RansomHouse first appeared in December 2021 and so far, the gang has claimed 6 victims, including Gaming Authority (SLGA) and others.

If you want to get a cyber security certification, it's probably the most successful.

Als je een cyberbeveiligingscertificaat wilt halen, is dat waarschijnlijk het meest succesvol.

5 Proven Cyber Security Certifications That Will Boost Your Salary in 2018Looking for which cyber security certifications you should get your hands on? Here are 5 certifications that will…

5 Bewezen Cyber Security Certificeringen die uw salaris in 2018 zullen verhogenOp zoek naar welke cybersecuritycertificeringen je in handen moet krijgen? Hier zijn 5 certificeringen die...

5 Proven Cyber Security Certifications That Will Boost Your Salary in 2018

Looking for which cyber security certifications you should get your hands on? Here are 5 certifications that will…

RansomHouse Claims to Hacking Semiconductor Giant AMD, Stealing 450GB of Data

In this video for Help Net Security, Dan Lorenc talks about the Sigstore project and how it was used to secure the Kubernetes 1.24 release.

A new project has been launched to protect software from attacks.

Er is een nieuw project gestart om software te beschermen tegen aanvallen.

Software supply chain attacks have been increasing over the past few years, spurring the Biden administration to release an executive order detailing what government agencies are supposed to do to protect themselves against them. These attacks consist of several different types of threats, but the result is always the same: attackers gaining access to run code on your infrastructure or to tamper with the code that you’re using in production. The Sigstore project aims to help address different threats by building a new standard for signing, verifying and protecting software.

Het aantal aanvallen op de softwareketen is de afgelopen jaren toegenomen, wat de regering-Biden ertoe heeft aangezet een uitvoeringsbesluit uit te vaardigen waarin wordt beschreven wat overheidsinstanties moeten doen om zich hiertegen te beschermen. Het Sigstore-project wil verschillende bedreigingen helpen aanpakken door een nieuwe standaard te ontwikkelen voor het ondertekenen, verifiëren en beschermen van software. Wekelijkse Nieuwsbrief - E-mail wordt elke maandag verstuurd met een samenvatting van de afgelopen 7 dagen.

Software supply chain attacks have been increasing over the past few years, spurring the Biden administration to release an executive order detailing what government agencies are supposed to do to protect themselves against them.

These attacks consist of several different types of threats, but the result is always the same: attackers gaining access to run code on your infrastructure or to tamper with the code that you’re using in production.

The Sigstore project aims to help address different threats by building a new standard for signing, verifying and protecting software. It helps make sure your software is what it claims to be.

In this video for Help Net Security, Dan Lorenc, CTO at Chainguard, talks about the Sigstore project and how it was used to secure the Kubernetes 1.24 release.



 Daily Newsletter - E-mail sent every business day with a recap of the last 24 hours Weekly Newsletter - E-mail sent every Monday with a recap of the last 7 days (IN)SECURE Magazine - E-mail sent when a new issue is released I have read and agree to the terms & conditions

Sigstore: Signature verification for protection against supply chain attacks

The Linux Foundation and OpenSSF project, with backing from Microsoft and Google, aims to improve security of 10,000 open-source projects.

Microsoft and Google have launched a new initiative to improve the security of open-source software.

Microsoft en Google zijn een nieuw initiatief gestart om de beveiliging van open-source software te verbeteren.

The Log4j vulnerability crisis that erupted in late-2021 heightened the security world’s awareness of supply chain risks in free and universally deployed open-source software. Backed by $5 million in initial funding from Microsoft and Google, the project seeks to improve software supply chain security for 10,000 open-source software projects by systematically looking for undiscovered vulnerabilities in open-source code and then working with project maintainers to get them fixed. Alpha will target critical projects; Omega will identify flaws in 10,000 projectsThe Alpha part of the project will target and evaluate the most critical open-source projects to help organizations improve their security postures.

Het Omega-gedeelte van het initiatief zal gebruik maken van geautomatiseerde methoden en instrumenten om kritieke beveiligingslekken op te sporen in ten minste 10.000 op grote schaal toegepaste open source-projecten, waarbij gebruik zal worden gemaakt van een combinatie van mensen, technologie en processen. Het project, dat wordt gesteund door 5 miljoen dollar aan initiële financiering van Microsoft en Google, wil de beveiliging van de softwareketen voor 10.000 open-source softwareprojecten verbeteren door systematisch op zoek te gaan naar onontdekte kwetsbaarheden in open-source code en vervolgens samen te werken met projectbeheerders om deze te laten verhelpen. Alpha zal zich richten op kritieke projecten; Omega zal gebreken in 10.000 projecten identificerenHet Alpha gedeelte van het project zal zich richten op de meest kritieke open-source projecten en deze evalueren om organisaties te helpen hun veiligheidspositie te verbeteren.

The Log4j vulnerability crisis that erupted in late-2021 heightened the security world’s awareness of supply chain risks in free and universally deployed open-source software. Following an intense holiday season push by admins and cybersecurity professionals to track and remediate the Log4j flaw, the White House held a meeting of industry leaders to discuss improving open source software security.

In a sign that the tech sector is stepping up efforts, the Linux Foundation and the Open Source Security Foundation (OpenSSF) have announced the Alpha-Omega Project. Backed by $5 million in initial funding from Microsoft and Google, the project seeks to improve software supply chain security for 10,000 open-source software projects by systematically looking for undiscovered vulnerabilities in open-source code and then working with project maintainers to get them fixed.

Alpha will target critical projects; Omega will identify flaws in 10,000 projects

The Alpha part of the project will target and evaluate the most critical open-source projects to help organizations improve their security postures. The projects will be selected based on the work by the OpenSSF Securing Critical Projects working group using a combination of expert opinions and data, including the OpenSSF Criticality Score and Harvard’s “Census” analysis identifying critical open source software.

For those projects, Alpha team members, initially composed of paid professionals funded under the initiative, will provide tailored help so that organizations can understand and address security gaps. That help can consist of, for example, threat modeling, automated security testing, source-code audits, and support with remediating vulnerabilities that are discovered.

The Alpha team will also track a series of important metrics providing stakeholders with a better understanding of the security of the open-source project they depend on. The team will further issue a transparent, standardized view of the project’s security posture and compliance with security best practices.

The Omega part of the initiative will use automated methods and tools to identify critical security vulnerabilities across at least 10,000 widely deployed open source projects using a combination of people, technology and processes. Omega will have a dedicated team of software engineers continually tuning the analysis pipeline to reduce false-positive rates and identify new vulnerabilities. Although both Alpha and Omega will launch with paid staff members, the initiative hopes to leverage a broader constituency of volunteers ultimately.

Brian Behlendorf, general manager of the OpenSSF, tells CSO, “We realized that there was a gap when it comes to a set of needs, which I think really came to the fore with the call a few weeks ago with the White House.” Although motivated by Log 4j, “The meeting thought to ask these deeper questions about how is it that the open-source community writes code and where are useful places for support for better interventions to help mitigate the chances of a future Log4j. Then once they happen, how do you respond to them in a more graceful manner?”

“To meet the needs [of the spectrum of open-source software security projects], there are two things you need,” Behlendorf says. “You need better tooling and better automation to try not just to determine the security posture of a large number of projects en masse, but also to ask questions, to try to discover new facts about those projects.”

Secondly, “You can't just roll in with a 300-page ‘thou shalt’ kind of like white paper on how everyone needs to run their open-source projects because every open-source project is different.” Behlendorf says a more hands-on approach is required. “You need to walk in and say: Have you done threat modeling? And here's how you might think about it.”

Michael Scovetta, principal security project manager at Microsoft, highlights the importance of a human approach in the Alpha-Omega process. He tells CSO that having people engaged on a highly collaborative basis is an essential component of the Alpha projects, the most critical ones.

“What Omega definitely is not is a machine that runs tools and then throws findings back to the open-source developer,” he says. In a much lighter touch way, “what the open-source developer for an Omega project would receive from us is we would engage them only when we find a critical vulnerability that needs their attention, and we would be there to help them to some extent in remediating it.”

Michael Winser, group product manager at Google, says that an essential outcome of the initiative, aside from fixing open-source software flaws, is the element of education that comes along with those fixes. “One of those sorts of meta outcomes is we're learning how to do this,” he tells CSO. “The industry as a whole is still figuring out how to have a proper security stance. We're going to start scaling our approach and learning from that scaling and working with other parts of the OpenSSF, other groups and foundations, and open-source maintainers to understand how we can essentially lift everybody up a few inches at a time to make our security better industry-wide.”

Separate from the announcement of the Alpha-Omega initiative, the Linux Foundation has released a report entitled Software Bill of Materials (SBOM) and Cybersecurity Readiness, which addresses the relationship between open-source maturity and SBOM readiness. Based on a survey of 412 organizations worldwide, the report finds that 98% of the organizations surveyed say they use open-source software.

More importantly, the report finds that SBOM innovators are more likely to use open-source software without conditions, not because they are most risk-prone but because “they simply have a more comprehensive and sophisticated culture around the use of open-source software.”

Stephen Hendricks, vice president of research at the Linux Foundation, tells CSO that 66% of the organizations surveyed said that SBOMs are equally important to open-source software as closed-source software, while 20% said SBOMs are more important for open source.

“The reality here is that you’ve got two-thirds of the organizations saying SBOMs are important whether they are open source or not,” Hendricks says. “Everybody wants to know what the bill of materials is; everybody wants to know about vulnerabilities. There is a lot of open-source software that goes into closed-source software, and with pretty much every organization using open source, it’s important to get open source right, but it’s important to get all software right.”

Open-source security is critical to overall cybersecurity

The Alpha-Omega project and the Linux Foundation survey underscore the growing refrain among industry practitioners that getting open-source software security right is a critical driver of overall cybersecurity. Speaking at the inaugural Secure Software Summit held last week, Dan Lorenc, founder and CEO of Chainguard, said, “Open-source software is part of everyone's supply chain, whether they know it or not. So, understanding the security of open-source software is pretty critical to understanding the broader supply chain security problems that we're facing.”

Abhishek Arya, principal engineer and manager of Google’s Open Source Security Team, said, “As new vulnerabilities come in, we need to understand these security risks and be better prepared to handle them. We need to understand that open-source software is not free. It looks so, but it comes at a massive security cost. Much of open-source software is developed by volunteers in their free time where security often comes last in their priority list.”

Rob Tompkins of the Apache Software Foundation stressed the need to preempt future Log4j-type security issues with more secure production practices: “First things first, remediate your production environment. Fix your production software, please, please, please. I can't stress it enough.”

Alpha-Omega Project takes a human-centered approach to open-source software security

Celebrated cryptographer Moxie Marlinspike is stepping down as chief executive at Signal, the encrypted messaging app he created more than a decade ago.

The chief executive of a secure messaging app has announced he is stepping down.

De chief executive van een beveiligde messaging app heeft aangekondigd dat hij opstapt.

Celebrated cryptographer Moxie Marlinspike is stepping down as chief executive at Signal, temporarily turning the reins of the popular encrypted messaging platform to WhatsApp co-founder Brian Acton. Marlinspike, who created Signal and led its growth into becoming a must-use encrypted messaging app, said Signal would begin the search for a new chief executive immediately. He said Acton, the WhatsApp co-founder who helped to bankroll Marlinspike’s Signal Foundation and sits on the non-profit board, has volunteered to serve as interim CEO during the search period.

De gevierde cryptograaf Moxie Marlinspike stapt op als chief executive van Signal en geeft de teugels van het populaire versleutelde berichtenplatform tijdelijk in handen van WhatsApp-medeoprichter Brian Acton. Hij zei dat Acton, de medeoprichter van WhatsApp die Marlinspike's Signal Foundation hielp financieren en in het bestuur van de non-profit organisatie zit, zich heeft aangeboden om als interim CEO te fungeren tijdens de zoekperiode. In 2018 sloegen Marlinspike en Acton de handen ineen om de Signal Technology Foundation te lanceren, waarbij Acton 50 miljoen dollar investeerde in de non-profit.

Celebrated cryptographer Moxie Marlinspike is stepping down as chief executive at Signal, temporarily turning the reins of the popular encrypted messaging platform to WhatsApp co-founder Brian Acton.

Marlinspike, who created Signal and led its growth into becoming a must-use encrypted messaging app, said Signal would begin the search for a new chief executive immediately.

He said Acton, the WhatsApp co-founder who helped to bankroll Marlinspike’s Signal Foundation and sits on the non-profit board, has volunteered to serve as interim CEO during the search period.

Marlinspike, who spent a decade working on the secure app, said he is “very comfortable replacing myself as CEO” because of the management team in place and the opportunity to expand the company’s success.

“I’ve been talking with candidates over the last few months, but want to open up the search with this announcement in order to help find the best person for the next decade of Signal,” Marlinspike added.

Back in 2018, Marlinspike and Acton teamed up to launch the Signal Technology Foundation, with Acton investing $50 million in the non-profit.

Related: Signal Provides Only Two Timestamps as Response to Grand Jury Subpoena

Moxie Marlinspike Steps Down as Signal CEO | SecurityWeek.Com

The DecisiveArchitect activity cluster uses a custom-built implant to stage intrusions. This blog outlines how to hunt for this implant or others that are similar.

In our series of letters from African journalists, the BBC’s Chris Stokel-Walker looks at how a cyber-attack could be handled.

In onze reeks brieven van Afrikaanse journalisten bekijkt Chris Stokel-Walker van de BBC hoe een cyberaanval zou kunnen worden aangepakt.

If such systems are not adequately protected using other security controls or unless they can only be accessed by systems with appropriate endpoint-based detection/prevention capabilities, this can cause a gap in visibility for an organization that an adversary could abuse. Similar to the activity cluster reported as LightBasin, this adversary primarily focuses on Linux and Solaris systems using a custom-built implant tracked by CrowdStrike Intelligence as JustForFun (also publicly known as BPFDoor). While this adversary does interact with Windows systems, mostly during the early stages of an intrusion, CrowdStrike has not yet identified any custom implants geared toward Windows systems.

Indien dergelijke systemen niet adequaat worden beschermd met andere beveiligingsmaatregelen of tenzij zij alleen toegankelijk zijn voor systemen met de juiste endpoint-gebaseerde detectie- en preventiemogelijkheden, kan dit voor een organisatie een hiaat in de zichtbaarheid veroorzaken waarvan een tegenstander misbruik zou kunnen maken. Net als de activiteitencluster die LightBasin wordt genoemd, richt deze tegenstander zich voornamelijk op Linux- en Solaris-systemen met behulp van een op maat gemaakt implantaat dat door CrowdStrike Intelligence wordt getraceerd als JustForFun (ook publiekelijk bekend als BPFDoor). Hoewel deze tegenstander wel inwerkt op Windows-systemen, meestal tijdens de eerste fasen van een inbraak, heeft CrowdStrike nog geen aangepaste implantaten geïdentificeerd die gericht zijn op Windows-systemen.

This blog was originally published by CrowdStrike on May 25, 2022.

The security landscape is constantly developing to provide easier ways to establish endpoint visibility across networks through the use of endpoint detection and response (EDR) utilities. However, certain challenges still remain, particularly as a result of many organizations’ need for systems running legacy or proprietary operating systems, such as Solaris. If such systems are not adequately protected using other security controls or unless they can only be accessed by systems with appropriate endpoint-based detection/prevention capabilities, this can cause a gap in visibility for an organization that an adversary could abuse.

On multiple occasions dating back to 2019, the CrowdStrike Services Incident Response team, CrowdStrike Intelligence team and Falcon OverWatch™ team have encountered an adversary targeting global entities, in particular telecommunications companies, to obtain targeted personal user information — for example, call detail records (CDRs) or information relating to specific phone numbers.

Similar to the activity cluster reported as LightBasin, this adversary primarily focuses on Linux and Solaris systems using a custom-built implant tracked by CrowdStrike Intelligence as JustForFun (also publicly known as BPFDoor). While this adversary does interact with Windows systems, mostly during the early stages of an intrusion, CrowdStrike has not yet identified any custom implants geared toward Windows systems. Instead, the adversary relies on publicly available tools, such as ldapdomaindump, or the post-exploitation framework Impacket, to target Windows systems from previously compromised Linux systems.

CrowdStrike Intelligence is currently tracking these intrusions under the DecisiveArchitect activity cluster (also publicly known as Red Menshen); however, this activity is not currently attributed by CrowdStrike to a specific country-nexus. While CrowdStrike has primarily observed the adversary targeting telecommunications companies, other isolated incidents targeting organizations such as logistics entities have also been observed.

DecisiveArchitect exhibits a high degree of operational security as part of their tactics to make it more difficult for defenders to identify and investigate their activity through the use of various defense evasion techniques. While other publicly available research highlights how the implant operates, this blog focuses on methods to hunt for this implant, or implants that may operate in a similar manner, while also highlighting techniques of interest across Solaris systems.

DecisiveArchitect utilizes a custom implant tracked by CrowdStrike as JustForFun, which is typically persisted using SysVinit scripts. When executed, the implant overwrites the process command line within the process environment by randomly selecting a new command line from one of ten hard-coded options, listed in Figure 1.

When DecisiveArchitect interacts with the implants to establish an interactive shell on a system, the bash process spawned by the implant process displays the following command line instead. This makes it appear as if the Postfix queue manager is executing as a way to hide itself from analysts and system administrators:

On Solaris systems, though the executable itself exhibits no mechanism for similar command-line spoofing, DecisiveArchitect achieves similar functionality through the use of LD_PRELOAD, such as the following example identified within a SysVinit script:

When executed, the process only shows the command line /usr/lib/vtdaemon -c 16, where the actual JustForFun implant is the file /lib/librbtinfo.so.1.

As recently as April 2022, CrowdStrike observed further variations with regard to DecisiveArchitect’s tactics, techniques and procedures (TTPs), with the actor using the LD_PRELOAD environment variable across Linux systems as well, loading the JustForFun implant, /lib64/libcaac.so.1, within the legitimate process /sbin/agetty. This highlights a deviation from the standard list of spoofed command lines in Figure 1, likely as part of a further effort to remain undetected and emphasizing the importance of behavioral-based hunting and detection methods.

The spoofed command line appears in commands such as ps that may be used to investigate suspicious activity on the host. The spoofed command line makes it less likely that the process will be treated as suspicious.

DecisiveArchitect targets Solaris systems via publicly available exploit code for CVE-2019-3010, a vulnerability in xscreensaver. Binaries used to exploit this vulnerability have usually been observed within a few minutes of the JustForFun implant deployment. CVE-2019-3010 is a logic bug that utilizes the LD_PRELOAD technique to facilitate local privilege escalation to the root user on Solaris 11 systems. Proof-of-concept (POC) code is publicly available and was not modified by DecisiveArchitect.1 Table 1 lists two files observed across Solaris systems related to this privilege escalation activity.

The way in which DecisiveArchitect achieves persistence across Linux systems involves the usage of SysVinit scripts (i.e., rc.d/init.d scripts). Instead of simply creating a new script that references the JustForFun implants, DecisiveArchitect uses a more operational security-conscious approach by modifying existing SysVinit scripts to reference a small script file, which then finally references the JustForFun implant. The following highlights an example, including the lines added to the legitimate SysVinit script /etc/rc.d/init.d/pcscd and the script /etc/sysconfig/pcscd referencing the JustForFun implant, /etc/sysconfig/pcscd.conf:

With this method of nested persistence, if an analyst simply reviews a set of SysVinit scripts by themselves, identifying the malicious line associated with the JustForFun implant would likely prove difficult without subsequently reviewing all of the files referenced within the scripts. Additionally, as part of DecisiveArchitect’s continued commitment to operational security, the adversary modifies different legitimate SysVinit scripts across systems, and uses different file names/paths for the implant and associated persistence-related scripts, making it difficult to search across other systems for indicators identified through analysis of a single system.

One of the best ways to detect or hunt for this activity is to utilize EDR technology across supported Linux systems, with machine learning capabilities to detect and prevent the malicious implants, and with hunting capabilities to identify anomalous usage of common Linux system administration utilities or processes running with spoofed command lines (such as the bash process running with the command line showing the Postfix queue manager command line instead).

But, even if an organization has a significant number of legacy or proprietary systems, already has the adversary burrowed into their network, or simply does not have EDR software deployed across Linux systems, all is not lost.

Given the fact the JustForFun implant opens a raw socket in order to wait for the magic packet, the built-in Linux utility lsof can be used to identify running processes with a raw socket open:

Even though this command alone cannot solely determine whether the implant is present — as there are legitimate reasons for processes to have raw sockets open — analysts can highlight processes of interest for further investigation. Of particular importance is that DecisiveArchitect’s use of spoofed command lines means that the lsof command will report the spoofed command line, as opposed to the actual malicious file, which may make it difficult to determine whether the process is malicious or not through this alone. However, by running the lsof command against the process ID without any of the grep filtering, an analyst can list any open files associated with that process, which should reveal the binary. An example of a true positive can be seen below, with the start of the line (i.e., the command line) displaying the start of one of the spoofed command lines listed in Figure 1. It should be noted that DecisiveArchitect can quite easily change these spoofed command lines, so analysts should be conscious of other processes beyond those listed:

While the lsof command is not part of a default Solaris installation, similar commands exist for obtaining additional details from processes:

The three commands above loop through every process, with the first command looking for a string indicative of a process running with a packet filter, and the other two searching for processes with the libpcap library loaded. As with the lsof command, this alone cannot solely determine whether the implant is present, so an analyst would need to further investigate the specific process to confirm the presence of the implant. DecisiveArchitect’s capability to spoof command lines across Solaris systems also needs to be taken into account when investigating these processes.

When investigating any of these entries, one of the key questions to ask is whether the process in question has any reason to have a raw socket open, to be using a packet filter or to be utilizing the libpcap library. One of the most common false positives relates to systems running processes such as tcpdump or other packet capture utilities.

While these hunting techniques provide a relatively simple method for identifying DecisiveArchitect activity based on activity observed across multiple intrusions, CrowdStrike expects that DecisiveArchitect will continue development of their implant across both Linux and Solaris platforms, while also improving their techniques regarding operational security of their intrusions to further hinder the ability of a defender to identify or investigate their activity, which might include identifying ways to combat these hunting techniques.

DecisiveArchitect’s operations present a clear and present threat to telecommunications companies, as well as other organizations such as logistics entities. This blog highlights important details about DecisiveArchitect’s implant, their abilities to operate on Solaris systems, and ways to hunt down the adversary’s implants to help organizations identify whether they have fallen victim to this campaign.

DecisiveArchitect and Its Custom Implant JustForFun | CSA

The FBI is becoming more adept at recovering bitcoin ransoms. Some criminals are responding by

A growing number of ransomware payments have been recovered by the FBI, according to the BBC’s weekly The Boss.

Een groeiend aantal betalingen van ransomware is teruggevorderd door de FBI, aldus het weekblad The Boss van de BBC.

The U.S. Department of Justice (DoJ) has recovered roughly a half million dollars in ransomware payments made to North Korean cyber criminals targeting healthcare organizations. The cybercriminals have been targeting healthcare organizations with a Maui strain of malware since at least May 2022. Maui first encrypts target files with AES 128-bit encryption, assigning each file a unique AES key.

De cybercriminelen hebben ten minste sinds mei 2022 gezondheidszorgorganisaties het doelwit gemaakt van een Maui-stam van malware. Maui versleutelt doelbestanden eerst met AES 128-bit encryptie, waarbij aan elk bestand een unieke AES-sleutel wordt toegekend. Met een aangepaste header in elk bestand, die het oorspronkelijke pad van het bestand bevat, kan Maui eerder versleutelde bestanden identificeren.

The U.S. Department of Justice (DoJ) has recovered roughly a half million dollars in ransomware payments made to North Korean cyber criminals targeting healthcare organizations. This is yet another sign law enforcement agencies are at least becoming more effective at preventing cyber attackers from enjoying their ill-gotten gains.

The cybercriminals have been targeting healthcare organizations with a Maui strain of malware since at least May 2022. Maui malware installs an encryption binary called “maui.exe” that employs a combination of Advanced Encryption Standard (AES), RSA, and XOR algorithms to prevent access to specific files.

Maui first encrypts target files with AES 128-bit encryption, assigning each file a unique AES key. A custom header contained in each file that includes the file’s original path allows Maui to identify previously encrypted files. The header also contains encrypted copies of the AES key. It then encrypts each AES key with RSA encryption and loads the RSA public (maui.key) and private (maui.evd) keys in the same directory as itself. It then encodes the RSA public key (maui.key) using XOR encryption with an XOR key that’s generated from hard drive information.

Finally, Maui then creates a temporary file for each file it encrypts using GetTempFileNameW() and then uses this file as the encrypted output. Maui then creates maui.log, which contains output from Maui execution that can be exfiltrated.

There’s not much to be done once Maui malware starts encrypting files, but the Federal Bureau of Investigations (FBI) in the U.S. did work closely with one of the victims of a Maui infestation to recover payments. After notifying the FBI, a hospital in Kansas paid approximately $100,000 in Bitcoin to regain access to its files. The FBI then traced those payments to a money laundering operation in China where it found an approximately $120,000 Bitcoin payment made by the Kansas hospital in a cryptocurrency account. The FBI also discovered that a medical provider in Colorado had just paid a ransom after being hacked by actors using the same Maui ransomware strain. The FBI seized the contents of two cryptocurrency accounts with the aim of eventually returning those funds to the ransomware victims.

While the FBI is generally being applauded for its efforts, there are concerns about what might come next. It’s clear that law enforcement agencies are getting more adept at tracking illicit cryptocurrency transactions and recovering those funds even in countries where they have no official jurisdiction. Cybercriminals are inevitably going to look for other methods of payment collection that are not quite as easy to track or recover. Some cybercriminals are, for example, looking to shift from Bitcoin to alternative, privacy-based digital currencies such as Monero.

Regardless of the payment method, ransomware transactions will likely be pushed further underground to avoid detection. In effect, the whole payment process for better or worse is likely to become that much more complex. As a result, the amount of time required to acquire the keys to decrypt files is likely to be just that much longer, which will only increase the level of stress for all involved.

The best way to eliminate that stress is to always have a pristine copy of data available. In the absence of that critical capability, it will be up to each organization to determine ahead of time how best to go about mastering the nuances of all the various types of cryptocurrency that might soon be more widely employed.

FBI recovers half million in ransomware payments

By Christopher Reynolds From verbal abuse to physical threats and police calls, front-line workers in the airline industry are finding themselves on the

Canadian airlines are struggling to cope with the coronavirus pandemic, according to a new report.

Volgens een nieuw rapport hebben Canadese luchtvaartmaatschappijen het moeilijk om het hoofd te bieden aan de pandemie van het coronavirus.

From verbal abuse to physical threats and police calls, front-line workers in the airline industry are finding themselves on the receiving end of passenger frustrations over flight delays and lost baggage. It also comes as the union representing more than 700 WestJet employees at airports in Calgary and Vancouver says they have voted to support a strike if they cannot reach a new contract with the airline. Toronto Pearson International Airport and Air Canada have topped global lists for share of flights delayed over the past month, frequently surpassing 50 per cent and fanning travellers’ ire.

Van verbaal geweld tot fysieke bedreigingen en politieoproepen: eerstelijnsmedewerkers in de luchtvaartindustrie worden het slachtoffer van de frustraties van passagiers over vertraagde vluchten en zoekgeraakte bagage. De gerafelde zenuwen en ontploffende buien zijn het resultaat van een voortdurende strijd door luchthavens en vervoerders om te gaan met de enorme reizen rebound deze zomer. Dit komt ook omdat de vakbond die meer dan 700 WestJet-werknemers op luchthavens in Calgary en Vancouver vertegenwoordigt, zegt dat zij voor een staking hebben gestemd als zij niet tot een nieuw contract met de luchtvaartmaatschappij kunnen komen.

From verbal abuse to physical threats and police calls, front-line workers in the airline industry are finding themselves on the receiving end of passenger frustrations over flight delays and lost baggage.

“I’ve had customers poke me in the chest and say, ‘You’re not going to get me off of this flight,'” said Cheryl Robinson, an Air Canada customer service agent at the Halifax airport.

“I’ve seen my colleagues in tears, walking away because they just can’t deal with another person yelling at them today.”

“It shakes you,” said Robinson, who’s worked at the airport for more than 24 years. “This is probably the worst I’ve ever seen.”

The frayed nerves and exploding tempers are the outcome of an ongoing struggle by airports and carriers to cope with the massive travel rebound this summer.

It also comes as the union representing more than 700 WestJet employees at airports in Calgary and Vancouver says they have voted to support a strike if they cannot reach a new contract with the airline.

Toronto Pearson International Airport and Air Canada have topped global lists for share of flights delayed over the past month, frequently surpassing 50 per cent and fanning travellers’ ire.

“We can all understand why they’re angry and frustrated. Your flight gets cancelled and they tell you to call and you wait on hold for six hours — and I’m not exaggerating,” said Leslie Dias, director of airlines at Unifor, which represents 16,000 air transport workers, including 5,600 customer service and sales agents at Air Canada.

“To some extent, our people are broken,” she said from Calgary, where she is part of the negotiations with WestJet over a deal for the hundreds of baggage and customer service agents.

“They’re upset, they’re often close to tears, they’re exhausted. At all airlines they’re being asked to work as many hours as they can possibly manage to work. And they feel helpless.”

Dias added that police officers are being called to airport gates daily because of verbal harassment from travellers.

The fallout from the “sinkhole of a mess” deters new recruits and drags down retention rates, she said.

Dias is calling on management for a stronger security presence as well as higher wages to attract more workers, which would speed up passenger processing and make employees feel safer, she said.

The workers in Calgary and Vancouver bargaining for their first collective agreement with WestJet start at $15.55 an hour, topping out at $23.87 an hour after seven years, she said.

On Wednesday, those employees voted 98 per cent in support of a strike if they cannot reach an agreement with the airline, and could walk off the job as early as July 27, Unifor said.

“The pay scale has not been increased for more than five years, making WestJet’s wages among the lowest in the Canadian aviation industry and no match for soaring inflation,” Unifor spokesman Scott Doherty said in a statement.

The union also highlighted a “pressure-cooker atmosphere,” stating that workers have endured verbal abuse and physical threats from travellers whose flights were delayed or cancelled by the carrier.

WestJet executive vice-president Angela Avery said the strike vote is a “common step” in the negotiation process and was “not unexpected.”

“We remain focused on successfully negotiating an agreement that provides value to our airport employees,” she said in a statement.

“As the airline rebuilds, the majority of its airports employees have been with the company for less than one year, and the vast majority of more tenured airport employees have received increases through the existing pay step structure, in addition to a Canadian industry leading variable compensation.”

Before taking any strike action, Unifor must serve WestJet with 72 hours’ notice.

At Air Canada, the payroll is at 93 per cent of 2019 levels, while its summer flight schedule is below 80 per cent of pre-pandemic volumes.

“We continue to recruit for certain jobs and have and continue to refine elements of our compensation packages to remain competitive in the current environment,” the company said in an email.

“Employees are professionals and they make every effort to manage challenging situations effectively in their respective environments. The overwhelming majority of passengers are respectful. That said, Air Canada has a zero-tolerance approach toward any kind of aggression in our business, especially towards our employees.”

Flight attendants and customs officers face their own passenger challenges as well.

“It’s like a nine-to-five job that’s now turned into a seven-day-a-week job with no fixed hours,” said Wesley Lesosky, who heads the Canadian Union for Public Employees’ airline division, which represents about 15,500 workers.

“If you have kids, if you have a family, a partner, a dog, cats … everything’s kind of up in the air.”

Frustration from long security queues, missed connecting flights, misplaced luggage and hours on tarmacs has pushed emotions to a “boiling point … resulting in increased reports of harassment and abuse — physical and verbal,” said Crystal Hill, president of CUPE 4070, which represents some 4,000 WestJet flight attendants.

“This is very scary when you’re 40,000 feet above ground.”

Border security agents also face exasperation from passengers, at least 30 per cent of whom show up at land and air checkpoints without having completed their ArriveCan app, said Mark Weber, president of the Customs and Immigration Union.

“We’re seeing an uptick in verbal abuse. In many cases they’re waiting in line two, three hours to get to us. We completely get why they’re frustrated,” he said.

The increase in automated kiosks to process international arrivals at some airports has not made up for staff cuts that helped reduce customs agents at Pearson airport to the current 300 from 600 in 2017, he added.

This report by The Canadian Press was first published July 20, 2022.

Airline workers face insults, physical threats as passenger frustration boils over

At Amazon Web Services (AWS) we prioritize security, performance, and strong encryption in our cloud services. In order to be prepared for quantum computer advancements, we’ve been investigating the use of quantum-safe algorithms for key exchange in the TLS protocol. In this blog post, we’ll first bring you up to speed on what we’ve been […]

The challenges of quantum-resistant encryption have been revealed in the latest phase of the project.

De uitdagingen van kwantumbestendige encryptie zijn in de laatste fase van het project aan het licht gekomen.

In order to be prepared for quantum computer advancements, we’ve been investigating the use of quantum-safe algorithms for key exchange in the TLS protocol. Then, we’ll focus on the QUIC transport protocol and show how you can enable and experiment with the newly released post-quantum (PQ) key exchange by using our s2n-quic library. The s2n-quic library is an open-source implementation of the QUIC protocol.

Om voorbereid te zijn op de vooruitgang van kwantumcomputers hebben wij onderzoek gedaan naar het gebruik van kwantumveilige algoritmen voor sleuteluitwisseling in het TLS-protocol. Daarna richten we ons op het QUIC transport protocol en laten we zien hoe je kunt experimenteren met de onlangs uitgebrachte post-quantum (PQ) sleuteluitwisseling door gebruik te maken van onze s2n-quic library. Waarom PQ-hybride sleutelopstelling gebruiken in s2n-quic?

At Amazon Web Services (AWS) we prioritize security, performance, and strong encryption in our cloud services. In order to be prepared for quantum computer advancements, we’ve been investigating the use of quantum-safe algorithms for key exchange in the TLS protocol. In this blog post, we’ll first bring you up to speed on what we’ve been doing on the TLS front. Then, we’ll focus on the QUIC transport protocol and show how you can enable and experiment with the newly released post-quantum (PQ) key exchange by using our s2n-quic library. The s2n-quic library is an open-source implementation of the QUIC protocol.

Why use PQ-hybrid key establishment in s2n-quic?

A large-scale quantum computer could break the current public key cryptography that is used to establish keys for secure communication connections. Although a large-scale quantum computer isn’t available today, traffic that is recorded now could be decrypted by one in the future. With such concerns in mind, the recent US Congress Quantum Computing Cybersecurity Preparedness Act and the White House National Security Memorandum set a goal of a timely and equitable transition of cryptographic systems to quantum-resistant cryptography.

At AWS, we are working to prepare for this future. Recently, AWS Key Management Service (AWS KMS), AWS Certificate Manager (ACM) and AWS Secrets Manager TLS endpoints started supporting post-quantum hybrid (PQ-hybrid) key establishment in TLS connections with three of the post-quantum key encapsulation mechanisms (KEMs) in the NIST Post-Quantum Cryptography (PQC) Project. The three post-quantum KEMs are Kyber (NIST’s Round 3 KEM selection), BIKE and SIKE (NIST’s Round 4 KEM candidates). All three of these AWS services’ support of post-quantum KEMs raises the security bar when making API requests to their endpoints over TLS.

PQ-hybrid key establishment in TLS is a feature that introduces post-quantum KEMs used in conjunction with classical Elliptic Curve Diffie-Hellman (ECDH) key exchange. The client and server still do an ECDH key exchange. Additionally, the server encapsulates a post-quantum shared secret to the client’s post-quantum KEM public key, which is advertised in the ClientHello message. This strategy combines the high assurance of a classical key exchange with the security of the proposed post-quantum key exchanges, to ensure that the handshakes are protected as long as the ECDH or the post-quantum shared secret cannot be broken.

After decapsulating the secret, the client and server have an ECDH and a post-quantum shared secret, which they concatenate and use to derive the symmetric keys that are used in the Authenticated Encryption with Additional Data (AEAD) cipher in TLS. These symmetric keys used by the AEAD cipher for data encryption will be secure against a quantum computer, which means that the TLS communication is secure against a quantum computer. The AWS implementation of TLS is s2n-tls, a streamlined open source implementation of TLS. The s2n-tls implementation already supports PQ-hybrid key exchange with ECDH and three NIST PQC Project KEMs (Kyber, BIKE, and SIKE) for TLS 1.2 and 1.3. The use of KEMs for TLS 1.2 is described in the draft-campagna-tls-bike-sike-hybrid IETF draft, and the use of KEMs for TLS 1.3 is described in the draft-ietf-tls-hybrid-design IETF draft.

AWS recently announced s2n-quic, an open-source Rust implementation of the QUIC protocol. QUIC is an encrypted transport protocol that is designed for performance and is the foundation of HTTP/3. For tunnel establishment, QUIC uses TLS 1.3 carried over QUIC transport. To alleviate the harvest-now-decrypt-later concerns for customers that use s2n-quic, in the next section we show you how to enable PQ-hybrid key establishment in s2n-quic. AWS services and software that use s2n-quic will automatically inherit the ability to support quantum-safe key exchanges in the future when post-quantum algorithms are standardized and are officially supported in s2n-quic.

The s2n-quic implementation is written in the Rust programming language. It can use either s2n-tls (the TLS library for AWS) or rustls (the TLS library in Rust) to perform the TLS handshake. If you build s2n-quic with s2n-tls, then s2n-quic inherits the post-quantum support that is offered in s2n-tls. In turn, s2n-tls is built over other crypto libraries such as the AWS libcrypto (AWS-LC) or alternatively OpenSSL crypto library (libcrypto). AWS-LC is a general-purpose cryptographic library that is maintained by AWS, which will incorporate standardized post-quantum algorithms. Therefore, building s2n-tls with AWS-LC will provide s2n-tls with the post-quantum cryptographic algorithms for use in s2n-quic.

Such a model allows for AWS services and software that use s2n-quic to automatically inherit the standardized post-quantum options as they are implemented in s2n-tls and its underlying crypto libraries. There will be no need to tweak s2n-quic to support post-quantum TLS 1.3 handshakes. The whole stack of protocol implementations is architected in an agile manner without duplication of work.

In the following section, we show you how to run an experimental PQ build of s2n-quic that supports PQ-hybrid key exchange.

The public s2n-quic GitHub repository includes an example that demonstrates how to build the library with PQ-hybrid key exchange support, along with a server and client to test. The PQ-hybrid key exchange feature test requires CMake in Linux or macOS. The experiments below were run in an Amazon Linux 2 instance with rustc, Cargo, Clang, and CMake installed. Connections that you establish with this experimental build of s2n-quic will support PQ-hybrid key exchange.
• Clone s2n-quic by using the following commands:
• Run the example post-quantum s2n-quic client and server in the post-quantum directory to confirm that they negotiate a PQ-hybrid key by using the following commands: Note: Although these examples with the PQ-hybrid feature experimental build of s2n-quic are self-contained, if you want to manually change and build s2n-quic and s2n-tls to enable PQ-hybrid key exchange, you have to update the default_tls13 policy in s2n-tls to point to security_policy_pq_tls_1_0_2021_05_26 in tls/s2n_security_policies.c. Then you rebuild s2n-tls and override the location that s2n-quic links to by setting the S2N_TLS_DIR, S2N_TLS_LIB_DIR, and S2N_TLS_INCLUDE_DIR environment variables at build time.
• To confirm the PQ-hybrid key establishment, you capture the QUIC negotiation by using the following command:
• Open the capture by using a packet capture visualization application. First you look at the ClientHello message, as shown in the capture in Figure 1 taken from Wireshark. In the QUIC CRYPTO frame, you can see the TLS 1.3 cipher suites, and that the TLS version is 1.3 while the supported key exchange groups are classical ECDH (with identifiers 0x0017, 0x0018, 0x001d) and 0x2f39, 0x2f3a, 0x2f37…. 0x2f1f. The 0x2f… groups are the agreed upon identifiers (not standardized yet) for PQ-hybrid key exchange. You also see the PQ-hybrid X25519+Kyber512 (with identifier 12089 or 0x2f39) key share that is offered by the client. That key share includes 32 bytes for the Curve25519 ephemeral ECDH client public key, 800 bytes for the ephemeral Kyber512 public key, and 4 bytes for the identifier and the key share length. Note: The post-quantum KEMs implementations at the time of this writing follow the NIST Round 3 Kyber, BIKE, and SIKE specifications. We expect these specifications to change as the NIST PQC Project proceeds with standardization. Post-quantum support in s2n-tls and s2n-quic will be experimental until NIST has selected and published standardized algorithms and identifiers. Pushing the change to the main branch now would mean that s2n-quic clients would be sending a PQ-hybrid key share that won’t be used until the servers on the internet start supporting it. The actual algorithms and their identifiers will still be integrated in future releases of s2n-tls and AWS-LC. Therefore, s2n-quic will still be able to negotiate the NIST and IETF standardized options. Meanwhile, we will continue to experiment with post-quantum QUIC and its potential challenges.
• Next, take a look at the server-negotiated keys in the ServerHello message, as shown in Figure 2.

You can again see the TLS 1.3 cipher suite, the TLS version being 1.3, and the picked PQ-hybrid X25519+Kyber512 key share. The key share includes 4 bytes for the identifier and the key share length, 32 bytes for the Curve25519 ephemeral ECDH server public key, and 768 bytes for the Kyber512 ciphertext that encapsulates a post-quantum shared secret to the client’s ephemeral Kyber512 public key (included in its ClientHello message).

The rest of the handshake completes successfully by deriving symmetric keys from the X25519 and Kyber512 post-quantum shared secrets (as defined in the draft-ietf-tls-hybrid-design IETF draft) and encrypting the rest of the messages with Advanced Encryption Standard with Galois/Counter Mode (AES-GCM) by using these symmetric keys over QUIC.

Now you can benchmark the post-quantum QUIC client and server by using netbench, a transport protocol benchmarking tool that is available in the s2n-quic repository.

To benchmark the post-quantum QUIC client and server
• Go in the netbench directory and build it with the correct flags for the experimental post-quantum QUIC examples, by using the following commands:
• Generate the scenario by using the following commands: In this example, you’re trying to create 10,000 sequential QUIC connections. The scenario opens a connection, sends a single byte, receives a single byte, closes it, and repeats 10,000 times.
• Run the server by using the following command:
• Run the client by using the following command: The drivers read the request_response.json to run the scenario. Then the driver is wrapped in a collector that outputs statistics to another JSON file. At the end of all of the 10,000 runs, the cli feature is used to generate the report.

Figure 3 shows the performance results for X25519, X25519+Kyber512, X25519+BIKE-1, and X25519+SIKEp434 key exchange. All connections used an ECDSA P256 server certificate for authentication.

The x-axis is time in seconds. The y-axis is the number of times send is called—which, for 1 byte per connection, practically means that the diagram shows the connection establishment rate (per second). The absolute performance numbers in these benchmarks are not important, because the results could change based on the netbench scenario parameters. The performance difference between PQ-hybrid key exchange algorithms is what this graph is highlighting.

You can see that the classical X25519 achieves higher connection rates, because it is the most efficient option (that offers no post-quantum protection). The performance of Kyber is competitive and achieves 8% fewer connections per second when used with X25519 in a PQ-hybrid key exchange. BIKE-1 is relatively efficient, but adds some extra latency and introduces two frames for the ClientHello, which leads to 37% fewer connections per second. SIKEp434, although it offers much smaller public keys and ciphertexts, is orders of magnitude slower, which means it offers 95% fewer connections per second. These results match previous results we have shared before and other research works, where the most efficient signature algorithms ended up with higher connection rates and lower connection failure probabilities due to overload.

In this post, we showed how you can use s2n-quic in conjunction with s2n-tls to enable QUIC connections to negotiate encryption keys in a quantum-resistant manner. If you’re interested in learning more about s2n-quic, join us at AWS re:Inforce in July for the breakout session entitled NIS304: Using s2n-quic: Bringing QUIC, the secure transport protocol, to AWS.

As always, if you’re interested in using or contributing to s2n-quic, the source code and documentation are publicly available under the terms of the Apache Software License 2.0 from our s2n-quic GitHub repository. If you package or distribute s2n-quic or s2n-tls, or use it as part of a large multi-user service, you might be eligible for pre-notification of security issues. Contact s2n-pre-notification@amazon.com for more information. If you discover a potential security issue in s2n-quic or s2n-tls, we ask that you notify AWS Security by using our vulnerability reporting page.

If you have feedback about this post, submit comments in the Comments section below. If you have questions about this post, contact AWS Support.

Want more AWS Security news? Follow us on Twitter.

Enable post-quantum key exchange in QUIC with the s2n-quic library

A dispute over legal protections for American customs officers has kept Nexus enrolment centres closed in Canada more than three months after they

The Canadian government says it is trying to resolve a long-running border dispute with the United States.

De Canadese regering zegt te proberen een langlopend grensgeschil met de Verenigde Staten op te lossen.

A dispute over legal protections for American customs officers has kept Nexus enrolment centres closed in Canada more than three months after they reopened south of the border — due in part to a clash over U.S. agents’ right to carry guns on Canadian soil. The Canada Border Services Agency says the number of Nexus applications has ballooned to 341,688 from about 270,000 in April at a time when delays are wreaking havoc on travellers’ summer plans. Two senior Canadian government sources told The Canadian Press the U.S. wants its customs officers who work in Nexus centres to have the same protections guaranteed to its preclearance officers in Canada under a bi-national agreement, with sidearms as a major sticking point in the talks.

Een geschil over de wettelijke bescherming van Amerikaanse douanebeambten heeft ertoe geleid dat de Nexus-inschrijvingscentra in Canada gesloten zijn gebleven, meer dan drie maanden nadat zij ten zuiden van de grens weer open waren gegaan - ten dele als gevolg van een conflict over het recht van Amerikaanse beambten om op Canadees grondgebied wapens te dragen. Volgens het Canada Border Services Agency is het aantal Nexus-aanvragen gestegen van ongeveer 270.000 in april tot 341.688, terwijl de vertragingen de zomerplannen van reizigers in de war schoppen. Twee hooggeplaatste Canadese regeringsbronnen vertelden The Canadian Press dat de VS willen dat hun douanebeambten die in de Nexus-centra werken dezelfde bescherming krijgen als hun preclearance-ambtenaren in Canada in het kader van een bi-nationale overeenkomst, waarbij zijwapens een belangrijk knelpunt in de besprekingen vormen.

A dispute over legal protections for American customs officers has kept Nexus enrolment centres closed in Canada more than three months after they reopened south of the border — due in part to a clash over U.S. agents’ right to carry guns on Canadian soil.

The standoff has led to a massive backlog in applications for the program, which allows pre-approved travellers to cross the border more quickly.

The Canada Border Services Agency says the number of Nexus applications has ballooned to 341,688 from about 270,000 in April at a time when delays are wreaking havoc on travellers’ summer plans.

Canada and the U.S. remain in discussions about when the 13 enrolment centres will reopen for applicant interviews as the two sides try to clarify “legal protections” for American customs officers while they are working at the jointly staffed centres, agency spokeswoman Rebecca Purdy said in an email.

U.S. Customs and Border Protection confirmed the holdup revolves around legal “authorities” for its Nexus office staff.

“One example could include the authority to carry or have access to a firearm while on duty,” spokeswoman Rhonda Lawson said in an email.

Two senior Canadian government sources told The Canadian Press the U.S. wants its customs officers who work in Nexus centres to have the same protections guaranteed to its preclearance officers in Canada under a bi-national agreement, with sidearms as a major sticking point in the talks.

The sources spoke on the condition of anonymity because they were not authorized to discuss the matter publicly.

All first-time Nexus applicants whose initial submissions are approved must come in for an enrolment centre interview before they get the green light. Some existing cardholders must also book a sit-down to renew their membership, which expires after five years.

About 75 per cent of current Nexus members are Canadian citizens, and another three per cent are permanent residents, according to the border agency.

While Canadians are allowed to head to one of a dozen Nexus centres in the U.S. located near the border, the wait is a long one. Five locations have no appointments available and four have none until next year, according to the U.S. Department of Homeland Security website. The only three spots with openings in 2022 are in Minnesota and Michigan’s Upper Peninsula.

The delay is affecting tourism and causing inconvenience for frequent border crossers.

“If you had more people with Nexus, they get through faster and they don’t clog up the other line,” said Jill Wykes, editor of Snowbird Advisor, an online resource for snowbirds.

“Many other government offices are open,” she said. “I think it’s inexcusable.”

The enrolment centres shut down in March 2020 due to the COVID-19 pandemic. Those in the U.S. reopened on April 19.

Since then, airports around the world have grappled with long security and customs queues amid staffing shortages and a massive travel rebound.

“It for sure has exacerbated the delay,” Duncan Dee, Air Canada’s former chief operating officer, said of the thinning number of Nexus travellers.

Added Teamsters Canada spokeswoman Catherine Cosgrove: “I haven’t even applied for Nexus, because there’s no point.”

Prime Minister Justin Trudeau declined to say whether firearms were at the heart of the impasse.

“I think it’s really important that we are able to stay true to our values as Canadians but respect the way we need to work together,” he told reporters Friday on a visit to Stratford, P.E.I.

“There are ongoing conversations right now and we’re going to try and make sure they get resolved in a way that is acceptable to both sides.”

The dispute has come up in recent discussions between Public Safety Minister Marco Mendicino and U.S. Homeland Security Secretary Alejandro Mayorkas, according to a Canadian government source.

Like the Fast program for long-haul trucker drivers, Nexus is a “trusted traveller” program that expedites entry for pre-cleared border crossers, typically through separate lines and automated kiosks at land crossings and airports as well as marine ports.

On top of a question portion, first-time interviews at enrolment centres include a high-resolution iris photo and fingerprinting, to be used for scanning at border kiosks.

Most Nexus processing centres are located at airports, though they are separate from customs halls.

“Why does an American officer need a gun during the Nexus interview? It’s not necessary,” said Len Saunders, an immigration lawyer based in Blaine, Wash., just south of Vancouver. He echoed one of the Canadian government sources, who noted any interviewees would already be provisionally approved following their background checks.

A Canada-U.S. agreement that took effect in 2019 laid out certain protections for U.S. border officers working in preclearance areas on Canadian soil and vice versa.

Preclearance is when customs and immigration officials from the destination country admit travellers in the country of origin — for example, clearing U.S. customs at the Toronto airport before boarding a flight to Los Angeles. The U.S. operates preclearance sites at eight Canadian airports and one ferry crossing.

Protections under the 2019 agreement include, for example, U.S. border officers being tried in American court for most offences if they’re charged with an on-duty crime in Canada. The deal also specifies that U.S. customs officers can carry firearms wherever Canada Border Services Agency officers can.

Neither CBSA nor U.S. officers are permitted to carry guns in Nexus centres. In the case of Nexus centres inside airports, the locations are distinct from preclearance areas.

The U.S. is seeking to apply the terms of the preclearance agreement to agents working in Nexus offices, which are not explicitly covered by the binational scheme, according to Saunders and the two government sources.

Not all stakeholders see Nexus as key to reducing overall wait times.

“It would be good to have them open again,” said Mark Weber, president of Canada’s Customs and Immigration Union, which represents some 10,000 border guards.

“But opening the Nexus offices will certainly not get people on to the front line, where we really need them.”

This report by The Canadian Press was first published July 22, 2022.

Clash over whether U.S. officers can be armed in Canada keeps Nexus centres closed

By Brett Bundale Rogers Communications Inc. was unable to switch customers to competing carriers during the unprecedented service outage earlier this

A Canadian telecom company has revealed how it was unable to restore its network during the blanket outage.

Een Canadees telecombedrijf heeft onthuld hoe het zijn netwerk niet heeft kunnen herstellen tijdens de algemene uitval.

Rogers Communications Inc. was unable to switch customers to competing carriers during the unprecedented service outage earlier this month despite offers of assistance from Bell and Telus, the company said in a document released late Friday. The fresh details offer a glimpse into the multiple options considered by Rogers during the blanket outage that knocked out mobile, landline and internet service to millions of customers across Canada on July 8. Despite competitors offering assistance during the outage, the company said it was unable to switch customers to a rival carrier.

Rogers Communications Inc. was niet in staat klanten om te schakelen naar concurrerende carriers tijdens de ongekende uitval van de dienst eerder deze maand, ondanks aanbiedingen van hulp van Bell en Telus, zei het bedrijf in een document vrijgegeven laat vrijdag. De nieuwe details bieden een blik op de verschillende opties die Rogers heeft overwogen tijdens de algemene storing die op 8 juli miljoenen klanten in heel Canada van mobiele telefonie, vaste telefonie en internet beroofde. Als gevolg daarvan was Rogers niet in staat de meeste 911-oproepen te routeren of vier noodsignalen af te geven tijdens de onderbreking van de dienst.

Rogers Communications Inc. was unable to switch customers to competing carriers during the unprecedented service outage earlier this month despite offers of assistance from Bell and Telus, the company said in a document released late Friday.

The telecom giant was also unable to shut down its radio access network, which would have automatically connected customers to another carrier for 911 calls, Rogers said in a submission to the Canadian Radio-television and Telecommunications Commission.

The fresh details offer a glimpse into the multiple options considered by Rogers during the blanket outage that knocked out mobile, landline and internet service to millions of customers across Canada on July 8.

It also reveals how the sweeping outage across its network limited its ability to respond with interim solutions while it restored service.

As a result, Rogers was unable to route most 911 calls or deliver four emergency alerts during the service disruption.

Despite competitors offering assistance during the outage, the company said it was unable to switch customers to a rival carrier.

It said doing so would have required access to parts of its system that were down during the outage.

Competing networks, Rogers said in its submissions, would also not have been able to handle the extra sudden volume of wireless customers, which the company pegged at more than 10 million.

The related voice and data traffic surge could have impeded operations on the other carriers’ networks, it said.

Meanwhile, Rogers considered shutting down its radio access network during the outage, which would have automatically connected customers to another carrier for 911 calls.

But once again, the company said the outage that took down its core system made such a shutdown impossible.

Moreover, turning off the radio access network would have prolonged the outage because restoring it once its network was fixed would have taken several hours, Rogers said.

“While considered many times during the day, shutting down the (radio access network) was simply not a solution,” Rogers said in its submission to the CRTC.

“The best and fastest way to restore 911 was to restore the network itself.”

As a result, Rogers said its radio access network remained in service, preventing many customer phones from automatically attempting to connect elsewhere.

Mobile customers always have the option to remove the SIM card from their device and to then place a 911 call. The handset will automatically connect to the strongest signal for emergency calls, Rogers said.

Although the number of failed 911 calls is unknown, the company said it was able to route “thousands” during its network’s intermittent service. Some Rogers customers were able to place emergency calls using the Bell or Telus networks.

Much of the specific information Rogers submitted to the CRTC was redacted from the document for security and competitive purposes.

Rogers also said four emergency alerts, all issued in Saskatchewan, did not reach customers during the outage.

It said one alert from the RCMP was related to a dangerous person while three were tornado warnings issued by Environment Canada.

Rogers, Bell and Telus are currently discussing solutions for potential future outages, which are expected to be included in a report to Ottawa this fall.

Rogers has come under intense scrutiny from both customers and the Canadian government following the ordeal, which also affected businesses and the Interac debit system.

Chief Executive Tony Staffieri has pledged to improve the resiliency of the company’s mobile and internet network.

Company representatives are scheduled to appear before the House of Commons industry committee on Monday to further discuss the outage.

The committee held an emergency meeting on July 15 and voted unanimously to open an investigation into the outage.

The committee will seek answers about the cause of the outage, its overall effect, and best practices to avoid similar situations in the future and better communicate with the public during such emergencies.

Following the outage, Innovation Minister François-Philippe Champagne directed Canada’s major telecom companies to reach agreements on assisting each other during outages and a communication protocol to better inform Canadians during emergencies.

This report by The Canadian Press was first published July 23, 2022.

RansomHouse beweert halfgeleiderreus AMD te hebben gehackt en 450 GB aan gegevens te hebben gestolen

Vergelijkbare publicaties

DecisiveArchitect en zijn aangepaste implantaat JustForFun | CSA

FBI vordert half miljoen aan ransomware betalingen terug

Werknemers luchtvaartmaatschappij geconfronteerd met beledigingen, fysieke bedreigingen als passagier frustratie kookt over

Activeer post-kwantum sleuteluitwisseling in QUIC met de s2n-quic bibliotheek

Conflict over de vraag of Amerikaanse agenten gewapend mogen zijn in Canada houdt Nexus-centra gesloten

Rogers niet in staat klanten over te zetten naar Bell, Telus, ondanks concurrerende carrier aanbiedingen

Gevonden topics

Sigstore: Handtekeningverificatie voor bescherming tegen aanvallen op de toeleveringsketen

Alpha-Omega Project kiest een mensgerichte aanpak voor open-source software beveiliging

Moxie Marlinspike stapt op als Signal CEO | SecurityWeek.Com