South Korea orders urgent review of energy infrastructure cybersecurity

Salesforce is digging itself out of a multi-hour outage right now that it has blamed on a DNS issue.

At one point today, the IT breakdown was so severe that its status page was pretty much inaccessible for netizens, and staff resorted to posting updates on their help and training sub-site.

“Salesforce is experiencing a major disruption due to what we believe is a DNS issue causing our service to be inaccessible,” CTO Parker Harris said in a statement. “We recognize the significant impact on our customers and are actively working on resolution.

A dozen Wi-Fi design and implementation flaws make it possible for miscreants to steal transmitted data and bypass firewalls to attack devices on home networks, according to security researcher Mathy Vanhoef.

On Tuesday, Vanhoef, a postdoctoral researcher in computer security at New York University Abu Dhabi, released a paper titled, “Fragment and Forge: Breaking Wi-Fi Through Frame Aggregation and Fragmentation” [PDF].

Scheduled to be presented later this year at the Usenix Security conference, the paper describes a set of wireless networking vulnerabilities, including three Wi-Fi design flaws and nine implementation flaws.

Microsoft says its Outlook desktop client is suffering serious “email visibility issues” today, with a fix yet to be rolled out. Users have reported either whole emails missing, chunks of data gone, or just seeing the first line of messages.

Folks can use the web or mobile client of Outlook, or the Windows desktop client in “safe mode.” Otherwise, you’re out of luck for the next few hours.

“We’re investigating an issue with email message visibility in Outlook. Outlook on the web appears to be unaffected,” the Windows giant said a couple of hours ago.

WhatsApp users who refuse to accept its new privacy policy will slowly but surely be cut off from the chat app, the social network has confirmed.

In January, WhatsApp users were told if they wanted to keep using the software, they must agree to an updated fine print that, among other things, allows their data to be passed onto not only WhatsApp’s parent Facebook but also its subsidiaries as and when decided by the tech giant.

This information includes names, profile pictures, status updates, phone numbers, contacts lists, and details about mobile devices and connections, though not the contents of encrypted messages and calls. Those who did not accept the terms and conditions would not be allowed to use the application from February.

CyberUK 21 SolarWinds’ chief exec has described the 18,000 customers who downloaded backdoored versions of its Orion software as a “very small” number while giving a speech to an infosec event.

Sudhakar Ramakrishna, who joined the biz in January, made the comparison while giving the opening keynote at the CyberUK conference, organised by Britain’s National Cyber Security Centre (NCSC). He’ll also be giving a talk on the topic at this month’s RSA Conference in the US, presumably part of an extended apology tour.

“Although the number of affected customers is very small, that we eventually discovered, it is still a very important thing to discover, because this is a unique and very novel attack on the supply chain of a company,” said Ramakrishna in his opening remarks – adding that “none of our source code control systems were tampered with.”

Patch Tuesday Microsoft’s May Patch Tuesday brought a lighter-than-usual load of 55 fixes for 32 of the Windows giant’s applications and services, which is about half what was served up in April.

The Redmond-based firm’s Office and Windows flagships house many of the identified vulnerabilities, alongside Internet Explorer, Visual Studio, Visual Studio Code, Skype, and other software.

Among the 55 CVEs identified by Microsoft, four are rated critical, 50 are rated important, and one is rated moderate.

Birds chirping, the gentle burbling of coffee brewing – these are the sounds we typically associate with the dawn hours.

Everyone, that is, except customers of O2, who arose this morning to a noise described as akin to a “nuclear siren” after the network performed an unannounced test of the UK’s emergency alert system.

The two alerts, sent around 0745 and 0800, were accompanied by a forebodingly shrill beep, the kind of which you’d expect to hear if a cruise missile was heading to your house. Meanwhile, a disembodied computerised voice read out the alert’s message, which said as follows:

CyberUK 21 Priti Patel has promised a government review of the UK’s 30-year-old Computer Misuse Act “this year” as well as condemning companies that buy off ransomware criminals.

The Home Secretary pledged the legal review in a speech at the CyberUK conference this afternoon, organised by the National Cyber Security Centre (NCSC).

“As part of ensuring that we have the right tools and mechanisms to detect, disrupt and deter our adversaries, I believe now is the right time to undertake a formal review of the Computer Misuse Act,” said Patel.

Folks in England can from next week use the NHS App to confer their vaccination status, in the face of warnings that the technology could lead to identifiable medical information being exposed.

The British government has announced that from 17 May, people will be able to demonstrate their COVID-19 vaccination status – a so-called vaccine passport or certificate – using the NHS App, which began its public rollout in January 2019, well before the pandemic. Connected to a GP’s practice systems, it is designed to help users book appointments, order repeat prescriptions, and view medical records. This feature is so far available to people registered with a GP in England only.

“You can access the app through mobile devices such as a smartphone or by tablet. Proof of your COVID-19 vaccination status will be shown within the NHS App,” the government said this week.

BT-owned infrastructure provider Openreach has confirmed plans to stop sales of copper-based phone and broadband services in 77 exchange locations across the UK, affecting roughly 700,000 premises.

The “stop-sell” order will come into effect on April 29, 2022. Included in the 77 locations are Ellesmere Port in Cheshire, Hayes in Greater London, Kelso in Scotland, and Coleraine in Northern Ireland.

Those clinging to their legacy-based copper phone lines won’t necessarily see any immediate changes to service. However, the “stop sell” order means that anyone who switches broadband or landline providers will only be able to choose from products delivered over fibre.