Archive for August 18, 2022

Rogers Shares More Details About The July Outage

Posted in Commentary on August 18, 2022 by itnerd

The cynic in my says that because of public pressure, the CRTC, and likely customers fleeing the telco, Rogers has shared more details about the nationwide outage in July. You can find the details in this Microsoft Word document here (Dumb question: Why doesn’t Rogers simply PDF this stuff?) But here’s what you need to know.

  • The outage affected 13 million wireline and wireless customers. 2.9 million customers were wireline and 10.2 million were wireless customers.
  • Rogers in the document provides more specifics on actions it took following the outage and details on its internal process for major network upgrades.
  • Wireless services were Rogers’ first priority of restoration. Wireline services were next. Critical care services (including police, hospital, and airports) was the third thing Rogers restored.

But there’s still a lot that Rogers didn’t disclose as the document is still heavily redacted. Thus I am going to stick by what I said when they initially filed this document. Which is that they have something to hide. A cynical view I know. But it’s the only view that one could have given the facts at hand. Now I get that there’s certain things that may be competitive info that Rogers may not want to share. But given that this was an outage that rocked the country, a larger degree of transparency by Rogers is going to be way better from a public image perspective than trying to cloak stuff as being competitive info.

Let’s see if the CRTC request for more info that I spoke about earlier today brings more details to light about this outage.

Leave a comment »

New Attack Exploits AWS to Build Personalized Phishing Page and Send Fake Auto-Filled Password Reset: Avanan

Posted in Commentary with tags on August 18, 2022 by itnerd

Researchers at Avanan, a Check Point Company, have discovered threat actors are using the legitimacy of Amazon Web Services (AWS) to create phishing websites that bypass scanners and get users to steal credentials. The attack brief that Avanan has put out looks at how hackers are creating phishing pages utilizing AWS applications via email for credential harvesting, using static expressway techniques to target victims. 

Avanan’s cybersecurity research uncovered that this new attack is exploiting a legitimate AWS app domain to build sites and send them as fraudulent password expiration notifications via email to victims prompting them to click on the page to conduct a credential reset.

This campaign is prompting vulnerable users to click on the password reset page, which shows the targeted victim’s company domain filled in at the URL bar, company logo, and pre-populated email address, so all the user needs to do is enter their password.

The attack brief can be found here: https://www.avanan.com/blog/hackers-build-phishing-pages-using-aws-apps

Leave a comment »

CRTC To Rogers: We Want More Detail On How You’re Going To Deal With The July Outage…. A Lot More Detail

Posted in Commentary with tags , on August 18, 2022 by itnerd

You might recall that after the nationwide outage in July, Rogers was told by the CRTC to serve up an explanation as to what happened and what they’re going to make sure it doesn’t happen again. Which Rogers did do. Though some details were redacted which makes it look like Rogers has something to hide. Regardless, that document wasn’t good enough for the CRTC based on this:

This letter is in relation to the national service outage experienced by Rogers Communications Canada Inc. (Rogers) that began on 8 July 2022 and is in reply to Rogers’ response dated 22 July 2022 to the Commission’s request for information (the Response). The Response provided valued information for the Commission to understand the cause of the outage, impact of the outage and immediate steps to mitigate the impact.

Since the Response, Rogers has made public statements about measures to reduce the likelihood of similar events as well as address consumers’ concerns. To better understand the impact of the event, mitigating measures as well as these recent announcements, further information is required for the Commission to assess this situation. 

Given the seriousness of this event, and while the Commission considers the complaints and calls for a public inquiry before it, Rogers is to provide, by 15 August 2022, comprehensive answers, including rationale and any supporting information, to the questions included in the attachment.

This letter and any subsequent correspondence will be placed on the public record. Should Rogers designate any information in its response as confidential pursuant to section 39 of the Telecom Act, an abridged version of the response must be provided for the public record. Note that, in accordance with its normal practices, the Commission may disclose or require the disclosure of information designated as confidential if its disclosure is in the public interest, i.e., where any specific direct harm likely to result from disclosure does not outweigh the public interest in disclosure.

First off, you’ll note that the request for Rogers to provide this information by August 15th. But Rogers has asked for more time. Specifically August 22nd.

Regardless, this is what the CRTC is looking for answers on:

  • A cost breakdown of the $250 million that Rogers is saying that it is going to spend to make its network more resilient
  • Implementation timelines and information on how separating networks will improve resilience
  • They want to know why Rogers is spending $10 billion in Artificial Intelligence and further testing and oversight and why that’s going to make a difference
  • Rogers has to provide details on the direct economic losses of the outage and confirmation if residential and small business customers receive the credit the company promised

Read from a cynical point of view, it sounds like the CRTC believes that Rogers is just putting stuff out there that they have no intention of doing in hopes of making the blowback from their outage go away, and the CRTC wants proof that they will actually follow through. It also sounds like the CRTC is for once doing its job. Which means that when Rogers puts out their response next week, it will not only be worth reading, but it will likely be a means to hold the troubled telco’s feet to the fire.

2 Comments »