Welcome to Cyber Security Today. This is the Week in Review for the week ending Friday, December 8th, 2023. From Toronto I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com and TechNewsday.com in the U.S.

In a few minutes David Shipley of Beauceron Security will be here to discuss recent news. That includes a report that millions of medical images like x-rays and CAT scans are sitting on easily cracked servers open to the internet, a warning by American and Israeli cyber authorities that an Iranian-based group is going after utilities and industrial networks, and the discovery that a lot of people are still running unsupported versions of Microsoft Exchange.

But before we get to the discussion here’s a quick a look at other headlines from the past seven days:

More Canadian organizations are refusing to pay ransomware gangs. That’s according to a survey by Palo Alto Networks. However, those who do pay are spending on average twice as much — just over $1 million — as they did in 2021.

The DNA testing service 23andMe says personal data of nearly 7 million customers was accessed by a hacker in October. The attacker got into 14,000 accounts using credentials stuffing. With that access they were able to also copy the DNA profile data of 5.5 million those people’s relatives, plus some family tree profiles of another 1.4 million people connected to the accounts.

Bluetooth has a protocol flaw that undercuts the security of some Android, Linux and Apple wireless mice and keyboards. That’s according to a security researcher. He promised full vulnerability details at an upcoming conference.

Fancy programming aimed at increasing security in new Intel and AMD processors may end up decreasing security. University researchers in the Netherlands make that claim in a new paper. Watch for guidance from chip makers.

Cyber agencies from the Five Eyes security co-operative including Canada and the U.S. issued guidance to application developers on making software better protected from memory attacks. Memory vulnerabilities are the most prevalent type of disclosed application holes. The agencies urge developers to use memory-safe programming languages.

For the benefit of threat researchers and defenders, Microsoft issued an updated report on the tactics and techniques of a Russian government-sponsored threat actor it calls Star Blizzard. Other researchers call it Coldriver and the Callisto Group. It has espionage and cyber-influence goals.

There’s no shortage of news stories about the cyber risks third parties pose to organizations. But a report from Blue Voyant suggests not a lot is being done. Only 47 per cent of respondents to a survey said they monitor their supply chain for cyber risk monthly or more. That’s up from 41 per cent last year. And only 19 per cent said they work actively with a supplier to fix a security issue once its found. The rest mainly rely on the supplier to solve the problem.

Cyber authorities in U.S. and the European Union signed an agreement to work closer. The pact between the U.S. Cybersecurity and Infrastructure Security Agency and the European Union Agency for Cybersecurity will improve knowledge-sharing of cyber threats and ways to better regulate the public and private sectors.

Finally, Google released another update to the Chrome browser. It patches 10 vulnerabilities. You should be running a version that starts with 120.

(The following is a partial transcript of the discussion. To hear the whole conversation play the podcast)

Howard: Millions of medical patient records are at risk because hospitals and clinics aren’t properly securing their image servers. That’s according to a German cybersecurity firm called Aplite. The servers hold X-rays, CT scans and MRIs stored in the DICOM format, a 30-year-old protocol accepted around the world for sharing and viewing medical data. But researchers at Aplite scanned the internet and found just over 3,800 servers in 111 countries are accessible from the internet. Fewer than one per cent of those servers use effective login authorization. Of the 3,800 servers just under a third leak data containing more than 59 million pieces of medical and personal data. David, this sound like violations of cybersecurity 101.

David Shipley: There’s so many things fundamentally wrong with the story — and terrifying when you think about the implications for things like ransomware, extortion and more. This is not the first company to dive into the digital imagery repositories in healthcare and come out with some massive horror stories. In fact, as part of new regulations for device manufacturers that started in March the U.S. Government Accountability Office did a study of vulnerabilities, and one of the things they found was that up to 51 per cent of all X-ray machines had high severity CVEs, 44 per cent of CT scanners and 20 per cent of imaging devices. Computers in a healthcare environment were running unsupported and unpatched versions of Windows. The implications for this are huge. There was a really interesting research project done in 2019 where a group of Israeli researchers — with authorization –hacked into one of these imaging depository systems and added or removed cancer indicators using AI deepfakes, and then went to see if the radiologist could tell. Short answer: They couldn’t tell. This also puts patient safety at risk … When you take down diagnostic imaging you set back healthcare 200 years

Howard: It’s not just medical images. These researchers could find some systems also had patient names. So medical information could be used for blackmail but also identity theft.

David: Absolutely. Keep in mind that these systems — particularly healthcare systems — often have privileged access back into billing systems. You can probably jump from an insecure patient instance and find many other vulnerable systems on the business network.

Howard: The DICOM protocol itself is old and has weaknesses as well. So a hacker can disrupt images, deny access to images, add false signs of illness and because the images are arranged with unlimited sequential numbers for each implementation this can cause real mayhem.

David: The points made by the Israeli researchers in 2019 was the fact that industry standard best practices on the public internet such as using [digital] certificates to authenticate so communications are made securely and not interfered with between an X-ray, CT scan machine and the patient system don’t exist. Authentication is hilariously absent. But along with the other things, the GAO report and the U.S. found hard-coded credentials [in medical devices] and other problems. While it’s cool that the U.S. has new regulations as of March 2023 for device manufacturers to actually build these things with secure-by-design … 75 per cent of [current] drug infusion pumps had at least one major vulnerability that could throw up a security concern. It’s going to take decades to get this equipment retired and new equipment in. We’re basically telling cyber criminals it’s open season on health care for the next 20-plus years.

The post Cyber Security Today, Week in Review for Friday, December 8, 2023 first appeared on IT World Canada.

The average ransomware payment made by mid-sized Canadian companies this year was just over $1 million, according to a new survey.

The survey of IT professionals at 1,000 organizations with between 100 and 1,000 employees, done for Palo Alto Networks, was released Thursday.

Called the Canadian Ransomware Barometer, it found that while the volume of ransomware attacks here had decreased since the last study two years ago, the average ransom paid was $1.13 million. That’s a 150 per cent increase over 2021.

Of the majority of businesses that paid ransoms, just over half paid more than $500,000. By comparison, only 29 per cent paid over that amount in 2021.

The number of respondents saying their firm was hit by ransomware stayed roughly the same — 35 per cent this year, compared to 37 per cent in 2021.

However, the number of organizations willing to pay ransoms dropped. Of those hit this year, only 34 per cent of respondents said their organization paid to get access to data back. By comparison, 45 per cent of respondents in the 2021 survey said their firm paid.

As with the previous study, more than half of respondents (58 per cent) said that it took
more than a month to recover from a ransomware attack. One-quarter (24 per cent) said that it took longer than four months.

The report offers these tips to defend against ransomware attacks:

— train staff that if they think a phishing email has arrived in their inbox, it must be reported;
— ensure all software and hardware have the latest patches;
— have a solid and tested data backup and recovery plan.

The post Canadian mid-sized firms pay an average $1.13 million to ransomware gangs first appeared on IT World Canada.

Ransomware is increasingly impacting OT systems, and more.

Welcome to Cyber Security Today. It’s Friday, December 8th, 2023. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com and TechNewsday.com in the U.S.

Ransomware attacks are increasingly hitting not only IT environments but also OT, or operational technology, systems. These are internet-connected systems running factories, power stations and pipelines. The information comes from a new survey by researchers at Claroty. Some 1,100 IT and OT security professionals in a number of countries answered a questionnaire in November. Thirty-seven per cent said ransomware attacks this year affected both their IT and OT environments. That compares to 27 per cent in 2021 — a 10 per cent rise in two years. Of those who were hit, 22 per cent said the impact was severe or extreme, meaning operations were impacted for more than a week. An additional 32 per cent said the impact was moderate. Sixty-nine per cent of respondents said their organization paid a ransom to get access back to their data or systems.

Hackers are taking advantage of AWS’s Secure Token Service to break into cloud applications and data. According to researchers at Red Canary, they’re doing it by generating short-term login credentials. These tokens last no longer than 36 hours and are offered to users so they don’t have to create an AWS identity. Ironically, the hacker gets short-term tokens by first creating a long-term identity and access token. The advantage of a short-term token is the hacker can hide themselves better. The best defences include logging all CloudTrail event data to a data lake for analysis of AWS services, and building altering to detect role chaining events and multifactor authentication abuse.

Many cyber attacks are opportunistic, taking advantage of vulnerabilities that hackers trip over. But Bloomberg News has a story about the 2020 attack on the U.S. Department of Health and Human Services at the outset of the COVID-19 pandemic. According to a synopsis of the article by The Cyberwire, it started with a large denial of service attack. It was probably used to hide penetration of the department’s servers. The attackers might have been looking for information the U.S. had on COVID-19. Whatever the motive, a former department official told the news service that the attackers had done their homework and knew where the large stores of data were.

Taylor Swift, Justin Bieber, Jennifer Lopez, Oprah and other celebrities are not denouncing Ukraine for resisting the Russian invasion. But fake ads on Facebook and X make it look that way. The ads have fake quotes beside the pictures of celebrities. According to Wired.com, Russia is suspected of placing the ads. It’s part of the Doppelganger influence campaign I told you about on Wednesday’s podcast. Researchers at a firm called Reset believe the campaign takes advantage of loopholes in Facebook’s ad verification and content moderation systems.

A Russian military-associated group is still going after vulnerable installations of Microsoft Outlook. That warning comes from Palo Alto Networks. The group is known by security researchers as Fighting Ursa, APT28 or Fancy Bear. It’s been exploiting unpatched Outlook servers for the past 20 months in 14 countries. Most of those countries are members of NATO. Targets are government departments and energy companies. This hole was patched in March. This group is still trying to find unpatched Outlook servers.

The Canadian Centre for Cyber Security has issued advisories that patches and mitigations are available for a number of products. These include Atlassian’s Confluence Data Centre and Server and Atlassian Companion App for MacOS; FA engineering software products from Mitsubishi Electric; and certain Facilities Explorer and Metasys products from Johnson Controls. IT and OT administrators need to pay attention to these warnings.

That’s it for now. But later today the Week in Review podcast will be available. Guest David Shipley and I will discuss why 20,000 out-of-date Microsoft Exchange servers are still online, why vulnerable medical images are open to the internet and cyber attacks against water utilities.

Follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker. Thanks for listening. I’m Howard Solomon

The post Cyber Security Today, Dec. 8, 2023 – Ransomware is increasingly impacting OT systems, and more first appeared on IT World Canada.

Purple Llama combines the red and blue team for AI. C+ gets an F in security because of memory vulnerabilities. Missing files in Google? Here’s a fix – but don’t ask questions. Apple launches some free machine learning tools and “would you like AI with that?” McDonalds is diving big into AI as fast food is moving into AI.

These and more top tech stories on Hashtag Trending

I’m your host Jim Love, CIO of IT World Canada and Tech News Day in the US.

Meta has launched “Purple Llama,” a set of cybersecurity benchmarks for large language models (LLMs), aiming to bolster AI safety. This move aligns with the White House’s call for enhanced AI security, as outlined in its AI Executive Order. LLMs, like Meta’s Llama 2, can be exploited for accessing sensitive information or generating harmful content. Purple Llama introduces CyberSec Eval, a benchmark for evaluating LLM cybersecurity, and Llama Guard, a pre-trained model to prevent the generation of risky outputs. Joseph Spisak, Meta’s director of product management for generative AI, emphasizes the need for community collaboration in standardizing these safety measures. Purple Llama, named after a blend of red (attack) and blue (defense) teams, is part of an AI Alliance including major tech players like Microsoft and Google Cloud. Critics, however, have questioned the effectiveness of Meta’s open-source model management in real-world applications.

Sources include: Axios

Meta has announced that all Facebook and Messenger chats will now be automatically encrypted, ensuring that messages and calls can only be read by the sender and recipient. This shift to end-to-end encryption (E2EE) as the default setting has sparked criticism from the UK government and police, who argue it will hinder efforts to detect child sexual abuse on Messenger. Home Secretary James Cleverly expressed disappointment, seeing it as a step back in online child safety. Despite these concerns, Meta insists on the importance of privacy and safety, working with experts to balance these aspects. The company plans to extend default encryption to Instagram messages in the new year. While encryption protects user privacy, it has become a contentious issue, with law enforcement and children’s charities opposing its expansion due to concerns over child safety. Meta, however, is committed to using tools like artificial intelligence to detect malicious behavior without scanning private messages.

Sources include: BBC News Article

The US Cybersecurity and Infrastructure Agency (CISA), along with cybersecurity authorities from the Five Eyes nations, is urging business and technical leaders to prioritize memory safety in software development. In a paper titled “The Case for Memory Safety Roadmaps,” CISA highlights the significant damage caused by memory safety errors like buffer overflows and type confusion.

These vulnerabilities can lead to system takeovers and data theft. The agency’s guidance, part of its Secure By Design recommendations, calls for a shift towards memory safe languages (MSLs) and the creation of roadmaps to eliminate these vulnerabilities in products. This initiative follows a year of criticism of C/C++ languages, known for memory safety bugs, and praise for memory safe languages like Rust. Microsoft, acknowledging that about 70 per cent of its bugs are memory safety vulnerabilities, has committed $10 million to Rust tooling development. CISA advises developers to transition to memory safe languages like C#, Go, Java, Python, Rust, and Swift to reduce these vulnerabilities.

Sources include: The Register

Google has addressed a recent issue with missing files in Google Drive for desktop users on Windows and macOS. The solution involves installing the latest version of the Drive for desktop app (version 85.0.13.0 or newer) and following a simple recovery process.

Users are instructed to open the app, access the settings while holding the Shift key, and select “Recover from backups.” This process will recover files and folders into a new folder named “Google Drive Recovery” on the desktop, separate from the locally synced Google Drive space. Google encourages users facing any recovery issues to provide feedback through the Drive desktop app with the hashtag #DFD84 and include diagnostic logs.

For those seeking more control over file recovery, Google also provides command line instructions. However, users who have disconnected their account or removed their local Drive cache as a DIY fix are limited to restoring from Windows backups or macOS Time Machine. The issue, which began affecting users in late November, was linked to Google Drive versions 84.0.0.0 to 84.0.4.0 and involved local files not yet synced to Drive. Google’s release notes for version 85 don’t clarify the cause of the problem, and further details are awaited.

Sources include: The Register

The race to deploy 5G networks by major US carriers like Verizon, AT&T, and T-Mobile has reached a pivotal point where the focus shifts from expansion to managing the financial aftermath. Initially, 5G was touted as a revolutionary technology for autonomous vehicles, remote surgery, and augmented reality. However, the actual applications have been more mundane, such as improved streaming capabilities and home internet options.

Verizon, having spent $45.5 billion on new spectrum licenses, is now under investor scrutiny for returns on this massive investment. The company’s approach includes selling private networks for industrial and manufacturing businesses, but progress has been slow due to the complexity of tailoring services to specific industries.

The most successful 5G application so far has been fixed wireless access (FWA), providing an alternative for home broadband. However, this falls short of the transformative benefits initially promised. Network slicing, a feature that prioritizes certain types of network traffic, shows potential but requires a standalone 5G network, which is still under development.

The rapid deployment of 5G has led to significant debt for these companies, prompting them to seek new revenue streams, often resulting in higher costs for consumers. The consolidation of wireless carriers, with T-Mobile’s acquisition of Sprint, has further limited competition in the market. The long-term benefits of 5G may still materialize, but for now, the technology’s impact is more incremental than revolutionary.

Sources include:  The Verge

Apple has quietly released Apple MLX, a new set of open-source machine learning tools optimized for Apple Silicon. Aimed at simplifying AI development, MLX is accessible via platforms like PyPI and GitHub. It’s designed to be efficient and user-friendly, supporting various AI tasks such as language processing and image generation. This move highlights Apple’s strategy to integrate advanced AI capabilities into its products, leveraging its powerful in-house silicon technology. While less publicized than its competitors, and dwarfed by Google’s Gemini, Apple’s MLX launch signals a significant step in its AI innovation journey, catering to both researchers and developers.

Sources include: ITPro Article

McDonald’s is set to collaborate with Google in 2024 to integrate generative AI into its operations. This partnership will involve hardware and software upgrades in thousands of McDonald’s stores, enhancing various systems including ordering kiosks and the mobile app. The goal is to utilize AI for optimizing operations, with a promise of delivering “hotter, fresher food” to customers.

While specific applications of AI in McDonald’s operations are not detailed, the upgrades will run both in-store and through Google Cloud services. These improvements aim to help managers quickly identify and solve operational issues, potentially reducing complexity for store staff and creating new experiences for customers and crew.

This move towards AI-driven automation aligns with trends in the fast-food industry, as seen with Wendy’s AI ordering tests. However, McDonald’s has not explicitly addressed the potential impact on human employment, focusing instead on enhancing operational efficiency and customer experience. The integration of AI in McDonald’s operations is part of a broader shift towards digital transformation in the fast-food sector, with potential implications for service quality and efficiency.

Sources include: The Verge 

And that’s what’s trending today.

Hashtag Trending goes to air 5 days a week with a special weekend interview show we call “the Weekend Edition.”

You can get us anywhere you get audio podcasts and there is a copy of the show notes at itworldcanada.com/podcasts

I’m your host Jim Love. Have a Fabulous Friday!

The post Hashtag Trending Dec.8- Meta’s Purple Llama for cybersecurity; Memory vulnerabilities in C/C++ languages; McDonald’s to integrate AI in its operations first appeared on IT World Canada.

In a presentation at IT World Canada’s Analytics Unleashed on Tuesday, Gartner Distinguished VP analyst Don Scheibenreif discussed what organizations need to do in order to handle the generative artificial intelligence (GenAi) juggernaut and artificial intelligence (AI) in general.

The content he delivered was originally seen by a packed house of upwards of 8,000 chief information officers (CIOs) and other senior IT executives attending an opening day keynote address at the Gartner IT Symposium/Xpo 2023 in Orlando in mid-October.

Scheibenreif and fellow Gartner Distinguished VP Analyst Mary Mesaglio were on stage to discuss the year’s hottest topic – generative AI (GenAI) – and how best to “stay out in front in this new era of human-machine relationships.” The title of their address was The Next Era – We Shape AI, AI Shapes Us.

“The truth is that we are at the beginning of a new era where AI is going to infuse everything that we do,” he told Analytics Unleashed attendees. “The last technology this huge was back in 2007 with the introduction of the iPhone, and before that it was 1993 with the arrival of the worldwide web.

“One of the things that we wanted to communicate in this year’s keynote is to get people to think about their relationship with machines, not just as tools, but how they can affect all parts of our lives, both at work and at home.”

There were, said Scheibenreif, four primary takeaways, starting with the fact the human-machine relationship  is fundamental to understanding AI. “We have to be very mindful about our relationship with machines, because they’re changing. They are moving from not just being our tools to actually becoming our teammates.

“This is part of an evolution that’s been taking place for a long time, and AI is not new, but GenAI and the associated tools have certainly sparked a lot of conversations about the role of machines in our lives. And it’s asking us to think about not what machines can do for us, but what machines can be for us. Machines as teammates, but also machine as a friend, as a consultant, machine as a customer, even.”

At a corporate level, the focus is squarely going to be on senior IT executives, he added, to deliver value, as judged by “our research that tells us about 51 per cent of CEOs expect the CIO or other tech leaders to really help the organization get the most value from investments in generative AI and AI in general. So, CIOs not only have a role, they actually have the role, at least for now.”

The second takeaway revolved around what Gartner defines as Everyday AI and Game Changing AI. The former, says Gartner, is focused on productivity: “The machine is a productivity partner. It enables workers to do what they already do, faster and more efficiently. Currently, 77 per cent of CIOs and technology leaders worldwide are focused on the opportunities of everyday AI.”

In Orlando, Mesaglio warned that “it is important to note that everyday AI will go from dazzling to ordinary with outrageous speed. Everyone will have access to the same tools, and it will not provide a sustainable competitive advantage.”

She described game-changing AI as being focused primarily on creativity. “It doesn’t just make us faster or better. Either it creates new results, via AI-enabled products and services, or it creates new ways to create new results, such as with AI-enabled new core capabilities. With game-changing AI, machines will disrupt business models and entire industries.”

In his address this week, Scheibenreif said the third takeaway revolved around every organization needing to define its own AI ambition and be governed by what Gartner calls Lighthouse principles. “This is very, very important. We’ve seen recently in the news how the lack of governance can impact organizations – i.e. OpenAI. We want to make sure that you as clients, and as organizations that are engaged in AI, can actually follow some of these Lighthouse principles to be able to govern your own use of the technology.

“In reality, most organizations really have to think about their opportunities for AI. How will you use this technology? What won’t you use the technology for? These are all important questions you’ll have to consider when thinking about AI in your organization.”

Lighthouse principles, he said, help “light the way when things are murky or unclear.”

The fourth and final takeaway is this: If your data is not ready for AI, then you are not ready for AI. Gartner analysis recently revealed that 96 per cent of organizations’ data is not ready for AI, and only four per cent is, which is, said Scheibenreif, “a problem, because if your data is not ready, then your ability to tap into some of the of the opportunities that AI offers will be limited.

“What is AI-ready data is one of the main things we talked about in the keynote. It is secure, obviously, it is enriched, it is fair, it is accurate, and it is governed by Lighthouse principles that you will have developed for your organization.

“Now, the other thing about data is that we’ve all been taught to believe that our mountains of data are actually mountains of gold. But in truth, it’s actually fool’s gold. Not all of it matters. We instead are encouraging organizations to focus on making that data essential to your AI ambition, ready for AI. And that includes your algorithms, your formulas, your blueprints, your schematics, and any type of data that’s really proprietary to your organization. That is the real goal – you don’t have to make all of your data ready for AI, just that which serves your AI ambition.”

Gartner, said Scheibenreif, believes that the CIO can be the guide “for the executive team when it comes to AI, and also be part of the team that helps govern its use. We also believe that you have to choose your AI ambition. What do you want to use this technology for? What will it do for you? And what won’t it do for you?”

The post Analytics Unleashed keynoter Scheibenreif examines how ‘we shape AI, AI shapes us’ first appeared on IT World Canada.

On the heels of cybersecurity guidance for generative AI systems issued by the federal government, Canada’s federal, provincial, and territorial privacy regulators have issued their own set of privacy-related principles to be followed.

Announced Thursday, the principles are aimed at advancing the responsible, trustworthy and privacy-protective development and use of generative artificial intelligence (AI) technologies in this country.

While Parliament is debating the proposed Artificial Intelligence and Data Act (AIDA), which would put mandatory rules around high-risk AI systems, the law likely won’t come into effect for several years. Governments and regulators hope in the meantime the guidelines will give application developers, businesses, and government departments some idea of how far they should — or shouldn’t — go.

And though laws regulating AI aren’t on the books yet, the regulators note that organizations developing, providing, or using generative AI have to follow existing privacy laws and regulations in Canada.

Also on Thursday, the government announced that eight more companies have signed on to its voluntary AI Code of Conduct. They include AltaML, which helps firms with AI solutions; BlueDot, which uses AI to track infectious diseases; solutions provider CGI, Kama.ai, which uses AI for building marketing and customer relationship applications; IBM, Protexxa, which offers a SaaS cybersecurity platform; Resemble Ai, which lets organizations create human-like voices for answering queries in call centres; and Scale Ai, which helps firms create AI models. The voluntary code identifies measures that organizations are encouraged to apply to their operations when they are developing and managing advanced generative AI systems.

Federal Privacy Commissioner Philippe Dufresne announced the new principles document today at the beginning of an international Privacy and Generative AI Symposium organized by his office.

The document lays out how key privacy principles apply when developing, providing, or using generative AI models, tools, products and services. These include:

establishing legal authority for collecting and using personal information used in AI systems, and when relying on consent, ensuring that it is valid and meaningful;
being open and transparent about the way information is used by AI systems and the privacy risks involved;
making AI tools explainable to users;
developing safeguards for privacy rights; and
limiting the sharing of personal, sensitive or confidential information.

Developers are also urged to take into consideration the unique impact that these tools could have on vulnerable groups, including children.

The document provides examples of best practices, including implementing “privacy by design” into the development of the tools, and labeling content created by generative AI.

The post Canadian privacy czars release principles for responsible development of AI first appeared on IT World Canada.

Police in Dominica have charged two American men, Jonathan Scott Lehrer and Robert Snyder Jr., with the murders of Softimage founder Daniel Langlois and his partner, Dominique Marchand, whose bodies were found in a burned-out car on Friday.

Lehrer and Snyder are alleged to have murdered Langlois and Marchand at Lehrer’s chocolate plantation, Bois Cotlette Estate, sometime between Nov. 29 and Dec. 2. They were remanded into custody pending a preliminary inquiry on Mar. 15, 2024, when the court will determine whether there is sufficient evidence to proceed to trial.

Langlois and Marchand had been reported missing last week, and the remains of two individuals were discovered on Friday in a vehicle which matched the description of their car. The bodies were burned beyond recognition, so police had to rely on circumstantial evidence for identification.

Langlois and Lehrer had been involved in a long-standing legal dispute over the use of Morne Rouge Public Road, which passed through Lehrer’s property on the way to the eco-resort and hotel owned by Langlois and Marchand. Lehrer had obstructed the road to prevent access, prompting Langlois to take legal action. The courts ruled in his favour, and Lehrer was ordered to unblock the road. In 2019, Dominica’s High Court affirmed the ruling that it was a public road.

A memorial ceremony will be held today (Dec. 7) on the island of Dominica for Langlois and Marchand, at 4 pm ET; it will be broadcast live on YouTube and Facebook. More than 15 local organizations will take part.

A release said, “Divers, fishermen, ecologists: all forces of the Dominican society are showing up for the deceased. They will come together at the Soufriere Bay, both offshore and on the jetty. At sunset, Dominicans will paddle out and form a circle ‘a symbol of the community and of the resilience of this exceptional couple,’ explains Simon Walsh, of the REZDM Foundation (Resilient Dominica Project).

“A minute of silence will be observed at 4:34 pm as flowers will be thrown in the middle of the circle at sea and traditional chants will arise, sung a cappella by the Sisserou Singers gathered on the jetty in a candlelight vigil.”

The post Memorial today for Softimage founder and partner to be broadcast online; two charged in their murder first appeared on IT World Canada.

Why were thousands of organizations seemingly defenceless against the zero-day vulnerability in Progress Software’s MOVEit file transfer service, a hole that so far has seen the personal data of tens of millions of people copied by the Clop/Cl0p ransomware gang?

That question may be at least partly answered by an investigation announced today by Nova Scotia Information and Privacy Commissioner Tricia Ralph into the theft of data from the provincial healthcare sector.

The purpose of the investigation is to review the adequacy of the security practices and incident response of the province’s health department, and of IWK Health Centre, a major pediatric hospital and trauma centre in Halifax.

Nova Scotia and the hospital have to comply with regulations under the Privacy Review Officer Act, the Freedom of Information and Protection of Privacy Act and the Personal Health Information Act.

The province uses MOVEit for transferring payroll information. Data of at least 100,000 public servants and hospital staff was stolen, including Social Insurance numbers, addresses and banking information.

Ralph promised a “comprehensive investigation,” the results of which will be publicly released.

This may be the first publicly announced investigation by a privacy commissioner of a MOVEit hack in Canada or the U.S. In October, Progress Software said it is co-operating with several inquiries from U.S. and foreign data privacy regulators, as well as inquiries from several U.S. state attorneys general. The company said in a regulatory filing that the U.S. Securities and Exchange Commission has also started a fact-finding inquiry.

Related content: Sony Playstation division hit by MOVEit hack

Security experts say a zero-day vulnerability in an application is hard to defend against because there are no known patches. However, that doesn’t necessarily mean protections such as firewalls, data encryption, network intrusion and detection, employee awareness training, and other tools can’t blunt an attack — for both the software companies that created the vulnerable applications as well as their customers.

According to an article in last month’s Cyber Defence Magazine by Jack Viljoen, head of Prodinity Cyber Solutions, the attacks were allegedly “driven by poor cyber security practices related to vendor access vetting and monitoring of company systems.” Weak password practices served as another entry point for attackers, he added.

Related content: Data on 3.4 million mothers, children stolen from Ontario registry

The MOVEit Transfer vulnerability (CVE-2023-35708) is a SQL injection exploitation. According to security firm Malwarebytes, it allows an attacker to drop a webshell in the wwwroot folder of the MOVEit install directory. This allows the attacker to obtain a list of all folders, files, and users within MOVEit, download any file within MOVEit, and insert an administrative backdoor. This last is crucial: It gives attackers an active session to allow credential bypass.

File transfer servers can be a golden repository for data if it’s just sitting there before or after being copied. The Clop/Cl0p gang is known for having found vulnerabilities in other file transfer applications such as GoAnywhere MFT and Accellion File Transfer Appliance (FTA). While many of the MOVEit hacks occurred in the last days of May, investigators at Kroll LLC believe the gang was likely experimenting with ways to exploit this particular vulnerability as far back as 2021.

Researchers at Emsisoft have so far identified 2,662 organizations around the world whose data was stolen through MOVEit Transfer, involving the personal information of over 83 million people.

The post Nova Scotia privacy commissioner investigating provincial MOVEit hack first appeared on IT World Canada.

A Calgary oil and gas producer says it has suffered a cybersecurity incident that impacted certain aspects of its business.

Clearview Resources Ltd. made the statement in a news release issued late Wednesday that gave no details of how the attack affected operations.

“Upon learning of the incident, Clearview took steps to secure its systems and mitigate the impact to the company’s data and operations,” the statement said. “Independent cybersecurity experts have been retained to assist the company in dealing with the matter in accordance with industry best practices.

“Clearview is in the process of assessing the impact to the company’s operations. At this time, we are not aware of any evidence that customer, supplier or employee data has been compromised or misused as a result of the situation.”

Clearview is a small player in the oil patch. Its third quarter oil and natural gas sales totaled C$5.7 million, compared to C$9.2 million in the same period in 2022. For the quarter it recorded a net loss of C$1.6 million.

For the nine months ending Sept. 30, oil and gas production was down 21 per cent compared to the same period in 2022, in part due to the disposition of non-core properties at the beginning of the year and production downtime due to wildfires and overland flooding in the second quarter.

Energy companies — producers and distributors — are considered part of any nation’s critical infrastructure. Without energy, a country’s economy stops, which is why the sector is a target for threat actors who hope firms will pay to get back access to stolen data, or control over operations. Nation states are also known to probe energy companies for espionage purposes.

In June, one of the country’s largest energy producers, Suncor, suffered a cyber attack affecting its ability to process credit and debit cards. Earlier this year, Prime Minister Justin Trudeau acknowledged a cyber attack on a Canadian energy firm, although, he said there was no physical damage to any energy infrastructure.

One of the biggest known attacks in North America was the 2021 ransomware attack on Colonial Pipeline in the U.S., which forced the company to shut down the operation of one of the largest gasoline, diesel, and jet fuel pipelines in the U.S.. Flights had to be re-routed, there was panic gasoline buying, and briefly, the price of gas shot up.

According to numbers compiled by Statista, energy firms were the fourth most popular targeted industry in 2022 (10.7 per cent of attacks around the world, behind manufacturing (24.8 per cent), finance and insurance (18.8 per cent) and professional services (14.6 per cent).

Attacks aren’t always direct. In a report released this week, SecurityScorecard said 90 per cent of the world’s leading energy companies reported having experienced a third-party data breach in the past 12 months.

In June, the Canadian Centre for Cyber Security issued a report on cyber threats to Canada’s oil and gas sector. Oil and gas organizations tend to have a broad attack surface of connected digital systems, it notes.

Financially motivated crooks are the main cyber threat against this country’s energy sector, the report says in part. But it is also targeted by state-sponsored threat actors looking for trade secrets, research, and business and production plans.

The post Small Canadian energy producer reports cybersecurity incident first appeared on IT World Canada.

Google announces that its new Gemini AI will outperform its rival OpenAI.  AMD’s new chips are claimed to outperform its rival NVIDIA (at least for now) and we might be closer to understanding why the board of OpenAI fired Sam Altman so he could return and be more powerful than his rivals.

These and more top tech stories on Hashtag Trending

I’m your host Jim Love, CIO of IT World Canada and Tech News Day in the US.

Google has announced its new advanced large language model (LLM) called Gemini, is now powering Google Bard and other AI-enabled products and includes a mobile version for Google’s Pixel 8 Pro. 

Google is also touting several industry-standard benchmarks which it claims shows Gemini outperforms ChatGPT 3.5.

Google unveiled Gemini in three sizes: Ultra, Pro, and Nano. Gemini Pro has been integrated into Bard, enhancing its capabilities in reasoning, planning, and understanding. 

Gemini’s design is multimodal, capable of recognizing and interacting with various formats like video, images, text, and voice. 

Gemini Ultra is currently undergoing additional safety and testing, but Gemini Pro is accessible to developers and enterprise customers through Google AI Studio or Google Cloud Vertex AI. 

Google also plans to introduce Bard Advanced, powered by Gemini Ultra, offering enhanced capabilities.

Gemini AI is also appearing in a mobile version on the Google Pixel 8 Pro. The phone now features Gemini Nano, a version of the AI model tailored for mobile devices. 

In practical terms, it will be used in the Smart Reply in Gboard and the auto summarize feature in the Recorder app. 

But Google is saying this is just the beginning of Gemini’s potential impact on Android devices, and will be a significant shift in how users interact with their smartphones.

Sources include:

– ZDNet on Bard’s Upgrade 

– Axios on Google’s AI Race

– ZDNet on Gemini’s Impact on Pixel 8 Pro 

In the high-octane world of datacenter GPUs, a new champion has emerged: AMD, with its “Antares” Instinct MI300 family of GPUs that has positioned AMD as the performance leader in the datacenter GPU arena, at least for the moment.

AMD’s new GPU accelerators, designed to directly challenge Nvidia in the generative AI market. The demand for these chips has skyrocketed, particularly in the generative AI space, where supply can barely keep up with the voracious demand.

Nvidia, long a dominant player in this field, finds itself in a fortunate position where the overwhelming demand for AI training and heavy inference accelerators outstrips the supply. So even head-to-head competition between AMD and Nvidia is unlikely to lead to price reductions.  

At some point, the AI hardware market may normalize, and bring things back to a more traditional competitive landscape, but that’s not expected in the short term.

As the market evolves, both Nvidia and AMD will continue to push each other and the boundaries of technology. The upcoming Nvidia “Blackwell” datacenter GPUs are expected to reclaim the performance crown, albeit temporarily, as AMD is already working on the next iteration, the MI400.

If you really want to geek out on this, there’s a great and very detailed article in the Next Platform. There’s a link on the show notes at itworldcanada.com/podcasts

Sources include: The Next Platform

Microsoft is extending a lifeline to Windows 10 users and  offering three additional years of security updates beyond the October 14, 2025, end-of-support date. 

This program, similar to what was offered for Windows 7, is aimed at those who need or want to stay on Windows 10. 

But it comes at a cost.

The ESU program will provide monthly security updates and technical support, paid for annually. While pricing details are yet to be announced, it’s expected to follow the pattern of the Windows 7 ESU program, where costs increased each year to encourage upgrading to a newer Windows version. The cost is also per-seat, meaning it varies based on the number of PCs requiring updates.

A notable difference this time is that Microsoft plans to offer Windows 10 ESU updates to individuals, not just businesses and institutions. 

This program will not include any additional features for Windows 10.

For businesses, educational institutions, and governments, the ESU program provides extra time to adapt to new Windows features, educate users, and test for compatibility issues. 

With Windows 11’s new system requirements, not all Windows 10 PCs support the latest version, so staying with Windows 10 can avoid hardware replacement.

For individuals, that decision to stick with an older operating system could be to avoid hardware upgrades or just personal preference. The ESU program could offer a solution for those who prefer Windows 10 over Windows 11, depending on its cost and availability for different Windows editions.

Sources include: Ars Technica 

A recent in-depth piece in The New Yorker by Charles Duhigg, who spent months embedded inside OpenAI, sheds light on the tensions within the board that led to the decision to fire Sam Altman..

The report suggests that some board members found Altman to be manipulative but in particular the story talks about his efforts to have fellow board member Helen Toner removed. 

Toner, the director of strategy and foundational research grants at Georgetown University’s Center for Security and Emerging Technology, co-wrote a paper that criticized OpenAI’s approach to AI safety compared to Anthropic’s more cautious stance. This apparently didn’t sit well with Altman.

Altman’s politicking to have Toner removed was perceived as manipulative by some, while others saw it as a clumsy attempt to address the issue.

The board’s attempt to hold Altman accountable could be seen as a personality conflict gone wild or a much loftier goal of trying to ensure that AI benefits all of humanity – I always say, never look for a complex reason or conspiracy when simple human nature could be the cause.  

But whatever it was, it ultimately backfired, solidifying Altman’s position as a powerful figure in Silicon Valley.

Sources include: Ars Technica 

And that’s what’s trending today.

Hashtag Trending goes to air 5 days a week with a special weekend interview show we call “the Weekend Edition.”

You can get us anywhere you get audio podcasts and there is a copy of the show notes at itworldcanada.com/podcasts 

I’m your host Jim Love.  Have a Thrilling Thursday. 

The post Hashtag Trending Dec.7- Google’s Gemini to outperform OpenAI? AMD takes on Nvidia with new GPU accelerators; Are we closer to understanding Altman’s ouster? first appeared on IT World Canada.