Parallels Desktop Updater Incorrect Permission Assignment Local Privilege Escalation Vulnerability

A security flaw has been discovered in the latest version of the Windows XP operating system.

Er is een beveiligingslek ontdekt in de nieuwste versie van het Windows XP-besturingssysteem.

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.

Deze kwetsbaarheid stelt lokale aanvallers in staat om privileges te escaleren op de betrokken installaties van Parallels Desktop. Een aanvaller moet eerst de mogelijkheid krijgen om code met beperkte rechten uit te voeren op het doelsysteem om dit lek te kunnen misbruiken. Een aanvaller kan deze kwetsbaarheid gebruiken om privileges te laten escaleren en willekeurige code uit te voeren in de context van root.

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the update machanism. The product sets incorrect permissions on sensitive files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root.

ZDI-22-942

Learn what is fleeceware and What to do if you fall victim to fleeceware apps.

Cyber-security firm SophosLabs has launched a new app called fleeceware.

Cyberbeveiligingsbedrijf SophosLabs heeft een nieuwe app gelanceerd, fleeceware genaamd.

It has been named fleeceware due to its defining characteristic of overcharging users for functionality that is widely available in free or low-cost apps. Though these apps do not cause harm to the victims’ devices or data, they trick users into a free trial and later overcharge them through subscriptions and simply perform fleeceware scams.

Het wordt fleeceware genoemd omdat het gebruikers te veel laat betalen voor functionaliteit die op grote schaal beschikbaar is in gratis of goedkope apps. Hoewel deze apps geen schade toebrengen aan de apparaten of gegevens van de slachtoffers, verleiden zij gebruikers tot een gratis proefperiode om hen later via abonnementen te overvragen en gewoonweg aan fleeceware te doen.

“Fleeceware” is a term introduced by SophosLabs in September 2019. It has been named fleeceware due to its defining characteristic of overcharging users for functionality that is widely available in free or low-cost apps. Though these apps do not cause harm to the victims’ devices or data, they trick users into a free trial and later overcharge them through subscriptions and simply perform fleeceware scams.

What is Fleeceware?

Hundreds of people have gathered for a vigil at the University of British Columbia's Okanagan campus for a security guard who was fatally assaulted at

Canadian police say they have arrested a suspect in connection with the death of one of their students.

De Canadese politie zegt een verdachte te hebben gearresteerd in verband met de dood van een van hun studenten.

Hundreds of people have gathered for a vigil at the University of British Columbia’s Okanagan campus for a security guard who was fatally assaulted at work last weekend. RCMP say a suspect who was also working at the university was arrested under the Mental Health Act and could face a murder charge. UBCO deputy vice-chancellor Lesley Cormack says flags at the campus were also being lowered in memory of Kaur.

Honderden mensen hebben zich verzameld voor een wake op de campus Okanagan van de Universiteit van British Columbia voor een veiligheidsagent die afgelopen weekend tijdens zijn werk dodelijk werd aangevallen. RCMP zegt dat een verdachte die ook op de universiteit werkte, werd gearresteerd op grond van de wet op de geestelijke gezondheid en beschuldigd kan worden van moord. Lesley Cormack, vice-kanselier van de UBCO, zegt dat de vlaggen op de campus ook werden gestreken ter nagedachtenis aan Kaur.

Hundreds of people have gathered for a vigil at the University of British Columbia’s Okanagan campus for a security guard who was fatally assaulted at work last weekend.

Twenty-four-year-old Harmandeep Kaur died in a Kelowna hospital after being attacked early last Saturday morning.

RCMP say a suspect who was also working at the university was arrested under the Mental Health Act and could face a murder charge.

UBCO deputy vice-chancellor Lesley Cormack says flags at the campus were also being lowered in memory of Kaur. (Global, CTV Vancouver)

Vigil held for fatally assaulted security guard

Ransomware has emerged to become the worst nightmare in healthcare and hospital devices running on outdated Windows versions or open-source software like Linux are the easy targets, according to research by Cynerio.

Hospitals are being targeted by ransomware attacks, according to a new report.

Ziekenhuizen zijn het doelwit van ransomware-aanvallen, zo blijkt uit een nieuw rapport.

More than half (53%) of the IoT (internet of things) and internet of medical things (IoMT) devices used in healthcare contain critical cybersecurity risks, according to The State of IoMT Device Security report by Cynerio, which analyzed devices from more than 300 hospitals in the US. For the report, more than 10 million IoT and IoMT devices were scanned. The report found that IV (intravenous) pumps make up 38% of a hospital’s typical healthcare IoT footprint, and 73% of these pumps have at least one vulnerability that could jeopardize patient safety, data confidentiality or service availability if identified by a bad actor.

In het rapport wordt geconcludeerd dat URGENT/11 en Ripple20 weliswaar de meest recente krantenkoppen hebben gehaald omdat zij de belangrijkste kwetsbaarheden zijn in IoT-apparaten voor de gezondheidszorg, maar dat zij slechts ongeveer 10% van de werkelijke dreiging vormen. Bij een typische aanval zijn de apparaten die de vitale functies van patiënten bijhouden, samen met de systemen die de medische geschiedenis en documentatie van elke patiënt samenstellen, de apparaten die het begeven, aldus Brodie. Meer dan de helft (53%) van de IoT- (internet of things) en internet of medical things (IoMT)-apparaten die in de gezondheidszorg worden gebruikt, bevatten kritieke cyberbeveiligingsrisico's, zo blijkt uit het rapport The State of IoMT Device Security van Cynerio, dat apparaten van meer dan 300 ziekenhuizen in de VS heeft geanalyseerd.

More than half (53%) of the IoT (internet of things) and internet of medical things (IoMT) devices used in healthcare contain critical cybersecurity risks, according to The State of IoMT Device Security report by Cynerio, which analyzed devices from more than 300 hospitals in the US.

Cynerio makes IoT and security systems for heathcare providers. For the report, more than 10 million IoT and IoMT devices were scanned. Cynerio used a connector which, when connected to a SPAN (switched port analyzer) port on the core switch of a network, collects device traffic information for each device connected to the network. This information was then analyzed by an in-house AI algorithm to help identify vulnerabilities and threats.

The report found that IV (intravenous) pumps make up 38% of a hospital’s typical healthcare IoT footprint, and 73% of these pumps have at least one vulnerability that could jeopardize patient safety, data confidentiality or service availability if identified by a bad actor.

“Healthcare systems have multiple attack surfaces from the very infrastructure within a hospital to the increased (if not total) digitization of medical records,” says Constellation Research analyst Liz Miller. “The global pandemic sweetened the pot for attackers, and it quickly became open season on networks, systems, and devices.”

The report found that 79% of IoT devices are used at least once a month, while 21% may go without use for four weeks.

“Once a medical device is used for a patient, it could be in use for days or weeks at a time,” says Daniel Brodie, Cynerio’s CTO. “Many devices have operational requirements of 24 hours a day, 7 days a week, and an interruption, even for patching, could have serious consequences for medical workflows, patient safety, and hospital operations.”

Another factor contributing to the devices missing out on timely upgrades is that a typical hospital network may host a combination of devices from different vendors and streamlining the patching and upgrading process becomes too complex to be achieved within the respective downtime windows, according to Brodie.

Almost half (48%) of the IoT devices scanned in the research used Linux as their operating system which, according to the report, leads to growing concerns as Linux is an open-source platform that has gained much popularity within the bad actors' community as it powers almost 70% of web servers worldwide.

“We are seeing an increased targeting of Linux devices by ransomware groups in IoT environments,” Brodie adds. “The offenders understand and target their attacks, almost in a customized fashion, to a hospital’s unique setup. It takes longer than a ‘spray and pray’ type of attack, but the potential for payoff is much higher.”

Another key finding of the report is that although only a marginal number of IoT devices in a healthcare setup run on Windows, the critical care sector overall is dominated by devices running old versions of Windows, typically older than Windows 10. These include devices used by hospital departments usually responsible for the direct care of patients like pharmacology, oncology, and labs.

Of the many cyberattacks targeting the healthcare space, ransomware has emerged to be the most problematic in recent times. The Cynerio report pointed out that in 2021 ransomware attacks on hospitals increased 123% year-on-year, costing a total of $21 billion from over 500 attacks. The average cost per ransomware attack has been found to be $8 million and each attack is estimated to take an organization around 287 days to fully recover.

Ransomware attacks have become more prevalent in the past two years, according to Forrester analyst Allie Mellen. Due to the nature of healthcare equipment, there can be a lot of challenges to upgrading legacy systems, given the wide array of devices.

Malware or DDoS (distributed denial of service) attacks are the most frequent and tend to turn into ransomware demands. In a typical attack, the devices to go down are the ones that track patients’ vital signs along with the systems that compile the medical history and documentation of each patient, according to Brodie. This is quickly followed by the shutdown of communication systems including email and VOIP phones, making it hard to pass on critical information. Other systems that lose functionality during these attacks include radiology, imaging, PACS (picture archiving and communication system) machines and scanners, IV and insulin pumps, printers, and other network equipment.

The report concluded that although URGENT/11 and Ripple20 have made the most recent headlines for being the key vulnerabilities within healthcare IoT devices, they make up only about 10% of the real threat. URGENT/11 and Ripple20 refer to the group of vulnerabilities that allows attackers to circumvent firewalls and remotely take control of the devices through TCP/IP stack without user interaction.

The top vulnerabilities, according to the report, are Cisco IP Phone CVEs (common vulnerabilities and exposures), which comprised 31% of vulnerabilities detected; weak HTTP credentials, with 21% of detected vulnerabilities; and open HTTP port, with 20%.

The report recommends network quarantine and segmentation as the most effective technique to remediate the vulnerabilities, as patching is a difficult fix for IoT devices coming from different vendors. It also emphasizes that a proper balance of network connections, with a mix of the east-west (device to device) and north-south (server to device) form of segmentation, is vital to ensure safety without disrupting connectivity.

“Context is important, in a healthcare environment specifically, you can’t have segmentation interfering with clinical workflows or interrupting patient care, so there is definitely a balance that needs to be struck between connection and severance,” Brodie says. He elaborates that, for instance, the IV pumps could be connected only to the servers at the data centers and not to other servers or devices (in a north-south segmentation maneuver) that may be more easily accessed.

Outdated IoT healthcare devices pose major security threats

The DecisiveArchitect activity cluster uses a custom-built implant to stage intrusions. This blog outlines how to hunt for this implant or others that are similar.

In our series of letters from African journalists, the BBC’s Chris Stokel-Walker looks at how a cyber-attack could be handled.

In onze reeks brieven van Afrikaanse journalisten bekijkt Chris Stokel-Walker van de BBC hoe een cyberaanval zou kunnen worden aangepakt.

If such systems are not adequately protected using other security controls or unless they can only be accessed by systems with appropriate endpoint-based detection/prevention capabilities, this can cause a gap in visibility for an organization that an adversary could abuse. Similar to the activity cluster reported as LightBasin, this adversary primarily focuses on Linux and Solaris systems using a custom-built implant tracked by CrowdStrike Intelligence as JustForFun (also publicly known as BPFDoor). While this adversary does interact with Windows systems, mostly during the early stages of an intrusion, CrowdStrike has not yet identified any custom implants geared toward Windows systems.

Indien dergelijke systemen niet adequaat worden beschermd met andere beveiligingsmaatregelen of tenzij zij alleen toegankelijk zijn voor systemen met de juiste endpoint-gebaseerde detectie- en preventiemogelijkheden, kan dit voor een organisatie een hiaat in de zichtbaarheid veroorzaken waarvan een tegenstander misbruik zou kunnen maken. Net als de activiteitencluster die LightBasin wordt genoemd, richt deze tegenstander zich voornamelijk op Linux- en Solaris-systemen met behulp van een op maat gemaakt implantaat dat door CrowdStrike Intelligence wordt getraceerd als JustForFun (ook publiekelijk bekend als BPFDoor). Hoewel deze tegenstander wel inwerkt op Windows-systemen, meestal tijdens de eerste fasen van een inbraak, heeft CrowdStrike nog geen aangepaste implantaten geïdentificeerd die gericht zijn op Windows-systemen.

This blog was originally published by CrowdStrike on May 25, 2022.

The security landscape is constantly developing to provide easier ways to establish endpoint visibility across networks through the use of endpoint detection and response (EDR) utilities. However, certain challenges still remain, particularly as a result of many organizations’ need for systems running legacy or proprietary operating systems, such as Solaris. If such systems are not adequately protected using other security controls or unless they can only be accessed by systems with appropriate endpoint-based detection/prevention capabilities, this can cause a gap in visibility for an organization that an adversary could abuse.

On multiple occasions dating back to 2019, the CrowdStrike Services Incident Response team, CrowdStrike Intelligence team and Falcon OverWatch™ team have encountered an adversary targeting global entities, in particular telecommunications companies, to obtain targeted personal user information — for example, call detail records (CDRs) or information relating to specific phone numbers.

Similar to the activity cluster reported as LightBasin, this adversary primarily focuses on Linux and Solaris systems using a custom-built implant tracked by CrowdStrike Intelligence as JustForFun (also publicly known as BPFDoor). While this adversary does interact with Windows systems, mostly during the early stages of an intrusion, CrowdStrike has not yet identified any custom implants geared toward Windows systems. Instead, the adversary relies on publicly available tools, such as ldapdomaindump, or the post-exploitation framework Impacket, to target Windows systems from previously compromised Linux systems.

CrowdStrike Intelligence is currently tracking these intrusions under the DecisiveArchitect activity cluster (also publicly known as Red Menshen); however, this activity is not currently attributed by CrowdStrike to a specific country-nexus. While CrowdStrike has primarily observed the adversary targeting telecommunications companies, other isolated incidents targeting organizations such as logistics entities have also been observed.

DecisiveArchitect exhibits a high degree of operational security as part of their tactics to make it more difficult for defenders to identify and investigate their activity through the use of various defense evasion techniques. While other publicly available research highlights how the implant operates, this blog focuses on methods to hunt for this implant, or implants that may operate in a similar manner, while also highlighting techniques of interest across Solaris systems.

DecisiveArchitect utilizes a custom implant tracked by CrowdStrike as JustForFun, which is typically persisted using SysVinit scripts. When executed, the implant overwrites the process command line within the process environment by randomly selecting a new command line from one of ten hard-coded options, listed in Figure 1.

When DecisiveArchitect interacts with the implants to establish an interactive shell on a system, the bash process spawned by the implant process displays the following command line instead. This makes it appear as if the Postfix queue manager is executing as a way to hide itself from analysts and system administrators:

On Solaris systems, though the executable itself exhibits no mechanism for similar command-line spoofing, DecisiveArchitect achieves similar functionality through the use of LD_PRELOAD, such as the following example identified within a SysVinit script:

When executed, the process only shows the command line /usr/lib/vtdaemon -c 16, where the actual JustForFun implant is the file /lib/librbtinfo.so.1.

As recently as April 2022, CrowdStrike observed further variations with regard to DecisiveArchitect’s tactics, techniques and procedures (TTPs), with the actor using the LD_PRELOAD environment variable across Linux systems as well, loading the JustForFun implant, /lib64/libcaac.so.1, within the legitimate process /sbin/agetty. This highlights a deviation from the standard list of spoofed command lines in Figure 1, likely as part of a further effort to remain undetected and emphasizing the importance of behavioral-based hunting and detection methods.

The spoofed command line appears in commands such as ps that may be used to investigate suspicious activity on the host. The spoofed command line makes it less likely that the process will be treated as suspicious.

DecisiveArchitect targets Solaris systems via publicly available exploit code for CVE-2019-3010, a vulnerability in xscreensaver. Binaries used to exploit this vulnerability have usually been observed within a few minutes of the JustForFun implant deployment. CVE-2019-3010 is a logic bug that utilizes the LD_PRELOAD technique to facilitate local privilege escalation to the root user on Solaris 11 systems. Proof-of-concept (POC) code is publicly available and was not modified by DecisiveArchitect.1 Table 1 lists two files observed across Solaris systems related to this privilege escalation activity.

The way in which DecisiveArchitect achieves persistence across Linux systems involves the usage of SysVinit scripts (i.e., rc.d/init.d scripts). Instead of simply creating a new script that references the JustForFun implants, DecisiveArchitect uses a more operational security-conscious approach by modifying existing SysVinit scripts to reference a small script file, which then finally references the JustForFun implant. The following highlights an example, including the lines added to the legitimate SysVinit script /etc/rc.d/init.d/pcscd and the script /etc/sysconfig/pcscd referencing the JustForFun implant, /etc/sysconfig/pcscd.conf:

With this method of nested persistence, if an analyst simply reviews a set of SysVinit scripts by themselves, identifying the malicious line associated with the JustForFun implant would likely prove difficult without subsequently reviewing all of the files referenced within the scripts. Additionally, as part of DecisiveArchitect’s continued commitment to operational security, the adversary modifies different legitimate SysVinit scripts across systems, and uses different file names/paths for the implant and associated persistence-related scripts, making it difficult to search across other systems for indicators identified through analysis of a single system.

One of the best ways to detect or hunt for this activity is to utilize EDR technology across supported Linux systems, with machine learning capabilities to detect and prevent the malicious implants, and with hunting capabilities to identify anomalous usage of common Linux system administration utilities or processes running with spoofed command lines (such as the bash process running with the command line showing the Postfix queue manager command line instead).

But, even if an organization has a significant number of legacy or proprietary systems, already has the adversary burrowed into their network, or simply does not have EDR software deployed across Linux systems, all is not lost.

Given the fact the JustForFun implant opens a raw socket in order to wait for the magic packet, the built-in Linux utility lsof can be used to identify running processes with a raw socket open:

Even though this command alone cannot solely determine whether the implant is present — as there are legitimate reasons for processes to have raw sockets open — analysts can highlight processes of interest for further investigation. Of particular importance is that DecisiveArchitect’s use of spoofed command lines means that the lsof command will report the spoofed command line, as opposed to the actual malicious file, which may make it difficult to determine whether the process is malicious or not through this alone. However, by running the lsof command against the process ID without any of the grep filtering, an analyst can list any open files associated with that process, which should reveal the binary. An example of a true positive can be seen below, with the start of the line (i.e., the command line) displaying the start of one of the spoofed command lines listed in Figure 1. It should be noted that DecisiveArchitect can quite easily change these spoofed command lines, so analysts should be conscious of other processes beyond those listed:

While the lsof command is not part of a default Solaris installation, similar commands exist for obtaining additional details from processes:

The three commands above loop through every process, with the first command looking for a string indicative of a process running with a packet filter, and the other two searching for processes with the libpcap library loaded. As with the lsof command, this alone cannot solely determine whether the implant is present, so an analyst would need to further investigate the specific process to confirm the presence of the implant. DecisiveArchitect’s capability to spoof command lines across Solaris systems also needs to be taken into account when investigating these processes.

When investigating any of these entries, one of the key questions to ask is whether the process in question has any reason to have a raw socket open, to be using a packet filter or to be utilizing the libpcap library. One of the most common false positives relates to systems running processes such as tcpdump or other packet capture utilities.

While these hunting techniques provide a relatively simple method for identifying DecisiveArchitect activity based on activity observed across multiple intrusions, CrowdStrike expects that DecisiveArchitect will continue development of their implant across both Linux and Solaris platforms, while also improving their techniques regarding operational security of their intrusions to further hinder the ability of a defender to identify or investigate their activity, which might include identifying ways to combat these hunting techniques.

DecisiveArchitect’s operations present a clear and present threat to telecommunications companies, as well as other organizations such as logistics entities. This blog highlights important details about DecisiveArchitect’s implant, their abilities to operate on Solaris systems, and ways to hunt down the adversary’s implants to help organizations identify whether they have fallen victim to this campaign.

DecisiveArchitect and Its Custom Implant JustForFun | CSA

The FBI is becoming more adept at recovering bitcoin ransoms. Some criminals are responding by

A growing number of ransomware payments have been recovered by the FBI, according to the BBC’s weekly The Boss.

Een groeiend aantal betalingen van ransomware is teruggevorderd door de FBI, aldus het weekblad The Boss van de BBC.

The U.S. Department of Justice (DoJ) has recovered roughly a half million dollars in ransomware payments made to North Korean cyber criminals targeting healthcare organizations. The cybercriminals have been targeting healthcare organizations with a Maui strain of malware since at least May 2022. Maui first encrypts target files with AES 128-bit encryption, assigning each file a unique AES key.

De cybercriminelen hebben ten minste sinds mei 2022 gezondheidszorgorganisaties het doelwit gemaakt van een Maui-stam van malware. Maui versleutelt doelbestanden eerst met AES 128-bit encryptie, waarbij aan elk bestand een unieke AES-sleutel wordt toegekend. Met een aangepaste header in elk bestand, die het oorspronkelijke pad van het bestand bevat, kan Maui eerder versleutelde bestanden identificeren.

The U.S. Department of Justice (DoJ) has recovered roughly a half million dollars in ransomware payments made to North Korean cyber criminals targeting healthcare organizations. This is yet another sign law enforcement agencies are at least becoming more effective at preventing cyber attackers from enjoying their ill-gotten gains.

The cybercriminals have been targeting healthcare organizations with a Maui strain of malware since at least May 2022. Maui malware installs an encryption binary called “maui.exe” that employs a combination of Advanced Encryption Standard (AES), RSA, and XOR algorithms to prevent access to specific files.

Maui first encrypts target files with AES 128-bit encryption, assigning each file a unique AES key. A custom header contained in each file that includes the file’s original path allows Maui to identify previously encrypted files. The header also contains encrypted copies of the AES key. It then encrypts each AES key with RSA encryption and loads the RSA public (maui.key) and private (maui.evd) keys in the same directory as itself. It then encodes the RSA public key (maui.key) using XOR encryption with an XOR key that’s generated from hard drive information.

Finally, Maui then creates a temporary file for each file it encrypts using GetTempFileNameW() and then uses this file as the encrypted output. Maui then creates maui.log, which contains output from Maui execution that can be exfiltrated.

There’s not much to be done once Maui malware starts encrypting files, but the Federal Bureau of Investigations (FBI) in the U.S. did work closely with one of the victims of a Maui infestation to recover payments. After notifying the FBI, a hospital in Kansas paid approximately $100,000 in Bitcoin to regain access to its files. The FBI then traced those payments to a money laundering operation in China where it found an approximately $120,000 Bitcoin payment made by the Kansas hospital in a cryptocurrency account. The FBI also discovered that a medical provider in Colorado had just paid a ransom after being hacked by actors using the same Maui ransomware strain. The FBI seized the contents of two cryptocurrency accounts with the aim of eventually returning those funds to the ransomware victims.

While the FBI is generally being applauded for its efforts, there are concerns about what might come next. It’s clear that law enforcement agencies are getting more adept at tracking illicit cryptocurrency transactions and recovering those funds even in countries where they have no official jurisdiction. Cybercriminals are inevitably going to look for other methods of payment collection that are not quite as easy to track or recover. Some cybercriminals are, for example, looking to shift from Bitcoin to alternative, privacy-based digital currencies such as Monero.

Regardless of the payment method, ransomware transactions will likely be pushed further underground to avoid detection. In effect, the whole payment process for better or worse is likely to become that much more complex. As a result, the amount of time required to acquire the keys to decrypt files is likely to be just that much longer, which will only increase the level of stress for all involved.

The best way to eliminate that stress is to always have a pristine copy of data available. In the absence of that critical capability, it will be up to each organization to determine ahead of time how best to go about mastering the nuances of all the various types of cryptocurrency that might soon be more widely employed.

FBI recovers half million in ransomware payments

By Christopher Reynolds From verbal abuse to physical threats and police calls, front-line workers in the airline industry are finding themselves on the

Canadian airlines are struggling to cope with the coronavirus pandemic, according to a new report.

Volgens een nieuw rapport hebben Canadese luchtvaartmaatschappijen het moeilijk om het hoofd te bieden aan de pandemie van het coronavirus.

From verbal abuse to physical threats and police calls, front-line workers in the airline industry are finding themselves on the receiving end of passenger frustrations over flight delays and lost baggage. It also comes as the union representing more than 700 WestJet employees at airports in Calgary and Vancouver says they have voted to support a strike if they cannot reach a new contract with the airline. Toronto Pearson International Airport and Air Canada have topped global lists for share of flights delayed over the past month, frequently surpassing 50 per cent and fanning travellers’ ire.

Van verbaal geweld tot fysieke bedreigingen en politieoproepen: eerstelijnsmedewerkers in de luchtvaartindustrie worden het slachtoffer van de frustraties van passagiers over vertraagde vluchten en zoekgeraakte bagage. De gerafelde zenuwen en ontploffende buien zijn het resultaat van een voortdurende strijd door luchthavens en vervoerders om te gaan met de enorme reizen rebound deze zomer. Dit komt ook omdat de vakbond die meer dan 700 WestJet-werknemers op luchthavens in Calgary en Vancouver vertegenwoordigt, zegt dat zij voor een staking hebben gestemd als zij niet tot een nieuw contract met de luchtvaartmaatschappij kunnen komen.

From verbal abuse to physical threats and police calls, front-line workers in the airline industry are finding themselves on the receiving end of passenger frustrations over flight delays and lost baggage.

“I’ve had customers poke me in the chest and say, ‘You’re not going to get me off of this flight,'” said Cheryl Robinson, an Air Canada customer service agent at the Halifax airport.

“I’ve seen my colleagues in tears, walking away because they just can’t deal with another person yelling at them today.”

“It shakes you,” said Robinson, who’s worked at the airport for more than 24 years. “This is probably the worst I’ve ever seen.”

The frayed nerves and exploding tempers are the outcome of an ongoing struggle by airports and carriers to cope with the massive travel rebound this summer.

It also comes as the union representing more than 700 WestJet employees at airports in Calgary and Vancouver says they have voted to support a strike if they cannot reach a new contract with the airline.

Toronto Pearson International Airport and Air Canada have topped global lists for share of flights delayed over the past month, frequently surpassing 50 per cent and fanning travellers’ ire.

“We can all understand why they’re angry and frustrated. Your flight gets cancelled and they tell you to call and you wait on hold for six hours — and I’m not exaggerating,” said Leslie Dias, director of airlines at Unifor, which represents 16,000 air transport workers, including 5,600 customer service and sales agents at Air Canada.

“To some extent, our people are broken,” she said from Calgary, where she is part of the negotiations with WestJet over a deal for the hundreds of baggage and customer service agents.

“They’re upset, they’re often close to tears, they’re exhausted. At all airlines they’re being asked to work as many hours as they can possibly manage to work. And they feel helpless.”

Dias added that police officers are being called to airport gates daily because of verbal harassment from travellers.

The fallout from the “sinkhole of a mess” deters new recruits and drags down retention rates, she said.

Dias is calling on management for a stronger security presence as well as higher wages to attract more workers, which would speed up passenger processing and make employees feel safer, she said.

The workers in Calgary and Vancouver bargaining for their first collective agreement with WestJet start at $15.55 an hour, topping out at $23.87 an hour after seven years, she said.

On Wednesday, those employees voted 98 per cent in support of a strike if they cannot reach an agreement with the airline, and could walk off the job as early as July 27, Unifor said.

“The pay scale has not been increased for more than five years, making WestJet’s wages among the lowest in the Canadian aviation industry and no match for soaring inflation,” Unifor spokesman Scott Doherty said in a statement.

The union also highlighted a “pressure-cooker atmosphere,” stating that workers have endured verbal abuse and physical threats from travellers whose flights were delayed or cancelled by the carrier.

WestJet executive vice-president Angela Avery said the strike vote is a “common step” in the negotiation process and was “not unexpected.”

“We remain focused on successfully negotiating an agreement that provides value to our airport employees,” she said in a statement.

“As the airline rebuilds, the majority of its airports employees have been with the company for less than one year, and the vast majority of more tenured airport employees have received increases through the existing pay step structure, in addition to a Canadian industry leading variable compensation.”

Before taking any strike action, Unifor must serve WestJet with 72 hours’ notice.

At Air Canada, the payroll is at 93 per cent of 2019 levels, while its summer flight schedule is below 80 per cent of pre-pandemic volumes.

“We continue to recruit for certain jobs and have and continue to refine elements of our compensation packages to remain competitive in the current environment,” the company said in an email.

“Employees are professionals and they make every effort to manage challenging situations effectively in their respective environments. The overwhelming majority of passengers are respectful. That said, Air Canada has a zero-tolerance approach toward any kind of aggression in our business, especially towards our employees.”

Flight attendants and customs officers face their own passenger challenges as well.

“It’s like a nine-to-five job that’s now turned into a seven-day-a-week job with no fixed hours,” said Wesley Lesosky, who heads the Canadian Union for Public Employees’ airline division, which represents about 15,500 workers.

“If you have kids, if you have a family, a partner, a dog, cats … everything’s kind of up in the air.”

Frustration from long security queues, missed connecting flights, misplaced luggage and hours on tarmacs has pushed emotions to a “boiling point … resulting in increased reports of harassment and abuse — physical and verbal,” said Crystal Hill, president of CUPE 4070, which represents some 4,000 WestJet flight attendants.

“This is very scary when you’re 40,000 feet above ground.”

Border security agents also face exasperation from passengers, at least 30 per cent of whom show up at land and air checkpoints without having completed their ArriveCan app, said Mark Weber, president of the Customs and Immigration Union.

“We’re seeing an uptick in verbal abuse. In many cases they’re waiting in line two, three hours to get to us. We completely get why they’re frustrated,” he said.

The increase in automated kiosks to process international arrivals at some airports has not made up for staff cuts that helped reduce customs agents at Pearson airport to the current 300 from 600 in 2017, he added.

This report by The Canadian Press was first published July 20, 2022.

Airline workers face insults, physical threats as passenger frustration boils over

At Amazon Web Services (AWS) we prioritize security, performance, and strong encryption in our cloud services. In order to be prepared for quantum computer advancements, we’ve been investigating the use of quantum-safe algorithms for key exchange in the TLS protocol. In this blog post, we’ll first bring you up to speed on what we’ve been […]

The challenges of quantum-resistant encryption have been revealed in the latest phase of the project.

De uitdagingen van kwantumbestendige encryptie zijn in de laatste fase van het project aan het licht gekomen.

In order to be prepared for quantum computer advancements, we’ve been investigating the use of quantum-safe algorithms for key exchange in the TLS protocol. Then, we’ll focus on the QUIC transport protocol and show how you can enable and experiment with the newly released post-quantum (PQ) key exchange by using our s2n-quic library. The s2n-quic library is an open-source implementation of the QUIC protocol.

Om voorbereid te zijn op de vooruitgang van kwantumcomputers hebben wij onderzoek gedaan naar het gebruik van kwantumveilige algoritmen voor sleuteluitwisseling in het TLS-protocol. Daarna richten we ons op het QUIC transport protocol en laten we zien hoe je kunt experimenteren met de onlangs uitgebrachte post-quantum (PQ) sleuteluitwisseling door gebruik te maken van onze s2n-quic library. Waarom PQ-hybride sleutelopstelling gebruiken in s2n-quic?

At Amazon Web Services (AWS) we prioritize security, performance, and strong encryption in our cloud services. In order to be prepared for quantum computer advancements, we’ve been investigating the use of quantum-safe algorithms for key exchange in the TLS protocol. In this blog post, we’ll first bring you up to speed on what we’ve been doing on the TLS front. Then, we’ll focus on the QUIC transport protocol and show how you can enable and experiment with the newly released post-quantum (PQ) key exchange by using our s2n-quic library. The s2n-quic library is an open-source implementation of the QUIC protocol.

Why use PQ-hybrid key establishment in s2n-quic?

A large-scale quantum computer could break the current public key cryptography that is used to establish keys for secure communication connections. Although a large-scale quantum computer isn’t available today, traffic that is recorded now could be decrypted by one in the future. With such concerns in mind, the recent US Congress Quantum Computing Cybersecurity Preparedness Act and the White House National Security Memorandum set a goal of a timely and equitable transition of cryptographic systems to quantum-resistant cryptography.

At AWS, we are working to prepare for this future. Recently, AWS Key Management Service (AWS KMS), AWS Certificate Manager (ACM) and AWS Secrets Manager TLS endpoints started supporting post-quantum hybrid (PQ-hybrid) key establishment in TLS connections with three of the post-quantum key encapsulation mechanisms (KEMs) in the NIST Post-Quantum Cryptography (PQC) Project. The three post-quantum KEMs are Kyber (NIST’s Round 3 KEM selection), BIKE and SIKE (NIST’s Round 4 KEM candidates). All three of these AWS services’ support of post-quantum KEMs raises the security bar when making API requests to their endpoints over TLS.

PQ-hybrid key establishment in TLS is a feature that introduces post-quantum KEMs used in conjunction with classical Elliptic Curve Diffie-Hellman (ECDH) key exchange. The client and server still do an ECDH key exchange. Additionally, the server encapsulates a post-quantum shared secret to the client’s post-quantum KEM public key, which is advertised in the ClientHello message. This strategy combines the high assurance of a classical key exchange with the security of the proposed post-quantum key exchanges, to ensure that the handshakes are protected as long as the ECDH or the post-quantum shared secret cannot be broken.

After decapsulating the secret, the client and server have an ECDH and a post-quantum shared secret, which they concatenate and use to derive the symmetric keys that are used in the Authenticated Encryption with Additional Data (AEAD) cipher in TLS. These symmetric keys used by the AEAD cipher for data encryption will be secure against a quantum computer, which means that the TLS communication is secure against a quantum computer. The AWS implementation of TLS is s2n-tls, a streamlined open source implementation of TLS. The s2n-tls implementation already supports PQ-hybrid key exchange with ECDH and three NIST PQC Project KEMs (Kyber, BIKE, and SIKE) for TLS 1.2 and 1.3. The use of KEMs for TLS 1.2 is described in the draft-campagna-tls-bike-sike-hybrid IETF draft, and the use of KEMs for TLS 1.3 is described in the draft-ietf-tls-hybrid-design IETF draft.

AWS recently announced s2n-quic, an open-source Rust implementation of the QUIC protocol. QUIC is an encrypted transport protocol that is designed for performance and is the foundation of HTTP/3. For tunnel establishment, QUIC uses TLS 1.3 carried over QUIC transport. To alleviate the harvest-now-decrypt-later concerns for customers that use s2n-quic, in the next section we show you how to enable PQ-hybrid key establishment in s2n-quic. AWS services and software that use s2n-quic will automatically inherit the ability to support quantum-safe key exchanges in the future when post-quantum algorithms are standardized and are officially supported in s2n-quic.

The s2n-quic implementation is written in the Rust programming language. It can use either s2n-tls (the TLS library for AWS) or rustls (the TLS library in Rust) to perform the TLS handshake. If you build s2n-quic with s2n-tls, then s2n-quic inherits the post-quantum support that is offered in s2n-tls. In turn, s2n-tls is built over other crypto libraries such as the AWS libcrypto (AWS-LC) or alternatively OpenSSL crypto library (libcrypto). AWS-LC is a general-purpose cryptographic library that is maintained by AWS, which will incorporate standardized post-quantum algorithms. Therefore, building s2n-tls with AWS-LC will provide s2n-tls with the post-quantum cryptographic algorithms for use in s2n-quic.

Such a model allows for AWS services and software that use s2n-quic to automatically inherit the standardized post-quantum options as they are implemented in s2n-tls and its underlying crypto libraries. There will be no need to tweak s2n-quic to support post-quantum TLS 1.3 handshakes. The whole stack of protocol implementations is architected in an agile manner without duplication of work.

In the following section, we show you how to run an experimental PQ build of s2n-quic that supports PQ-hybrid key exchange.

The public s2n-quic GitHub repository includes an example that demonstrates how to build the library with PQ-hybrid key exchange support, along with a server and client to test. The PQ-hybrid key exchange feature test requires CMake in Linux or macOS. The experiments below were run in an Amazon Linux 2 instance with rustc, Cargo, Clang, and CMake installed. Connections that you establish with this experimental build of s2n-quic will support PQ-hybrid key exchange.
• Clone s2n-quic by using the following commands:
• Run the example post-quantum s2n-quic client and server in the post-quantum directory to confirm that they negotiate a PQ-hybrid key by using the following commands: Note: Although these examples with the PQ-hybrid feature experimental build of s2n-quic are self-contained, if you want to manually change and build s2n-quic and s2n-tls to enable PQ-hybrid key exchange, you have to update the default_tls13 policy in s2n-tls to point to security_policy_pq_tls_1_0_2021_05_26 in tls/s2n_security_policies.c. Then you rebuild s2n-tls and override the location that s2n-quic links to by setting the S2N_TLS_DIR, S2N_TLS_LIB_DIR, and S2N_TLS_INCLUDE_DIR environment variables at build time.
• To confirm the PQ-hybrid key establishment, you capture the QUIC negotiation by using the following command:
• Open the capture by using a packet capture visualization application. First you look at the ClientHello message, as shown in the capture in Figure 1 taken from Wireshark. In the QUIC CRYPTO frame, you can see the TLS 1.3 cipher suites, and that the TLS version is 1.3 while the supported key exchange groups are classical ECDH (with identifiers 0x0017, 0x0018, 0x001d) and 0x2f39, 0x2f3a, 0x2f37…. 0x2f1f. The 0x2f… groups are the agreed upon identifiers (not standardized yet) for PQ-hybrid key exchange. You also see the PQ-hybrid X25519+Kyber512 (with identifier 12089 or 0x2f39) key share that is offered by the client. That key share includes 32 bytes for the Curve25519 ephemeral ECDH client public key, 800 bytes for the ephemeral Kyber512 public key, and 4 bytes for the identifier and the key share length. Note: The post-quantum KEMs implementations at the time of this writing follow the NIST Round 3 Kyber, BIKE, and SIKE specifications. We expect these specifications to change as the NIST PQC Project proceeds with standardization. Post-quantum support in s2n-tls and s2n-quic will be experimental until NIST has selected and published standardized algorithms and identifiers. Pushing the change to the main branch now would mean that s2n-quic clients would be sending a PQ-hybrid key share that won’t be used until the servers on the internet start supporting it. The actual algorithms and their identifiers will still be integrated in future releases of s2n-tls and AWS-LC. Therefore, s2n-quic will still be able to negotiate the NIST and IETF standardized options. Meanwhile, we will continue to experiment with post-quantum QUIC and its potential challenges.
• Next, take a look at the server-negotiated keys in the ServerHello message, as shown in Figure 2.

You can again see the TLS 1.3 cipher suite, the TLS version being 1.3, and the picked PQ-hybrid X25519+Kyber512 key share. The key share includes 4 bytes for the identifier and the key share length, 32 bytes for the Curve25519 ephemeral ECDH server public key, and 768 bytes for the Kyber512 ciphertext that encapsulates a post-quantum shared secret to the client’s ephemeral Kyber512 public key (included in its ClientHello message).

The rest of the handshake completes successfully by deriving symmetric keys from the X25519 and Kyber512 post-quantum shared secrets (as defined in the draft-ietf-tls-hybrid-design IETF draft) and encrypting the rest of the messages with Advanced Encryption Standard with Galois/Counter Mode (AES-GCM) by using these symmetric keys over QUIC.

Now you can benchmark the post-quantum QUIC client and server by using netbench, a transport protocol benchmarking tool that is available in the s2n-quic repository.

To benchmark the post-quantum QUIC client and server
• Go in the netbench directory and build it with the correct flags for the experimental post-quantum QUIC examples, by using the following commands:
• Generate the scenario by using the following commands: In this example, you’re trying to create 10,000 sequential QUIC connections. The scenario opens a connection, sends a single byte, receives a single byte, closes it, and repeats 10,000 times.
• Run the server by using the following command:
• Run the client by using the following command: The drivers read the request_response.json to run the scenario. Then the driver is wrapped in a collector that outputs statistics to another JSON file. At the end of all of the 10,000 runs, the cli feature is used to generate the report.

Figure 3 shows the performance results for X25519, X25519+Kyber512, X25519+BIKE-1, and X25519+SIKEp434 key exchange. All connections used an ECDSA P256 server certificate for authentication.

The x-axis is time in seconds. The y-axis is the number of times send is called—which, for 1 byte per connection, practically means that the diagram shows the connection establishment rate (per second). The absolute performance numbers in these benchmarks are not important, because the results could change based on the netbench scenario parameters. The performance difference between PQ-hybrid key exchange algorithms is what this graph is highlighting.

You can see that the classical X25519 achieves higher connection rates, because it is the most efficient option (that offers no post-quantum protection). The performance of Kyber is competitive and achieves 8% fewer connections per second when used with X25519 in a PQ-hybrid key exchange. BIKE-1 is relatively efficient, but adds some extra latency and introduces two frames for the ClientHello, which leads to 37% fewer connections per second. SIKEp434, although it offers much smaller public keys and ciphertexts, is orders of magnitude slower, which means it offers 95% fewer connections per second. These results match previous results we have shared before and other research works, where the most efficient signature algorithms ended up with higher connection rates and lower connection failure probabilities due to overload.

In this post, we showed how you can use s2n-quic in conjunction with s2n-tls to enable QUIC connections to negotiate encryption keys in a quantum-resistant manner. If you’re interested in learning more about s2n-quic, join us at AWS re:Inforce in July for the breakout session entitled NIS304: Using s2n-quic: Bringing QUIC, the secure transport protocol, to AWS.

As always, if you’re interested in using or contributing to s2n-quic, the source code and documentation are publicly available under the terms of the Apache Software License 2.0 from our s2n-quic GitHub repository. If you package or distribute s2n-quic or s2n-tls, or use it as part of a large multi-user service, you might be eligible for pre-notification of security issues. Contact s2n-pre-notification@amazon.com for more information. If you discover a potential security issue in s2n-quic or s2n-tls, we ask that you notify AWS Security by using our vulnerability reporting page.

If you have feedback about this post, submit comments in the Comments section below. If you have questions about this post, contact AWS Support.

Want more AWS Security news? Follow us on Twitter.

Enable post-quantum key exchange in QUIC with the s2n-quic library

A dispute over legal protections for American customs officers has kept Nexus enrolment centres closed in Canada more than three months after they

The Canadian government says it is trying to resolve a long-running border dispute with the United States.

De Canadese regering zegt te proberen een langlopend grensgeschil met de Verenigde Staten op te lossen.

A dispute over legal protections for American customs officers has kept Nexus enrolment centres closed in Canada more than three months after they reopened south of the border — due in part to a clash over U.S. agents’ right to carry guns on Canadian soil. The Canada Border Services Agency says the number of Nexus applications has ballooned to 341,688 from about 270,000 in April at a time when delays are wreaking havoc on travellers’ summer plans. Two senior Canadian government sources told The Canadian Press the U.S. wants its customs officers who work in Nexus centres to have the same protections guaranteed to its preclearance officers in Canada under a bi-national agreement, with sidearms as a major sticking point in the talks.

Een geschil over de wettelijke bescherming van Amerikaanse douanebeambten heeft ertoe geleid dat de Nexus-inschrijvingscentra in Canada gesloten zijn gebleven, meer dan drie maanden nadat zij ten zuiden van de grens weer open waren gegaan - ten dele als gevolg van een conflict over het recht van Amerikaanse beambten om op Canadees grondgebied wapens te dragen. Volgens het Canada Border Services Agency is het aantal Nexus-aanvragen gestegen van ongeveer 270.000 in april tot 341.688, terwijl de vertragingen de zomerplannen van reizigers in de war schoppen. Twee hooggeplaatste Canadese regeringsbronnen vertelden The Canadian Press dat de VS willen dat hun douanebeambten die in de Nexus-centra werken dezelfde bescherming krijgen als hun preclearance-ambtenaren in Canada in het kader van een bi-nationale overeenkomst, waarbij zijwapens een belangrijk knelpunt in de besprekingen vormen.

A dispute over legal protections for American customs officers has kept Nexus enrolment centres closed in Canada more than three months after they reopened south of the border — due in part to a clash over U.S. agents’ right to carry guns on Canadian soil.

The standoff has led to a massive backlog in applications for the program, which allows pre-approved travellers to cross the border more quickly.

The Canada Border Services Agency says the number of Nexus applications has ballooned to 341,688 from about 270,000 in April at a time when delays are wreaking havoc on travellers’ summer plans.

Canada and the U.S. remain in discussions about when the 13 enrolment centres will reopen for applicant interviews as the two sides try to clarify “legal protections” for American customs officers while they are working at the jointly staffed centres, agency spokeswoman Rebecca Purdy said in an email.

U.S. Customs and Border Protection confirmed the holdup revolves around legal “authorities” for its Nexus office staff.

“One example could include the authority to carry or have access to a firearm while on duty,” spokeswoman Rhonda Lawson said in an email.

Two senior Canadian government sources told The Canadian Press the U.S. wants its customs officers who work in Nexus centres to have the same protections guaranteed to its preclearance officers in Canada under a bi-national agreement, with sidearms as a major sticking point in the talks.

The sources spoke on the condition of anonymity because they were not authorized to discuss the matter publicly.

All first-time Nexus applicants whose initial submissions are approved must come in for an enrolment centre interview before they get the green light. Some existing cardholders must also book a sit-down to renew their membership, which expires after five years.

About 75 per cent of current Nexus members are Canadian citizens, and another three per cent are permanent residents, according to the border agency.

While Canadians are allowed to head to one of a dozen Nexus centres in the U.S. located near the border, the wait is a long one. Five locations have no appointments available and four have none until next year, according to the U.S. Department of Homeland Security website. The only three spots with openings in 2022 are in Minnesota and Michigan’s Upper Peninsula.

The delay is affecting tourism and causing inconvenience for frequent border crossers.

“If you had more people with Nexus, they get through faster and they don’t clog up the other line,” said Jill Wykes, editor of Snowbird Advisor, an online resource for snowbirds.

“Many other government offices are open,” she said. “I think it’s inexcusable.”

The enrolment centres shut down in March 2020 due to the COVID-19 pandemic. Those in the U.S. reopened on April 19.

Since then, airports around the world have grappled with long security and customs queues amid staffing shortages and a massive travel rebound.

“It for sure has exacerbated the delay,” Duncan Dee, Air Canada’s former chief operating officer, said of the thinning number of Nexus travellers.

Added Teamsters Canada spokeswoman Catherine Cosgrove: “I haven’t even applied for Nexus, because there’s no point.”

Prime Minister Justin Trudeau declined to say whether firearms were at the heart of the impasse.

“I think it’s really important that we are able to stay true to our values as Canadians but respect the way we need to work together,” he told reporters Friday on a visit to Stratford, P.E.I.

“There are ongoing conversations right now and we’re going to try and make sure they get resolved in a way that is acceptable to both sides.”

The dispute has come up in recent discussions between Public Safety Minister Marco Mendicino and U.S. Homeland Security Secretary Alejandro Mayorkas, according to a Canadian government source.

Like the Fast program for long-haul trucker drivers, Nexus is a “trusted traveller” program that expedites entry for pre-cleared border crossers, typically through separate lines and automated kiosks at land crossings and airports as well as marine ports.

On top of a question portion, first-time interviews at enrolment centres include a high-resolution iris photo and fingerprinting, to be used for scanning at border kiosks.

Most Nexus processing centres are located at airports, though they are separate from customs halls.

“Why does an American officer need a gun during the Nexus interview? It’s not necessary,” said Len Saunders, an immigration lawyer based in Blaine, Wash., just south of Vancouver. He echoed one of the Canadian government sources, who noted any interviewees would already be provisionally approved following their background checks.

A Canada-U.S. agreement that took effect in 2019 laid out certain protections for U.S. border officers working in preclearance areas on Canadian soil and vice versa.

Preclearance is when customs and immigration officials from the destination country admit travellers in the country of origin — for example, clearing U.S. customs at the Toronto airport before boarding a flight to Los Angeles. The U.S. operates preclearance sites at eight Canadian airports and one ferry crossing.

Protections under the 2019 agreement include, for example, U.S. border officers being tried in American court for most offences if they’re charged with an on-duty crime in Canada. The deal also specifies that U.S. customs officers can carry firearms wherever Canada Border Services Agency officers can.

Neither CBSA nor U.S. officers are permitted to carry guns in Nexus centres. In the case of Nexus centres inside airports, the locations are distinct from preclearance areas.

The U.S. is seeking to apply the terms of the preclearance agreement to agents working in Nexus offices, which are not explicitly covered by the binational scheme, according to Saunders and the two government sources.

Not all stakeholders see Nexus as key to reducing overall wait times.

“It would be good to have them open again,” said Mark Weber, president of Canada’s Customs and Immigration Union, which represents some 10,000 border guards.

“But opening the Nexus offices will certainly not get people on to the front line, where we really need them.”

This report by The Canadian Press was first published July 22, 2022.

Clash over whether U.S. officers can be armed in Canada keeps Nexus centres closed

By Brett Bundale Rogers Communications Inc. was unable to switch customers to competing carriers during the unprecedented service outage earlier this

A Canadian telecom company has revealed how it was unable to restore its network during the blanket outage.

Een Canadees telecombedrijf heeft onthuld hoe het zijn netwerk niet heeft kunnen herstellen tijdens de algemene uitval.

Rogers Communications Inc. was unable to switch customers to competing carriers during the unprecedented service outage earlier this month despite offers of assistance from Bell and Telus, the company said in a document released late Friday. The fresh details offer a glimpse into the multiple options considered by Rogers during the blanket outage that knocked out mobile, landline and internet service to millions of customers across Canada on July 8. Despite competitors offering assistance during the outage, the company said it was unable to switch customers to a rival carrier.

Rogers Communications Inc. was niet in staat klanten om te schakelen naar concurrerende carriers tijdens de ongekende uitval van de dienst eerder deze maand, ondanks aanbiedingen van hulp van Bell en Telus, zei het bedrijf in een document vrijgegeven laat vrijdag. De nieuwe details bieden een blik op de verschillende opties die Rogers heeft overwogen tijdens de algemene storing die op 8 juli miljoenen klanten in heel Canada van mobiele telefonie, vaste telefonie en internet beroofde. Als gevolg daarvan was Rogers niet in staat de meeste 911-oproepen te routeren of vier noodsignalen af te geven tijdens de onderbreking van de dienst.

Rogers Communications Inc. was unable to switch customers to competing carriers during the unprecedented service outage earlier this month despite offers of assistance from Bell and Telus, the company said in a document released late Friday.

The telecom giant was also unable to shut down its radio access network, which would have automatically connected customers to another carrier for 911 calls, Rogers said in a submission to the Canadian Radio-television and Telecommunications Commission.

The fresh details offer a glimpse into the multiple options considered by Rogers during the blanket outage that knocked out mobile, landline and internet service to millions of customers across Canada on July 8.

It also reveals how the sweeping outage across its network limited its ability to respond with interim solutions while it restored service.

As a result, Rogers was unable to route most 911 calls or deliver four emergency alerts during the service disruption.

Despite competitors offering assistance during the outage, the company said it was unable to switch customers to a rival carrier.

It said doing so would have required access to parts of its system that were down during the outage.

Competing networks, Rogers said in its submissions, would also not have been able to handle the extra sudden volume of wireless customers, which the company pegged at more than 10 million.

The related voice and data traffic surge could have impeded operations on the other carriers’ networks, it said.

Meanwhile, Rogers considered shutting down its radio access network during the outage, which would have automatically connected customers to another carrier for 911 calls.

But once again, the company said the outage that took down its core system made such a shutdown impossible.

Moreover, turning off the radio access network would have prolonged the outage because restoring it once its network was fixed would have taken several hours, Rogers said.

“While considered many times during the day, shutting down the (radio access network) was simply not a solution,” Rogers said in its submission to the CRTC.

“The best and fastest way to restore 911 was to restore the network itself.”

As a result, Rogers said its radio access network remained in service, preventing many customer phones from automatically attempting to connect elsewhere.

Mobile customers always have the option to remove the SIM card from their device and to then place a 911 call. The handset will automatically connect to the strongest signal for emergency calls, Rogers said.

Although the number of failed 911 calls is unknown, the company said it was able to route “thousands” during its network’s intermittent service. Some Rogers customers were able to place emergency calls using the Bell or Telus networks.

Much of the specific information Rogers submitted to the CRTC was redacted from the document for security and competitive purposes.

Rogers also said four emergency alerts, all issued in Saskatchewan, did not reach customers during the outage.

It said one alert from the RCMP was related to a dangerous person while three were tornado warnings issued by Environment Canada.

Rogers, Bell and Telus are currently discussing solutions for potential future outages, which are expected to be included in a report to Ottawa this fall.

Rogers has come under intense scrutiny from both customers and the Canadian government following the ordeal, which also affected businesses and the Interac debit system.

Chief Executive Tony Staffieri has pledged to improve the resiliency of the company’s mobile and internet network.

Company representatives are scheduled to appear before the House of Commons industry committee on Monday to further discuss the outage.

The committee held an emergency meeting on July 15 and voted unanimously to open an investigation into the outage.

The committee will seek answers about the cause of the outage, its overall effect, and best practices to avoid similar situations in the future and better communicate with the public during such emergencies.

Following the outage, Innovation Minister François-Philippe Champagne directed Canada’s major telecom companies to reach agreements on assisting each other during outages and a communication protocol to better inform Canadians during emergencies.

This report by The Canadian Press was first published July 23, 2022.

ZDI-22-942

Vergelijkbare publicaties

DecisiveArchitect en zijn aangepaste implantaat JustForFun | CSA

FBI vordert half miljoen aan ransomware betalingen terug

Werknemers luchtvaartmaatschappij geconfronteerd met beledigingen, fysieke bedreigingen als passagier frustratie kookt over

Activeer post-kwantum sleuteluitwisseling in QUIC met de s2n-quic bibliotheek

Conflict over de vraag of Amerikaanse agenten gewapend mogen zijn in Canada houdt Nexus-centra gesloten

Rogers niet in staat klanten over te zetten naar Bell, Telus, ondanks concurrerende carrier aanbiedingen

Gevonden topics

Wat is Fleeceware?

Vigil gehouden voor dodelijk mishandelde bewaker

Verouderde IoT-apparatuur voor de gezondheidszorg vormt grote bedreiging voor de veiligheid