, and sending that to Azure for processing.Elsewhere, the force is also working on its Integrated Policing Operating System (IPOS), which will replace the existing 27-year old central database and be used to manage all the data from operations including triple zero calls, arrests and charges, firearms, criminal investigations, forensics, complaints, and public reports.IPOS is based on Mark43’s public safety software.IPOS also provides the force with a single view of a person of interest and can be viewed on an officer’s MobiPol mobile devices. “It can also provide access to important additional information; for example, alerting police to the fact that the address where they are going to apprehend someone is located next to another house where residents are known to be antagonistic to the police through its geofencing capability,” Microsoft added.See also: How Victoria Police handled the Bourke Street incident on social media (TechRepublic)Dunsford said that, at present, officers share MobiPols, but with IPOS there are plans to equip every officer with their own device and access to IPOS.NSW Police also has plans to replace the legacy data store systems with the Digital Evidence Cloud, and has built a small-scale capability that it has trialled with NSW Police’s Forensics Command.Dunsford also wants to understand how low earth orbit (LEO) satellites could be used to support police; how data from the Integrated Connected Officer program which collects data from an officer’s firearm, taser, car, and body worn camera can be ingested into Insights; and how drones could be deployed to collect video that could help identify potentially dangerous situations.Advanced AI and machine learning could, he thinks, be used to train systems to identify everything from the colour, make, and model of vehicles, to a backpack in a crowded street, to finding a particular individual based on their unique gait.In June 2020 Microsoft said that it would not sell or deploy facial recognition to police services.RELATED COVERAGE More

CSIRO chief Dr Larry Marshall trying to explain basic science to a climate science-denying Senator
Image: APH
As with many things, timing is everything, and in the weeks after word drifted out that Australia’s Commonwealth Scientific and Industrial Research Organisation’s (CSIRO) Data61 was binning its secure microkernel research, the world of cyber attacks manifested in the real world in new ways. From oil pipelines, to meat works, to a more traditional Russian-backed phishing campaign, the cyberdial has been turned up and the frequency of attacks, particularly in the ransomware space, has hit deluge-like levels. And yet, while the torrent of malware is far from unexpected, people lining up with jerry cans and fighting with each other because someone might have clicked on a dodgy email certainly is. The need to develop a better foundation, and more secure ways of computing, would appear to be more necessary than ever — but not at the CSIRO, where artificial intelligence is the order of the day. “We think Australia needs artificial intelligence for industry 4.0, for our sovereign capability, for digital agriculture, and to deal with environmental hazards,” CSIRO CEO Dr Larry Marshall told Senate Estimates on Thursday night. “Really putting digital at the heart of Australia’s resilience and recovery as we build back.” One of the problems with the seL4 microkernel and the Trustworthy Systems team that developed it, according to Marshall, was that it supposedly did not provide enough “national benefit”.

“So it’s difficult to see an opportunity to build an industry in Australia, or to derive a national benefit from that technology, and given priorities are artificial intelligence, we chose to pursue that and focus our resources where we thought we could drive greater national benefit,” Marshall said. “The challenge with that technology … it’s very mature and it is open source.” During the hearing, Marshall waved articles listing CSIRO’s high ranking among global research organisations, but seL4 has been similarly regarded as first class research. One has to walk a long way to find a mathematically proven secure kernel. “This is an instance of Aus policy directly leading to undermining Australian cybersecurity,” security researcher Vanessa Teague said in reaction to CSIRO’s decision. “It’s hard to think of better world-leading Aus cybersecurity research than [seL4 Foundation].” Chair of the seL4 Foundation Gernot Heiser rebutted CSIRO claims that seL4 was mature technology in a blog post. “The group is not accidentally called ‘Trustworthy Systems’ (and not, say, the ‘seL4 Research Group’). seL4 is only the starting point for achieving trustworthiness in computer systems. It’s as if over 100 years ago people said combustion engines are a solved problem once it was shown they could power a car,” he wrote. “Fact is that, while seL4 is mature enough to be deployed in the real world, there’s plenty of fundamental research work left on seL4 itself, and there is far more research left on how to achieve real-world trustworthy computer systems. It’s not that just sprinkling a bit of seL4 fairy dust over a system will make it trustworthy.” Heiser laid out the work to be done on temporal isolation of processes, especially on systems where critical real-time workloads run at the same time, but he added the research was under threat as the CSIRO had handed back some money from the US Air Force. The University of New South Wales has backed Trustworthy Systems until the end of 2021, with Heiser stating it gives some breathing space to “line up more pathways”. In recent years, the push has been on in Australia to commercialise the country’s research, and this seems to be the rock that Trustworthy Systems has tripped on. “Unfortunately that technology was licensed [to Qualcomm] for a one-time fee,” Marshall said. “And when I say unfortunately, that technology has gone through two billion mobile devices, but unfortunately, there’s no ongoing royalty arrangement with that deal that was done back in at that time.” Keep in mind that the CSIRO loves royalty payments and will sue to ensure it gets its cut. The organisation boasts it got AU$430 million in settlements over its Wi-Fi patents. The open-source nature of seL4 does not lend itself to this type of outcome. Marshall said it would be great if a company was spun out around the work and if it could figure how to make money. “Our conclusion was that’s not really feasible in Australia, which is why we chose to discontinue the work,” he said. Given the current environment, where Australian politicians are calling on ASD to use its classified powers to blast away ransomware groups, and who knows what the political response from Moscow, Pyongyang, and Beijing would be to that; local law enforcement continue to say dumb stuff about encryption; and Australia’s strategic rivals are using current weaknesses to be downright awful to parts of their population, a little research on the defensive side of computing would be useful. The seL4 kernel isn’t going to be powering any desktop or server near you anytime soon, but it could go some way to making IoT devices look less like Swiss cheese to bad actors. It could even end up being the underpinning of CSIRO’s “artificial intelligence for industry 4.0” systems — whatever they are — or help inform the new OSes that are being developed. In a worst case scenario for CSIRO where it kept seL4 but it didn’t yield rivers of gold, it could still push research in vital areas of cybersecurity, increase Australia’s research reputation, and show that the nation isn’t completely full of the cyber ignorant. But alas, the world of secure kernels is not as sexy and pitch-friendly as the buzzword-laden AI realm, and Trustworthy Systems has been forced to shift from a national research organisation that has been subject to funding cuts, into a university sector that has seen far more drastic cuts. For our national benefit, hopefully the upcoming AI research yields more than a better chatbot. ZDNET’S MONDAY MORNING OPENER  The Monday Morning Opener is our opening salvo for the week in tech. Since we run a global site, this editorial publishes on Monday at 8:00am AEST in Sydney, Australia, which is 6:00pm Eastern Time on Sunday in the US. It is written by a member of ZDNet’s global editorial board, which is comprised of our lead editors across Asia, Australia, Europe, and North America.  PREVIOUSLY ON MONDAY MORNING OPENER: More

Security teams are in place in less than a third of Brazilian organizations, even though most businesses frequently suffer cyberattacks, according to new research. Some 57% of businesses from the education, financial services, insurance, technology and telecommunications, health and retail are targeted by cybercriminals frequently, according to a survey by Instituto Datafolha commissioned by Mastercard.On the other hand, the study has found that only 32% of the organizations polled have dedicated cybersecurity teams. While 80% of respondents claimed digital security matters are important to them and most have some kind of plan in place to deal with potential cyberattacks, this is not among the budgetary priorities for 39% of those polled.

Among the segments analyzed in the survey, financial services, insurance, technology and telecommunications are among the most prepared in terms of cybersecurity readiness. Conversely, the education and healthcare sectors are the most vulnerable. According to the survey, the areas most susceptible to hacker attacks are the finance department and customer databases. The Mastercard/Datafolha survey interviewed 351 decision-makers in Brazil in February 2021. The survey echoes the findings of a separate study on perceptions of cybersecurity risk in Latin America since the start of the Covid-19 crisis, carried out by consulting firm Marsh on behalf of Microsoft. Most Brazilian companies have not increased their investments in information and cyber security since the emergence of the pandemic despite an increase in threats, the study noted, adding that the majority of Brazilian companies invests 10% or less of their IT budget in that area. More

The FBI and Justice Department upped the ante on the rhetoric around ransomware attacks on Thursday and Friday, telling a number of news outlets that cyberattacks will be treated with almost the same level of concern as terrorist attacks.Christopher Wray, the director of the FBI, compared the government’s fight against ransomware to the situation the country faced after 9/11 in an interview with The Wall Street Journal. He added that the FBI has identified nearly 100 different types of ransomware, each of which has already been implicated in attacks. He also took direct aim at the Russian government, singling them out for harboring many of those behind the different brands of ransomware. But he also revealed that the FBI has had limited success working with some private sector cybersecurity officials in obtaining encryption keys without paying any ransoms. The comments came after three significant developments in the government’s response to the recent wave of ransomware attacks on companies in critical industries like Colonial Pipeline and global meat processor JBS. Anne Neuberger, deputy assistant to the President and deputy National Security Advisor for Cyber and Emerging Technology, sent a letter to private sector leaders on Thursday urging them to prepare for potential attacks and implement a number of security measures to prevent an incident. Senior Justice Department officials then told Reuters that memos had been sent out to all US Attorney’s Offices explaining that ransomware attacks would be investigated in a manner similar to incidents of terrorism. Technology journalist Kim Zetter shared a snippet of a memo sent by Deputy Attorney General Lisa Monaco that said urgent reports should be filed whenever a US Attorney’s Office learns about a new ransomware attack. The memo adds that officials should notify a newly created ransomware task force about any new developments in cases, potential emergencies or incidents that will “generate national media or Congressional attention.”

“Urgent Reports should be submitted, for instance, when a United States Attorney’s Office learns of a ransomware attack on critical infrastructure or upon a municipal government in their District,” Monaco wrote. Reuters reported that the new guidance also said senior Justice Department officials need to be notified of any cybercrime cases involving cryptocurrency exchanges, botnets, digital money laundering, illicit online forums, “bulletproof hosting services” and counter anti-virus services. Rep. Jim Langevin told ZDNet that the memo from Neuberger was a sign that President Joe Biden was taking the ransomware incidents seriously, but he urged the White House to give CISA more power to issue similar guidelines.”The advice in the White House memo is sound, and I hope corporate leaders will adopt a more risk-informed cybersecurity posture as soon as possible,” Langevin said. “However, I also hope the President will follow Congress’s direction and empower CISA to make similar recommendations moving forward.”Cybersecurity experts said that while the guidance from the White House was helpful, it did little to address the underlying problems thousands of organizations face when trying to protect themselves. Robert Haynes, open source evangelist with Checkmarx, said it was critical for organizations to identify the impact of the loss of different systems on their ability to operate. For most businesses, Haynes noted, the threat of a ransomware attack, the cost of the ransom itself and the huge impact on operations should be motivation enough to take these threats extremely seriously. “The primary focus needs to be on prevention, and then mitigation assuming total loss of systems. Leaders should be aware that the recovery time will involve rebuilding systems and restoring data, even with a successful recovery of encrypted files,” Haynes said. “The risks are real and the disruption, no matter how good your data protection solutions are, can be costly.”Dirk Schrader, global vice president at New Net Technologies, suggested the government find a way to make it a requirement for organizations to report any case of ransomware to authorities and strongly discourage ransom payments. But he noted that companies may not be willing to report a ransomware incident if that will delay the return to normal operations. Kevin Breen, director of cyber threat research at Immersive Labs, explained that valuable advice from the White House, like having offline backups, was nice to say but can cause friction within enterprises because they are typically hard to implement and costly. The same goes for other guidance shared by Neuberger like network segmentation. “If you’re not already doing it, implementation may be complex,” he said, adding that incident response tests will be key for preparing any organization for an attack.”These need to be done with a higher cadence than traditionally, and across the entire workforce to take into account the impact on technical, legal, communications and other cross functional teams.”The Justice Department’s efforts to create a centrally coordinated response will give authorities a deeper pool of evidence and data while also helping with the identification and targeting of the entire chain, Breen added, noting that it may also help add legislative teeth to mitigation efforts.Breen went on to say that the other measures being taken by the FBI and Justice Department were happening because ransomware gangs had “poked the sleeping giant one time too many.” More

Cyberattackers are now using the notoriety of the Colonial Pipeline ransomware attack to leverage further phishing attacks, according to the findings of a cybersecurity company. It is common for attackers to use widely-covered news events to get people to click on malicious emails and links, and cybersecurity firm INKY said it recently received multiple helpdesk emails about curious emails their customers were receiving. INKY customers reported receiving emails that discuss the ransomware attack on Colonial Pipeline and ask them to download “ransomware system updates” in order to protect their organization from a similar fate. The malicious links take users to websites with convincing names — ms-sysupdate.com and selectivepatch.com — both of which are newly created and registered with NameCheap. The same domain that sent the emails also controlled the links, INKY explained in a blog post. 
INKY
The people behind the attack were able to make the fake websites look even more convincing by designing them with the logo and images from the target company. A download button on the page downloads a “Cobalt Strike” file onto the user’s computer called “Ransomware_Update.exe.”In March, Red Canary’s 2021 Threat Detection Report listed “Cobalt Strike” as the second most frequently detected threat and the INKY report notes that Talos Intelligence found it was involved in 66% of all ransomware attacks in Q4 of 2020. Bukar Alibe, data analyst for INKY, said they began to see the phishing attack just a few weeks after news broke that the pipeline paid millions to the DarkSide ransomware group in order to restore the company’s systems.  

“In this environment, phishers tried to exploit people’s anxiety, offering them a software update that would ‘fix’ the problem via a highly targeted email that used design language that could plausibly be the recipient’s company’s own,” Alibe wrote. “All the recipient had to do was click the big blue button, and the malware would be injected.”In addition to capitalizing on the fear around ransomware, the attackers made the emails and fake website look like it came from the user’s own company, giving them an air of legitimacy, Alibe added. The attackers were also able to get past many phishing systems by using new domains. 
INKY
“If it looks as if it was sent by the company itself (e.g., from HR, IT or Finance), does it in fact originate from an email server under the company’s control? If it looks like the HR or IT Departments but deviates from the norm, that should be a flag,” the blog post said. Alibe urged IT teams to notify employees that they will “not be asked to download certain file types” because these kinds of phishing emails seek to exploit employees desire to do the right thing by following purported security guidelines. Alibe noted that the attack was targeted toward two companies and said IT teams should expect more attacks along the same lines. “We would not be surprised if we see attackers use the recent Nobelium-USAID phishing campaign as a lure,” Alibe said.  More