Category: News

Ransomware is targeting VMware’s hypervisor, hospitals are attacked and more.

Welcome to Cyber Security Today. It’s Monday, February 6th, 2022. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com and TechNewsday.com in the U.S.

Ransomware gangs are going after organizations running unpatched versions of VMware’s ESXi hypervisor. The warning comes from France’s computer emergency response team. VMware says the problem is in OpenSLP, an open-source component of the hypervisor that has a heap-overflow memory vulnerability. The solution is to install updates as soon as possible to plug this hole. Patches were available two years ago. VMware also recommends disabling the OpenSLP service if it isn’t being used.

Update: Italy’s national broadcaster, RAI, said government officials were to meet Monday to discuss a warning about this vulnerability from the computer security incident response team of the country’s National Cybersecurity Agency (ACN). It issued an alert about “massive” network exploitation. The ACN technicians have already surveyed “several dozen probably compromised national systems, RAI said.

Breaking news: The top U.S. cyber diplomat says one of his Twitter accounts was hacked. According to CNN, Nate Fick, the American “ambassador-at-large” for cyberspace and digital policy, used his personal Twitter account to announce the news.

Two American companies offering businesses and individuals the ability to check public records on customers, friends or anyone have admitted they were hacked recently. These background check online services, owned by the same firm, are Truthfinder and Instant Checkmate. Lists of people using either service between 2011 and 2019 were copied. The data includes subscribers’ names, emails, and telephone numbers in some instances, as well as encrypted passwords and expired and inactive password reset tokens. According to Bleeping Computer, this information began being pedalled on a hacking forum on January 21st. It is claimed the combined data is on 20 million people who used the services.

A company that makes mobile apps used by individuals to snoop on their lovers and others will have to pay US$410,000 to New York State for illegally promoting spyware. The apps were promoted as being legal, but installing these apps without people’s knowledge violates U.S. federal and state laws. In addition to the penalties, the apps have to be modified to alert people that their smartphones are being monitored. The apps being marketed are called Auto Forward, Easy Spy, DDI Utilities, Highster Mobile, PhoneSpector, Surepoint and Turbospy.

Your company’s IT hardware and software partners are vital. They are also a possible cybersecurity risk. How big? Researchers at SecurityScorecard figure 98 per cent of organizations have a relationship with at least one third-party software supplier that had a data breach in the past two years. Third parties make your business applications. Fourth parties are the thousands of partners these third-party companies have relationships with. The report says half of all organizations have indirect relationships with at least 200 fourth parties that have had breaches in the last two years. Now, these breaches may not have had an effect on your firm. But the point of the report is to make you think about your firm’s indirect exposure to risk. What should your security team be doing? Understanding the cyber risk of your IT partners — and their partners.

Coincidently. the U.S. Cybersecurity and Infrastructure Security Agency just opened a cyber supply chain risk management office to help federal departments and agencies with this problem.

Some hackers will go after anything online, including a suicide prevention phone line. The U.S. has acknowledged that a December 1st day-long outage of the American 988 emergency phone system was caused by a cyberattack on the service’s provider. The text and chat service was still available until service was restored. The Associated Press says it isn’t publicly known who launched the attack. People in distress in the United States can call 988 and reach a crisis support worker. Last week two members of Congress introduced a bill calling for better co-ordination and reporting of cyberattacks on the 988 system.

Meanwhile, a Tennessee hospital is still recovering from a cyberattack last week. As of Sunday, Tallahassee Memorial HealthCare was still diverting some emergency patients from the hospital. As a precaution, all IT systems were taken offline Thursday. Also last week a Maryland TV station reported that Atlantic General Hospital suffered a ransomware attack.

Google is still working on a solution to close a vulnerability in managed Chromebook deployments by school boards and organizations. Security researchers at the Mercury Workshop Team found a way users can unenroll their Chromebooks from the Google Admin management suite. That would allow a user to install anything on the computers in violation of corporate rules. The SANS Institute notes that Chromebook administrators will for the time being have to monitor machines to make sure they stay enrolled.

Staying with Google, security researchers at Spamhaus Technology say crooks are increasingly suing Google Ads to deliver malware. They’re doing it by creating ads for products like Adobe Reader, Gimp, Microsoft Teams, OBS, Slack and the Thunderbird email client. Unsuspecting people using Google to search for these applications are clicking on the first results, which are Google Ads and not the real home pages of the developers. Victims are ignoring the word ‘Ad’ beside the link. This is a two-part problem: One is Google — and other browser makers — need to scan their ads better. The second is the need for better security awareness training for everyone.

Finally, the cyber attackers who last month stole a subscriber database of the French satirical magazine Charlie Hebdo are based in Iran, according to Microsoft. The group, which calls itself ‘Holy Souls’, is believed to have attacked the magazine as a response to it starting an international competition for cartoons ridiculing Iran’s Supreme Leader. The threat group has put what they say is a cache of stolen data including names, phone numbers, home addresses and email addresses up for sale on several hacker forums.

Follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker.

The post Cyber Security Today, Feb. 6, 2023 – Ransomware is targeting VMware’s hypervisor, hospitals are attacked and more first appeared on IT World Canada.

Does cutting CEO salaries lead to increased corporate performance? Elon Musk is found not liable in a suit by shareholders. And a University student helps scientists identify 8 new “technosignatures” in their search for intelligent life in space. 

Welcome to Hashtag Trending – today’s top tech news stories for Monday, February 6, 2023. 

We’ve all heard of the layoffs in the tech sector. Over 100,000 tech employees have lost their jobs as Google, Amazon, Meta,Twitter, Microsoft and a host of others shed staff in response to flagging demand and lower profits. 

But it turns out that CEOs and top executives are also being asked to share the burden by taking pay cuts. 

Apple is cutting Chief Executive Officer Tim Cook’s compensation by more than 40 per cent to $49 million dollars in 2023. Cook was among the highest-paid executives in 2021, drawing a multi-million dollar salary in cash and Apple stock. 

Alphabet CEO Sundar Pichai has announced that senior executives will get significantly lower bonuses this year. 

Microsoft, however, is bucking the trend. While it cut 10,000 jobs, it gave CEO Satya Nadella a 10 per cent increase to $55 million. 

But the cuts are to some degree always related to corporate performance as a significant amount of a CEO’s compensation is paid in the form of company stock.

Amazon’s CEO Andy Jassy gets a meager $175,000 a year in base pay with most of his compensation coming from stock awards. With Amazon shares falling to almost half their 2022 value, that will reduce his overall compensation by a huge amount. 

Meta CEO Mark Zuckerberg. takes a symbolic salary of $1 per year with his entire compensation paid in Meta stock. Zuckerberg’s lost $100 billion in value with his 13 percent share of Meta in 2022. 

But do pay cuts or freezes in senior executive pay have any impact on company performance? Executive pay cuts that allow for employee raises, were shown to reduce turnover by almost 50 per cent according to a study by Vienna University of Economics and Business published in Forbes. According to that article, researchers determined that a “pay cut was as good as finding a new CEO.” They also found that financial performance tends to rebound following executive compensation cuts. 

Median profitability “increases from -8 per cent to 10 per cent in the 3 years following a large cut according to another study referenced in the Forbes article done by three universities – Nayang Technology University, the University of Washington and the University of British Columbia. 

____________________

Elon Musk was found “not liable” for a 2018 tweet in which he wrote that he had “funding secured” to take the Tesla private. This is a big win for Musk who has been in a huge public fight with the U.S. Securities and Exchange Commission. Musk settled a potential lawsuit with the SEC by agreeing to step down as Chairman of Tesla and pay a 20 million dollar fine.

Although Musk settled the SEC lawsuit, he was still sued by a group of investors who alleged that Musk “knowingly or recklessly made the public claims, and caused them investment losses.” Last Friday, a San Francisco jury found him “not liable” on those charges. 

“Thank goodness, the wisdom of the people has prevailed,” Musk said noting also “I am deeply appreciative of the jury’s unanimous finding of innocence in the Tesla 420 take-private case. 

Source: Axios

____________________

In another story involving the Securities and Exchange Commission, power management giant Schneider Electric has developed a set of tools for its MSP and data center customers to allow them to provide proof of compliance with carbon emission standards. 

The SEC has proposed rule changes that would require companies to report “climate-related risks that are reasonably likely to have a material impact on their business.” 

A recent article in Bloomberg noted that many companies were not effectively making cuts to their emissions, but were relying on what are called “Renewable Energy Credits” or REC’s – essentially purchasing these certificates from clean power providers, allowing them to claim that they are using carbon-free power.” But under these schemes, the companies don’t actually contract for clean power, instead, they use the credits to subtract an equivalent amount of fossil fuel-powered electricity from their climate ledgers.

Not surprisingly, these credits have come under heavy scrutiny and the article notes that once they are removed from a company’s carbon accounting, many businesses would no longer be on track for meeting the climate goals “pegged to the Paris Agreement” for limiting global warming. 

A study published in the journal Nature Climate Change notes that with RECs in their carbon accounting, the 115 companies studied reduced their emissions by 31 per cent from 2015 to 2019. Without the credits, their emissions fell by only 10 per cent. The authors note the credits “allow companies to report emission reductions that are not real.” 

This has led to concerns about penalties for “greenwashing,” where companies make claims of being climate-friendly but aren’t. Schneider’s toolset aims to allow companies to measure and prove their emission reductions. 

Carsten Baumann, director of strategic initiatives & solutions architect at Schneider Electric noted, “The challenge right now is companies want to appear to be sustainable and try to gain some sort of an advantage over others, yet there’s no real accountability to what you say,”

Source: U.S. SEC, Data Center Knowledge

____________________

Southwest Airlines announced that it has appointed Lauren Woods, the company’s VP of Technology, as its new SVP and CIO. Woods will replace CIO Kathleen Merrill, who has been at Southwest for over two decades.

According to a company statement, Woods will “play an important role” in managing the much-needed technology transformation. Southwest is expected to spend as much as 1.3 billion dollars in system upgrades and maintenance.

The announcement of the leadership change follows a major IT outage during the critical holiday travel season. According to an SEC filing by the airline, it said that the outages cost it more than $725 million, between additional operating costs and estimated revenue losses. 

Woods, who has been at the company for 12 years, has a tough job ahead of her in an industry that has struggled and largely failed to keep up with technology modernization, often spending far less on IT than other industries. 

According to Ted Schadler, VP and principal analyst at Forrester. “The failure of Southwest’s crew scheduling systems shows why technology investments are critical to any business”. In a January blog post, he wrote, “Southwest’s reputation was lost in an instant by not executing on something that the company must have to succeed,”

____________________

And finally, some new AI developments, devised by Peter Ma, a University of Toronto student has allowed scientists searching for signs of extraterrestrial life to identify eight new signals that may be interpreted as coming from a technologically advanced civilization. 

Ma’s new technique for training the AI algorithm is better able to pinpoint where in the sky a signal comes from, which will drastically reduce false positives from radio interference.

Using the improved algorithm, the team fed 150 terabytes of data and identified 20,515 signals of interest, which they then had to manually inspect. From that sample, eight signals had the characteristics of “technosignatures”, ones that couldn’t be attributed to radio interference. 

Unfortunately, the team was unable to find these signals again which means they are probably false positives, but it gives hope to the scientists who have to sort through terabytes of data who now have improved AI-driven tools to aid in their search for intelligent life. If they do ever succeed, a University of Toronto student may have helped us move closer to finding out if “the truth is out there.”

____________________

And that’s the top tech stories for today. Hashtag Trending is produced by the ITWC podcast network and is heard Monday to Friday with a special weekend edition hosted by me where we feature interviews on key subjects in technology. 

Follow us on Apple Podcasts, Google, Spotify or wherever you get your podcasts. You can have us delivered to you daily on your your smart speaker. If you follow stories about cybersecurity, why not check out our sister podcast CyberSecurityToday. 

You can find all our podcasts and the text versions as well as more in-depth coverage itworldcanada.com and on technewsday.com in the US. 

We hope you’ve enjoyed this new expanded format. Let us know in the comments below at itworldcanada.com/podcasts

I’m Jim Love – talk to you tomorrow with the top tech news stories on Hashtag Trending.

The post Hashtag Trending Feb.6th- Cutting CEO salaries and increased corporate performance, Elon Musk not liable in a suit by shareholders and AI helps search for intelligent life in space first appeared on IT World Canada.

The post Greg Young, Vice President of Cybersecurity at Trend Micro – 2023 report on Hashtag Trending Weekend Edition first appeared on IT World Canada.

Welcome to Cyber Security Today. This is the Week in Review edition for the week ending Friday, February 3rd, 2023. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com and TechNewsday.com in the U.S.

In a few minutes David Shipley of Beauceron Security in New Brunswick will be here to discuss recent cybersecurity events. But first a quick look back at headlines from the past seven days:

The 2020 ransomware attack that temporarily crippled a Maryland public school district started with a staff member falling for a phishing email, according to a report released last week. That wasn’t the only human failure. David and I will talk about lessons learned.

We’ll also look at two new pieces of computer-wiping malware from a Russian-based group targeting Ukraine.

We’ll delve into a heated online debate that a misconfiguration of the KeePass password management application could allow anyone to copy supposedly protected passwords.

And David and I will discuss the aftermath of the dismantling of the Hive ransomware gang’s IT infrastructure.

Also in the news, manufacturers of point-of-sale devices have been warned of new malware that defeats the secure tap-and-pay capability of credit and debit cards. Researchers at Kaspersky say the latest version of the Prilex gang’s malware forces customers using infected POS devices to insert their cards into the payment devices. That way the malware can read transaction information hidden when customers wirelessly tap their cards. POS makers and distributors have to combat this advance.

Microsoft has disabled fake partner network accounts created by crooks to enable phishing scams. The crooks were impersonating legitimate companies when enrolling in the partner program. They then used the access to trick firms into granting permission to access fraudulent apps created by the crooks. The goal was to hack companies’ email. Most victims were in the U.K. and Ireland.

QNAP released a fix to close a vulnerability in storage devices that runs its QTS 5.0.1 operating system. It needs to be installed as soon as possible.

GitHub has revoked a number of code signing certificates for some versions GitHub Desktop for Mac and Atom apps. This comes after Microsoft discovered threat actors had stolen the certificates.

And administrators of servers running the Redis in-memory database were warned that a hacking group has been compromising Redis servers for the last 15 months. The group is dubbed HeadCrab and uses malware undetectable by traditional anti-virus, say researchers at Aqua Security. As a result the gang has created a botnet of at least 1,200 servers. Redis should not be exposed directly to the internet.

(The following transcript, which has been edited for clarity, is the first part of our discussion. Play the podcast to hear the entire conversation)

Howard: Let’s start with the report on the 2020 ransomware attack on the Baltimore County Public School system. The county surrounds the city of Baltimore. At the time the system supported 173 schools, 100,000 computers and devices used by 140,000 students, teachers and staff members. The attack started with an educator receiving a phishing message pretending to be from an official of a college. Attached was a supposed invoice. The educator fell for the lure, tried opening the attachment but couldn’t — the report doesn’t say why. That might have stopped things. But the person sent the email to an IT tech liaison person, who then forwarded it to a security contractor. The contractor mistakenly opened the attachment on an unsecured email domain and that triggered the spread of the malware and the eventual ransomware attack. The school board’s antivirus couldn’t detect the malware because the file format wasn’t known. The malware had been programmed to not execute immediately, another reason why it wasn’t detected. But the malware was able to quietly disable critical functions on the IT network that could have prevented the malware from spreading the ransomware. It didn’t help that some of the previous security recommendations by the state’s auditor had NOT been implemented, including moving the board’s publicly accessible database servers to the cloud. Nor had multifactor authentication been implemented. What do you make of this incident?

David Shipley: First, I’m glad that we have the level of transparency with this report. I have no doubt in my mind Baltimore County Public School District is not unique. Think about how every public school district is squeezed for every penny and dollar. None of this [report] surprises me, but all of this transparency can help others learn from this. And let’s be honest: we don’t expect schools to be as secure as we expect banks in critical infrastructure — and criminals know that, have been hammering away at the sector. I really appreciate the transparency. I wish they [the report authors] had gone a little bit further. I’m still confused by what they mean by the [contractor using an] unsecure email domain. I would have much preferred to understand more about the mechanics of this. Was the security consultant’s device connected to the school’s network at the time? And I would love to know what ransomware family this was. I would love to know if the security consultant had elevated privileges? Was a combination of opening it on a device that was connected to the network with elevated privilege that led to this. which is what I currently hypothesize because it just seems incredibly unclear. I did some background research on the total cost of this incident and to date it’s US$10 million — and they’re still not fully recovered … The chain of events is preventable. The question now is, with valuable information will other school districts be given the resources the time and the support to make these changes?

Howard: It sounded like from this report that the school board had two email networks. One of them was secured and one wasn’t secured. Is this common? Is this good practice?

David: This is where the report doesn’t help. I don’t think that it’s terribly common, and I don’t think it’s necessarily what they intended. I think this [synopsis] is the potential [broken] telephone effect of highly technical expertise and forensic reports hitting kind of a bureaucratic process. It would be weird to have two entirely separate email systems, one of which if you compromise you sink the battleship. That’s unusual.

Howard: Coincidentally, because this is about a human failure in someone falling for a phishing scam, this week Terranova Security released the results of its annual Gone Phishing Tournament, which is an international test of how many employees will fall for a phishing test. This year’s test was a supposed gift card offer Seven per cent of people clicked on the link to see more information. And three per cent of those people actually entered their company credentials to get the supposed gift card — which, of course, is an absolute violation of security awareness training. That three per cent failure rate is actually good news. Because more people fell for tricks in previous tests. So the failure rate has gone down. But even still, if you think about it in a company of 100 employees three would have given away their passwords had this test been real.

David: The challenge with phishing remains. By the way, criminals know this: Phishing attacks were up 61 per cent in the fourth quarter of 2022. The sophistication of phishing attacks continues to escalate. We’ve done research with millions of phishes is we know that if an organization does not educate their employees about phishing and doesn’t do phishing simulations on a regular basis their click rate can be as high as 33 per cent. So it doesn’t surprise me the click rate on a per template basis varies dramatically so like this. A seven per cent click rate is cool. But if you put a little bit more effort, like the manager’s name into the [test phishing] email template you wouldn’t believe the additional impact [in staff falling for the lure].

Howard: Here’s something else: The malware did not corrupt the Baltimore County school board’s backup files. But when IT tried to use the latest backup some of the files relating to the HR department and staff payroll were unreadable or damaged. So the school board IT department had to use a one-year-old backup file — which of course didn’t have the latest HR and payroll information.

David: It’s so critical to have exercises where on a quarterly basis you actually try to recover something from your backups. Rotate through your critical systems and try your backups at depth. This has to be part of the routine maintenance and process of maintaining backups. You cannot assume that automated systems are always going to work. Change happens. Drift happens within technology, and if you don’t pay attention it will catch you. Badly.

Howard: The report recommends the school board do things that every IT pro should know: Follow the 3-2-1 backup rule, which is three copies of data on two different devices with one stored offsite; use cloud backups with intelligence; do regular backup tests and have security awareness training for staff.

David: These are all the good basics. The other part that I think needs to be included in these recommendations is that the senior leadership of school districts need to practice tabletop cyber attack scenarios annually. Work through a ransomware incident, work through a staff member going rogue etc. You’ll realize gaps in your technology processes … The reality is education is under attack and it’s going to remain under attack. The only way it’s going to change is if the sector increases its vigilance.

Howard: This reminds me of another news story this week: A senior Microsoft security official told a CISO conference in Toronto that many cyber attacks are successful because firms haven’t implemented cyber security basics like limiting privileged access and using multifactor authentication.

David: Cybersecurity isn’t a story about the lack of technology controls. We have thousands of vendors offering thousands of ways to reduce risk for organizations. But it goes back to people processing culture. Are we giving IT teams the time to set these up? Are they getting the political buy-in from management? The greatest barrier to multifactor authentication is not cost or technology. You can afford a decent MFA from a variety of different providers — and honestly, if you can’t afford it you should re-evaluate what you’re doing because it’s less than a cup of coffee. The biggest barrier is people don’t want to be inconvenienced; they resist change. They only want to apply it to certain groups. The biggest barrier to security is culture and process.

The post Cyber Security Today, Week in Review for Friday, February 3, 2023 first appeared on IT World Canada.

Successful ransomware attacks continue.

Welcome to Cyber Security Today. It’s Friday, February 3rd, 2023 . I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com and TechNewsday.com in the U.S.

News of successful ransomware attacks keeps emerging. Vice Society this week confirmed it was behind last month’s ransomware attack on Okanagan College in British Columbia. It has also begun posting stolen data for anyone to see. In a statement the college called it a double extortion attack, meaning data was copied by the crooks before it was encrypted. No ransom will be paid, the college said. It also won’t detail what data was compromised. Instead students and staff were told to assume any personal data on record with the college is at risk. The college is providing credit monitoring services.

Meanwhile, the LockBit ransomware gang says it is responsible for hacking the ION Group, a U.K.-based software provider to financial institutions. The company says only its ION Cleared Derivatives division suffered a cybersecurity incident. It is contained to a specific IT environment, the company said on Tuesday. No further update has been issued as of the recording of this podcast. According to Bleeping Computer, Lockbit says it will start publishing stolen data on Saturday.

Also in the U.K. data breach notices are going out to perhaps millions of customers of retailers. The victims shopped at JD Sports, Millets, Blacks, and Scotts stores. They are being told details of their orders made in a two-year period ending in October, 2020 are at risk. That would include their names, addresses, email addresses, phone numbers and the last four digits of their payment cards.

Still in the U.K., the Play ransomware group said this week it hit car dealership chain Arnold Clark. It says gigabytes of personal information — including copies of passports and leasing contracts — was stolen in December. The company has over 200 car dealerships in England and Scotland.

Cisco Systems has released patches to fix high-severity vulnerabilities in a number of its industrial products. This comes after researchers at Trellix discovered the holes allowing an attacker to bypass certain protections. To exploit the vulnerabilities an attacker would have to first authenticate to affected devices and get admin privileges on the system. Still, these devices have to be patched. They include industrial routers, industrial compute gateways, wireless industrial routers and devices running Cisco’s IOS XE operating system configured with IOx.

Finally, a former employee of Ubiquity pleaded guilty in a New York court to criminal charges relating to stealing gigabytes of data in 2021 and then tried to extort the company for nearly US$2 million for the return of the files. When he didn’t get anything he then planted misleading news stories about the company’s handling of the data breach he created. That caused the value of company’s shares to drop. A statement by the U.S. Justice Department named the accused but not the company. However, the man was identified two years ago when he was arrested. He will be sentenced in May.

That’s it for now. But later today the Week in Review will be available. Guest David Shipley of Beauceron Security and I will discuss new details of a ransomware attack against a U.S. school board, a debate on how secure applications should be, the discovery of more wiperware, and more.

Follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker.

The post Cyber Security Today, Feb. 3, 2023 – Successful ransomware attacks continue first appeared on IT World Canada.

Real-time tracking and notifications of spending on Microsoft Azure broken, Twitter API no longer free to access and Microsoft Teams injects AI into its service.

That’s all the tech news that’s trending right now. Welcome to Hashtag Trending. It’s Friday, February 3rd and I am your host, Ashee Pamma

Microsoft announced that real-time tracking and notifications of partners’ Azure spend is broken until-March, sparking the possibility that spending overruns will go undetected. Azure Savings Plans promise to deliver lower prices if customers sign up to spend a fixed hourly amount on compute devices for one or three years. If they exceed the hours, additional use is billed at pay-as-you-go prices and invoiced separately. Information about customers who exceed their planned spend will still be recorded – but partners won’t get regular notifications about what their customers are doing with Azure. Microsoft has blamed “technical problems with their internal processing system” for the issue.

Source: The Register

Twitter announced that starting February 9, the Twitter API will no longer be free to access. This comes as a disappointment to a wide range of developers whose research, bots and apps depend on free access to the platform’s API to function. Now they will have to either pay to access public data or abruptly shut down their projects. Twitter has not yet shared how much its new “paid basic tier” will cost, but the company promised more details to come next week. Developers and popular commentators have protested the announcement, particularly the short notice, the lack of information on pricing and their potential loss of valuable content.

Source: Ars Technica

Microsoft Teams will offer new features powered by GPT-3.5. By injecting AI into its service, Microsoft seeks to help organizations re-energize employees to achieve business results. From automatically generated meeting notes, recommended tasks to personalized highlights, the AI-generated action items seek to help organizations looking to optimize IT investments and boost employee productivity. Now generally available, the incorporation of AI in Teams is aided by OpenAI in which Microsoft has invested $10 billion.

Source: The Register

As companies look to trim their technology spending, after they ramped up investment and efforts to enable remote work during the pandemic, the demand for cloud remains a question mark. Companies are coming to Amazon Web Services, a market leader in cloud computing services to ask for help cutting their bills, reported Data Center Knowledge. Microsoft, Amazon’s rival in cloud services, alarmed investors last week when it forecast slower growth for its own cloud operations. Analysts expect AWS’s sales to grow by 22% in the fourth quarter,and slow through 2023.

Source: Data Center Knowledge

AI has been generating an endless Seinfeld episode for more than a month on Twitch under the name Nothing, Forever. The episode was launched on December 14th 2022 and has been broadcasting since. Vice wrote that the episode features low poly versions of the show’s characters hanging out in a slightly reconfigured version of Jerry’s sitcom apartment, talking in robotic sentences. Sometimes there is an exterior shot of the apartment, with Jerry performing stand up. It also has a laugh track along lots of not-funny lines of GPT-3 generated dialogue. The creator explained to Vice that  the concept came from “this weird, very off-center kind of nonsensical, surreal art project” that was further developed using “machine learning, generative algorithms, and cloud services” over the years.

Source: AV Club

That’s all the tech news that’s trending right now. Hashtag Trending is a part of the ITWC Podcast network. Add us to your Alexa Flash briefings or your Google Home daily briefing. Make sure to sign up for our Daily IT Wire newsletter to get all the news that matters directly in your inbox every day. Also, catch the next episode of Hashtag Tendances, our weekly Hashtag Trending episode in French, which drops every Thursday morning. If you have a suggestion or a tip, drop us a line in the comments or via email. Thank you for listening, I’m Ashee Pamma.

The post Hashtag Trending Feb.3rd- Microsoft Azure’s tracking and notifications broken; Twitter paid API; Microsoft Teams incorporates AI first appeared on IT World Canada.

Want to hear some mind-blowing stats? Get this. 65% of Canadian office workers have expressed a preference for a hybrid work model where they split time between home and office. And here’s the most important nugget. Over 40% of these individuals say that they would begin hunting for a new job if their current employer mandated the return to the office full-time. Translation. If you are not actively finding ways to embrace and optimize your hybrid workspace, you’re in for a world of hurt. It’s not a question of if, but when. And in this episode of All Hands on Tech, we’ll discuss a few things you may not have considered.

The hybrid workspace is a reality and the vast majority of businesses are not going back to work as it was. The issue you face now as a business outside of how to transition staff to a hybrid world is how to make the new workspace as safe as the old one was, whether in your home, at your office, or wherever you may be. Security was much easier when everything was under one roof. However, in today’s world, we’re not always in the same location. That translates to a dire need for a 360 degree review of your company’s best practices when it comes to internet safety and security. Put it this way, the evil that’s out there absolutely loves the vulnerability of this new hybrid workspace.

Let’s start with email. Look, I know you’re thinking it’s not that difficult. Let the fake duct cleaning rep prey on someone more gullible than you. The thing is, anyone can be fooled. Okay, look, literally the fourth day at my IT World Canada career, I got an email from a kindhearted soul about a litter of puppies who needed a new home. Attached to the email was a contact form that you had to print out, fill in, and fax back to them. Yep, it was an email to send a fax. Like a responsible person, I emailed it to the entire company distribution list.

Speaker 2:
Houston, we have a problem.

Someone even more responsible than me Googled, identified it as a scam, and let the company know. The point is it can happen to anyone.

So how do you guard against that? By setting up a strong email security policy and culture. Here are five guidelines we feel are important. One, keep your work and your home emails separate. We’re all guilty of signing up for coupons with our work email address, but you can just make a special address for that. Gmail. Yahoo. Outlook. They give them away like their candy at Halloween. Two, using multi-factor authentication. Why use multi-factor? Because when they get more sophisticated, we need to get more sophisticated. Three, double check links and attachments. Hover over them and see if they make sense considering who sent them and exercise common sense. Why would the company’s bank be contacting you through an email, especially since you’re not accountant? Four, use strong and unique passwords. Let’s face it, passwords get stolen, so you need to keep strong, unique passwords. If you can’t remember them, there are so many password management tools out there. Consider rolling out one to your staff. And remember, password is not a password, Kevin.

Oh crap.

Mat Pancha:

Five and most importantly, embrace cybersecurity training. There is no question too stupid to ask. And in the online world, no mistake is too small. Get your staff trained.

Next up, backups. By now, we all likely have a great horror story that keeps us up every night. But in case you don’t, here’s a unique one that some of you may have heard before. During production of Pixar’s Toy Story 2, 90% of the movie was deleted during production. Luckily, the film supervising technical director was on maternity leave and didn’t want to lose out on doing her work. So she had a machine at home with the entire movie on it. The bottom line, have a backup. Have a backup plan, and have a backup plan to your plan.

A few guidelines on building your backup strategy. First, ransomware protection built in. It’s a must, because you don’t want your backup to have the ransomware in it that you’re trying to recover from. It’s human to forget to backup. So number two is automate. With your team working from home, consider having your backups go to the cloud as well. And finally, not everyone has the fastest internet at home, so deduplication and compression are very important, to shrink the size of your backups, thus keeping your recovery very fast.

Lastly, comes the company security audit. Basically, how secure are you, your team and the whole company. Even the biggest and best of us out there have some serious head-shaking moments. For example, just in July 2022, a single employee’s computer getting breached, caused theft of 20 gigabytes of data from Marriott Hotels. Also, in July 2022, a Twitter data breach exposed the contact info of some 5.4 million accounts. #oops.

Let’s be real. You’re faced with two dilemmas when it comes to security auditing. First off, it’s extremely difficult to do internally since no one ever seems to have the time to dive into. And secondly, doing so will likely give you a skewed and inaccurate scope of your actual security posture. Your perception and reality are rarely the same thing. Not convinced? Try asking people this question. Do you work out? See what I mean? Nothing is as telling and as honest as the input from outside of your circle. And it’s even more honest when the people doing the telling are experts in the field. It’s what they do.

Having said that, we have a white paper from the people at Ricoh who can tell you everything you need to know about baseline security audits. It’s well worth the read, but I will let you in on a couple of the tasty nuggets. A few things that we dive into. Who has access to what information? What are your software and equipment standards? What are your company cybersecurity policies? Do you even have cybersecurity policies? What are your biggest threats? And of course the proverbial much, much more. It even ends with this really cool car chase.

Look, we all love the new hybrid workspace. And when I say all, I mean all those creepy crawly threats out there as well. Do yourself a favor and beat them to the punch, or scam or bot or virus or Trojan. You get the picture. Anyway, thank you for watching. Be sure to like, subscribe, and check out that Ricoh white paper I mentioned and tell me what you thought of the car chase. Mat out.

The post All Hands on Tech – Security in the Hybrid Office first appeared on IT World Canada.

A Canadian mortgage broker’s database containing personal information on thousands of people was left open on the internet, according to security researchers.

Access to the database belonging to Toronto-based 8Twelve Financial Technologies was quickly restricted after the company was notified by researcher Jeremy Folwer and the staff of Website Planet, which offers resources for website builders.

According to a report issued today, the database has 717,814 records on thousands of Canadian residents, with home mortgage loan-related information including names, phone numbers, email addresses, physical addresses, and more. Many of the records appeared to be mortgage leads of people who want to buy a house, refinance, obtain an equity line of credit, or purchase an investment property, the report says.

“We immediately sent a responsible disclosure notice and 8Twelve acted fast and professionally by restricting public access within hours of our discovery,” the researchers say.

In an interview 8Twelve Financial president and CIO Akber Abbas said a staffer made a mistake in December when shifting data to an AWS bucket. “This incident happened when one of our report analysts was working on a migration and accidentally left one of the ports open. It was quickly identified through our penetration testing. No data was removed from our server. That person was subsequently let go from the organization. We have solutions now in place to protect us moving forward.”

As for the researchers who found the blunder, Abbas said “we realized it ourselves before they notified us.”

Abbas said the company’s responses included working with security consultants to close any gaps.

Asked if the incident is embarrassing, he replied, “Yeah. You never want to be in this type of position. The reality of the security landscape is things are changing very quickly. We have since [the incident] put in a number of additional controls in the last four weeks above what we do … to be as proactive as we can.”

Abbas didn’t know if his company has notified a regulatory body about the breach of security controls.

The company has two lines of business: 8Twelve Mortgage for mortgage lending, which, the company’s site says, negotiates with 65 lenders to find the best mortgage rates in the North York region of Toronto; and 8T Capital, which offers short-term loans.

This apparent breach of security controls is just the latest in a string of corporate databases found unprotected on the internet. Often these wrongly-configured files are uploaded to cloud storage sites like Amazon AWS, where the creators put them temporarily or intend to do data analysis, and then forget to either password-protect the files or to ensure they aren’t connected to the public internet.

A blog by vendor SecurityTrails notes that some of the most common database blunders involve the use of Elasticsearch, a database for storing and analyzing large amounts of data. Elasticsearch by default binds to localhost only, the article notes, which is secure enough. But, it adds, to make Elasticsearch usable in an organization, database administrators often make the mistake of binding Elasticsearch to the public network interface without firewalling it.

A great tool for finding exposed databases is the Shodan search engine, which finds anything connected to the internet. As a 2017 article on exposed databases in Wired noted, if you want to find all the MongoDB databases connected to the public internet, just type “MongoDB” into Shodan. Not all of the databases found will have sensitive personal information, but some might.

According to Website Planet, the database contained:

717,814 records. The database contained one folder named “applicant” and five folders named “application”;
applicant names, emails, phone number for work, home, and cell. Some records contained physical addresses, state or province. As most of the data could relate to a specific individual, data found in the records could be considered Personally Identifiable Information (PII);
in a random sampling of 10,000 records, the term “email” returned 18,382 results. Each record displayed contained two email addresses; one belonging to the applicant accompanied by a corresponding one from the 8Twelve agent who was assigned the lead. Nearly all common email services appeared in the data, notably Gmail (13,695 results), and Yahoo (3,406), along with Outlook, iCloud, AOL, and smaller numbers of multiple other email providers.
mortgage leads from multiple Canadian provinces were collected in multiple folders marked as “Prod” (which we assume stands for “production”). The records appeared to indicate where the leads came from: Facebook ads, referral, website, etc. Campaign ID numbers were also listed in the applicant files, which we may infer were for the purposes of internal tracking of sales and marketing effectiveness.
applicants’ self-submitted information about their own financial standing, in the form of their credit scores, bankruptcy, savings, finances, and other data to start the loan application process. For credit evaluation purposes, mortgage agents may need to determine an applicant’s creditworthiness by disclosing the aforementioned financial information to an independent credit reporting agency or another source.
records also included 8 Twelve employee names, email addresses, and internal notes about the prospective loan or customer, indicating whether an applicant was credit-worthy or not.
The post Customer database of Canadian mortgage broker left open on internet first appeared on IT World Canada.

On Tuesday, the emergency 911 service was down for two and a half hours in the early morning across the province of Nova Scotia and in some areas of New Brunswick and Prince Edward Island. The disruption affected landlines and some cellphones.

Bell, which operates the affected 911 network, restored the service at 9.30 am AT, saying in a statement to CBC News that the cause of the outage was a 6 am software update to prepare for 10-digit dialing for New Brunswick, “which triggered an unexpected call processing failure to 911.”

Bell stressed that 911 outages are rare, and receive the full attention of their engineering teams, adding that the issue was an “isolated incident.”

 But it is important to remember that the problem is not with the 911 systems, which are “essentially bullet-proof,” said Mark Tauschek, vice president, distinguished analyst and research fellow at Info-Tech Research Group, but rather with Bell’s public switched telephone network (PSTN). More importantly, Tauschek added, it was not likely a software issue, rather a configuration issue.

“We’ve started conflating software updates and configuration updates, which are not the same thing,” Tauschek explained. “Recall the recent 16-hours plus Rogers internet outage in July of 2022 – that was not a “software bug”; it was a configuration change to BGP (Border Gateway Protocol) routing that took the whole network down until they could rectify the issue and route internet traffic back through Rogers’ network.”

The same thing potentially happened with the configuration update to allow for 10-digit calling, whereby the call routing tables probably did not know how to handle a 3-digit call because it had not been routed to a new 10-digit local number, suggested Tauschek.

Bell updating call routing to 10-digit dialing in Eastern Canada is a once in a lifetime configuration update, hence, not something the company will find fruitful to plan for again, said Tauschek. But a post mortem is necessary, and the lessons should be applied to change management processes going forward. He added, “Bell will likely have to do that either way, because the government will be on them like they were on Rogers.”

Bell is seemingly of the same mind, stating that it “adjusted its processes and safeguards to ensure this type of issue will not happen again.” 

That statement, however, did not stop industry minister François-Philippe Champagne from expressing his discontent with the matter in a tweet: “The telecoms outage that affected 911 services in Nova Scotia early this morning is unacceptable. As I have said before, Canadians expect and deserve reliable telecoms connection to access emergency services at all times.”

The minister responsible for the Nova Scotia Emergency Management Office, John Lohr, also called the outage ‘extremely concerning’, adding, “I think it’s clear that could cost somebody their life if they didn’t receive the services they need.” 

Public trust in Canada’s national telcos is also seemingly at a low, as many users took to Twitter to convey their indignation. Some expressed their dissatisfaction with their service and the exorbitant rates, while others pointed out the fact that a similar outage happened for six hours, 15 years ago in the 613 area code when Ontario shifted to 10-digit dialing, yet Bell managed to repeat the same errors.

The post Maritime-wide 911 outage likely a configuration issue similar to the “software bug” that disrupted Rogers internet last summer, says analyst first appeared on IT World Canada.

Samsung yesterday unveiled the latest in its Galaxy flagship phones, a trio known as the Galaxy S23 series, all available for pre-order now, and for purchase in stores on Feb. 17.

Let’s get the painful bit over with first. These are flagship phones, and they are not cheap! The base phone, the Samsung Galaxy S23, starts at C$1,099.99 on the Samsung site. It offers 8 GB of RAM, and 128 GB of storage. The next model up, the S23+, starts at C$1,399.99 with 8GB RAM and 256 GB storage, and the top of the line, the S23 Ultra, starts at C$1,649.99 with 8 GB RAM and 256 GB storage. To sweeten the deal, Samsung is offering double the storage at the same price on pre-orders.

While you still have your smelling salts handy, I must add that the price of the S23 Ultra’s top configuration, 12 GB RAM and 1 TB storage, is shown as C$2,209.99 – but you get Samsung Care+, worth C$229, at no charge.

And speaking of charging – none of the devices comes with a wall charger, just a data cable. The fast charger, should you need one, will set you back around C$25.

Now let’s look at what you get for all that money.

Samsung S23 Series specs

S23
S23+
S23 Ultra

RAM
8GB
8GB
8GB
12GB

Storage options

128GB
256GB
512GB
256GB
512GB
256GB
512GB
1TB

Cameras
12 MP ultra-wide
50 MP wide
10 MP telephoto
12 MP Front
12 MP ultra-wide
50 MP wide
10 MP telephoto
12 MP Front
12 MP ultra-wide
200 MP wide
10 MP telephoto F2.4
10 MP telephoto F4.9
12 MP Front

Display
6.1 inch FHD+
6.6 inch FHD+
6.8 inch QHD+

Dimensions
70.9 x 146.3 x 7.6 mm
76.2 x 157.8 x 7.6 mm
78.1 x 163.4 x 8.9 mm

Weight
168 g
196 g
234 g

Battery
3900mAh
4700mAh
5000mAh

Price starting at

C$1099.99
C$1399.99
C$1649.99

Samsung separated its announcement into discussions of the S23/S23+ and the S23 Ultra. And, as in most recent launches, the focus was on the cameras, particularly those in the Ultra. In this release, the company featured a film shot on the S23 Ultra by Ridley Scott. It also showed off the 200 MP wide angle camera, which blows the socks off previous models. The phone’s night mode (the “Nightography camera”) and Astro Hyperlapse (for astronomy buffs), plus Expert RAW mode, are designed to make photography-centric users happy.

The Ultra also includes a built-in S Pen, continuing the Ultra’s legacy replacing the discontinued Galaxy Note. The company says the writing experience is now virtually latency-free, providing a pen and paper-like experience.

All three S23 models include dynamic AMOLED displays with a 120Hz refresh rate, and include wireless charging. Samsung touts improved gaming performance as well, especially on the S23 Ultra.

Laptops

Credit: Samsung

The final segment of the event was devoted to some new Samsung laptops: The Galaxy Book3 Ultra, Book3 Pro 360, and Book3 360. The Ultra and Pro feature 16 inch screens, and the 360’s display is 13.3 inches.

The 360 and Pro 360 are available for pre-order now and the Ultra can be ordered on Feb. 14. The 360 will be in stores in March, the Pro 360 on Feb. 17, and the Ultra on Feb. 22. Pricing will begin at C$1,499 for the 360, C$2,199 for the Pro 360, and C$2,999 for the Ultra. Each comes in two versions with different amounts of storage.

Graphics, connectivity, and light weight (1.49 kg – 1.79 kg, depending on model) were the featured points during the launch event. Samsung emphasized the power of its ecosystem, in which all of its devices can seamlessly commune to extend displays and processing across devices. Phones, tablets, and laptops connect to allow a phone app to display on a PC, or the PC display be extended to a tablet to provide extra video real estate.

This part isn’t new – Samsung devices have always been able to interoperate – but Samsung has enhanced the laptop’s innards with NVIDIA GeForce RTX graphics processing units (GPUs), as well as with the current generation of Intel processors. The displays have been enhanced as well – the Galaxy Book3 Ultra provides 3K resolution (2880 x 1800) – and, like the phones, a 120Hz refresh rate.

As with the phones, Samsung is offering double storage on most pre-ordered systems, as well as free or discounted Samsung Care+ on most models.

We will be reviewing devices soon and will report on how they live up to their promises. Stay tuned.

The post Samsung unpacks new devices first appeared on IT World Canada.