Nine Entertainment got hit by a "major cyber attack" that impacted its live broadcasting operations and print production systems on Sunday morning. It was apparently so bad they had to get the Australian Cyber Security Centre involved and told all their staff to work from home indefinitely. Fortunately, the attack prevented Nine broadcasting "Weekend Today from 7am until 10am". It doesn't appear to be a cryptolocker, as the article says "no requests for ransom have been made". The article also reckons "a large number of external security experts" "had not seen this kind of attack before in Australia" and said experts "believe it is some kind of ransomware likely created by a state-based actor".
NBN has admitted they've done modeling on a "flat rate" pricing model for ISPs - i.e: they pay NBN a fixed rate per month for bandwidth instead of a mix of fixed rate and variable costs based on customer use. NBN has historically been absolutely against a flat pricing model as it means less money for them, but the ISPs are demanding NBN make that modeling public, as its something they've been calling for since pretty much day one of the NBN and would make it easier for them to price end user plans. Ken Tsang's blog has a good explanation of how NBN's wholesale pricing works and Launtel's blog highlights how that mess of a pricing model impedes higher speed tiers.
Looks like Google's Project Zero security team stumbled across a "hacking group exploiting 11 powerful vulnerabilities to compromise devices running iOS, Android, and Windows", that ended up being a counter terrorism operation by western governments. They chose to reveal the vulnerabilities, but didn't attribute it to anyone and it's still unknown if Google gave the governments a heads up. It's a tricky area for Google as on one hand, they want their software to be as secure as possible to protect their customers, but on the other, governments of all kinds leverage those flaws to spy on people. Sometimes the people they spy on, we want them to spy on and then arrest or whatever. Sometimes we don't. Glad its not me making those decisions.
Many of you use Pi-Hole or NextDNS to block and track "smart" devices that send tracking info back to their overlords. Unfortunately manufacturers know this, as researchers at the University of Iowa found that 98% of smart assistants, 72% of smart TVs and 46% of game consoles have hardcoded DNS settings in their configuration to by-pass our solutions to their bullshit. Even if you give out a DHCP lease to these devices with a different DNS server IP addresss, they ignore it and use the DNS server the manufacturer wants you to use. LabZilla has some instructions on how to force all DNS queries through a local DNS server (e.g: Pi-Hole) via some port forwarding NAT rules, but it's a bit of a pain to implement.
📻 New Race - Radio Birdman
😎 The Sizzle is curated by Anthony "@decryption" Agius and emailed every weekday afternoon.
💬 Did you know that The Sizzle has a Slack group? Join in and chat with other subscribers like you.
💳 Paid subscriber looking to manage your billing info? Visit the customer portal.
The Sizzle is created on Wathaurong land and acknowledges the traditional owners of country throughout Australia, recognising their continuing connection to land, water and community. I pay my respect to them and their cultures and to elders both past and present.