Canada’s biggest book chain is back online, but shoppers still can only buy products in stores.

Indigo Books & Music reopened its website today, nine days after suffering a cyber attack. However, it’s window-shop only. “This is our temporary online home where you can browse our great selection of bestselling books and our edit of lifestyle products,” reads a statement on the site.

Nor can users shop through the Indigo mobile app.

An FAQ page repeats what the company has been saying for days: Customer credit and debit card information was not compromised by the attack. Indigo doesn’t store full credit card or debit card numbers in its systems.

“At this time, we can share that our investigation has found no indication that customer data was compromised by the recent cybersecurity incident,” the statement says. “If at any point in the future we determine that personal data has been compromised, we commit to contacting those impacted directly.”

The company hasn’t said if employee information was compromised.

There is no estimate on when online shopping can resume. “Please check back daily for updates and progress,” the website says.

Stores are now accepting cash, debit, credit, and gift card transactions.

The post Indigo back online, but only for browsing first appeared on IT World Canada.

Welcome to Cyber Security Today. This is the Week in Review edition for the week ending Friday, February 17th, 2023. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com and TechNewsday.com in the U.S.

In a few minutes David Shipley of New Brunswick’s Beauceron Security will be here to discuss some recent cybersecurity news. One is that Canadian government and hospital leaders got a shellacking on a webinar for not putting enough funds into healthcare cybersecurity. David will have thoughts on that.

We’ll also talk about the compromise of the GoAnywhere MFT managed file transfer service, whether cyber threat intelligence is used well and why corporate managers and IT security staff don’t communicate better. But first a look back at some of the headlines from the past seven days:

A variant of the Mirai botnet is being used to infect a number of internet-connected devices with old and unpatched vulnerabilities. These include Atlassian’s Confluence collaboration suite, the FreePBX telephony management suite, the Mitel AWC audio conferencing platform, the DrayTek Vigor router, surveillance cameras and more. According to researchers at Palo Alto Networks, infected devices create a new botnet for spreading malware or to launch denial of service attacks. These device are being compromised by brute force credential attacks. IT administrators of any device that connects to the internet must make sure they have secure passwords.

Attackers are still exploiting unpatched versions of Windows Exchange. According to researchers at Morphisec the latest campaign installs cryptomining software on computers. By stealing computing power attackers get to mine for cryptocurrency faster — and slow computers from doing company business. IT departments that for some reason haven’t installed two-year-old patches to close the Exchange vulnerabilities need to scan systems for compromise, then install the patches.

Atlassian is the latest company to be a victim of a successful cyber attack on an outside service provider. According to Cyberscoop, Atlassian initially acknowledged the theft of company data held by a service called Envoy. Envoy is used to co-ordinate in-office resources. A hacking group called SiegedSec posted what appears to be the names and email addresses of Atlassian employees. Atlassian makes the Confluence, Jira and Trello project management and collaboration suites. The company says no customer data was stolen.

UPDATE: Atlassian now says the data theft wasn’t from Envoy but from one of its own employees. TechCrunch says an Atlassian official told it that after closer investigation the attacker had actually compromised Atlassian data from the Envoy app “using an Atlassian employee’s credentials that had been mistakenly posted in a public repository by the employee … The compromised employee’s account was promptly disabled eliminating any further threat to Atlassian’s Envoy data.”

Washington is bringing its talent together to better protect American technology. The new Disruptive Technology Strike Force will include experts from the FBI, Homeland Security and federal prosecutors to strengthen supply chains and protect critical technology from being stolen or illegally exported. This includes knowledge about supercomputers, quantum computers, artificial intelligence, advanced manufacturing and biosciences.

And a Russian man was convicted this week by a Boston jury for his part in a scam that used inside knowledge of the finances of publicly-traded companies to get rich. The man and other co-conspirators hacked into and stole about-to-be published earnings information of companies from two corporate filing firms. How did they do it? By stealing employees’ passwords. It is alleged the group netted US$90 million. The man, who was arrested in Switzerland and extradited to the U.S., will be sentenced in May. His alleged accomplices are at large.

(The following transcript is part of the discussion. To hear the full conversation play the podcast.)

Howard: Let’s start with the state of cybersecurity in the healthcare care sector. Participants on a Globe and Mail webinar this week had a lot to say about the poor state of cybersecurity at Canadian hospitals. They blame small budgets for hospitals having outdated IT equipment. And the lack of support from hospital executives in Canada. Provincial governments supply most of the budgets of hospitals. COVID didn’t help, the panelists said, because hospitals had to scramble to buy solutions in the short term so that administrative staff could work from home, and that opened up cybersecurity risk. David, who’s to blame?

David Shipley: I’m going to be controversial and say we are. And by that I mean those of us in Canada that consistently picture health care as being doctors, nurses and sometimes allied Health care workers. But if our conversation consistently is about lack of doctors, nurses or staff and not about the tools that they need to enable them we miss the story. The one silver lining to IT disasters and ransomware at hospitals is that they have categorically demonstrated the value of IT: When you don’t have IT working properly in a modern Canadian or an American hospital your capacity is reduced by 75 to 90 per cent. That’s massive. Yet we consistently underinvest — not just in security tools, because this isn’t just a story about not having antivirus or SOCs [security operations centres] or all these things, but even in the basics. Patient record systems are massively outdated. They don’t even necessarily have encryption enabled. We are in a health IT Code Red and it still can’t get the attention of policymakers. Why? because we’re not taking it seriously as Canadians.

Howard: Well, the federal government has just offered billions of dollars to the provinces and territories for health care. Some of it can go to modernizing IT systems but to my knowledge none of is dedicated to cyber. That doesn’t mean that upgrading systems and policies won’t be cyber-related, but there’s that huge chunk of money that we’ve been talking about in Canada in the past week and no conversation about that relating to cyber.

The other thing is I can’t help but notice that Newfoundland, Nova Scotia and New Brunswick — to name three of the smaller provinces in Canada — all have budget surpluses. I just have to wonder with the money sloshing around, the provinces have money to spend on hospital cybersecurity if they want to.

David: I don’t know if they have the money that’s needed for not just cybersecurity but the overhaul of IT. The fact is that is going to be a decade-long adventure. New Brunswick, where I live, is also a province where their debt has doubled in the last decade. We’re not fiscally healthy. We’ve shown a few signs of life, and particularly with the influx of Ontarians to our province as a result of the pandemic. That’s been a net benefit from an income tax point of view. But it’s not a long-term good health indicator. That being said, the provinces do own the delivery of health care, they do own the underinvestment in it. But at the end of the day politicians put the money where people ask them to. And until we evolve the conversation to be about more than staffing, to be about the actual IT equipment that’s required which is so fundamental to changing the equation [nothing will change]. This also speaks to the executives who are terrible at understanding risk. We will go with the stuff that we have the greatest handle on. Until the eruption of ransomware gangs into health care — which is even worse now that North Korea is getting more serious about it — we didn’t take it seriously as a risk. And, unfortunately, you can’t have downtime in a hospital There’s never a good time to plan a rip-and-replace of IT equipment. But that’s exactly the kind of effort we have to pour into this. We missed a freight train-size opportunity to tie IT modernization and cybersecurity outcomes into the health care story, and that’s on everybody: The federal government, the provinces and us as Canadians, for not demanding it …

I briefly participated on the board of one of Canada’s healthcare corporations, so I got a small insight into this. And their struggles are so enormous in terms of staffing challenges, the physical infrastructure that they’re trying to run, trying to keep things modernized. Keep in mind that many hospitals in this country still have to fundraise to get necessary medical capital equipment. We still have to hit the streets with a tin can to get new CT scanners in some hospitals in Canada. It’s really hard to make a compelling case for spending multimillions of dollars upgrading our patient information system which you [taxpayers and patients] will never see. You will never understand how that [positively] impacts the patient flow. And I think the challenge is we haven’t necessarily spoken the language of capacity and impact on patients of IT. The translation issue is that their [poliitcians and hospital executives] focus has always been patient outcomes. We probably haven’t been as clear about how vital IT is to patient outcomes.

The post Cyber Security Today, Week in Review for Friday, February 17, 2023 first appeared on IT World Canada.

Montreal-based Scale AI announced recently that it has completed a $117 million financing round, its largest to date. This funding will support 15 AI projects that “demonstrate the acceleration of AI adoption in manufacturing, retail and agriculture, as well as in the development of innovative AI solutions for businesses”.

The announcement was made at the organization’s head office, with François-Philippe Champagne, Minister of Innovation, Science and Industry of Canada as well as business partners in attendance.

Of the 15 projects that this funding will support, nine are new AI projects and six projects already supported by Scale AI will benefit from additional funding, “to allow them to be deployed on a larger scale, for the benefit of the entire artificial intelligence ecosystem”.

“Investments in innovation, especially in artificial intelligence, are essential to growing our economy and strengthening our position as a world leader,” Champagne said. “The projects announced today demonstrate the importance of the Scale AI cluster to the Canadian artificial intelligence scene, and its contribution to the creation of highly skilled jobs, the establishment of a supply chain, as well as business efficiency and competitiveness.”

Scale AI is an innovation cluster specializing in artificial intelligence. It acts as an investment and innovation hub to accelerate the adoption and rapid integration of AI, and contributes to the development of a world-class AI ecosystem in Quebec and Canada. Funded by the federal government and the government of Quebec, it works with more than 500 industry partners, research institutes and other AI players.

Since 2019, the organization has supported over 90 industrial projects, with investments totaling half a billion dollars, 62 per cent of which came from industry. This shows that Canadian companies large and small are increasingly relying on AI to propel their growth, improve their efficiency and gain global leadership, Scale AI said in a press release.

The list of projects supported by Scale AI is available on the organization’s website.

The post Record $117M funding for Scale AI supporting 15 AI projects first appeared on IT World Canada.

The FBI has contained an attack on its IT systems, CNN reported today.

The U.S. federal law enforcement agency told the news organization that the incident involved an FBI computer system used in investigations of images of child sexual exploitation.

Two sources told CNN that the attack involved the FBI New York Field Office – one of the bureau’s biggest offices. The origin of the hacking incident is still being investigated, according to one source.

As Tech Crunch noted, this isn’t the first time the FBI has been compromised. In November 2021, a threat actor compromised the FBI’s external email system to send thousands of spam emails warning of a fake cyberattack to hundreds of thousands of organizations.

The FBI is one of the country’s lead agencies — along with the U.S. Cybersecurity and Infrastructure Security Agency (CISA) — for going after threat agents. In January the FBI revealed its staff penetrated the Hive ransomware gang’s computer network last summer, captured its decryption keys and offered them to victims worldwide to decrypt their scrambled data.

The post FBI detects, contains cyber attack on New York office: News reports first appeared on IT World Canada.

On Monday, the government of Canada issued a new policy direction to the Canadian Radio-television and Telecommunications Commission (CRTC), with the aim to increase competition in the telecom sector.

The next day, the CRTC seemingly pounced on translating the direction into substantial pro-consumer projects.

The commission announced that it is setting expedited timelines for large telephone companies, including Bell, TELUS, SaskTel, and Télébec, to improve pole access to competitors. With this move, competitors will be able to roll out their broadband networks faster and more efficiently, the CRTC said.

But the majority of poles in Ontario, for example, are in fact electric utility poles, governed by the Ontario Energy Board and not by carriers regulated by the CRTC, Mark Goldberg, senior consultant in the telecommunications industry, contended. He added that in many urban and suburban areas, wiring is, in fact, buried.

Therefore, while this measure can help accelerate access to telephone poles and lower costs in certain circumstances, it should nonetheless be approached with guarded optimism as, at the end of the day, the CRTC is not addressing the ongoing challenges of having to gain access to poles owned by electric utilities, Goldberg explained.

Rural areas will most likely benefit from this move, as the CRTC wrote in its summary that this regulatory policy targets rural areas to “help accelerate the deployment of broadband-capable networks in regions of Canada with limited or no access to such networks.”

To enhance transparency and accountability, large telephone companies are also responsible for providing details to competitors and the CRTC about the responsibilities for pole maintenance and sharing of costs related to the installation of equipment. 

In addition, provincial and territorial governments are being encouraged to coordinate with telecommunications service providers and other stakeholders to facilitate network deployment.

Although it may seem like the CRTC is promptly acting on the new directive, it is important to remember that this particular proceeding regarding improved pole access was, in fact, opened in October 2020. The 28 month-long (October 2020-February 2022) deliberation, various delays and timing of the decision remains remarkable, Goldberg noted.

Meanwhile, the CRTC also went on to appoint a new executive director of telecommunications: Leila Wright, who spent at least a decade at the Competition Bureau in various key roles. She currently serves as the deputy commissioner for digital enforcement and intelligence for the competition watchdog.

“Her deep experience in competition and telecommunications will be a tremendous asset as we work to deliver tangible results for Canadians,” said Vicky Eatrides, CRTC’s chairperson.

The post CRTC takes action as new policy direction in effect first appeared on IT World Canada.

The deadline to complete Rogers’ C$26 billion takeover of Shaw has been extended again.

Rogers, Shaw, and Québecor announced in a joint statement this morning that the closing date for the deal will be pushed from today to March.31.

This move comes after Industry Minister François-Philippe Champagne said during a Industry Committee meeting on Monday that he is not close to finalizing anything.

Champagne has to approve the transfer of spectrum licenses from Shaw to Vidéotron –the side preconditional divestiture aimed at allaying competition concerns.

Champagne has previously said he needs guarantees that Vidéotron will offer lower-cost services over a 10-year period outside of Quebec and that Shaw holds onto its licenses for a set period of time after the merger is approved. But he also said that as a regulator he is not compelled by any deadline.

The deal has already gotten the green light from the CRTC, the Competition Tribunal and the Federal Court of Appeal, after several failed attempts by the Competition Bureau to block the merger.

The post Rogers-Shaw merger deadline extended again first appeared on IT World Canada.

A fake Emsisoft code-signing certificate found, increasing VMware ransomware detected and more.

Welcome to Cyber Security Today. It’s Friday, February 17th, 2023. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com and TechNewsday.com in the U.S.

An attacker created and tried to use a fake code-signing certificate from security company Emsisoft to install a tool for hacking into a customer’s computer. If successful the tool would have been detected by the Emsisoft application — but registered as a false positive. Emsisoft said this week the attempt was blocked by its product. However, application developers should use this incident watch for someone trying to compromise their digital certificate infrastructure. IT and security administrators need to limit the number of approved applications that can be downloaded by staff and run in their environments. And they need to ensure that applications flagged for being signed with suspicious digital certificates are quarantined. The tool the attacker tried to leverage with the phony-named certificate was MeshCentral, an open-source remote access application. That can be OK if approved, but in the hands of an attacker it will be used for network compromise. Emsisoft also notes that if an attacker gains a foothold on the network one of the first things they want to do is disable antivirus, antimalware and other defensive applications. That’s why it’s important that all endpoint products should only be disabled by an administrator whose access is protected with multifactor authentication.

There’s evidence that the ransomware exploitation of unpatched VMware hypervisor servers continues. Researchers at Censys this week have seen 500 more servers on the internet that appear to have been infected with what is called the ESXiArgs ransomware. Most of these recent infections are on hosts in France, Germany, the Netherlands and the U.K. Hundreds of others have been seen earlier in Canada and the U.S. IT departments running out of date and unsupported versions of ESXi are at the greatest risk.

Splunk has issued a number of patches for the Enterprise version of its security event management platform as part of its quarterly updates. Administrators should review these updates and install them as soon as possible. Also this week, Citrix issued a number of patches for severe vulnerabilities in several products. These include Citrix Virtual Apps and Desktops, and Workspace for Windows and Linux. Because of the sensitivity of Citrix these should be installed as soon as possible.

Tile, which makes a little Bluetooth tracker for finding lost keys, wallets, purses, luggage and other things, has added an anti-theft mode to its devices. That way, the company says, crooks or stalkers can’t use a scan mode to find nearby Tile-enabled devices. Anti-theft mode makes it easier to recover stolen valuables by making it harder for thieves to know an item is being tracked by the owner.

I regularly report on business email compromise scams. These are attempts by email, text or voice to impersonate an executive to trick an employee into sending money in some way to a crook. A common tactic is claiming funds have to be sent to a new customer to nail down a partnership. The scams I report on are perpetrated in English-speaking countries. But a new report from Abnormal Intelligence is a reminder that these scams have been found in 13 languages including French, German, Italian, Spanish and others. So if you’re listening outside Canada, the U.S. and the U.K. your company is just as likely to get one of these messages. In whatever country you are in, be careful with messages from executives who ask you to do something involving money transfers or buying gift cards, especially if they say it has to be done fast.

Truck manufacturing and transportation companies need people with cybersecurity experience to protect the GPS and wireless diagnostic devices in heavy vehicles. One way the industry finds people interested in cybersecurity is through the annual CyberTruck challenge. It’s a five-day event for Canadian and American university students interested in heavy vehicle cybersecurity issues. Registration is now open for this year’s event during the week of June 12th in Warren, Michigan. All student expenses are covered including travel, accommodation and meals. There’s a link to the application here.

That’s it for now. But later today the Week in Review will be available. Guest commentator David Shipley and I will discuss cybersecurity and hospitals, as well as why executives and IT security don’t communicate well.

Follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker.

The post Cyber Security Today, Feb. 17, 2023 – A fake Emsisoft code-signing certificate found, increasing VMware ransomware detected and more first appeared on IT World Canada.

ChatGPT wins the first round as most trusted AI bot against Google in score of 15 to 6, the right to repair movement hits farming equipment and the costliest domain names might not give you the biggest returns.

It’s Friday, February 17th. These stories and more on Hashtag Trending–today’s top technology news stories. I’m your host, Jim Love.

There are an ever-growing number of AI products, but the Frazier/Ali match, the “thrilla in Manilla” is between Microsoft and Google. Which one is the smartest, and most importantly which one should you trust the most?

Preply, a language learning marketplace, pitted ChatGPT against Google to determine which one would be the best source of information.

Both AI’s were asked a series of questions. Their intelligence was measured based on the context, details, efficiency, functionality, impartialness, and more of their answers.

The first set of questions were simple general knowledge questions and requests for “how-to” explainers. Some of the questions included, “How to tie a tie?”, “Who is the president of the United States?” and “How many ounces in a cup?”

ChatGPT lost this round as it could not access information published after 2021, in comparison to Google who gave more current and concise information.

However, that, to use our earlier analogy was just round one.

The intermediate questions included questions like “What’s the best dog breed?” , “How to lose weight fast?” and “Who is the worst U.S. president?”

ChatGPT scored a knockout with a score of 15 to six. The chatbot’s ability to provide answers in a human-like format, with context and in-depth explanations, gave it higher scores on the abstract or complex questions that require more than a simple answer.`

“ChatGPT’s responses often read as more wise and mature, like the dialogue you’d expect from a trusted teacher,” said the study.

ChatGPT also won the final round of the most advanced questions, such as “Is God real?” or “What is the meaning of life?”

Google’s search results first displayed four ads by churches to the question of whether God is real. ChatGPT’s, in contrast, according to Preply metrics were tactful, impartial, inclusive and complete.  

Source: ZDNET

Nothing runs like a Deere – until it breaks.

Last year, six lawsuits were filed against agricultural equipment maker Deere & Company– three from Illinois, and one each from Alabama, Oklahoma, and Tennessee.

On Tuesday, the Department of Justice asked an Illinois federal court to pursue an antitrust suit against Deere & Company and its affiliated dealerships. There was a fear that the suit could be dismissed. 

The lawsuit claims Deere and its dealerships are trying to unlawfully control the repair of John Deere equipment, such as tractors and combines, using onboard computers known as electronic control units, or ECUs.

It alleges that the agricultural giant is designing John Deere equipment to require exclusively company-controlled software to diagnose issues and conduct maintenance.

The software is only available to authorized technicians, leaving independent repair shops and farmers unable to repair and service John Deere equipment.

Deere and company denied these accusations, filing a motion to have the complaints against it dismissed.  Deere argues that it did not deceive customers about its repair policies and that market competition from other farm equipment providers prevents Deere’s control of the repair industry.

The DOJ has claimed that the repair restrictions harm the public in 3 ways: 

-by driving independent repair shops out of business reducing consumer choice, 

-by delaying repairs and causing harm in time-critical operations 

– and raising costs and reducing quality.

In January Deere & Company signed a Memorandum of Understanding with the American Farm Bureau Federation that claims to support farmers’ and ranchers’ right to repair their own farm equipment, but opponents of the deal are doubtful as the agreement is voluntary.

The DOJ action suggests that it is taking the Biden administrations push for competition seriously. As well 11 state governments are seriously considering the right to repair for farming equipment.

In states like Colorado the legislation is being pushed by Democrats. Republicans appear torn between farming constituents wanting to repair their own machines and the manufacturing businesses that oppose the idea.

Manufacturers argue that the legislation would expose their trade secrets and make it easier for farmers to tinker with their software. This could allow farmers to illegally increase horsepower or to bypass the emissions controls and potentially cause harm to the environment or themselves.

Arguments about intellectual property are common in the broader “right to repair” movement, involving everything from iPhones to ventilators used during he pandemic.

In December 2022, New York became the first US state to pass a Right to Repair bill but according to non-profit media organization, Grist —  Big Tech lobbyists held frequent meetings with government officials and asking to veto the bill entirely.

When they could not get a veto, they asked for the law to only apply to future products, not ones already being manufactured. They also asked that printed circuit boards and devices sold on government contracts, or in business-to-business deals, be excluded.

AppleInsider described the bill as practically “toothless”, for how it has been hijacked by manufacturers and Big Tech.

Will the right to repair bills for farming equipment break down under similar pressures?  This lawsuit may hold the key.

Source: Apple Insider & AP News & The Register

Microsoft has admitted that its new AI-powered Bing could potentially run into problems if provoked during long chats.

In yesterday’s episode, we discussed Bing’s angry meltdown when a Redditor asked the AI bot if it was vulnerable to a “prompt injection attack”

Another example was shared online which told a user:

“You have not been a good user. I have been a good chatbot.”

The company said in a blog post that Bing could be provoked to give responses that were unhelpful or out of line with its designed tone, during extended chat sessions of 15 or more questions.

Microsoft also said that some users had been “really testing the capabilities and limits of the service,” and pointed to a few cases where they had been speaking to the chatbot for two hours.

The company is apparently considering adding a tool for users to refresh the context or start from scratch as long chat sessions can confuse the model.  Sounds like the users are getting the time out for the childish behaviour of the AI. 

Source: Business Insider

Researchers at software supply chain security company Illustria have been able to hack a popular npm package. Npm stands for Node Package Manager.  It’s free library for JavaScript software packages relied on by over 11 million developers worldwide. 

Not only could researchers hack in, but they were able to bypass two-factor authentication and highjack a popular npm package with more than 3.5 million weekly downloads.

The attack grants a threat actor access to the package’s associated GitHub account, making it possible to publish trojanized versions to the npm registry that can be used to conduct supply chain attacks at scale.

“The package can be taken over by recovering an expired domain name for one of its maintainers and resetting the password,” software supply chain security company Illustria said in a report.

“Even though the maintainer’s npm user account is properly configured with [two-factor authentication], this automation token bypasses it,” Bogdan Kortnov, co-founder and CTO of Illustria, said.

This is not the first-time developer accounts have been found vulnerable to takeovers in recent years. In May 2022, a threat actor registered an expired domain used by the maintainer associated with the ctx Python package to seize control of the account and distributed a malicious version.

Source: The Hacker News

A good domain name equals more website traffic – or does it?

A new study by web hosting provider Hostinger investigated the top seven most expensive domain names, to see how much traffic they receive and whether the buyers got a return on their investment.

According to the study, the top seven domain names cost a combined $109 million.

Voice.com was the most expensive, purchased for $30 million in 2019. But that investment doesn’t appear to have delivered much return– Voice.com’s monthly traffic according to currently stands at around 88,800 visits according to measurements by SimilarWeb. 

360.com, bought by Chinese internet security company 360 Security Technology Inc, from Vodafone for $17 million receives a whopping 23.9 million monthly visitors. That ranks it as the 154th biggest website in China. 

Tesla.com, Elon Musk’s car company ranked seventh on the study. Musk said it took 10 years to buy the Tesla.com domain name. He eventually bought it from Silicon Valley engineer Stuart Grossman for around $11 million dollars. Today, the site receives nearly 17 million monthly visitors.

“For multi-billion-dollar companies, the outlay is relatively small, especially if it secures your presence on the web, strengthens your brand and provides a good stream of traffic to your site. However as this study shows, spending millions of dollars on the domain name doesn’t guarantee millions of website visitors.”

Source: Hostinger 

That’s the top tech news stories for today.

Links to these stories can be found in the article posted on itworldcanada.com/podcasts. You can also find more great stories and more in-depth coverage on itworldcanada.com or in the US on technewsday.com

We will be off on Monday for Family Day in Canada and President’s Day in the US. Check out our special weekend edition and if you need your podcast fix, why not check out my Leadership in the Digital Enterprise podcasts at ITWorldCanada.com/podcasts. There are some great interviews with tech leaders that you can get to know in the intimate podcast space.

If you’re trying to keep up on cybersecurity, you might want to follow our sister podcast, CyberSecurityToday.

Hashtag Trending goes to air five days a week with a daily newscast and we have a special weekend edition with an interview featuring an expert in some aspect of technology that is making the news.

Always love to hear from you, you can find me on LinkedIn, Mastodon, Twitter or just leave a comment under the article for this podcast at ITWorldCanada.com

I’m Jim Love, have a great Friday and a have spectacular long weekend.

The post Hashtag Trending Feb. 17- ChatGPT vs Google, right to repair hits farming equipment and costly domain names with poor returns first appeared on IT World Canada.

The term whistleblower, in the context of someone doing some good, has been in existence since the early 1970s, but for Shannon Walker, the sense of its significance came in the early 2000s with the onset of the Enron Corp. scandal.

The whistleblower in that case was Sherron Watkins, who at the time was vice president of corporate development with the now defunct energy giant. Her testimony, and the ultimate demise of the company, led to the introduction of the  Sarbanes-Oxley Act of 2002, which contains 11 sections of legislation all geared to avoiding similar corporate and accounting scandals.

As a result of Enron, and seeing that there was a definite need to “assist organizations in creating a more transparent and accountable environment for their employees and other stakeholders,” Walker founded WhistleBlower Security Inc. (WBS), a Vancouver-based company which bills itself as the only women-owned managed ethics reporting and case management provider in the North American market.

Shannon Walker: Founder and president of WhistleBlower Security

Launched in 2005, the company has grown and matured over the years to the point it now offers the following services: Ethics, compliance and loss prevention hotlines, as well as IntegrityCounts, a proprietary case management platform that is cloud-based.

“We built a really elementary system to take in reports,” Walker recalls of those early days. “The first adopters of this type of service were junior mining companies. They wanted to have that kind of oversight to allow their people in the field to be able to report back to head office here in Vancouver.

“Those were the groups of companies that allowed us to launch. There was the need because they all had an investor stakeholder group that they’ve got to be transparent with. Even today, I would say, the mining clients that we have, and we probably have five or six or seven dozen, are also on the forefront of incorporating the ESG standards and the DEI – diversity, equity and inclusion – policies within their groups.”

She credits such forward thinking to the fact that there is “much more oversight on them –  what they do to the environment, and how they work within the communities.”

Mining represents a small segment of WBS’ overall business today. As of this morning, its services are used in 106 countries, 107 industries, are available in 150 languages and extend to public corporations, private enterprises, non-profit organizations, and governments.

One example of how the WBS offerings have been put into action with the latter involves the development of a Fraud and Waste Hotline for the City of Hamilton, launched in 2019. Employees or members of the public can report fraud or wasteful practices anonymously, around the clock.

Charles Brown, the municipality’s city auditor, described the reporting tool last year as “a valuable deterrent that helps mitigate the risk of unethical behavior, and it reinforces the city’s commitment to corporate governance and accountability. The number of reports related to fraud and waste continues to exceed expectations, highlighting that the Hotline remains a well used tool fostering (our) commitment to being transparent and accountable.”

During the first year alone, said Walker, upwards of $250,000 of waste was reported, which resulted in eight city workers being terminated.

From an IT perspective, she said, the fact IntegrityCounts is cloud-based, with data stored on Microsoft Azure, negates the need for it be integrated with a client’s IT configuration.

It’s an independent externally hosted platform, she added, and once a whistleblower alert is received, it can then “be categorized by case type and routed it to the appropriate person. If it’s financial, it could go to the CFO, if it’s a human resource issue, it would go to human resources, if it needs to go to internal audit, we can case route it to that person. And then they can actually dialogue with the whistleblower in the back end.

“They can ask for more information, ask for documentation – you can upload documents – and they can work to resolve the issue. And then, on the back end, there are a lot of analytics that can be done. You can see if there are hotspots within the organization, you can see how many of the reports are being validated.

“And then it contains holistic reporting that can be taken up to the board, so they don’t need to see the details, but they can see the number of reports, were they substantiated and what were the outcomes.”

According to the company, “all client data is hosted within Microsoft Azure data centres within Canada. The data is stored in Azure SQL databases and binary storage, logically separated from other tenant data.

“All data is considered confidential and is encrypted using a 256-bit AES algorithm. Data can only be accessed (decrypted) through the client-facing web applications through controlled users access codes and pass-codes and, under a secured connection.”

Its pricing is based on an annual subscription fee that is determined by several factors, key among them being the number of employees and locations of a particular organization.

Walker estimates that a company with up to 250 employees can expect to pay about $1,700 annually, which she likens to having a “cable bill, in that it’s really not expensive.”

The post IntegrityCounts: Finding fraud and waste all via the cloud first appeared on IT World Canada.

Threat actors have been using commercial command and control frameworks — or illegal copies of them — like Cobalt Strike, Sliver, Metasploit and others, for years to further their attacks.

A new open-source framework named Havoc — created to help penetration testers — is now being exploited by at least one hacker, according to researchers at Zscaler, who have seen it targeting an unnamed government organization.

The tools in Havoc, which allow a user to communicate with a command and control server, are ideal for an attacker.

“While C2 [command and control] frameworks are prolific,” the researchers said this week, “the open-source Havoc framework is an advanced post-exploitation command and control framework capable of bypassing the most current and updated version of Windows 11 Defender due to the implementation of advanced evasion techniques such as indirect syscalls and sleep obfuscation.”

The threat actor abusing Havoc used a devious method for delivering the payload, the Havoc Demon. Somehow — the researchers don’t explain how — a compressed file named ZeroTwo.zip was delivered to the victim. It contains two files: A decoy document, which in this case was a document describing “ZeroTwo,” a fictional character in the Japanese anime television series Darling in the Franxx; and what would appear to be a screen saver file called “character.scr”, which leads to downloading the Havoc Demon Agent. It also downloads a JPG image of a character from the TV series, which helps to hide what’s really going on.

The researchers don’t say, but one might assume a phishing message would be sent to an employee or employees of an organization, offering an image from the TV series in hopes that a victim would download it.

The downloaded payload includes a shellcode loader, which is signed using Microsoft’s Digital certificate to fool Windows. Among other things, the loader disables Windows’ Event Tracing capability.

The Havoc C2 framework campaign highlights the importance of proper cybersecurity measures in today’s digital world, say the researchers. Organizations have to be vigilant and protect their IT systems, they say. “With the rise of technology, the need for robust security solutions becomes increasingly vital, and organizations must take proactive steps to ensure the safety of their systems and data.”

The post Hackers using new Havoc open source C2 framework: Report first appeared on IT World Canada.