More stories

  • in

    Various Japanese government entities had data stolen in cyber attack: Report

    Data from various Japanese government entities has reportedly been stolen by hackers that gained access to Fujitsu’s ProjectWEB platform. Fujitsu’s software-as-a-service platform has since been taken down and the Japanese tech giant is currently investigating the scope of the attacks, Japan’s public broadcaster NHK said in a report. Among the impacted government entities are the Ministry of Land, Infrastructure, Transport, and Tourism; the Cabinet Secretariat; and Narita Airport. The land, infrastructure and transport ministry reportedly had at least 76,000 email addresses of its employees and business partners leaked, along with data on the ministry’s internal mail and internet settings. Meanwhile, the Cabinet Secretariat’s cybersecurity centre reportedly had data on the centre’s information system stolen from several of its offices. Narita Airport air traffic control data was also stolen, the report said, which has prompted the Cabinet Secretariat’s national cybersecurity centre to issue alerts about the use of the Fujitsu software. In the past three weeks alone, one of the US’ largest pipeline operators and healthcare institutions across Canada, New Zealand, and Ireland have faced cyber attacks. Related Coverage More

  • in

    Singtel continues downward trend across 2021 fiscal year

    Image: Singtel
    Singaporean telco Singtel has continued to see its balance sheet contract as it reported decreases across the board for the full year to the end of March. Revenue for the telco was down 5% from SG$16.5 billion to SG$15.6 billion, earnings before interest, taxation, depreciation, and amortisation (EBITDA) dropped by 16% to SG$3.8 billion, and net profit halved to SG$554 million. All of these numbers were down in the last financial year, dramatically so in some cases. For net profit, the telco reported SG$3.1 billion in fiscal 2019, SG$2.5 billion higher than this year’s number. “This year’s results are disappointing given unprecedented headwinds from COVID-19 and ongoing structural challenges,” CEO Yuen Kuan Moon said. “NCS and our data centre services proved to be bright spots, showing strong growth as enterprises rushed to digitalise and transform their businesses. We will be capitalising on this mass digitalisation with plans for a strategic reset to drive recovery and growth.” One of the few positive areas for Singtel was the contribution from its regional associates, up 4% to SG$1.7 billion, however all the gains were posted by Bharti Airtel which reversed last year’s SG$403 million loss into profit of SG$23 million. Telkomsel was down 22% to SG$915 million, AIS dropped 8.5% to SG$334 million, Intouch saw its contribution fall 7.4% to SG$94 million, and Globe experienced a 15.6% decline to SG$346 million. Singtel’s consumer business in Singapore reported a revenue drop of 14% to SG$1.8 billion, and said during the second half it had seen reduced roaming, prepaid mobile, and voice revenue, while on the other hand, it had higher handset sales as consumers upgraded to 5G devices. EBTIDA was down 17% to SG$627 million. The enterprise segment reported revenue dropping 1.4% to SG$5.94 billion and EBITDA falling 5% to SG$1.51 billion. Managed services grew 9.7% to SG$1.95 billion, revenue for business application services jumped 5% to SG$592 million, and communications engineering saw sales increase 5% to SG$153 million. Headed in the other direction were all carriage services — mobile, equipment sales, data, and fixed voice — which collectively were down 10% to SG$2.68 billion. Cybersecurity was down very slightly to SG$564 million.

    Broken out by unit, NCS saw revenue increase 6.2% to SG$2.3 billion and EBITDA grow 13% to SG$330 million, while Trustwave saw revenue steady at SG$393 million and EBITDA improve 92% to a SG$61 million loss. Along with Amobee, which posted revenue down 17.6% to SG$664 million and EBITDA shrink 85% to SG$4 million, Trustwave is now facing a strategic review. “The exceptional items in the second half year included non-cash impairment charges of SG$589 million ($438 million) and SG$336 million for the intangible assets and goodwill of Amobee and Global Cyber Security Business respectively,” the telco said. “The ongoing industry and operational challenges and COVID-19 pandemic have resulted in underperformance of their business plans and impacted the recoverable values of these businesses. Singtel has commenced a strategic review to consider options for these businesses in order to sharpen the group’s focus and ensure that these assets are positioned for growth.” As well as the review, NCS will be taking on Trustwave’s technology services, as the NCS is slated to become a “key growth driver”. “With its public-sector focus, NCS has been a consistent revenue growth engine for the Group over the years,” Yuen said. “It makes a lot of sense to develop this growth engine by casting its net further afield into the enterprise sector and markets outside Singapore where we have presence and synergies. There will be no letting up in the e-government side of the business, but this is a major turning point for NCS.” As for Singtel’s Australian arm, Optus walked away from the full year to March 31 a little battered and bruised. The company saw declines across the board, and thanks to a number of exceptional items, recorded a AU$208 million net loss for the year, a drop of AU$610 million. “With the completion of the NBN rollout in Australia and the subsequent migration of customers, Optus has undertaken a comprehensive review of its network assets and recorded non-cash impairment charges of AU$197 million due mainly to its legacy fixed access networks that will no longer be used,” the company said. Optus added it also had a AU$98 million item against its payroll review that saw thousands of its current and former workers potentially having underpaid superannuation. Optus is set to spend AU$1.5 billion in capital expenditure over its next financial year, while the rest of the Singtel group will spend SG$800 million. Related Coverage More

  • in

    Network impairment and payroll review turn slim profit into AU$208m net loss for Optus

    Image: Asha Barbaschow/ZDNet
    Singapore-owned Australian telco Optus has walked away from the full year to March 31 a little battered and bruised. The company saw declines across the board, and thanks to a number of exceptional items, recorded a AU$208 million net loss for the year, a drop of AU$610 million. Revenue was down 7% to AU$8.32 billion, and earnings before interest, tax, depreciation, and amortisation (EBITDA) fell by a quarter to AU$2 billion, and underlying net profit dropped 98% to AU$8 million. The underlying profit turned into a AU$208 million net loss once AU$216 million of exceptional items were taken into account. “With the completion of the NBN rollout in Australia and the subsequent migration of customers, Optus has undertaken a comprehensive review of its network assets and recorded non-cash impairment charges of AU$197 million due mainly to its legacy fixed access networks that will no longer be used,” the company said. Optus added it also had a AU$98 million item against its payroll review that saw thousands of its current and former workers potentially having underpaid superannuation. “Optus has also undertaken a programme to review its staff compensation and has recorded an exceptional charge of AU$98 million relating to staff payroll adjustments, professional fees as well as remediation of Optus’ systems and processes,” it said. Beyond the exceptional items, Optus said the revenue reductions were due to COVID-19, lower payments from NBN for transferring customers coupled with shrinking margins on NBN connections, and lower equipment sales.

    “This has been a challenging year with COVID-19 and structural NBN impacts affecting the whole industry,” Optus CEO Kelly Bayer Rosmarin said. “However, Optus continued to prioritise keeping Australians connected, ensuring our teams were safe and employed, and investing in our network, customer service, and digital experiences.” Giving an update on its plans to sell off its tower business, the company said it finished restructuring the towers into Australia Tower Network and began the sale process in April. Optus will be taking bids in June, and will look to wrap the divestiture of up to 70% of the business during the second half of 2021. Australia Tower Network has 3,212 towers under its remit, 565 committed builds, and a current tenancy ratio on its towers of 1.6. For its enterprise segment, revenue was up 2.3% to AU$1.23 billion. Managed services saw sales grow 7.3% to AU$448 million, cybersecurity increased 19% to AU$120 million, and mobile service revenue increased 9.3% to AU$173 million. Headed in the other direction, equipment sales plunged 21% to AU$61 million, data and internet dropped 5.6% to AU$237 million, and fixed voice declined 3% to AU$194 million. EBITDA for the enterprise division increased 21% to AU$116 million. For the consumer division, revenue was down 8.6% to AU$7.1 billion for the full year, EBITDA dropped 26% to AU$1.88 billion. Optus saw its number of prepaid plans drop 12% to 2.97 million, and postpaid plans fell 1% to 5.77 million. Average revenue per user in prepaid grew 2% to AU$19 a month, while postpaid was steady at AU$37. The total number of customers on Optus Sport grew during the year from 821,000 to 870,000. The company is set to spend AU$1.5 billion in capital expenditure over its next financial year, while the rest of the Singtel group will spend SG$800 million. Overall for Singtel, revenue was down 5.4% during the year to SG$15.6 billion, and EBITDA fell 15.6% to SG$3.8 billion. On Wednesday, Optus said it has completed a 5G standalone call using a handset from Oppo and network equipment from Ericsson. “The success of this technology milestone is a leap towards full deployment of Optus’ 5G standalone architecture nationwide, and we are already working on enabling 5G standalone voice calls using Voice over New Radio,” Optus managing director of networks Lambo Kanagaratnam said. “As we evolve our network, 5G standalone will enable future opportunities, including on-premise 5G and end-to-end network slicing allowing personalisation and control for our customers.” Related Coverage More

  • in

    Colonial Pipeline attack used to justify Australia's Critical Infrastructure Bill

    The Department of Home Affairs has said the recent ransomware attack earlier this month targeting the operator of the Colonial Pipeline in the United States was a “timely reminder” of why Australia’s Critical Infrastructure reforms are “so important”.Among other things, the Security Legislation Amendment (Critical Infrastructure) Bill 2020 would allow government to provide “assistance” to entities in response to significant cyber attacks on Australian systems. Tech giants operating in Australia, such as Amazon Web Services, Cisco, Microsoft, and Salesforce, have all taken issue with these “last resort” powers.”In the absence of these measures, we will remain vulnerable in an increasingly hostile threat environment for our critical infrastructure,” Home Affairs secretary Mike Pezzullo told Senate Estimates on Monday.”You saw the pipeline attack … transnational criminal groups are holding whole economic sectors effectively to ransom — we’re seeing this with hospital systems, we’re seeing it with vaccine data, and we’re seeing it with healthcare providers. Typically, the criminals will chase opportunity, in the knowledge that it’s likely to achieve a benefit.”In justifying the passage of the legislation, the secretary said it makes “good business sense” to have common platforms and connected systems so that, in an example of an electricity grid going down, plant operators and others can remotely dial in to see how machinery is performing. “For all of those reasons — and I could keep adding more layers of explanation — the government has seen fit to propose to the parliament that the current regime known as the Security of Critical Infrastructure Act be significantly overhauled to add additional layers of mitigation,” he said.”Should the Parliament see fit to pass this legislation — and, hopefully, as the government has proposed, by 30 June — we can enliven these obligations from 1 July.”

    Failing to pass the legislation, Pezzullo said, would see Australia left “perilous”.As part of the 2021-22 Budget, the government earmarked AU$42.4 million over two years to improve security arrangements for critical infrastructure assets, including those designated as systems of national significance, in accordance with the yet-to-be-passed Bill, and to assist critical infrastructure owners and operators to respond to significant cyber attacks. Pezzullo said the preponderance of the money is staffing resources. “There’s also some infrastructure mapping software and tools that we’re looking to put in place to understand the interdependencies of infrastructure,” he added. “It’s to assist us in designing what are called the rules under the legislation.”Department representatives later confirmed the funding would be spread across three components: Staffing expenses, supply costs, and capital. Staffing costs represent AU$21.4 million of the AU$42.4 million, and that is for 59 staff in 2021-22, and 83 in 2022-23. Supply costs are flagged as AU$14.9 million in 2021-22 and AU$6.1 million in 2022-23. Meanwhile, AU$1.1 million in 2021-22 and AU$1 million in 2022-23 are classed as “capital”, in particular, for an investment in the current regulatory management system to expand its capability and scope.Mandatory ransomware reporting under considerationPezzullo was asked if the government has considered the merits of a mandatory reporting requirement for any sort of cyber extortion or ransomware. “It’s currently considering that matter, as an extension of the cybersecurity strategy that was released last year … there was a specific commitment to put in place a national strategy to combat cybercrime, as an element of that,” Pezzullo said, pointing to the lacklustre Commonwealth cybersecurity strategy that was released in August.”Obviously, that work was well advanced. We’ve had a change of minister since that time. I have flagged with the minister that that will be one of the issues. I haven’t yet given her advice on that question. It is something on which I wish to consult with the Director-General of the Australian Signals Directorate, given the close working partnership that we necessarily need to have.”Pezzullo said he was also in the process of consulting with law enforcement and other colleagues due to the need to “balance the burden of reporting and the efficacy of reporting as against the value of that reporting”. “My inclination — I will not state it as an opinion — is that it’s likely that a regime of that character will be proposed, but there’s still some stakeholder engagement to undertake,” he said. “I don’t want to presume or preempt government policy. I think most advanced economies are at a point where, through some means, whether it’s mandatory reporting combined with the sorts of other measures that I’ve already described, a much more active defence posture will be required, simply because of the prevalence of the attacks, which I can state in those general terms.”Too much independence with government cloud useElsewhere on Monday, Pezzullo declared there is too much “independence” when it comes to the usage of cloud services across the government.Each government entity, in effect, contracts out their own cloud services, but in accordance with the Information Security Manual, the Secure Cloud Strategy, and the Data Hosting Strategy.”This is too much independence,” Pezzullo said. “The government has recently moved in that direction. So Minister Robert, who retains responsibility for digital services, has directed, through the promulgation of a data hosting policy framework and strategy, that departments are to consolidate their data hosting arrangements.”Internally, Michael Milford, group manager of technology and major capability within Home Affairs, said the department doesn’t have a heavy cloud presence “yet”. “Unlike most departments, we haven’t historically been a cloud department, but we do have a number of cloud services, primarily with a few of the systems we have been putting in place recently,” he said. “I don’t have the exact data on each of those, but there is Microsoft Azure Cloud, and others.”We do have a number, generally speaking, in scale they are small. We clearly get DTA’s guidance on those that are appropriate.”It is currently a requirement to have data stored in Australia, but historically that hasn’t always been the case. “We are in transition,” Milford said in response to being asked where Home Affairs’ data was located. “We are moving the data, or attempting to ensure that the data is 100% verified as being in Australia.”MORE ON THE CRITICAL INFRASTRUCTURE BILL More

  • in

    New algorithms show accuracy, reliability in gauging unconsciousness under general anesthesia

    Anesthestic drugs act on the brain, but most anesthesiologists rely on heart rate, respiratory rate, and movement to infer whether surgery patients remain unconscious to the desired degree. In a new study, a research team based at MIT and Massachusetts General Hospital shows that a straightforward artificial intelligence approach, attuned to the kind of anesthetic being used, can yield algorithms that assess unconsciousness in patients based on brain activity with high accuracy and reliability.

    “One of the things that is foremost in the minds of anesthesiologists is ‘Do I have somebody who is lying in front of me who may be conscious and I don’t realize it?’ Being able to reliably maintain unconsciousness in a patient during surgery is fundamental to what we do,” says senior author Emery N. Brown, the Edward Hood Taplin Professor in The Picower Institute for Learning and Memory and the Institute for Medical Engineering and Science at MIT, and an anesthesiologist at MGH. “This is an important step forward.”

    More than providing a good readout of unconsciousness, Brown adds, the new algorithms offer the potential to allow anesthesiologists to maintain it at the desired level while using less drug than they might administer when depending on less direct, accurate, and reliable indicators. That can improve patient’s post-operative outcomes, such as delirium.

    “We may always have to be a little bit ‘overboard,’” says Brown, who is also a professor at Harvard Medical School. “But can we do it with sufficient accuracy so that we are not dosing people more than is needed?”

    Used to drive an infusion pump, for instance, algorithms could help anesthesiologists precisely throttle drug delivery to optimize a patient’s state and the doses they are receiving.

    Artificial intelligence, real-world testing

    To develop the technology to do so, postdocs John Abel and Marcus Badgeley led the study, published in PLOS ONE, in which they trained machine learning algorithms on a remarkable dataset the lab gathered back in 2013. In that study, 10 healthy volunteers in their 20s underwent anesthesia with the commonly used drug propofol. As the dose was methodically raised using computer-controlled delivery, the volunteers were asked to respond to a simple request until they couldn’t anymore. Then when they were brought back to consciousness as the dose was later lessened, they became able to respond again. All the while, neural rhythms reflecting their brain activity were recorded with electroencephalogram (EEG) electrodes, providing a direct, real-time link between measured brain activity and exhibited unconsciousness.

    In the new work, Abel, Badgeley, and the team trained versions of their AI algorithms, based on different underlying statistical methods, on more than 33,000 2-second-long snippets of EEG recordings from seven of the volunteers. This way the algorithms could “learn” the difference between EEG readings predictive of consciousness and unconsciousness under propofol. Then the researchers tested the algorithms in three ways.

    First, they checked whether their three most promising algorithms accurately predicted unconsciousness when applied to EEG activity recorded from the other three volunteers of the 2013 study. They did.

    Then they used the algorithms to analyze EEG recorded from 27 real surgery patients who received propofol for general anesthesia. Even though the algorithms were now being applied to data gathered from a “noisier” real-world surgical setting where the rhythms were also being measured with different equipment, the algorithms still distinguished unconsciousness with higher accuracy than other studies have shown. The authors even highlight one case in which the algorithms were able to detect a patient’s decreasing level of unconsciousness several minutes before the actual attending anesthesiologist did, meaning that if it had been in use during the surgery itself, it could have provided an accurate and helpful early warning.

    As a third test, the team applied the algorithms to EEG recordings from 17 surgery patients who were anesthetized with sevoflurane. Though sevoflurane is different from propofol and is inhaled rather than infused, it works in a similar manner, by binding to the same GABA-A receptors on the same key types of brain cells. The team’s algorithms again performed with high, though somewhat-reduced accuracy, suggesting that their ability to classify unconsciousness carried over reliably to another anesthetic drug that works in a similar way.

    The ability to predict unconsciousness across different drugs with the same mechanism of action is key, the authors said. One of the main flaws with current EEG-based systems for monitoring consciousness, they said, is that they don’t distinguish among drug classes, even though different categories of anesthesia drugs work in very different ways, producing distinct EEG patterns. They also don’t adequately account for known age differences in brain response to anesthesia. These limitations on their accuracy have also limited their clinical use.

    In the new study, while the algorithms trained on 20-somethings applied well to cohorts of surgery patients whose average age skewed significantly older and varied more widely, the authors acknowledge that they want to train algorithms distinctly for use with children or seniors. They can also train new algorithms to apply specifically for other kinds of drugs with different mechanisms of action. Altogether, a suite of well-trained and attuned algorithms could provide high accuracy that accounts for patient age and the drug in use.

    Abel says the team’s approach of framing the problem as a matter of predicting consciousness via EEG for a specific class of drugs made the machine learning approach very simple to implement and extend.

    “This is a proof of concept showing that now we can go and say let’s look at an older population or let’s look at a different kind of drug,” he says. “Doing this is simple if you set it up the right way.”

    The resulting algorithms aren’t even computationally demanding. The authors noted that for a given 2 seconds of EEG data, the algorithms could make an accurate prediction of consciousness in less than a tenth of a second running on just a standard MacBook Pro computer.

    The lab is already building on the findings to refine the algorithms further, Brown says. He says he also wants to expand testing to hundreds more cases to further confirm their performance, and also to determine whether wider distinctions may begin to emerge among the different underlying statistical models the team employed.

    In addition to Brown, Abel and Badgeley, the paper’s other authors are Benyamin Meschede-Krasa, Gabriel Schamberg, Indie Garwood, Kimaya Lecamwasam, Sourish Chakravarty, David Zhou, Matthew Keating, and Patrick Purdon.

    Funding for the study came from the National Institutes of Health, The JPB Foundation, A Guggenheim Fellowship for Applied Mathematics, and Massachusetts General Hospital. More

  • in

    This weird memory chip vulnerability is even worse than we realised

    Google has detailed its work discovering a new Rowhammer vulnerability dubbed “Half-Double”, which evolves the style of attack on DRAM memory first reported in 2014 and suggests the Rowhammer problem won’t go away soon. 

    ZDNet Recommends

    The Rowhammer attack is unusual because it aims to cause “bit flips” by rapidly and repeatedly accessing data in one memory row on a RAM chip to create an electrical charge that changes data stored in other addresses in an adjacent “memory row” on a chip. The attacking memory rows are called “aggressors” and the rows where bit flips occur are called “victim rows”.  Over the years since the first Rowhammer attack was discovered, researchers have demonstrated numerous ways to use the technique to alter data stored on RAM cards, including DDR3 and DDR4 generations. While initially limited to scenarios where an attacker had physical access to the target, researchers eventually showed a Rowhammer attack could be carried out remotely over the web and use the technique to gain control of Linux VMs in the cloud.As Google Project Zero (GPZ) researchers explained in 2015, Rowhammer attackers work because DRAM cells are gradually becoming smaller and closer together. Miniaturization and the ability to pack in more memory capacity has made it harder to prevent DRAM cells from interacting electrically with each other. “Accessing one location in memory can disturb neighboring locations, causing charge to leak into or out of neighboring cells. With enough accesses, this can change a cell’s value from 1 to 0 or vice versa,” GPZ researchers explained of bit flips.  The Half-Double, which Google details on a PDF on GitHub, “capitalizes on the worsening physics of some of the newer DRAM chips to alter the contents of memory,” Google researchers explain in a new blogpost. 

    The style of attack is comparable to the speculative execution attacks on CPUs (Spectre and Meltdown), but rather focus on design vulnerabilities in DRAM. The consequences can be pretty nasty if the attacker successfully exploits these design issues. “As an electrical coupling phenomenon within the silicon itself, Rowhammer allows the potential bypass of hardware and software memory protection policies. This can allow untrusted code to break out of its sandbox and take full control of the system,” write Google’s research team, which includes Salman Qazi, Yoongu Kim, Nicolas Boichat, Eric Shiu & Mattias Nissler. Kim, now a software engineer at Google, was one of the researchers who reported the first Rowhammer vulnerability.  The Half-Double expands the original Rowhammer attack, which could cause bit flips at a distance of one DRAM row. The Half-Double shows the aggressor rows can cause bit flips on more distant victim rows.”With Half-Double, we have observed Rowhammer effects propagating to rows beyond adjacent neighbors, albeit at a reduced strength,” the team notes.       “Given three consecutive rows A, B, and C, we were able to attack C by directing a very large number of accesses to A, along with just a handful (~dozens) to B. Based on our experiments, accesses to B have a non-linear gating effect, in which they appear to “transport” the Rowhammer effect of A onto C.”The Half-Double is interesting because it’s a property of the underlying silicon substrate, and suggests the increasing density of cells means Rowhammer vulnerabilities will live on. They add that Half-Double also differs from the TRRespass attack on DDR4 RAM detailed in 2020, which relied on reverse engineering to undermine some of the Rowhammer mitigations that DRAM vendors had implemented to prevent these attacks in DDR4.   “This is likely an indication that the electrical coupling responsible for Rowhammer is a property of distance, effectively becoming stronger and longer-ranged as cell geometries shrink down. Distances greater than two are conceivable,” the researchers note. Google additionally has been working with the semiconductor engineering trade organization JEDEC to search for mitigations to Rowhammer. 
    Google More

  • in

    Ransomware: Dramatic increase in attacks is causing harm on a significant scale

    A dramatic increase in the number of ransomware attacks and their severity is causing harm on a significant scale, the UK’s National Crime Agency (NCA) has warned.The NCA’s annual National Strategic Assessment (NSA) of Serious and Organised Crime details how the overall threat from cyber crime has increased over the last year, with more severe and high profile attacks against victims.Ransomware attacks in particular have grown in frequency and impact over the course of the last year, to such an extent they rank alongside other major crimes “causing harm to our citizens and communities on a significant scale,” warns the report.One of the things which has made ransomware much more dangerous is the increase in attacks which don’t just encrypt networks and demand a ransom paid in Bitcoin or other cryptocurrency in exchange for the decryption, but also see cyber criminals steal sensitive information from the victim organisation which the crooks threaten to publish it if their extortion demands aren’t met, potentially putting employees and members of the public at risk of additional fraud. According to the NCA report, over half of ransomware attacks now deploy this double extortion techniques.SEE: A winning strategy for cybersecurity (ZDNet special report) | Download the report as a PDF (TechRepublic)  In addition to this, ransom demands are rising, often reaching millions of pounds and the increased severity of attacks is reflected by the impacts on businesses and other organisations, which aren’t able to provide public services after falling victim to ransomware.

    The paper details the ransomware attack against Redcar and Cleveland Borough Council in Februrary 2020 as an example of how cyber crime can have consequences for society. As a result of the ransomware attack, the local authority was briefly unable to deliver frontline services, including functions around vulnerable children and adult care. The attack encrypted data relating to school admissions, delaying the placement process for students.The NCA worked with the National Cyber Security Centre (NCSC), law enforcement and local authorities in order to help restore services.Since then, the cyber threat has increased as criminals have exploited the Covid-19 pandemic and the rise of remote working as a means of gaining access to networks, via phishing attacks or breaching cloud services, Remote Desktop Protocal services and VPNs. “The increase in home working has increased risks to individuals and businesses,” says the report.Universities and schools have become regular targets for ransomware attacks, while organisations including the Scottish Environment Protection Agency (SEPA) and UK Research and Innovation (UKRI) have become high profile victims of ransomware attacks against UK targets this year.SEE: This company was hit by ransomware. Here’s what they did next, and why they didn’t pay upBut despite the increasing threat of ransomware and the scale of the damage that can be done, it’s possible to take steps to avoid falling victim to it in the first place. The NCA recommends organisations keep software up-to-date by applying patches in order to prevent cyber criminals from being able to exploit known vulnerabilities to gain access to the network.Organisations should also ensure that staff are using strong, unique passwords in order to prevent them being breached in brute-force attacks and that two-factor authentication should be applied where possible to provide an extra barrier to cyber criminals, should they successfully crack an account.It’s also recommended that organisations back up important data to an external hard drive or to cloud-based storage, so if the worst happens and they are hit by a ransomware attack, data can be recovered without paying cyber criminals for the decryption key.MORE ON CYBERSECURITY More

  • in

    Bluetooth bugs open the door for attackers to impersonate devices

    Threat actors could exploit vulnerabilities in the Bluetooth Core and Mesh specifications to impersonate devices during pairing, paving the way to man-in-the-middle (MITM) attacks. 

    The vulnerabilities, disclosed by researchers at the Agence nationale de la sécurité des systèmes d’information (ANSSI) and disclosed on Monday, allow for “impersonation attacks and AuthValue disclosures” according to a Carnegie Mellon University CERT Coordination Center advisory.Bluetooth Core and Mesh are separate specifications suitable for low-energy and Internet of Things (IoT) devices or and many-to-many (m:m) device communication for large-scale networks.  The vulnerabilities are as follows: CVE-2020-26558: A vulnerability in the Passkey Entry protocol, used during Secure Simple Pairing (SSP), Secure Connections (SC), and LE Secure Connections (LESC) in Bluetooth Core (v.21 – 5.2). Crafted responses could be sent during pairing by an attacker to determine each bit of the randomly generated Passkey generated during pairing, leading to impersonation.  CVE-2020-26555: Another vulnerability in Bluetooth Core (v1.0B through 5.2), the BR/EDR PIN Pairing procedure can also be abused for the purposes of impersonation. Attackers could spoof Bluetooth device addresses of a target device, reflect encrypted nonces, and complete BR/EDR pin-code pairing without knowing the pin code. This attack requires a malicious device to be in wireless range.  CVE-2020-26560: Impacting Bluetooth Mesh (v.1.0, 1.0.1), this vulnerability could allow attackers to spoof devices being provisioned via crafted responses created to appear to possess an AuthValue.This may give them access to a valid NetKey and AppKey. An attacker’s device needs to be in the wireless range of a Mesh Provisioner.  

    CVE-2020-26557: Affecting Bluetooth Mesh (v.1.0, 1.0.1), the Mesh Provisioning protocol could allow attackers to perform a brute-force attack and secure a fixed value AuthValue, or one that is “selected predictably or with low entropy,” leading to MiTM attacks on future provisioning attempts.  CVE-2020-26556: If the AuthValue can be identified during provisioning, the Bluetooth Mesh authentication protocol (v.1.0, 1.0.1) is vulnerable and may be abused to secure a Netkey. However, the researchers note that attackers must identify the AuthValue before a session timeout.  CVE-2020-26559: The Mesh Provisioning procedure used by Bluetooth Mesh (v.1.0, 1.0.1) allows attackers, with provision — but without access to the AuthValue — to identify the AuthValue without the need for a brute-force attack.  “Even when a randomly generated AuthValue with a full 128-bits of entropy is used, an attacker acquiring the provisioner’s public key, provisioning confirmation value, and provisioning random value, and providing its public key for use in the provisioning procedure, will be able to compute the AuthValue directly,” the advisory reads.  The researchers also identified a potential vulnerability in Bluetooth Core relating to LE Legacy Pairing in versions 4.0 to 5.2 which could allow an attacker-controlled device to perform pairing without knowledge of temporary keys (TK).  The Android open source project, Cisco, Cradlepoint, Intel, Microchip Technology, and Red Hat are cited as vendors with software vulnerable to the disclosed vulnerabilities, in some form or another.  The Android open source project said, “Android has assessed this issue as High severity for Android OS and will be issuing a patch for this vulnerability in an upcoming Android security bulletin.” Cisco said: “Cisco has investigated the impact of the aforementioned Bluetooth Specification vulnerabilities and is currently waiting for all the individual product development teams to provide software fixes to address them.” Microchip Technologies is also working on patches.  Red Hat, Cradlepoint, and Intel did not issue the team statements ahead of public disclosure.  Bluetooth Special Interest Group (SIG), which works on the development of global Bluetooth standards, has also published separate security advisories.  To mitigate the risk of exploit, updates from operating system manufacturers should be accepted once they are made available.  The research follows a separate Bluetooth-related security issue disclosed in September 2020 by Purdue University academics. Dubbed the Bluetooth Low Energy Spoofing Attack (BLESA), the vulnerability impacts devices running on the Bluetooth Low Energy (BLE) protocol, a system used when limited battery power is available. ZDNet has reached out to Red Hat, Cradlepoint, and Intel and we will update when we hear back.  Previous and related coverage Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More