Archive for July 17, 2022

Canadian Networking Company Saw Trouble With The Rogers Network Weeks Ago

Posted in Commentary with tags on July 17, 2022 by itnerd

The recent nationwide Rogers outage that crippled the country was a big shock to all of us with the exception of Packetworks based in Waterloo. They build networks for cities, hospitals and businesses among others, and they apparently saw trouble coming weeks ago from Rogers. Here’s what John Fagg, the president at Packetworks had to say:

His company uses both Rogers and Bell networks to ensure clients are never without internet and mobile, and Packetworks clients sailed through the countrywide outage, he added.

The Rogers monitoring system constantly checks on the Rogers software and hardware used by in the networks built by Packetworks. Normally, the engineers and operators at Packetworks receive one notice a week from the Rogers monitoring system about disruptions.

But that jumped to 50 a week during the two-month period before the Rogers networks crashed for more than 24 hours, beginning about 4:30 a.m. Friday, July 8.

“It was the Rogers monitoring system that is sending us notices saying, ‘Hey, we see a problem here and we see a problem there.’ They are small, a computer can see it, but most people don’t see those problems,” said Fagg.

“If you get one a year that is not a problem , but if you start getting one a week you know that equipment is going to be failing pretty soon,” said Fagg. “Once a week we were getting several, 50 at a time, that sort of thing.”

And:

“They contacted us a couple of times wanting to do upgrades because their optics are showing signs of deterioration,” said Fagg. “In hindsight, maybe that is something that was indicative of what we had on Friday.”

That’s pretty damming and businesses and individuals based on this should be re-evaluating if Rogers can be trusted ever again. Because you have to assume that things must have been pretty bad on the Rogers network for Packetworks to see trouble up to two months ago. And it also implies that since an outage of this scale is something that cannot be fixed instantly, the underlying issues are still there. That in turn implies that Rogers could have a similar outage again. Which of course is bad. Now Rogers is free to prove me wrong on this by simply coming clean and saying in detail what happened and what they’re going to do to make sure it never happens again. But I know they won’t do that because that isn’t who they are. Thus I guess that we’ll have to leave it to the CRTC and the feds to get those answers for Canadians.

Leave a comment »

Rogers To Be Investigated By A Parliamentary Committee In Relation To The Catastrophic Nationwide Outage

Posted in Commentary with tags on July 17, 2022 by itnerd

When the catastrophic nationwide Rogers outage happened, I said this shortly afterwards as I mused that Rogers wouldn’t come clean about what happened in detail:

After thinking about this, I concluded that there is zero chance that Rogers is ever going do any of that. I don’t believe that they’re that kind of company who would be that transparent. And they are going to hope that Canadians forget about this and turn the page when they do move on. Thus what needs to happen is that Parliament needs to step in and pull Rogers in front of them to answer questions in public.

It looks like I might get a version of my wish come true as CTV News is reporting that Rogers is being investigated by The House of Commons Industry and Technology:

Parliamentarians on the House of Commons Industry and Technology committee voted unanimously on Friday to study the Rogers Communications outage, with at least two meetings scheduled before July 30.

Members will invite company executives, representatives from the Canadian Radio-television and Telecommunications Commission (CRTC), and Industry Minister Francois-Philippe Champagne to speak about the outage that saw millions of customers lose internet and wireless services a week ago.

They will review the causes of the disruption and the impact on Canadians, consumers, businesses as it relates to health care, law enforcement and financial sectors, as well as the best practices to prevent a similar situation from happening again.

So for those keeping score at home, the feds told the big three telcos to come up with a plan to ensure that this doesn’t happen again, the CRTC is investigating Rogers and giving them a tight deadline to answer questions, and now this. If this keeps up, I am going to go out on a limb and say that Rogers CEO Tony Staffieri and family patriarch Edward Rogers are going to feel like they are having the most uncomfortable prostate exam ever. But let’s face it, Rogers needs to put under a lot of scrutiny as this outage was as I said earlier, catastrophic. Canada needs answers and Rogers needs its feet held to the fire so that this never, ever happens again. Thus I am all for this and it will be “fun” to watch.

Leave a comment »

Microsoft Publishes Their Findings On The H0lyGh0st Ransomware Group

Posted in Commentary with tags on July 17, 2022 by itnerd

Microsoft on Thursday released their findings regarding H0lyGh0st, which is a group with ties to North Korea which utilizes a ransomware payload with the same name for its campaign and has successfully compromised small businesses in multiple countries, starting as early as September 2021.

Along with their H0lyGh0st payload, DEV-0530 maintains an .onion site that the group uses to interact with their victims. The group’s standard methodology is to encrypt all files on the target device and use the file extension .h0lyenc, send the victim a sample of the files as proof, and then demand payment in Bitcoin in exchange for restoring access to the files. As part of their extortion tactics, they also threaten to publish victim data on social media or send the data to the victims’ customers if they refuse to pay. This blog is intended to capture part of MSTIC’s analysis of DEV-0530 tactics, present the protections Microsoft has implemented in our security products, and share insights on DEV-0530 and H0lyGh0st ransomware with the broader security community to protect mutual customers.

Saryu Nayyar, CEO and Founder, Gurucul had this comment:

     “While ransomware is seemingly focused on getting paid to unlock your sensitive data, threat actors often return multiple times once they are successful at an attack, knowing the victim has paid once. We also know they often replicate the data for themselves for sale even as they lock organizations out of their own data. However, this additional extortion through threats of posting the already stolen data is another example of how threat actors find ways to extract more out of their victims. It feels like a never-ending cycle for targeted organizations. This reinforces the need to evaluate newer and more advanced technologies beyond current XDR and SIEM platforms as part of ongoing threat detection and response initiatives within security operations to prevent a successful detonation of ransomware. Prioritizing solutions that automate detection, prioritize seemingly random indicators of compromise for further investigation and even automating responses with a high-level of confidence and low impact are critical in deciding where to invest.”

I would take a good look at the Microsoft report on these threat actors as this is clearly a dangerous bunch of individuals.

Leave a comment »