Archive for December 1, 2023

EU Adopts New Rules To Protect Devices Connected To The Internet

Posted in Commentary with tags on December 1, 2023 by itnerd

EU countries and EU lawmakers on Thursday agreed to rules to protect laptops, fridges, mobile apps and smart devices connected to the internet from cyber threats following a spate of such attacks and ransom demands in recent years around the world:

The European Commission, the European Union’s executive arm, proposed the new law last year in a bid to tackle the increasing risk from cyber threats to any smart devices, including a growing number of household goods as products become more connected.

The commission hopes the rules could save companies affected by such cyber incidents between 180 to 290 billion euros ($196-305 billion) every year.

The law will affect any product that is connected either directly or indirectly to another device or to a network.

The new rules introduce EU-wide cybersecurity requirements for the design, development and production of hardware and software products.

Manufacturers will also be forced to assess the cybersecurity risks of their products, and the rules demand greater transparency on the security of hardware and software products for consumers and business users.

Alongside CISA’s push for “secure by design” and the White House mandate for security nutrition labels on consumer devices by December 2024, this is a significant moment in the security of network-embedded devices. Pia McSharry, Security Strategist at Beyond Identity, shared the following commentary: 

Device health is of the utmost importance to an organization’s overall cybersecurity posture. Putting the onus back on the manufacturer to produce devices that are “secure by design” eases the responsibility on the end user. Between this move by the EU and CISA/White House push for consumer security labels on devices by December 2024, IoT manufacturers will have to change their current practices to meet these new requirements and change up software and production practices.

The importance of upholding specific security hardening guidelines which are monitored and maintained by manufacturers is extremely important for organizations to minimize their attack surface.  The management of the security posture of any connected device should be a shared responsibility between the manufacturer and the consumer.  The manufacturer should always communicate the security standards used to harden the device, and the consumer should be aware of any potential security gaps to assure they are mitigating the risks effectively.  This is a step forward to making security a priority for all.

Given that everything from lightbulbs to cars is on the Internet, this is a great move by the EU. Hopefully this forms the basis for devices that are assumed to be secure rather than something that you have to question its security.

UPDATE: George McGregor, VP, Approov Mobile Security Had This To Say:

   “Despite a lot of pushback, particularly on the 24 hour breach reporting requirements,  the EU Cyber Resiliency Act (CRA) is now on its way to being in force in 2024.  Companies will have a 21-month grace period before they must conform with the reporting obligation of manufacturers for incidents and vulnerabilities.

   “Any companies who operate in the EU would do well to make it a priority to study this legislation: it provides a cybersecurity framework and rules governing the planning, design, development and maintenance of any products, with obligations to be met at every stage of the value chain. The breach reporting requirements are particularly demanding. 

   “This is another sign that pressure is being put on all companies and organizations around the world to invest in their cybersecurity resilience and response. The SEC is also active, proposing new guidelines with a four business day reporting rule.   

   “This trend will continue and it is inevitable that all companies will have to increase their focus and investment on cybersecurity governance, protection and response. 

David Ratner, CEO, HYAS Infosec follows with this:

   “The Cyber Resiliency Act is a great start and will certainly help to increase transparency and responsibility.  However, organizations should not let attestations and compliance drive their overall operational resiliency and business continuity strategy. They still require solutions capable of giving them the visibility and observability required to move business forward with confidence in the face of a constant onslaught of new and innovative cyber attacks.”

Elon Musk Gets Desperate When It Comes To Advertisers On Twitter

Posted in Commentary with tags on December 1, 2023 by itnerd

Clearly Elon Musk’s F-bomb laced tirade has had significant knock on effects. It seems to have accelerated the departure of advertisers from Twitter. Which I did predict here:

What’s clear from this debacle is that Elon completely off his rocker. And this will simply accelerate the departure of advertisers from Twitter. I wonder if Elon will start caring once Twitter is in critical condition with no hope of recovery? By the time he does, if he actually does care, it may be too late. 

According to this story, the departures likely have started:

The Tesla chief also acknowledged that an extended boycott by advertisers could bankrupt X, formerly Twitter, but suggested that the public would blame the brands and not him for a potential collapse.

However, Insider Intelligence analyst Jasmine Enberg said: “If anyone is killing X, it’s Elon Musk – not advertisers.”

“Should X collapse, an autopsy would reveal a series of platform policy decisions, staffing cuts, tweets and antagonistic comments by Musk that have driven away X’s primary source of revenue,” Enberg said.

An executive at a major global ad-buying firm, who declined to be named, said only one major client was continuing to advertise on X.

“(Musk) seems to be hell bent on destroying the platform,” the executive said.

And:

“We believe there is a risk that more companies will stop advertising on X; at least on a short-term basis,” D.A. Davidson & Co analyst Tom Forte said.

“It is fair to say this makes the company’s subscription efforts more important and potentially means it may need more than half its revenue to come from subscriptions,” he said.

So how is Elon going to square this circle? The Financial Times is reporting that X is now going to be focusing on smaller businesses. The story is paywalled, but a TL:DR is available on The Verge with the key point from the article. At least from a Twitter perspective:

‘Small and medium businesses are a very significant engine that we have definitely underplayed for a long time,’ the company told the Financial Times. ‘It [was] always part of the plan — now we will go even further with it.’

Here’s the problem with that strategy. I don’t see how getting a bunch of small and medium sized businesses on board will make up the revenue shortfall of a Disney or IBM, or Apple individually, never mind all three of those companies combined. This seems more like a Hail Mary more than a real strategy that could produce real revenue. And given the fact that subscriptions aren’t exactly raking in the cash for Twitter, that means only one thing. Which is Elon has doomed Twitter to a slow and painful death. And his latest stunt has accelerated the death of the platform. Anything he does now is simply delaying the inevitable. There’s just no denying it at this point.

Congratulations Elon. You’ve proven how bad you are at running a company.

North Texas Municipal Water District Pwned In A Ransomware Attack

Posted in Commentary with tags on December 1, 2023 by itnerd

North Texas Municipal Water District was recently pwned in a ransomware attack, causing operational issues and exfiltrated customer files:

Officials at North Texas Municipal Water District have confirmed that the water, wastewater, and solid waste management services provider had its business computer network impacted by a cyberattack, according to The Record, a news site by cybersecurity firm Recorded Future.

While phone services have been disrupted by the attack, there has been no impact on customers, said NTMWD Director of Communications Alex Johnson, who added that an investigation looking into the extent of the incident is already underway.

Ransomware operation Daixin Team has taken credit for the attack, which it claims has resulted in the exfiltration of more than 33,000 files with customer details from NTMWD’s systems.

Well that sucks for North Texas Water. Tom Marsland, VP of Technology, Cloud Range had this comment:

The breach of the North Texas Municipal Water District only breached the business network and phone system, and core water, wastewater, and solid waste services were unaffected. Kudos to the teams for strong isolation and/or practices that prevented a breach of the OT network. Municipal water and utility companies are a growing target due to limited staff – there is still a schism between IT and OT operations personnel in most organizations that I’ve worked with.

The recent publication by CISA regarding the exploitation of Unitronics PLCs used in water and wastewater systems highlights basic principles that highlight the schism between OT operations personnel and cybersecurity departments. Use of default passwords, multi-factor authentication, keeping backups of running configurations, practicing recovery, and keeping things off the open internet that do not need to be there are basic tenets of cybersecurity – the fact CISA has to remind organizations of these highlights the need for experienced professionals working in OT cybersecurity. All of these are low-hanging fruit for any organization to cover. 

We will continue to see more breaches of OT/ICS systems until these methods of protection are taken seriously. Devices should not be connected to the internet that could directly impact human life just for convenience. There needs to be wider, open-source security solutions provided to smaller organizations, both in ICS/OT and IT, to help with cybersecurity practices.  Too often we’re seeing the smaller organizations be the weak link in the chain that is then enabling wider breaches.

Seeing as a municipal water provider was the target of this attack, it highlights the fact critical infrastructure needs to be protected from attacks like this. But clearly that isn’t happening, and that needs to change. Now.

More Tech Predictions For 2024

Posted in Commentary on December 1, 2023 by itnerd

As 2024 quickly approaches, I’m sure you know what that means. More predictions! Here’s a few more predictions from three more industry leaders:

Dr. Darren Williams, CEO and Founder at BlackFog:

“After a record-breaking 2023, we expect that ransomware will not ease anytime soon. Fundamentally, ransomware is becoming the main threat to all organizations, and insurance is no longer a viable option. Action needs to be taken. In 2024 we predict several new trends to take hold.  

  1. Ransomware gangs will look for new ways to force victims into paying. We have already seen gangs contact the SEC directly, reporting victims immediately to inflict maximum damage, forcing regulatory, reputational and class action liabilities. We expect this is just the beginning of several new tactics to maximize payouts. 
  2. Organizations will realize that their existing security is not making any impact on the new threat vectors and will finally start to focus on the core problem, “data security” and “data exfiltration”.  
  3. More than 40% of existing data exfiltration goes to China and Russia. We expect other countries such as North Korea to play larger roles in 2024. 
  4. We expect to see major infrastructure applications become threat vectors for cyber gangs, similar to the way the MOVEit exploit was developed. Hiding in plain sight is going to be the new mantra for cyber gangs as they continue to avoid detection. 
  5. We expect to see ransomware disrupt major infrastructure through IoT devices and non-traditional platforms. These diverse systems often have limited security designed in and have significant exposure for organizations, particularly in the manufacturing industry.” 

Sabrina Gross, Regional Director of Strategic Partners, Veridas:

AI Safeguards

“With the increased use of AI, we will see more discussions and regulation efforts around the world to set up AI safeguards in 2024.

We’ve already seen discussions in 2023 with the EU’s AI Act, the UK AI Summit and Biden’s Executive Order on AI. However, in 2024, safeguards will begin to focus on how accurately AI performs – especially when these systems do not have enough information or lack clear instruction.

There will be a crackdown on AI hallucinations, including those created by mistake and those with malicious intent, and safeguards around overwriting AI decisions, which is particularly important in medical and judiciary systems.

In 2024, organizations will be expected to be transparent in how they use AI to help build public trust in the technology. Companies must be transparent about how they train AI algorithms, how they use data and how much of the process is solely in ‘the hands’ of AI.”

Online Safety Bill and Biometrics

“With the passing of the Online Safety Bill, we’re going to see a rapid rise in the number of UK organizations adopting biometrics in 2024. The bill requires tech companies to make their sites safe for children by design, and businesses will need to find solutions that are secure, robust and future proof.

Naturally, biometrics is the obvious solution as it covers these requirements. Age verification biometric technology can anonymously prove the age of individuals without sharing data they do not wish to share.

Another key part of the bill is to verify children on social media and ensure they are not exposed to inappropriate content. Biometrics, such as facial access and anti-fraud, not only allow organizations to verify ages within seconds but provide access control to sensitive content, block illegal content and provide a seamless user experience.”

Fighting Abusive Deepfakes

“In 2024, deepfake abuse is going to significantly increase. This will become particularly prevalent on social media, especially with elections in the US and EU as well as potentially one in the UK. It will become a popular technique among cyber criminals for financial crime, with voice deepfakes being used for phone fraud.

As a result, over the next year, customers will expect organizations to have processes in place to prevent fraud and to ensure they are actively investing resources that combat deepfakes.

Additionally, legislation will come in that requires deepfake content and products to be tagged and labeled. Fines will be produced for those who fail to comply, and in some cases, more severe punishments will be handed out – similar to regulations such as GDPR. The challenges when it comes to regulation will be complexity of governance and responsibility by jurisdiction.”

Dr. John Pritchard, Chief Product Officer, Radiant Logic

What are the biggest changes we will see in the adoption of AI in 2024?

“Much like what we saw with networking, cloud computing and mobile apps, the early market begins with euphoria, followed by a period of diffusion, before becoming mainstream. AI will go through a similar adoption curve through 2024. When it comes to enterprise software specifically, I expect to see major advancements in the augmented workforce as AI accelerates and improves human capabilities. Although there is early concern about AI replacing the human worker, I see augmentation as a bigger near-term change as AI starts to drive hyper-automation. We see this in software development, marketing content generation, document editing and even movie production.”

What AI-related challenges or risks will be more present in 2024?

“Although privacy and data protection risks were early concerns for AI adoption, we are now seeing greater privacy options available on the market. The bigger concern for most enterprises leveraging GenAI is inaccurate or fabricated answers, otherwise known as chat hallucination, a phenomenon in which Large Language Models (LLMs) generate text that is coherent but is not based on factual or true information. These models can sometimes produce responses which are creative but misleading or entirely fictional. The challenge in natural language processing is to ensure the AI models provide accurate and reliable information without engaging in chat hallucination. This will put pressure on companies to assess and test the accuracy, appropriateness, and actual usefulness before being accepted.”

What are some of the biggest market developments you predict for 2024?

“One of the most profound developments I see in 2024 will be the rise of AI ecosystems. I expect this to take two distinct, but equally important, forms. Firstly, we will see AI ecosystems formed out of a growing partnership between Academia and Open Source. This can be observed today in Hugging Face, a machine-learning community where participants collaborate on models, datasets, and applications. One of the most popular resources is ‘Daily Papers’, a curated list of daily academic research papers. The open-source approach attracts a community of sharing participants which engage with Academica on research to fill in gaps on how AI performs.

The second form will be GPT ‘app stores’. I expect universal AI agents to eventually be distributed through app store-like exchanges which will create discoverability, distribution, and network effects like what we experienced with the Apple App Store in 2008, Shopify’s App Store in 2009 and the Force.com/Salesforce App Exchange later that same year.”

Any thoughts on EU AI act, US developing AI position, any other regulatory related predictions for 2024?

“With the pace that AI innovation is moving in, we are quickly finding areas of concern with issues of model bias, copyright infringement, and personal data privacy. Regulations in these areas can help build needed protections, we just need to be careful however that we do not stifle the innovation process. Many recent regulatory announcements impose compliance or reporting requirements that significantly limit small companies and the open-source community, key participants in ensuring a healthy ecosystem. Regulations should balance protections without creating a regime that entrenches large tech incumbents.”

Guest Post: The Perfect Gifts For Everyone On Your Holiday Shopping List

Posted in Commentary with tags on December 1, 2023 by itnerd

This year, Hisense Canada released some incredible technology ranging from TVs, to refrigerators, to all consumer and home electronics in between. To find out what you should get everyone on your holiday shopping list this season – keep reading. 

For the one who loves film….

short-throw laser TV offers a simple set up, and projects a crystal-clear and razor sharp 4K image on a screen up to 130 inches. If the budget it too tight for a top-end short-throw projector, the Hisense C1 mini projector is a compact but powerful machine that puts out more than a billion colours in consistently clear and vibrant images on screens from 65 inches up to 300 inches. 

Mini-LEDs TVs are also an excellent choice for set ups without a projector TV. Mini-LED screens are available up to 85 inches and are ideal televisions for watching movies — with fluid motion and a vibrant HDR picture that captures all the dazzling details. There is a wide range of Mini-LED options available (U6, U7 or U8 series) depending on your lifestyle and preferences.

For the one who loves to cook…

If someone in your family or another loved one loves to cook, odds are they are in the kitchen as much as possible. Say thank you this year for their culinary delights with a PureFlat Collection Counter-Depth French Door Refrigerator (Model: RF225C3CSEI). The elegant design with stainless steel finishes of the refrigerator makes it seamlessly fit into any kitchen space, providing a sophisticated look to the entire area. The advanced cooling technology, an optimum temperature is consistently maintained throughout your fridge and freezer, keeping food chilled to perfection – no matter where it is placed.

For the one who loves to bake…

Although a new range may seem like a strange gift but, on average, households make this larger purchase on average every 10-15 years and with the right pick, could really blow someone away who uses the oven quite often. The new Hisense Slide-In Electric Range, with Air Fry and True Convection (Model: HFE3501CPS) comes equipped with unique features like air frying, dehydrating, baking pizza, keeping warm, proofing bread, convection baking, roasting, frozen baking and broiling. The true convection oven circulates heated air around food continuously, for faster, more even baking and roasting on every rack.

For the one who loves to game…

Some new TVs on the market were designed specifically with game play in mind. Hisense has introduced Game Play PRO to its U88KM series and U78KM series, giving gamers the power to dominate their opponents. Equip the game bar and use an array of tools to customize the best gaming experience technology has to offer. From providing real time refresh rate and input lag status reports, to an adaptive easy to adjust screen to quickly and smoothly adjust your picture size and position, surprise your opponents with a tactical game-play that fully supports your skill set.

For the one who loves music…

soundbar fills a room with pure and powerful sound for a truly pleasing sonic experience. They offer a sleek look, and are easy to set up — there is no need to run and hide wires to all corners of the room. Equipped with a subwoofer, it makes sure the highest highs and deepest booms resonate, making you feel like you are at centre stage.

For the one who loves wine…

A Hisense 54-bottle wine cooler ensures your favourite Chardonnay or Pinot Noir are always close by. The wine coolers are equipped with dual-zone and reversible door options with a  sleek design that compliments any space as a little luxury. There is also a 46-bottle option available.

For the one who hates washing the dishes…

This one is tricky, get it for the parent who is also working on house duties all the time, looking to get spoiled this holiday season – and you might get a lump of coal in return! But for the whole family, the new 24” Top Control Dishwasher with Pocket Handle (Model: HUI6220XCUS) could be a very special treat to help you all relax and spend more quality time together. 

To make it extra special, there is an added bonus of two-year warranty on every Hisense home appliance!

There you have it — a gift guide of high-quality technology that is truly for everyone. Learn more about the Hisense family of products at hisense-canada.com

TELUS Secures 3800 MHz Spectrum Licences

Posted in Commentary with tags on December 1, 2023 by itnerd

TELUS has announced the acquisition of new 3800 MHz spectrum licences nationwide at a cost of $620 million during the recent ISED 3800 MHz auction. TELUS will now hold licences to an average of 72 MHz of 3800 MHz spectrum nationally, acquired at an average price of $0.24 per MHz-pop. Combined with the 3500 MHz spectrum obtained in 2021, TELUS has secured approximately 100 MHz of prime 5G mid-band spectrum nationally, with contiguity in 96% of the country including all major markets, at an average price of $0.82 per MHz-pop.

TELUS is well positioned to fully maximise the efficient use of 5G and the effective development and deployment of 5G products and services conceived of since the launch of this wireless technology. With mid-band spectrum becoming the critical global band for 5G innovation due to the ideal combination of speed, capacity, low latency, and coverage, this contiguous spectrum provides wider channels and enables a superior network experience for customers.

Innovation, Science and Economic Development Canada (ISED) shifted from the previous auction framework utilising set-aside spectrum in favour of a spectrum cap. Spectrum caps are the auction mechanism used almost exclusively by the rest of the world. This shift in the framework now more closely aligns spectrum costs with the competitive prices in the market. Declining spectrum prices are essential in supporting the 18.6% year over year decline in wireless prices, significant during this heightened inflationary period. In addition, this auction design enabled the provision of enough spectrum to the four national operators at a cost comparable to other jurisdictions. Canada’s average price per MHz-pop was in line with the average rate paid in Australia, of $0.26 per MHz-pop (CAD equivalent).

Japan’s Space Agency Pwned…. Again

Posted in Commentary on December 1, 2023 by itnerd

In a briefing yesterday, Chief cabinet secretary Matsuno said the network server of Japan’s aerospace exploration agency (JAXA) was hacked. JAXA is the agency responsible for developing and launching satellites into orbit and other advanced missions such as human exploration of the moon.

During the investigation, the agency temporarily shut down part of its network to assess the extent of the incident. So far, no data leaks have been confirmed.

It is believed that the hackers gained unauthorized access to JAXA’s central Active Directory server that manages information such as employee IDs, passwords and viewing privileges via a vulnerability disclosed by the network equipment manufacturer in June of this year.

JAXA told Japanese media that they became aware of the hack when they were contacted by law enforcement in the fall and that the system was likely hacked during the summer.
 
This is not the first time JAXA has been hit by a cyberattack. In 2016 and 2017, it was among 200 Japanese companies and research institutes allegedly targeted by Chinese military hackers.

Ted Miracco, CEO, Approov Mobile Security had this to say:

   “The cyberattack on Japan’s aerospace exploration agency (JAXA) bears all the characteristics reminiscent of past incidents, raising questions about the involvement of state-sponsored actors. In the historical context previous attacks were linked to Chinese military hackers, and the reported exploitation of a vulnerability disclosed by a network equipment manufacturer in June adds a layer of sophistication to the attack, indicating a state-sponsored attack.

   “The motivation behind the cyber intrusion, given the nature of JAXA’s operations in satellite development and advanced missions, points towards an interest in strategic intelligence and technological advancements. Understanding the identity, methods, and motivations of the perpetrators becomes crucial in fortifying cybersecurity measures to mitigate future risks, as these attacks are unlikely to stop anytime soon.”

The fact that this organization has been pwned three times says to me that they really need to get their act together in terms of being secure. Because being pwned once is a problem. Three times being pwned screams major problem.