Connect with us

Tech

UK ramps up ransomware fightback with supply chain security guide | Computer Weekly

Published

on

UK ramps up ransomware fightback with supply chain security guide | Computer Weekly


The UK government has released new anti-ransomware guidance designed to address the weaknesses in supply chains that have been the ultimate source of several of many of the record 204 “nationally significant” incidents dealt with by the National Cyber Security Centre (NCSC) in the past year.

Developed alongside the Singapore authorities as part of a joint commitment made last year under the auspices of the Counter Ransomware Initiative (CRI), the guidance aims to help organisations spot issues in their supply chains before cyber criminals are able to exploit them and sets out several practical steps to check supplier security and guard against vulnerabilities. The CRI is backed by over 67 countries – but not the US – and bodies such as Interpol and the World Bank.

“Ransomware and cyber attacks pose an immediate and urgent threat to our nation’s security and economy,” said UK security minister Dan Jarvis. “We are taking decisive action to counter this threat, but global coordination is essential.

“Cyber security must be a top priority for all businesses. It’s vital that the counter-ransomware guidance is followed and strong measures are taken to defend against these destructive attacks.”

NCSC director for national resilience, Jonathon Ellison added: “A ransomware attack on one organisation can severely disrupt entire supply chains, affecting businesses and services across the UK and beyond. We know that many of these incidents are preventable by implementing basic cyber security measures, such as the UK’s Cyber Essentials certification.

“We strongly urge organisations to follow the NCSC’s supply chain security guidance to help protect themselves, their partners, and the UK’s national cyber resilience.”

The guidance itself – available to read in full here – sets out a multi-step plan to enhance supply chain resilience. These steps emphasise factors such as the need to select suppliers that have implemented security controls aligned to the risk levels of the activity they are participating in; the need to communicate your organisation’s own security expectations to supplier partners; the need to build cyber into the contracting process; the need to conduct independent audits and tests of suppliers or requiring external accreditation from cyber technical authorities; and the need to insist upon cyber insurance policies being in place.

The guidance additionally advises organisations to work hand-in-hand with suppliers to review any incidents or near misses, exercise response plans, share new threat intelligence or revised best practices, and keep contracts updated to reflect the changing cyber security landscape. It also urges organisations to do more to drive dialogue and coordination across their supplier network and among their peers.

“Meticulously planning, investing in the right tools and running countless exercises are vital, but even so, nothing truly prepares you for the moment a real cyber event unfolds. The intensity, urgency and unpredictability of a live attack is unlike anything you can rehearse,” said Shirine Khoury-Haq, CEO of The Cooperative Group, which was hit by a massive ransomware attack in April that cost the group £206m

“What matters most is learning, building resilience, and supporting each other to prevent future harm. This is a positive step in the right direction for building a safer digital future,” she added.

UK to sign controversial UN cyber convention

UK delegates also plan to sign a controversial new United Nations (UN) convention on tackling global cyber crime this weekend at a ceremony in Hanoi, Vietnam.

The UN Convention against Cybercrime was adopted at the General Assembly on 24 December 2024 by resolution 79/243, and is the first comprehensive global treaty on cyber crime.

The convention was initially proposed by the Russian government which objected to the longstanding Budapest Convention on Cybercrime, a Council of Europe-backed initiative dating back to 2004.

Although the European Union (EU), UK and US initially aligned against the convention on the basis they believed it to be a power grab by Russia to increase its control over the wider internet, the Biden administration ultimately rejected human rights concerns and was swayed to back it on the basis that it was felt more important for the US to have a seat at the table.

Whether or not it will truly be effective in tackling the notorious Russian-speaking ransomware gangs to which Moscow effectively turns a blind eye remains to be seen.

However, besides supposedly getting tough on ransomware, the convention importantly aligns the criminalising of cyber-enabled offences such as child sexual exploitation, fraud, and the non-consensual sharing of intimate images.

It also establishes a global network to strengthen international law enforcement collaboration with a constant point of contact in every state to assist in cross-border investigations.



Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Tech

AI Research Is Getting Harder to Separate From Geopolitics

Published

on

AI Research Is Getting Harder to Separate From Geopolitics


The world’s top AI research conference, the Conference on Neural Information Processing Systems—better known as NeurIPS—became the latest organization this week to become embroiled in a growing clash between geopolitics and global scientific collaboration. The conference’s organizers announced and then quickly reversed controversial new restrictions for international participants after Chinese AI researchers threatened to boycott the event.

“This is a potential watershed moment,” says Paul Triolo, a partner at the advisory firm DGA-Albright Stonebridge who studies US-China relations. Triolo argues that attracting Chinese researchers to NeurIPS is beneficial to US interests, but some American officials have pushed for American and Chinese scientists to decouple their work—especially in AI, which has become a particularly sensitive topic in Washington.

The incident could deepen political tensions around AI research, as well as dissuade Chinese scientists from working at US universities and tech companies in the future. “At some level now it is going to be hard to keep basic AI research out of the [political] picture,” Triolo says.

In its annual handbook for paper submissions, issued in mid-March, NeurIPS organizers announced updated restrictions for participation. The rules stated that the event could not provide services including “peer review, editing, and publishing” to any organizations subject to US sanctions, and linked to a database of sanctioned entities. It included companies and organizations on the Bureau of Industry and Security’s entity list and those on another list with alleged ties to the Chinese military.

The new rules would have affected researchers at Chinese companies like Tencent and Huawei who regularly present work at NeurIPS. The database also includes entities from other countries such as Russia and Iran. The US places limits on doing business with these organizations, but there are no rules around academic publishing or conference participation.

The NeurIPS handbook has since been updated to specify that the restrictions apply only to Specially Designated Nationals and Blocked Persons, a list used primarily for terrorist groups and criminal organizations.

“In preparing the NeurIPS 2026 handbook, we included a link to a US government sanctions tool that covers a significantly broader set of restrictions than those NeurIPS is actually required to follow,” the event’s organizers said in a statement issued Friday. “This error was due to miscommunication between the NeurIPS Foundation and our legal team.”

Before they reversed course, the conference organizers initially said that the new rule was “about legal requirements that apply to the NeurIPS Foundation, which is responsible for complying with sanctions,” adding that it was seeking legal consultation on the issue.

Immediate Backlash

The new rule drew swift backlash from AI researchers around the world, particularly in China, which produces a large quantity of cutting-edge machine learning papers and is home to a growing share of the world’s top AI talent. Several academic groups there issued statements condemning the measure and, more importantly, discouraging Chinese academics from attending NeurIPS in the future. Some urged Chinese academics to contribute instead to domestic research conferences, potentially helping increase the country’s influence in relevant science and tech fields.

The China Association of Science and Technology (CAST), an influential government-affiliated organization for scientists and engineers, said Thursday that it would stop providing funding for Chinese scholars traveling to attend NeurIPS and would use the money instead to support domestic and international conferences that “respect the rights of Chinese scholars.”

CAST also said it will no longer count publications at the 2026 NeurIPS conference as academic achievements when evaluating future research funding. It’s unclear if the organization will reverse course now that NeurIPS has walked back the new rule.



Source link

Continue Reading

Tech

Iranian Hackers Breached Kash Patel’s Email—but Not the FBI’s

Published

on

Iranian Hackers Breached Kash Patel’s Email—but Not the FBI’s


Handala’s second claim, however—that it hacked the FBI—seems, for now, to be fiction. All evidence points to Handala having breached Patel’s older, personal Gmail account. Widely believed to be a “hacktivist” front for Iran’s intelligence agency the MOIS, Handala suggested on its website that the emails contained classified information, but the messages initially reviewed by WIRED didn’t appear to be related to any government work. TechCrunch did find, however, that Patel appears to have forwarded some emails from his Justice Department email account to his Gmail account in 2014.

Handala, which cybersecurity experts have described to WIRED as an “opportunistic” hacker group whose cyberattacks and breaches are often calculated more for their propaganda value than their tactical impacts, has nonetheless made the most of Patel’s embarrassing breach. “To the whole world, we declare: the FBI is just a name, and behind this name, there is no real security,” the group wrote in its statement. “If your director can be compromised this easily, what do you expect from your lower-level employees?”

Handala Hackers Put $50 Million Bounty on Trump and Netanyahu’s Heads

For further evidence of Handala’s bombastic rhetoric, look no further than another post on its website earlier this week (we’re intentionally not linking to it) that offered a $50 million bounty to anyone who could “eliminate” US president Donald Trump and Israeli prime minister Benjamin Netanyahu. “This substantial prize will be awarded, directly and securely, to any individual or group bold enough to show true action against tyranny,” the hackers’ statement read, along with an invitation to any would-be assassins to reach out via the encrypted messaging app Session. “All our communication and payment channels utilize the latest encryption and anonymization technologies, your safety and confidentiality are fully guaranteed.”

That bounty, Handala explained, was posted in answer to a statement about Handala published on the US Department of Justice website last week that offered $10 million for information leading to the identity or location of anyone who carries out “malicious cyber activities against US critical infrastructure” on behalf of a foreign government.

“Our message is clear: If you truly have the will and the power, come and find us!” Handala wrote in its response. “We fear no challenge and are prepared to respond to every attack with even greater force.”

In yet another post on its website this week, Handala also claimed to have doxed 28 engineers at military contractor Lockheed Martin working in Israel and threatened them with personal harm if they didn’t leave the country within 48 hours. When WIRED tried calling the phone numbers included in Handala’s leaked data, however, most of them didn’t work.

Apple says no device with its Lockdown Mode security feature enabled has ever been successfully compromised by mercenary spyware in the nearly four years since its launch. Amnesty International’s security lab head, Donncha Ó Cearbhaill, also says his team has seen no evidence of a successful attack against a Lockdown Mode–enabled iPhone. And Citizen Lab, which has documented several successful spyware attacks against iPhones, says none involve a Lockdown Mode bypass, while in two cases its researchers found the feature actively blocked attacks against NSO Group’s Pegasus and Intellexa’s Predator. Google researchers, meanwhile, found one spyware strain that simply abandons infection attempts when it detects the feature is enabled.

Lockdown Mode works by disabling commonly exploited iPhone features, such as most message attachment types and features like links and link previews. Incoming FaceTime calls are blocked unless the user has previously called that person within the past 30 days. When the iPhone is locked, it blocks connections with computers and accessories. The device will not automatically join nonsecure Wi-Fi networks, and 2G and 3G support is disabled. Apple has also doubled bounties for researchers who detect any Lockdown Mode bypass, with payouts up to $2 million.



Source link

Continue Reading

Tech

This Premium Sennheiser Soundbar Is $1,000 Off

Published

on

This Premium Sennheiser Soundbar Is ,000 Off


Looking for an all-in-one soundbar that sounds as big as it looks? Sennheiser’s Ambeo Max uses its oversized body to produce beefy, enveloping sound, and right now you can grab it for just $2,000 at Best Buy, a sizable $1,000 markdown from the usual list price. It’s one of our favorite standalone premium soundbars, particularly if you don’t want to deal with an exterior subwoofer but still want bigger bass than you’re likely to find on smaller options.

While it might be a bit larger than your average soundbar, Sennheiser uses the space well, packing a ton of functionality and drivers into the less-than-compact body. There are both full-range and 1-inch tweeters combined in every conceivable direction, and the result is an impressive reproduction of true spatial audio, something few other standalone bars can claim. As a result, it also has an impressive low-end, with bass that doesn’t rival dedicated subwoofers, but comes really close for how much simpler the setup process will be.

The larger footprint also allows for a huge number of inputs, more than you’re likely to find on those tiny soundbars that slide under your screen. In addition to an HDMI 2.1 output with eARC, you’ll get three HDMI inputs with 4K pass-through at 60Hz, USB, Ethernet, and optical audio. There are even RCA ports in case you want to hook this up to your turntable. There’s also a dedicated subwoofer output, in case you decide you want to add one to your setup down the road, giving you a ton of options should you decide to put the Ambeo Max at the center of your home audio setup.

Ready to make the move to a bigger, better soundbar? Swing on over to Best Buy to grab this hefty discount on the Sennheiser Ambeo Max, or check out our guide to the best premium soundbars for some of our other favorite picks. If you’re just out looking for a great deal in general, the Amazon Big Spring Sale is underway, and we’ve got a dedicated post with all the best discounts on everything from smartwatches to water bottles.



Source link

Continue Reading

Trending