Rogers Email Issues Continue To Drag On…. With Not Even A Peep From The Telco

Posted in Commentary on March 17, 2023 by itnerd

I’ve been covering issues with Rogers Internet offering. It started as a general outage, but what has dragged on for weeks is an issue with email.

Let me the recap the issue that Rogers has been unable to fix. Anyone who uses Rogers email service (in other words they have a @Rogers.com address) cannot get their email. This is in part due to the fact that Rogers requires users to create  App Specific Passwords via Rogers Member Center on each program or device that an email address is used on. The creation of new app specific passwords doesn’t work and existing app specific passwords appear to have been deleted in many cases. That pretty much breaks your applications that rely on them.

#Fail

There is a workaround though:

The workaround for this is to open a web browser and go to https://mail.yahoo.com and enter your Rogers email account details there. The password that you should use is the one for Rogers Member Center. This will at least allow you to view and reply to email on the web. And while this is a sub optimal workaround for many, it’s the only workaround that exists right now. 

A secondary issue is that you might have tried to reset your email password under the belief that you were using the wrong password. If that’s you, I have some bad news for you. The only way to truly reset your email password is to dial into Rogers to do that. The good news is that once you hit a human, it doesn’t take long to do that. The bad news is that I am hearing wait times of three hours or more to actually get to a human. And I am also hearing that people are getting disconnected while waiting for a human to come onto the line. Which punts you to the back of the line. 

The fact that this workaround is available is great. But viewing mail through a web browser is suboptimal. Especially on a smart phone. And having to get a human to reset your password is likely the reason why nobody can get through to Rogers in a timely manner. For a company who has spent a lot of time and effort to improve the customer experience, that’s really bad.

But what’s worse is that the silence from Rogers is stunning. But don’t take my word on that. I’ve been monitoring this situation as I have clients who are affected by this, and there are several threads on Community Forums that I have been watching. And Rogers customers are not happy. Here’s a few examples:

I want to stop here for a second. Assuming that this comment is true, it’s pretty bad when Rogers basically lies to a customer about an issue. That erodes any trust that the customer might have left.

And I want to talk about these last two comments. The first is relates to the fact that Rogers has not said a single word about this. Zip, zero, nada. When you don’t communicate to your customers about an ongoing issue, it creates room for people to say and think anything. Which means that you (or in this case Rogers) loses control of the message. That’s where the first comment comes from. In terms of the second comment, the person who wrote this is 1000% correct. Rogers needs to communicate way better than it has to date. But Rogers hasn’t and as this person has said, they’re left in the dark as a result. That’s not a good customer experience and that will come back to haunt Rogers.

So, what are your options if you’re affected by this and the workaround is sub optimal? Well, some of my customers are having me assist them in creating domains and email addresses associated with them so that they and not their ISP are in control of their email. Basically doing what I suggest here in terms of never using an ISP’s email service. One challenge that they have is exporting emails that they have since doing what I suggest here isn’t an option at the moment. But as long as they can get email on the device or program of their choosing, that’s good enough for them and they will take care of the export part of this whenever Rogers fixes their issues.

Other clients are taking a step further. On top of doing the above, they are also transitioning over to Bell if they have that option. Which in the areas where my clients are located in, they do. The feedback that I get from these clients is that they forgave Rogers for the outage in July of last year. And they even bought into Rogers marketing (Which is dead from what I can tell. Likely because of the backlash to it) that they are “committed to Canadians“. But those days are over and it’s time to dump Rogers as far as they are concerned. The fact is that Rogers really has dropped the ball here and bungled this situation badly. However this turns out, Rogers as a telco would have really deleted whatever goodwill that it had left with its customers. Which to be frank, I didn’t think was possible.

Shame on you Rogers.

Leave a comment »

Hackers Only Need To Know Your Phone Number To Pwn Samsung Exynos Based Devices

Posted in Commentary with tags , on March 17, 2023 by itnerd

Google’s Project Zero team has posted a blog post that paints a pretty scary picture for Pixel and Samsung owners:

In late 2022 and early 2023, Project Zero reported eighteen 0-day vulnerabilities in Exynos Modems produced by Samsung Semiconductor. The four most severe of these eighteen vulnerabilities (CVE-2023-24033 and three other vulnerabilities that have yet to be assigned CVE-IDs) allowed for Internet-to-baseband remote code execution. Tests conducted by Project Zero confirm that those four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim’s phone number. With limited additional research and development, we believe that skilled attackers would be able to quickly create an operational exploit to compromise affected devices silently and remotely.

The fourteen other related vulnerabilities (CVE-2023-26072, CVE-2023-26073, CVE-2023-26074, CVE-2023-26075, CVE-2023-26076 and nine other vulnerabilities that are yet to be assigned CVE-IDs) were not as severe, as they require either a malicious mobile network operator or an attacker with local access to the device.

The following devices are known to be affected by these exploits:

  • Samsung phones including the Galaxy S22 series, the Galaxy M33, M13, M12, A71, A53, A33, A21, A13, A12 and A04
  • Vivo phones including the S16, S15, S6, X70, X60 and X30
  • Google Pixel 6 and 7 series
  • Wearables using the Exynos W920 chipset
  • Vehicles that use the Exynos Auto T5123 chipset

That’s a very big list. And I have to wonder what cars use Exynos based modems. I guess we will find out shortly. In any case, the mitigation until updates come out is to turn off Wi-Fi calling and Voice-over-LTE (VoLTE). You should be able to find both of these in the Settings menu under Network & internet > SIMs, though the exact location may vary from device to device. If you have a vehicle that uses this chipset, I have no mitigation for you. And I have no way for you to check your vehicle to see if you have this Exynos chipset.

Expect patches for phones and wearables to come out soon, if they haven’t already. As for vehicles, your guess is as good as mine.

UPDATE:

David Maynor, Senior Director of Threat Intelligence at Cybrary had this to say:

   “The flaw in the baseband component is important for enterprise customers to be aware of but not for the reasons it seems. The baseband component is the radio that communicates with cellular infrastructure. The software is a binary blob that’s encrypted, and there are not good ways to inspect the baseband state. So, you have a place you can’t monitor with software you can’t inspect that creates a perfect place for bad guys to do nefarious things.”

Ted Miracco, CEO of Approov followed up with this:

   “The discovery of 18 vulnerabilities in Samsung’s Exynos chipsets is deeply unsettling, especially given that four of them enable remote code execution without any user interaction or indication. Overall, the discovery of these vulnerabilities highlights the importance of ongoing security research and the need for vendors to prioritize mobile security in their products. While, It also serves as a reminder for users to remain vigilant and take steps to protect themselves from potential attacks, the fact that an attacker only needs the victim’s phone number to carry out these attacks further highlights the severity of these vulnerabilities.”

Leave a comment »

New Zealand Becomes The Latest To Ban TikTok On Government Devices

Posted in Commentary with tags on March 17, 2023 by itnerd

The march to ban TikTok continues with news that New Zealand is going to be the latest country to ban TikTok on government devices:

New Zealand said on Friday it would ban TikTok on devices with access to the country’s parliamentary network due to cybersecurity concerns, becoming the latest nation to limit the use of the video-sharing app on government-related devices.

Concerns have mounted globally about the potential for the Chinese government to access users’ location and contact data through ByteDance, TikTok’s Chinese parent company.

The depth of those concerns was underscored this week when the Biden administration demanded that TikTok’s Chinese owners divest their stakes or the app could face a U.S. ban. 

In New Zealand, TikTok will be banned on all devices with access to parliament’s network by the end of March.

Parliamentary Service Chief Executive Rafael Gonzalez-Montero said in an email to Reuters that the decision was taken after advice from cybersecurity experts and discussions within government and with other countries.

    “Based on this information, the Service has determined that the risks are not acceptable in the current New Zealand Parliamentary environment,” he said.

The thing is that TikTok other than saying things like it it “disappointed” by these bans, hasn’t really offered up anything in the way of a substantive rebuttal to accusations that the social media app is a tool for the Chinese Communist Party to spy on the west and spread Chinese propaganda. Until they do that, these bans will simply continue. And likely expand to outright bans where TikTok will be erased from phones everywhere. Such as the one that seems to be coming in the US. So as a result of that, I expect these bans to continue to accelerate and expand.

Leave a comment »

CISA to begin scanning for vulnerabilities

Posted in Commentary with tags on March 17, 2023 by itnerd

On Monday, CISA announced that under its new Ransomware Vulnerability Warning Pilot (RVWP) program it has started scanning critical infrastructure entities’ networks for vulnerabilities to warn and help entities fix the flaws ahead of the bad actors.

As part of RVWP, CISA leverages existing authorities and technology to proactively identify information systems that contain security vulnerabilities commonly associated with ransomware attacks. Once CISA identifies these affected systems, our regional cybersecurity personnel notify system owners of their security vulnerabilities, thus enabling timely mitigation before damaging intrusions occur.

CISA accomplishes this work by leveraging its existing services, data sources, technologies, and authorities, including CISA’s Cyber Hygiene Vulnerability Scanning service and the Administrative Subpoena Authority granted to CISA under Section 2209 of the Homeland Security Act of 2002.

Naveen Sunkavalley, Chief Architect at Horizon3.ai had this to say:

   “CISA’s new program is a necessary and definite step in the right direction to protect critical infrastructure. Many N-day vulnerabilities are now being exploited by threat actors within days of being disclosed. Time is of the essence. The faster organizations are notified of critical vulnerabilities, the faster they can react to avoid compromise.

   “CISA’s program is not a panacea though. Many vulnerabilities are exploited as zero days, and there is often a delay of at least a few days between the time a new vulnerability is disclosed and when CISA adds that vulnerability to its Known Exploited Vulnerabilities catalog. Understanding which vulnerabilities are likely to be exploited and notifying prior to any known exploitation would be valuable.

   “Moreover, exploiting vulnerabilities isn’t the only method ransomware actors have at their disposal. Phishing attacks and leaked credentials are used just as often (for instance with the Colonial Pipeline attack). Organizations need to operate under the mindset that a breach will eventually happen, and critically evaluate their attack surface, both external and internal, against a wide spectrum of possible attacks.”


Dave Ratner, CEO of HYAS follows up with this:

   “We continue to see increasing attacks on all aspects of critical infrastructure and believe that increased visibility and observability into what is happening in real-time inside the environment is critical to rapid identification of these attacks and shutting them down before they expand into major incidents.  

   “Attackers continue to find new and innovative ways to circumvent the perimeter and breach both IT and OT networks; however, given that the malware then needs to beacon out for instructions, visibility into outgoing communication – which domains and what infrastructure is being communicated with and how often — can identify anomalous and nefarious activity inside the network and provide a key layer of protection, if not the “last line of defense”, for all aspects of critical infrastructure.”

This is a good step in terms of fighting threat actors. But it is only a step. This has to be combined with the hard work of those responsible for defending networks against threat actors along with spending money on the tools to effectively fight threat actors. Otherwise the CISA’s work will mean nothing.

Leave a comment »

Independent Living Is Largest Healthcare Hack of 2023 – SO FAR

Posted in Commentary with tags on March 17, 2023 by itnerd

On March 14th, Miami based Independent Living Systems (ILS) disclosed a healthcare data breach that impacted more than 4 million individuals, the largest reported healthcare data breach of 2023, so far. More on the so far part later.

Hackers were in their network from June 30th to July 5, 2020, when the company discovered that its network was accessed and employee data had been exfiltrated. Here’s a snippet of what the data breach notice said.

On July 5, 2022, ILS experienced an incident involving the inaccessibility of certain computer systems on its network. ILS responded to the incident immediately and began an investigation with the assistance of outside cybersecurity specialists. Through our response efforts, ILS learned that an unauthorized actor obtained access to certain ILS systems between June 30 and July 5, 2022. During that period, some information stored on the ILS network was acquired by the unauthorized actor, and other information was accessible and potentially viewed. Upon containing the incident and reconnecting its computer systems, ILS conducted a comprehensive review to understand the scope of potentially affected information and identify the individuals to whom such information relates. ILS received the results of this review on January 17, 2023, and then worked as quickly as possible to validate the results and provide notice to potentially impacted individuals and entities. 

The types of impacted information varies by individual and could have included: name, address, date of birth, driver’s license, state identification, Social Security number, financial account information, medical record number, Medicare or Medicaid identification, CIN#, mental or physical treatment/condition information, food delivery information, diagnosis code or diagnosis information, admission/discharge date, prescription information, billing/claims information, patient name, and health insurance information.  

But the part that catches my attention is this:

ILS previously notified potentially affected individuals on September 2, 2022 by posting a preliminary notice of this data event on its website. Additionally, ILS previously provided preliminary notice to its primary state and federal regulators. Now that its review and validation efforts are complete, ILS is notifying potentially affected individuals via this media release, posting supplemental notice on its website, and mailing letters to potentially affected individuals for whom ILS has address information. ILS is also providing supplemental notice to its primary state and federal regulators, initial notice to certain additional state regulators (as required), and initial notice to the three major consumer reporting agencies (i.e., Equifax, Experian, and TransUnion). 

Yeah, it took over six months to identify and notify victims. #Fail.

Tim Schultz, VP, Research & Development at SCYTHE had this to say:

   “Healthcare data – the most treasured record in the Underground Economy.

   “The healthcare industry is going to continue to be targeted by threat actors and I don’t see it stopping anytime soon. Similar to other industries where more restrictive cybersecurity controls may have a broader business impact, cybersecurity maturity lags behind. Since medical information can be leveraged in future attacks against individuals either for social engineering or extortion, the data stolen will be valuable for a long time.”

Healthcare is a huge target for threat actors as evidenced by these major breaches:

•    February, Heritage Provider Network – 3.3 million patients
•    February, Community Health Systems – 1 million patients
•    March, Cerebral – 3.1 million patients

The take home message here is that the healthcare sector needs to up its game to stop this from happening over and over again. Because with the scale of hacks that we see in this sector, there clearly isn’t enough being done to safeguard data.

Leave a comment »

Things Get Worse For TikTok As The FBI And DOJ Are Apparently Investigating Them

Posted in Commentary with tags on March 16, 2023 by itnerd

I suspect that Chinese owned social media company TikTok is really in deep trouble here as Forbes is reporting that they are under investigation from the FBI and DOJ:

The FBI and the Department of Justice are investigating the events that led TikTok’s Chinese parent company, ByteDance, to use the app to surveil American journalists, including this reporter, according to sources familiar with the departments’ actions.

According to a source in position to know, the DOJ Criminal Division, Fraud Section, working alongside the Office of the U.S. Attorney for the Eastern District of Virginia, has subpoenaed information from ByteDance regarding efforts by its employees to access U.S. journalists’ location information or other private user data using the TikTok app. According to two sources, the FBI has been conducting interviews related to the surveillance. ByteDance’s use of the app to surveil U.S. citizens was first reported by Forbes in October, and confirmed by an internal company investigation in December.

“We have strongly condemned the actions of the individuals found to have been involved, and they are no longer employed at ByteDance. Our internal investigation is still ongoing, and we will cooperate with any official investigations when brought to us,” said ByteDance spokesperson Jennifer Banks. TikTok did not respond to a request for comment.

The Office of the U.S. Attorney for the Eastern District of Virginia, the DOJ and the FBI did not immediately respond to a request for comment.

This is the first report of the federal government investigating ByteDance’s surveillance practices. It is not clear if the DOJ’s subpoena is connected to the FBI’s interviews.

The reporter behind this story is Emily Baker-White who broke a couple of stories linked above on TikTok spying on journalists last year. And she herself was tracked by TikTok. All of this is highly problematic to TikTok and I am of the opinion that this will lead to an outright ban sooner rather than later. And I am talking about very soon. As in weeks and not months.

That has to be TikTok’s greatest nightmare. Let’s see what they, or their Chinese Communist Party overlords can do about it.

Leave a comment »

Silicon Valley Bank Phishing Scams Are In High Gear Says INKY

Posted in Commentary with tags on March 16, 2023 by itnerd

NKY has published an article detailing how cybercriminals are using the Silicon Valley Bank collapse in a credential harvesting phishing scheme. Which is something I’ve been predicting for a few days now.

This report details how the phisher is using a fake DocuSign email notifications requiring the unsuspecting customer to sign important documents.

You can read the report here.

Leave a comment »

OVHcloud purchases its first Quandela quantum computer

Posted in Commentary with tags on March 16, 2023 by itnerd

 OVHcloud, the European cloud leader, further confirms its ambitions and support of the growing quantum computing ecosystem with the purchase of its first quantum powered machine to kick-off new efforts in the fields of research and development. Designed by French company Quandela, the MosaiQ computer is powered by a photonic processor.  

Doubling down on its efforts in quantum computing, the Group’s goal is to provide its research and development department with the right tools to experiment with a Quantum Processing Unit (QPU) based machine for various use cases. This comes in addition to the announcement, last summer, of a plan to offer quantum-based calculation as-a-service through several emulators, including Perceval, the programming framework developed by Quandela.  

Staying true to its commitment towards open ecosystems, OVHcloud actively supports development efforts in the field of quantum computing via its France Quantum conference initiative, where OVHcloud is a co-founding member, and through its Startup Program. The latter provides technical assistance as well as credits elevating innovation in quantum computing with startups, active both in the hardware and software fields. Over the years, this commitment already led to significant breakthroughs with Quandela’s early proof of concept effectively using OVHcloud infrastructure and Quandela’s first customers being able to connect to their QPU through OVHcloud. Hosted in OVHcloud datacentres in France (GRA) and Canada (BHS), Quandela’s Perceval notebook is also available here for OVHcloud Public Cloud customers so that they can discover quantum emulation. 

Marking a significant milestone and paving the way for a quantum ready future, Quandela’s system is expected for delivery sometime this fall. It relies on an upgradeable platform thanks to the use of photonics. With a QPU that can be reconfigured, the system will prove to be upgradable through new modules to quickly ramp up the overall computing capabilities.  

Leave a comment »

Nuspire Introduces Managed Microsoft Defender Solution

Posted in Commentary with tags on March 16, 2023 by itnerd

Nuspire, a leading managed security services provider (MSSP), has announced the launch of its Managed Microsoft Defender services for Endpoint, ID, O365 and Cloud App Security. The new service will help organizations realize the full value of Microsoft Defender through a seamless, expert-led managed solution.

Microsoft Defender offers robust protection against a wide range of threats, including malware, ransomware and other sophisticated attacks. However, configuring, tuning, maintaining and monitoring Microsoft Defender can be challenging, especially when it comes to technology and operating systems outside of the Windows environment. In addition, there is still a significant talent shortage in the security industry, and companies have fewer resources to manage security solutions like Defender and respond to threats.

To address these challenges, Nuspire’s Managed Microsoft Defender services leverage the expertise of seasoned security professionals to guide integration and implementation. Nuspire’s team will monitor, mitigate, respond to and remediate threats directly in a client’s environment. The service also provides 24×7 monitoring and SOC support to reduce false positives and alert fatigue.

For more information on Nuspire’s Managed Microsoft Defender services, please visit https://www.nuspire.com/services/managed-security/managed-microsoft-defender.  

Leave a comment »

HP Wolf Security report shows move to block macros by default is forcing threat actors to think outside the ‘box’

Posted in Commentary with tags on March 16, 2023 by itnerd

HP today issued its latest quarterly HP Wolf Security Threat Insights Report, showing cybercriminals are diversifying attack methods, including a surge in QR code phishing campaigns. By isolating threats on PCs that have evaded detection tools, HP Wolf Security has specific insight into the latest techniques being used by cybercriminals in the fast-changing cybercrime landscape. To date, HP Wolf Security customers have clicked on over 25 billion email attachments, web pages, and downloaded files with no reported breaches. Further HP Wolf Security insights will be featured at the upcoming Amplify Partner Conference, March 28-30, McCormick Place Chicago.

From February 2022, Microsoft began blocking macros in Office files by default, making it harder for attackers to run malicious code. Data collected by the HP Threat Research team shows that from Q2 2022, attackers have been diversifying their techniques to find new ways to breach devices and steal data. Based on data from millions of endpoints running HP Wolf Security, the research found:

  • The rise of QR scan scams: Since October 2022, HP has seen almost daily QR code “scan scam” campaigns. These scams trick users into scanning QR codes from their PCs using their mobile devices – potentially to take advantage of weaker phishing protection and detection on such devices. QR codes direct users to malicious websites asking for credit and debit card details. Examples in Q4 included phishing campaigns masquerading as parcel delivery companies seeking payment.
  • HP noted a 38% rise in malicious PDF attachments: Recent attacks use embedded images that link to encrypted malicious ZIP files, bypassing web gateway scanners. The PDF instructions contain a password that the user is tricked into entering to unpack a ZIP file, deploying QakBot or IcedID malware to gain unauthorized access to systems, which are used as beachheads to deploy ransomware.
  • 42% of malware was delivered inside archive files like ZIP, RAR, and IMG: The popularity of archives has risen 20% since Q1 2022, as threat actors switch to scripts to run their payloads. This is compared to 38% of malware delivered through Office files such as Microsoft Word, Excel, and PowerPoint. 

In Q4, HP also found 24 popular software projects imitated in malvertising campaigns used to infect PCs with eight malware families – compared to just two similar campaigns in the previous year. The attacks rely on users clicking on search engine advertisements, which lead to malicious websites that look almost identical to the real websites. 

HP Wolf Security runs risky tasks like opening email attachments, downloading files and clicking links in isolated, micro-virtual machines (micro-VMs) to protect users, capturing detailed traces of attempted infections. HP’s application isolation technology mitigates threats that might slip past other security tools and provides unique insights into novel intrusion techniques and threat actor behavior. 

The full report can be found here: https://threatresearch.ext.hp.com/hp-wolf-security-threat-insights-report-q4-2022/

Leave a comment »

« Older Entries
Newer Entries »