More lessons from the Russia-Ukraine cyber war, a US medical lab fined after theft of old data, and more.

Welcome to Cyber Security Today. It’s Monday, February 27th, 2023. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com and TechNewsday.com in the U.S.

The first-year anniversary of the Russian invasion of Ukraine has spawned a lot of analysis of the cyber side of the war. One, from researchers at Florida-based ReliaQuest caught my eye. It has two conclusions about cyberattacks on businesses that information security pros should think about. First, some cybercrime groups are keeping their allegiance to Russia quiet. This is because after the Conti ransomware group said it was on the side of Russia, a Ukrainian security researcher leaked their communications in retaliation. As a result the gang’s operations were impaired. It allegedly has disbanded. Other cybercrooks that support Russia learned the lesson. They’re quiet about that support. The conclusion: Criminals are no longer focused on just chasing your firm’s money when they chose targets. Second, hacktivists aligned with Russia represent one of the biggest cyber threats to most businesses, the report says. These are groups launching distributed denial of service attacks. Both conclusions complicate things for security teams looking to attribute where attacks come from. My advice: Attribution is less important than a multi-layered defence. Crooks may have chosen your firm because it has revenue. Or because your government supports Ukraine.

An unknown threat actor is using the Discord messaging platform to host ransomware and malware sent to unsuspecting victims. According to researchers at Menlo Security, many of the targets are government departments in North America and the Asia Pacific regions. A typical attack starts with an email inviting a victim to click on a link to an app on Discord. The link goes to a malicious password-protected zip file. When opened it downloads malware. Lesson: Employees must regularly be reminded to not trust links in messages, especially if they’re the ‘Hey, try this.’ variety.

In January, IBM issued a patch to close a serious vulnerability in its Aspera Faspex file transfer tool. The hole serious enough that the U.S. government has added the bug to its catalog of known vulnerabilities being exploited by threat actors. US civilian government departments have until March 14th to install the patch. If your IT department uses this utility and hasn’t installed the update yet, do it fast.

By the way, also added to the patching catalog are two vulnerabilities to Mitel’s MiVoice communications platform.

An American lab that does DNA testing has agreed to pay US$200,000 to two U.S. states as a result of a data breach in 2021. The lab, DNA Diagnostics Centre, failed to properly use reasonable data security measures to protect sensitive personal information, the attorney generals of Ohio and Pennsylvania said. A hacker was able to copy and exfiltrate 28 databases. The thing is, those databases — which included patients’ social insurance numbers — dated back to a 2012 acquisition of a competitor. The lab didn’t realize it still had those databases. Lesson: You can’t secure your organization if you don’t know where all your data is. Or prevent it from being fined for the theft of data you don’t know you have.

News Corp., which owns Fox News, the Wall Street Journal and other media outlets, has admitted a data breach it discovered this month began as far back as two years ago. The Bleeping Computer news site says attackers got names, dates of birth, social security numbers, drivers licence numbers, passport numbers, financial and medical information on some employees. The attackers also accessed email and document storage systems. The suspicion is the attacker is affiliated with China and the goal was spying.

Scammers continue getting away with putting deceptive ads with links on search engines like Chrome. These ads fool unsuspecting victims who give away personal or financial information. One of the latest victims is journalist and author Cory Doctorow. He admitted on Twitter he was recently fooled by what he thought was a search engine link to his favourite Los Angeles-area takeout restaurant. He ordered a meal on the fake site, which sent the order to the real site — but secretly added 15 per cent to the tab. Luckily the restaurant spotted something wrong and canceled the order. But there are two questions: First, why can’t search engines do a better job at detecting fake ads, and second, how did a credit card company get fooled? For those who don’t know, an ad on a search engine looks like a description and link to a legitimate website. But if you look closely the word ‘ad’ or ‘sponsored’ will appear beside the company’s name. When people search for a product, relevant ads appear at the top of the results. You’ve got to to think carefully if you want to click on them.

Finally, can you trust the privacy descriptions developers write about their apps in Google’s Play Store? Maybe not, say researchers at Mozilla. They looked at 40 popular free and paid apps to see if their data collection policies align with what was disclosed on Google’s Data Safety Forms. Those are the descriptions that people who use the Play Store see. There were significant discrepancies between the apps’ own privacy policies and what shows on the Play Store, the report says. This is similar to a finding about apps in the Apple Store, the Washington Post found in 2021. Lesson: No app store platform is responsible for what app developers write about their products. In fact, if you look closely Google and Apple say that. Mozilla suggests platforms that distribute apps require developers to follow a standard disclosure form, just like companies that make packaged food have to put a Nutrition Facts label on their products.

Follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker.

The post Cyber Security Today, Feb. 27, 2023 – More lessons from the Russia-Ukraine cyber war, a US medical lab fined after theft of old data, and more first appeared on IT World Canada.

Facebook’s parent Meta enters the AI fight with a surprising one-two punch, companies are already replacing workers with ChatGPT and remote work paranoia.

It’s Hashtag Trending for Monday, February 27th and I’m your host Jim Love, bringing you the top tech news stories for today.

On Friday, Meta, the parent of social media giant Facebook announced that it was entering the AI competition with a large language model that it claims will outperform OpenAI’s GPT-3.

If Meta’s announcement is to be believed, their new AI, called LLaMA, has two huge differences from OpenAI’s ChatGPT.  

First, Meta’s offering is ten times smaller.  

Second, Meta trained its AI using publicly available datasets, such as Common Crawl, Wikipedia, and C4, which makes the sourcing of the training much more transparent and allows the possibility that Meta’s model could be offered as open source.  And in a tweet issued by a project member Guillame Lample, it appears that making the model open source is a real possibility.

Lample states: Unlike Chinchilla, PaLM or GPT-3, we only use datasets publicly available, making our work compatible with open-sourcing and reproducible, while most existing models relay on data which is either not publicly available on undocumented.” 

The key to this breakthrough appears to be in what is termed parameter size. Parameters are the variables that a machine-learning model uses to make its predictions based on input data. Larger models typically are more capable of delivering much more complex answers. But since more parameters take exponentially more computing resources, if an AI could generate the same results with fewer parameters, it is capable of running with far less resources.  

Anyone who has tried to investigate ChatGPT and found the “server busy” message, has had direct experience of why a more efficient model can lead to greater usage.

Plus, a model with a reputed 10X efficiency advantage opens the way for ChatGPT style AI on devices such as PCs and possibly even smartphones. 

A copy of the link to Meta’s paper announcing their new model can be found in the text version of this podcast at ITWorldCanada.com

Sources for this include an article in ArsTechnica

Employers are already replacing workers with ChatGPT

Resumebuilder.com, an online app for resume development, surveyed 1,000 business leaders who already use or are planning to use ChatGPT. Nearly half of the companies have already implemented it, and of that roughly ½ of the companies who have adopted it, say they were already using it to replace workers.  

Resumebuilder’s Chief Career Advisor Stacie Haller said, “Since this new technology is just ramping up in the workplace, workers need to surely be thinking about how it may affect the responsibilities of their current job. The results of this survey show that employers are looking to streamline some job responsibilities using ChatGPT.

According to the survey results, some of the ways that companies are using ChatGPT include 66 per cent for writing code, 57 per cent for customer support and 52 per cent for meeting summaries and other documents. 

77 per cent of companies say they are using ChatGPT to help write job descriptions, 66 per cent to draft interview question and 65 per cent to respond to applications.

And in a news release from ResumeBuilder.com, the company reported that companies were extremely impressed with the results to date.  “Fifty-five per cent say the quality of the work produced by ChatGPT is ‘excellent’ and 34 per cent say it is ‘very good.’”

Haller noted that the “economic model for using ChatGPT is evolving.” But of the companies surveyed who were using it, nearly all said they’ve saved money, with 48 per cent saying they’ve saved $50,000 and 11 per cent saying they’ve saved more than $100,000. 

No wonder that 93 per cent said they plan to expand their use of ChatGPT.  A further note in from the survey – 90 per cent of executives say ChatGPT experience is beneficial for job seekers – provided of course, that it hasn’t already been used replaced their job.

Productivity paranoia?

Another survey, this one from Envoy.com claims that although 94 per cent of employees believe their managers trust them to do work from anywhere, only 24 per cent of those same employees trust their co-workers who work from home.

Larry Gadea, CEO and founder of Envoy said,
“Less visibility in the office is skewing perceptions and seeding a distrust of everyone and everything, starting from leadership and trickling down,” “Now, managers realize that the relationships and trust employees develop in person are critical to getting work done right, especially in today’s environment,”

There’s a significant gap between the responses of Gen Z, Millenials and Baby Boomers as well. Only 57 per cent of Gen Z “feel strongly they have the manager’s trust.” That’s compared with 71 per cent of Millenials and 77 per cent of Boomers.

But despite these differences, they are universally suspicious of their co-workers. Only 31 per cent of Gen Z, 23 per cent of Millenials, and 17 per cent of Boomers trust their colleagues to do work when working outside the office.

That distrust percentage varies radically based on whether the employees themselves work remotely or full time in the office. While 34 per cent of hybrid employees trust their colleagues, and only 10 per cent of those who work full time in the office feel the same way.

Almost all (98 per cent) felt that certain work is better done in the office. Training and onboarding, problem solving and brainstorming were favoured as in office by one half or more of the sample. Curiously, conflict management was only viewed by 37 per cent as more effective in the office and only 35 per cent thought that the office was best for meeting people from outside the organization.

One of the most telling statistics was in terms of the recent round of layoffs is that 92 per cent said that being seen at the office improves their job security.

Sources include: TechRepublic and envoy.com

And in more related news from what is the fastest growing app of all time, hackers are exploiting the popularity of ChatGPT to swindle unsuspecting users. 

ITWorldCanada.com’s security reporter, Howard Solomon reported a number of weeks ago that there were a number of applications in the Google Play Store which purported to be ChatGPT additions, but which actually contained malware or could potentially steal data or load malware to a user’s phone or PC.  According to a tweet by Dominic Alvieri, the number of those potentially malicious apps keeps growing,  Alvieri, , so devoted to security that he has reportedy deleted his own Facebook account –  reported that there were 1,453 domains registered this week including the words ChatGPT

One website, according to Alvieri, called chat-gpt-pc.online presented itself as a way to download ChatGPT as a local application for Windows. Alvieri found that the download would inject users with a malware called RedLine which stole information from the user’s web browsers. If, for instance, a user has passwords or credit card in information stored in their browser, this application could pull that information and send it to the hackers.

A report from cybersecurity firm Cyble discovered more than 50 fake ChatGPT apps. In addition to stealing data, one of these, called ChatGPT1 provides no AI services, but does covertly subscribe its victims to numerous paid services in an SMS billing fraud scheme.

Until such time as reliable listings of AI programs become available, the only reliable source of ChatGPT is at the OpenAI website or through the facility in the Bing web brower .

Despite layoffs, the average salary for tech workers in the United States remains in excess of six figures according to a leading salary database provider, Dice.com 

Dice’s 2023 Tech Salary report reports that “the average tech salary increased 2.3 per cent year over year to $111,000 (compared to $108,000) in 2022. Following a year of strong salary growth for tech professionals, the continued upward trend in average tech salary shows that tech skills and the professionals that provide them can still command high compensation because of sustained demand.

The top cities in terms of salaries had significant gains including Tampa, with a year over year increase of 22 per cent and Portland at 16 per cent.

Also, according to Dice’s analysis, six figure plus salaries for high tech workers are no longer limited to the coasts. Non-traditional tech hubs including Columbus, saw average tech salaries increase of 16 per cent year over year, and Phoenix saw salaries grew 26 per cent.

All of the top 25 cities for tech compensation boast an average salary over $100,000, and these locations are spread throughout the country.  For more information you can go to Dice.com/Salary Trends.

Source: Business Insider

And that’s the top tech news stories for today.  Hashtag Trending goes to air five days a week with daily news and we have a special weekend edition, bringing you an interview with an expert on some area of technology that’s making the news.

Follow us on Apple, Google, Spotify and anywhere you get your podcasts. You can get us on your smart speaker and instructions for that can be found on our podcast page at www.itworldcanada.com/podcasts where you can also find links mentioned in this podcast. 

If you are interested in cybersecurity, why not check out our sister podcast Cybersecurity Today. 

As always, we are glad to hear from you – a shout out to a couple of people who wrote me over the weekend and thanks for your comments. As always, I’ll take the time to respond personally to each of these and we will be working to incorporate your great suggestions. Your ideas and your comments help us serve your information needs better. Keep ‘em coming.

Thanks. I’m your host Jim Love – Let’s make it a great Monday!

The post Hashtag Trending Feb. 27th- Meta enters the AI battle; companies replace workers with ChatGPT; study reveals remote work paranoia first appeared on IT World Canada.

He was driving to the airport and this problem kept bugging him.  There has to be a better way.

We have an artificial intelligence solution, he thought, but it only runs on a dedicated server. But why do I have to buy a device in the US, have it shipped it to my lab in Canada, provision it with our solution and then ship it back to my customer in the U.S. ?

Then it hit him.  Why can’t I provision this in the cloud, do that in less that an hour and my client will have immediate access?

I know what you’re thinking.  What is so interesting about this?  Isn’t the solution obvious – easy in fact?  And the answer to that is, yes. In 2023.  But what if I told you this was what was going through my guest’s mind in 2009. Almost 14 years ago.

At that time he was talking about something that few companies had done.  There wasn’t much of a road map in place and there were lot’s of problems to solve to make that vision work.

Laurent Simoneau was and is the CTO of Canada’s Artificial Intelligence company, Coveo. Along with co-founder Louis Tetu, he has been a driving force at Coveo and a cloud pioneer for almost two decades.

Through the years he’s continued to innovate and learn lessons in both the cloud, and in AI — answers to questions that many companies are still grappling with.

Some startups came to market in the cloud and then found that the costs of a consumption model meant that their rapid growth was sinking their business, especially in a freemium model – Laurent anticipated this, maximizing the efficiency of his solution to manage costs as they grew.

Having done this, his company has found real benefits,  having one software version for all customers, having virtually an infinite, but also an elastic resource.

And he hasn’t stopped. Today he’s still pioneering – looking for ways to continually optimize. And he’s on a quest for that elusive, exceptional customer interface…

We can learn a lot from his past experience and his future directions.  Not only about how to manage the cloud – but in how we might take new ideas like conversational AI and harness them to solve real problems for our companies and our customers.  So I was thrilled to have him come by our virtual studio for this week’s weekend interview.

Hey, if you are reading this, please take a minute to let us know what you think. We do this for you, the listener and we can only get better if you help us.

Have a great weekend!

The post Laurent Simoneau, CTO of Coveo – Talking about cloud and AI on Hashtag Trending, the Weekend Edition for February 25, 2023 first appeared on IT World Canada.

At this year’s edition of Technicity GTA, ITWC’s chief information officer Jim Love sat down with Becky Jamieson, director, corporate services/municipal clerk, Township of Scugog, and Kalyan Chakravarthy, chief information officer, Durham Region, to discuss a residents’ services digital transformation project where the two organizations of very different sizes found a way to work together in a way that, in the end, was certainly to the benefit of the residents as much as the organizations.

In 2022, the Township of Scugog, one of the eight lower-tier municipalities in the Region of Durham, partnered with the Region of Durham on its Customer Relationship Management (CRM) project. Scugog built its CRM, myscugogconnected.ca, within the Region of Durham’s CRM, which will be live to the public in late March 2023.

The project started when Durham Region was seeking to enhance its customer experience, explains Chakravarthy. What they ended up doing was taking an all-channels approach. One of these channels was telephone, so the system had to support 311 service for the region. They also chose to include a customer portal where residents can create service requests and then track their progress, as well as get information about the Region’s services.

But the most unique thing about the project is how two levels of government managed to work together on a common project that would respond to the specific needs of each organization, as well as those of their respective residents.

“We were in a position where we were looking to do our CRM,” says Jamieson, “and it happened to be that the Region of Durham was going down a very similar path at the same time.” Durham Region had already been providing support to the Township of Scugog at the time. “So we already had started to develop that partnership, and then this opportunity presented itself and we decided to give it a shot,” she continued.

The project was not without its challenges, and Durham knew there were going to be some. “But I think the biggest part of this partnership was about that trust and respect for each other,” said Chakravarthy. “That is what helped us to really go into this partnership and think about it and say: ‘Hey, let’s try to make this so that it is always thinking about our residents’. We were looking at it and saying ‘how can we make it easy for our residents?’”

For the Township of Scugog, there was a lot of stress to begin with. A lot of people told Jamieson she was crazy. “But when we weighed our pros and cons, it made the most sense for us”, she says. “We have limited resources here at the township, especially on an IT front, and we saw this as an opportunity. Hopefully in the future, others will look at what the region has done and allowed us to be a part of as something that they want to strive to do in the future.”

Reflecting on the challenges they encountered, Chakravarthy explained how integrating the township’s portal within the region’s came with its set of hurdles, starting with branding and differentiating one from the other. “These are all the kind of small technical challenges [that] we would not have thought about if you’re going alone,” he said. And these challenges were addressed through discussion and compromise.

In the end, the winners turned out to be the residents of Scugog Township and Durham Region. As Jamieson puts it, “Being able to provide something to our residents [where] they’re not going to have to know whether it’s Scugog or the region that’s responsible for it, and being able to track all those service requests in one place, is a huge win. And I think that’s really what sold us on this project – the ability that, from a resident standpoint, it’s going to be so simple and easy for them to understand and see all their various service requests in one place.”

Chakravarthy also gave some advice to other organizations contemplating such a partnership. First and foremost, this is about enhancing customer service for the residents. You need to see the partners are equal, despite their size difference. There will be roadblocks, but with many smart-minded people working together as one, the chances of success are there. “Although from a legal perspective, from a provincial perspective, we are two separate entities, at the end of the day we are serving the same residents, so we are here to help each other out,” he concluded.

The post Technicity GTA 2023: A partnership in customer relationship management first appeared on IT World Canada.

Welcome to Cyber Security Today. From Toronto, this is the Week in Review edition for the week ending Friday, February 24th, 2023. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com and TechNewsday.com in the U.S.

In a few minutes Terry Cutler of Montreal’s Cyology Labs will be here to discuss recent news. But first a summary of some of what happened in the last seven days:

Twitter users will soon have to pay to get their two-factor authentication (2FA) codes by SMS. They’ll have to subscribe to the premium Twitter Blue service. Is this logical? Terry and I have opinions.

More malware has been discovered in the open-source NPM and PyPI code repositories. We’ll ask why repository operators can’t put a lid on this.

Game developer Activision acknowledged it was hacked in December after an employee fell for a text messaging scam. That will be part of our discussion.

In France five people were indicted for using a device normally only accessible to police. They used it to capture hundreds of thousands of mobile phone numbers for spam.

And Gartner predicts there may be upheaval in infosec departments. Stress is causing cybersecurity leaders to re-evaluate their careers, the company said, predicting that over the next two years nearly half of them will change jobs. Terry will have some thoughts on the pressure on leaders.

Researchers at ESET suspect North Korea’s Lazarus threat group is deploying a new backdoor. It’s part of malware discovered in 2021 capable of downloading Windows binaries. The new backdoor is one of the payloads. The backdoor module collects system information and provides ways of deleting or exfiltrating files.

Fruit and salad processor Dole had to temporarily shut its production plants in North America earlier this month because of a ransomware attack.

And a new information-stealing malware is being marketed to threat actors. According to researchers at the French firm Sekoia, the malware is called Stealc. It’s similar to other code that steals data from infected computers like Vidar, Raccoon, Mars and Redline. One way Stealc is spreading is through infected software and mobile apps pretending to be utilities.

(The following is an edited transcript of part of the discussion. To hear the full talk play the podcast)

Howard: Gartner published research this week about how worn out cyber security leaders are. By 2025, it predicts, half of the cybersecurity leaders will have changed their jobs, and of them 25 per cent will just leave the IT profession for different roles entirely due to multiple work-related stressors. These include low executive support for cybersecurity and making IT focus on compliance rather than risk management. What are you hearing from cybersecurity leaders that you talk to?

Terry Cutler: I’m not sure if you’ve ever seen this meme on the internet where day one of your cybersecurity job you looked like baby Yoda, and two years or three years later, you looked like 900-year-old Yoda. The burnout’s real. It’s very, very, very difficult this field, especially if you’re not passionate about it. You’re gonna burn out even quicker. How many times have you heard folks say, ‘Cybersecurity is paying really, really well.’ But if you’re a plumber, for example, and you want to switch over to cyber, it’s very, very difficult. So you have to be passionate about this field to get in. But there’s a lot of high pressure to manage consistent, evolving threats. Then you got limited resources and conflicting priorities.

For example, you’ll have issues in cybersecurity, but then other business leaders are not on the same page as you. They’re not going to prioritize your requests. And that’ll leave you with a sense of frustration and isolation because you’ll say, ‘This is a threat. It’s a zero-day [vulnerability]. We have to deploy these patches right away.’ I actually experienced this often in healthcare: There was a vulnerability out and we said let’s scan the [IT] environment. I’m still waiting four months later to get the approval to scan the environment for vulnerabilities. There’s so much red tape in some of these companies. it’s crazy. You have to wait for all the groups to be on the same page and give you permission. As an advisor and such you’re always faced with these delays. And if you’re not on the same page as the other folks, because they don’t understand the risk level, you’re just going to feel like you’re banging your head against the wall. And that’s why people just leave.

You know what? You wanna get hacked? Don’t blame me. Here, sign this paper. That’s what I think CISOs are going to have to do to cover their butts: ‘I’m advising you of this threat. You don’t want to do it, sign here.’

Howard: What will it take for CEOs to prevent cybersecurity leaders from leaving their company?

Terry: CEOs need to prioritize cybersecurity as a critical business function and provide the necessary resources and support to help cybersecurity leaders be successful. The biggest is provide adequate funding. How many times do we try to do audits that are really inexpensive, that could save the company hundreds of thousands, if not millions, of dollars? It probably would’ve just cost 10 grand to avoid headaches. The other thing is the CEOs need to build a cybersecurity culture. Even if the janitor has access to the network to check his email he can click on a ransomware link and infect the whole company. So everybody needs to be on the same page that cybersecurity is really important and understand if the firm gets hit with a cyber attack it could cost their jobs.

One of the bigger things is to bring the CISO to the [executive] table as a respected thought leader. It’s important that the CISO is able to articulate the risks. And provide career paths [for infosec leaders] … If you don’t do these things you’re not going to attract the top talent to your company.

The post Cyber Security Today, Week in Review for Friday, February 24, 20223 first appeared on IT World Canada.

Researchers at a Québec university are investigating two of the country’s biggest cybersecurity worries: The readiness of power utilities to face cyber attacks, and the security of wireless industrial internet-connected devices.

News of the projects came Thursday when Ottawa announced it has given the University of Sherbrooke the second half of just under $2 million for the studies.

Sébastien Roy, a professor in the Department of Electrical Engineering, and one of the co-principal investigators, told IT World Canada that the money was awarded over two years ago, when work started, but the announcement was delayed by the pandemic. Reports on both are due in 2024.

One project is assessing the resiliency of Hydro Sherbrooke, a medium-sized power distributor, in the context of Industry 4.0, particularly its ability to identify new threats. According to Roy, this project is almost done.

Industry 4.0 refers to the integration of new technologies (Internet of Things, cloud computing, artificial intelligence) into a company’s production centres and overall operations.

The second project is analyzing the security of the industrial Internet of Things devices with 5G connectivity and edge computing. It includes studying the devices’ applications to agriculture, water management, and building management.

Partners in this study include Bell Canada, VMware, Honeywell, and the cities of Sherbrooke and Magog, QC.

For both projects, lessons learned will be spread through the electric, telecommunications, and IT manufacturing industries, Roy said.

The funding from Public Safety Canada came under the National Cyber Security Strategy.
The projects are being overseen by a multi-faculty and multi-disciplinary team involving five university faculties, 11 researchers, and more than 50 students from 14 countries.

“This work will strengthen the resiliency of Canada’s critical infrastructure, or the assets and equipment that a third party needs to access to offer its own product or service in a market,” the university said in a news release.

“There is a lot of synergy between the two projects, although the objectives are distinct,” said Roy. The underlying theme in both is protecting critical infrastructures. In the first case it’s energy distribution, the second is more about communications infrastructures.”

5G is different from previous cellular technologies, Roy said, in that it is less centralized and puts more control at the edge of wireless networks. That causes security concerns, particularly access authentication. It doesn’t help that typically 5G IoT devices “have no security,” he added.

“At the end we will be able to recommend good practices and technological architectures for these areas to the government and our industrial partners for specific use cases. In the meantime, we’re training over 50 students at the master’s, PhD and post-doctorate levels, in addition to a lot of interns, who will then move on to use their expertise in industry.”

The post Researchers looking into cybersecurity of Canada’s power, IoT sectors first appeared on IT World Canada.

Dell Technologies said this week it is helping the telecommunications industry “accelerate the adoption of open, cloud-native technologies” with a series of new product offerings and partnerships timed to coincide with the start of Mobile World Congress 2023 next week in Barcelona.

Launched were Dell Telecom Infrastructure Blocks for Red Hat, new Dell PowerEdge edge servers, a private wireless program and expanded lab capabilities.

“The promise of open telecom network architecture is clear to operators, but has so far been a challenge to realize,” said Dennis Hoffman, senior vice president and general manager at the company’s telecom systems business.

“To address this challenge, the industry needs to create consumable, tested solutions that telecom operators can confidently deploy in their networks.”

An example is the joint initiative with Red Hat, to be available in the second half of this year, which is designed to help network operators meet the demands of 5G core and radio access network (RAN) workloads.

Co-designed with Red Hat, and backed by Dell services and support, the release said that the cloud-native offering includes the hardware, software and subscriptions that network operators need to build, scale out and power core network functions using Red Hat OpenShift and Red Hat Advanced Cluster Management for Kubernetes.

With the expanded Telecom Infrastructure Block portfolio, network operators can improve the efficiency of how they use their IT resources to reduce operational costs and power consumption, which lowers their carbon footprint, Dell said.

ACG Research estimates that communications service providers (CSPs) deploying it can reduce opex (operating expense) by as much as 40 per cent and capex (capital expense) by 10 per cent versus deploying telecom cloud infrastructure.

According to the Dell release, ACG found that, by “reducing power and cooling expenses, 833 Metric tons of total CO2 emissions can be saved over five years, which is equivalent to driving 179 gas-powered cars for one year or the average amount of electricity used by 162 homes during one year.”

Honoré LaBourdette, vice president, telco, media, entertainment, and edge ecosystem at Red Hat, said, “networks operating at scale from the core to the edge require layered capabilities, across infrastructure and software-defined architecture, with added security measures, orchestration and cloud-native applications.”

PowerEdge servers

The new Dell PowerEdge XR8000, XR7620 and XR5610 servers, which are based on 4th Gen Intel Xeon Scalable processors, are designed for telecom, open RAN and mobile edge computing workloads while simplifying edge operations, the company said. They will be available in May, but Dell is not disclosing pricing at this time,

Private wireless

The Dell Private Wireless Program is designed to offer CSPs and enterprise customers more choice in private wireless offerings, so that they can find the best fit for their own needs, Dell said. Jointly developed with technology partners, the private wireless solutions, based on open architectures, are pre-tested and validated by Dell, and include self-service operations capabilities.

Open Telecom Ecosystem Labs

Finally, the Dell Open Telecom Ecosystem Lab, located in Round Rock, Texas, according to the company supports “more than 25 customers and partners with testing, certifying and validating open telecom solutions and applications, so they can be quickly and easily deployed in telecom networks.”

Dell is ramping its efforts to accelerate innovation and simplify ecosystem collaboration with the following:

A new Open Telecom Ecosystem Lab in Cork, Ireland, which will provide customers and partners with another location to collaborate “across the global, open telecom ecosystem.”
Dell Open Telecom Ecosystem Lab Validation Services, which build upon the lab’s capabilities to give customers dedicated access to Dell engineers for ongoing design consultation and validation, helping CSPs to mitigate risk and launch new offerings and services more quickly.
A new Wind River self-certification lab testing environment for partners to test and validate their software with the Wind River Studio cloud-native platform before deploying in a telecom network.
The post Dell issues flurry of announcements in lead-up to MWC 2023 first appeared on IT World Canada.

Cogeco Connexion, which brings together all of the Canadian cable operations of Cogeco Communications, this week announced the acquisition of the telecommunications activities of internet service provider (ISP) oxio. The ISP will continue to operate independently, and serve its customers under its own brand.

Oxio provides internet and telecommunications services to residential customers in Canada, mainly serving customers in Québec, Ontario and western provinces.

As part of this transaction, Cogeco Connexion will also become the licensee of gaiia, oxio’s proprietary software, and will use it to serve oxio’s customers.

“As we are making the strategic shift to focus exclusively on the growth of our software business, Cogeco presented itself as the best home for our Internet customers,” said Marc-André Campagna, chief executive officer and co-founder of oxio in a press release. “As a Québec-based company with a human scale and an entrepreneurial culture, we believe that Cogeco is best-positioned to enable oxio to reach new heights.”

Through its Cogeco Connexion and Breezeline (formerly Atlantic Broadband) business units, Cogeco Communications provides broadband internet, television, and telephone services to 1.6 million residential and business customers in Québec and Ontario, as well as in thirteen states of the United States.

“Oxio is an attractive brand with high customer satisfaction and a great team. Its home internet offering, based on a digital-only experience, is an exciting addition to our wide range of high-quality telecommunications services. With the acquisition of oxio, Cogeco Connexion will now have a second brand to serve the telecommunications needs of Canadians,” said Frédéric Perron, president of Cogeco Connexion.

The post Cogeco Connexion acquires ISP oxio first appeared on IT World Canada.

To soften up Ukraine just prior to its February 24, 2022 invasion, Russia, or Russian-backed threat groups, unleashed a wave of wiperware against the country’s organizations, deployed a new version of the Industroyer malware against power generating stations and took down thousands of routers used by Ukrainian (and other) subscribers to Viasat’s satellite internet service.

That was just the start of the cyber war.

Wiperware is a favoured weapon. Alex Rudolph, a Carleton University doctoral candidate, told a House of Commons defence committee last week that there have been at least 16 wiper malware families deployed into Ukraine since the start of fighting.

Those 12 months are giving a window into what modern hybrid war — physical and cyber combat — looks like, at least in a limited theatre of war. Global cyber war officially hasn’t broken out yet.

But, for example, the bombardment of some Ukrainian power stations was combined with cyber attacks, notes Jean-Ian Boutin, Ottawa-based director of threat research for ESET, which is headquartered in Slovakia. He’s not sure if was a coincidence or a combined attack.

Meanwhile, there have been suspected cyber attacks against countries supporting Ukraine. Last week, for example, a group called Anonymous Russia took credit for DDoS [distributed denial of service] attacks on the websites of several German airports. The pro-Russian Killnet group took credit for an IT outage at Lufthansa — which the airline blamed on damaged broadband cables mistakenly cut on a railway line during construction work.

In November, 2022, hackers from the Russian-affiliated group KillNet took down the website of the European parliament, hours after the legislative body declared Russia a terrorist state.

However, cyber attacks outside Ukraine haven’t been as crippling as some experts feared.

On the anniversary of the start of the invasion, we look back at what happened since and lessons learned.

Cyber attacks are a feared weapon: Under the worst conditions, they can cripple a heathcare system and cause death. But a Canadian expert points out that cyber attacks alone can’t win wars.

“Cyber-attacks cannot gain territory, but they can disrupt the other side’s operations, target infrastructure and civilians, and affect public opinion during the process of gaining physical territory,” wrote Abby MacDonald, a fellow at the Canadian Global Affairs Institute, when the war was only two months old. “In this conflict, complete cyber-war does not appear to be strategically useful, though cyber-activities including disinformation will continue.”

To David Swan, Alberta-based cyber intelligence director of the Center for Strategic CyberSpace and International Studies, an international think tank, the outset of the cyber war held no surprises.

“Russia has a very well-developed standard cyber battle plan,” he said. “They used it in Georgia [in 2008], they used it in Estonia [in 2007] … it’s been developing since the mid-1990s”

That plan sees cyber or DDoS attacks to impair or close media websites and broadcast systems; on financial institutions to block residents from making any purchases unless they had cash; on infrastructure (eg: gas stations with electronic pumps regulated over the internet were shut or jammed); on government web sites to stop the country from running; and on military wireless communications.

But against Ukraine, the Russians haven’t been as successful for a number of reasons. “They believed most Ukrainians were pro-Russian and would happily support the Russians coming in,” Swan believes. “Wow, did they get that wrong!”

Second, Swan said, Ukraine has been preparing for physical and cyber war since the Russian capture of Crimea in 2014. It learned some lessons during cyber attacks that knocked power out across parts of Ukraine in 2015. Ukraine said the attack came from inside Russia.

In addition, said Swan, in the months leading up to the invasion, Ukraine moved closer to the European Union. In June, 2021, the EU and Ukraine held their first cyber dialogue about responsible state behaviour in cyberspace, but also about cyber resilience. Two days before the invasion, several EU countries activated a cyber rapid response team to help Ukraine. Since the war started, the U.S., Canada and the EU have been offering intelligence and cyber defence support. U.S. cyber support began in 2017. This May 2022 U.S. document outlines what has been done since.

Separately, since the war began, Microsoft, Google, Amazon, Mandiant, ESET, Palo Alto Networks, Cisco Systems and other IT companies have donated software, threat intelligence and countered misinformation to augment Ukraine’s capabilities. They helped the government and the Ukrainian hacker underground that emerged.

Microsoft’s role began earlier. Before the start of the invasion, Russia launched a cyberattack that targeted Ukrainian government and financial websites, notes this analysis of the first six months of the cyberwar in the journal Lawfare. This attack — known as FoxBlade — was poised to wipe data from computers. Within hours of its appearance, the Microsoft Threat Intelligence Center had written code to stop it, which was quickly shared with Ukraine.

Ukraine has come up with at least one unique defensive tactic: It ordered wireless carriers in the country to block mobile devices from roaming with carriers in Russia and Belarus. This is unprecedented, said Cathal Mc Daid, chief technology officer of Sweden’s Enea AdaptiveMobile Security. It meant Russian forces in Ukraine couldn’t use mobile phones as a backup or primary communication system. “We know from history (Russia-Georgia war of 2008) and in Ukraine itself, that Russian forces have used mobile phones to communicate,” he said in an email to IT World Canada, “but this decision by Ukraine, on the day of the invasion, made Russian forces’ communications problems much worse.”

None of this suggests that Ukraine has been impervious to cyber attacks. But the government has been able so far to persevere and direct military action. Or, to put it another way, Russia has so far failed to strike a knockout cyber blow.

Russia, and threat groups that support it, meanwhile, are still active. In fact news emerged this week that Russian hackers planted backdoors in multiple government websites as far back as December 2021. Ukraine’s computer emergency response team said it spotted a webshell deposited through one of those backdoors yesterday (Feb. 23). It isn’t clear if the access has been used undetected for months.

There’s a long list of Russian-deployed [and Western-named] wiperware that has been deployed since the invasion: HermeticWiper, IsaccWiper, WhisperGate, and CaddyWiper, to name a few. And Ukrainian hacktivists struck back with the RURansom wiper.

Just as Ukraine has its civilian cyber forces, so does Russia. One, Swan says, is dubbed NoName057(16). He believes it was formed from KillNet members. This group’s attacks have hit the Polish government and organizations in Lithuania (mainly cargo and shipping firms). For more on NoName057(16) see this report from SentinelLabs.

In a January report published by CSCIS, Swan said it is also attempting to recruit and encourage hackers to attack targets by starting a project called “DDosia”. Volunteers are encouraged to attack ‘anti-Russian targets’, earning as much as 80,000 rubles (US$1,200) for a successful attack.

In a first-year analysis of attacks, researchers at CheckPoint software noticed that, since September, there has been a gradual but major decline in the number of attacks per gateway in Ukraine. On the flip side, it added, there was a significant increase in the attacks against NATO members.

In its analysis of the war so far, Google predicts with “high confidence” that Moscow will increase disruptive and destructive attacks in response to developments on the battlefield that fundamentally shift the balance – real or perceived – towards Ukraine (e.g., troop losses, new foreign commitments to provide political or military support, etc.). These attacks will primarily target Ukraine, it says, but increasingly expand to include NATO partners.

More than one analyst has noted DDoS attacks don’t have large impacts. Nor, seemingly are they aimed at causing significant damage — so far.

“This begs a critical question,” said Dave Masson, head of Darktrace Canada. “One year on, is the risk of a cyber fallout still there? The answer is a resounding yes. While there is no direct evidence of a large-scale cyber-attack on the horizon, it is absolutely critical that defenders stay on guard. The history of cyber threats has shown us time and time again that we cannot rely on historical attack data to predict future threats. The risk of Russian retaliation is real, pervasive, and cannot be underestimated.”

Among the lessons of the cyber conflict so far, said Jean-Ian Boutin of ESET, is the importance of public and private sectors working together. “We already knew that communications is key, but this really strengthened our thinking that the key to thwarting attacks is to keep communications open and report attacks as soon as we see them.”

The Communications Security Establishment (CSE), responsible for securing Canadian government networks, declined a request for an interview. Instead, it sent this statement:

“As mentioned in CSE’s National Cyber Threat Assessment (NCTA 2023-24), Russia’s unlawful invasion of Ukraine in February 2022 gave the world a new understanding of how cyber activity is used to support wartime operations.

“While we can’t speak about specific events or tactics that we’ve monitored through our foreign intelligence mandate, we can confirm that CSE has been tracking cyber threat activity associated with Russia’s war with Ukraine. CSE has been sharing valuable cyber threat intelligence with key partners in Ukraine. We also continue to work with the Canadian Armed Forces (CAF) in support of Ukraine, including intelligence sharing, cyber security, and cyber operations.”

Through the Canadian Centre for Cyber Security, the CSE urges Canadian organizations to

isolate critical infrastructure components and services from the internet and corporate/internal networks if those components would be considered attractive to a hostile threat actor to disrupt. When using industrial control systems or operational technology, conduct a test of manual controls to ensure that critical functions remain operable if the organization’s network is unavailable or untrusted;
increase organizational vigilance. Monitor your networks with a focus on the Tactics, Techniques, and Procedures (TTPs) reported in the CISA advisory. Ensure that cybersecurity/IT personnel are focused on identifying and quickly assessing any unexpected or unusual network behavior. Enable logging in order to better investigate issues or events.
enhance your security posture: Patch your systems with a focus on the vulnerabilities in the CISA advisory, enable logging and backup. Deploy network and endpoint monitoring (such as anti-virus software), and implement multifactor authentication where appropriate. Create and test offline backups.
have a cyber incident response plan, a continuity of operations and a communications plan and be prepared to use them.
inform the Cyber Centre of suspicious or malicious cyber activity.

“The thing I’m expecting is one of those wiper families with a new front end, a new way of breaking into networks, to get loose and come West,” said Swan. “I know that there’s a lot of effort going into backstop to support Ukraine and pre-empt malware families coming West. The problem is Russia only has to get it right once, and they’ve got some of the world’s best hackers on their side writing this stuff. My concern is the longer the war goes on, the higher the likelihood that one or more of these things is going to get loose and there’s going to be hell to pay.”

The post The Russia-Ukraine cyber war: one year later first appeared on IT World Canada.

Cloud giant Amazon Web Services (AWS) will offer RingCentral MVP (Message Video Phone) and RingCentral Contact Center solutions to its customers, as part of a multi-year agreement announced last week.

This partnership between RingCentral and AWS seeks to help organizations accelerate their cloud journeys while transforming their employee and customer communications.

“Together, AWS and RingCentral are giving customers across multiple industries greater choice and support for their call center and business communications needs,” said Matt Garman, senior vice president of sales, marketing, and global services at AWS. “By making RingCentral’s cloud communications solution available on AWS, large enterprise and mid-size customers can benefit from the reliability and scalability of the cloud, while giving employees and customers the ability to collaborate in new ways.”

RingCentral’s unified communications as a service (UCaaS) solutions enable employees to communicate from any location and any device through a single platform that integrates team messaging, video meetings and a cloud phone system.

RingCentral also plans to provide technical resources for workstreams to make RingCentral offerings functional and transactable for AWS customers – supporting AWS Marketplace Listings and integrations to AWS services.

Further, both companies will work together to deploy end-to-end cloud migration solutions for businesses in the healthcare, financial service, retail, education, and public sector industries. Users will be able to access flexible migration options through bring-your-own-carrier (BYOC) and hybrid PBX solutions.

The two companies will also share their resources to enable experts to better assist customers with their cloud adoption and technical integrations. 

This collaboration will initially be rolled out in North America, followed by additional countries in Europe, Asia Pacific, and Latin America over the multi-year period.

The post RingCentral and AWS enter strategic partnership first appeared on IT World Canada.