The UK's cyber-security agency warned on Wednesday of the dangers and complications that may arise from not removing Adobe Flash Player and continuing to use the software past its end-of-life (EoL) date of December 31, 2020.

Problematic scenarios include enterprise and other networks where legacy web apps and desktop software still use Flash to display multimedia content or support features like file uploads, file explorers, loading screens, and more.

The UK National Cyber Security Centre (NCSC) fears that some system administrators —with disregard for the security of their network— might make the wrong decision and disable update mechanisms in these applications or web browsers so employees can continue using these apps.

"Just to be clear: You should not disable browser and/or platform updates as a way of continuing to use Adobe Flash Player after 2020," the agency said on Wednesday. [Emphasis by the NCSC]

"Instead, we encourage you to work alongside your suppliers to remove Flash dependencies. Any vendors that are unwilling, or unable, to do this should, themselves, be considered risky."

Some software providers like SAS, Citrix, Articulate, and others have already released updates and customer guidelines in preparation for the Flash EOL. Others may have not, and system administrators may need to intervene and remove the software from their networks and find a Flash-free alternative.

But if there's one thing that IT administrators can't say is that they've been taken by surprise. Adobe gave companies a three-year start to prepare for the Flash EOL, having first announced it in 2017.

Browser makers like Apple, Google, Microsoft, and Mozilla have all announced they also planned to remove Flash from their products by the end of 2020 or late January 2021, making playing any Flash content inside their products impossible.

In a recent update to the Flash EOL page, Adobe itself has asked companies to be proactive about the EOL and remove the software even before the end of the year, even planning to manually prompt users to uninstall Fash later this year.

This is the second time that the NCSC has stepped forward to issue a warning to UK IT admins about a soon-to-be EOL software application. The agency published a similar alert in August 2019 to urge software developers to migrate their code to Python 3.x as the Python 2.x branch was nearing its scheduled EOL date of January 1, 2020.

The assistant chief executive of Singapore’s Cyber Security Agency, Brigadier General Gaurav Keerthi, says the island nation now considers providing a secure environment to citizens and businesses the equivalent of providing fresh water and sewerage services, and will next week improve digital hygiene with a voluntary scheme that will rate the security consumer broadband gateways.

Speaking at the Black Hat Asia conference in Singapore today, Keerthi explained that it’s his job to defend Singapore from cyber-threats. To explain his approach he started with a little history lesson in which he recounted how in the 1800s securing a fresh water supply and disposing of waste water were seen as personal responsibilities. Once it was realised that public health crises were the result of that attitude, widespread rollout of a universal fresh water supply and sewerage quickly became seen as a public good that governments needed to provide.

Keerthi said government thinking about information security is mired in that 1800s mentality of hoping citizens will do the right thing, or can be scolded into better behaviour. But with everyday life increasingly dependent on online services, he said Singapore has decided it is time to provide the infosec equivalent of clean tap water to all.

One way the nation is doing so is with services that the private sector can – pardon the pun - tap into. To that end the country offers “SingPass”, a national identity scheme that links citizens to services and is also offered to private enterprise such as banks as a free-to-use alternative to developing their own authentication schemes.

“We want to make the secure process the easier process,” Keerthi explained, promising the announcement of more such services for developers next week.

Also to be revealed next week is a “Consumer labelling service” for connected devices.

The scheme will initially see gateways provided by ISPs and smart hubs rated with a four-star assessment of their security. Keerthi likened the ratings to nutrition advice on food packaging and said the aim of the scheme is to have vendors aspire to winning good ratings and make investments that will make their products, and therefore Singapore, more secure.

Singapore has form in this field, he said, with energy efficiency ratings for air conditioners. Before the advent of those ratings, Keerthi said, consumers bought on price and manufacturers raced to the bottom. Today he says manufacturers even claim they would achieve a six-star rating if Singapore’s scheme did not max out at five stars.

Keerthi said the scheme will not be mandatory, but over time he thinks it will become natural for vendors to participate.

The Register asked how Singapore plans to secure participation in the scheme given the sheer quantity of connected devices on offer. Keerthi’s answer was “one at a time”, starting with devices that have the greatest potential for harm.

Details of how devices will be rated will be revealed during Singapore International Cyber Week 2020, which starts on October 5th.

Keerthi also said that Singapore hopes to share its consumer tech labelling scheme with other nations, as it believes the notion of infosec as a public good will become widespread to safeguard increasing dependence on national services and therefore improve national security. ®

Australia’s Department of Foreign Affairs and Trade (DFAT) has just exposed personal details of over 1,000 citizens in an email.

Australia has all-but-closed its borders during the COVID-19 pandemic, rationing the number of citizens who can fly into the country each day. That policy means the few airlines still flying sell their business class seats and not many more, leading to people holding cheaper tickets being bumped off flights and big backlogs of citizens trying to get home to mostly-COVID-free Australia.

Some of those bumped from flights have quit jobs and packed up homes in in anticipation of returning home. Others are no longer permitted to work in whichever country they currently inhabit.

In recent weeks this has led to political pain for the government as Australians ask increasingly pointed questions about why they can’t come home at a time of their choosing.

So last week the government increased entry quotas and started an emergency loans scheme for those in dire need.

And when it emailed potential recipients of those loans, it used the “To” field.

DBA locked in police-guarded COVID-19-quarantine hotel for the last week shares his story with The Register

READ MORE

Officials tried to recall the mail, but that seldom works and didn’t do so on this occasion either.

A little later DFAT sent another mail in which it said: “"We request your assistance in immediately deleting that email from your IT system and refraining from any further forwarding of the email, to protect the privacy of the individuals concerned.”

The Department also tweeted an apology of sorts, but it did not always go down well.

It may be “government agencies doing dumb things with email” week in Australia’s neighborhood, as a similar breach has emerged with New Zealand’s Civil Aviation Authority allegedly making the same mistake when mailing residents who had complained about drone regulations. That breach is detailed in this video. ®

Social networking giant Twitter said today that it removed around 130 Iranian Twitter accounts for attempting to disrupt the public conversation during last night's first Presidential Debate for the US 2020 Presidential Election.

Twitter said it learned of the accounts following a tip from the US Federal Bureau of Investigations.

"We identified these accounts quickly, removed them from Twitter, and shared full details with our peers, as standard," the social network said today.

"They [the accounts] had very low engagement and did not make an impact on the public conversation," it added.

Twitter said it plans to publish details about the removed accounts and their tweets on its Transparency portal's section for influence operations.

This marks the second time this month that Twitter has intervened to take down an influence operation on its website following an FBI tip. Twitter previously removed accounts tied to PeaceData, a news site that published misleading articles about world politics, which the FBI claimed was a Russian influence operation.

Developing story...

Conversations on the final day of this year’s WIRED25 event revolved around the existential mess that has characterized 2020: Covid-19, election integrity, California wildfires. But the experts who came together to share their insights into these problems, and the work they have been doing to confront them, also communicated a sense of genuine optimism.

National Institute of Allergy and Infectious Diseases director Anthony Fauci started off today’s event in conversation with WIRED editor at large Steven Levy. And while Fauci noted some alarming signs—40,000 new US cases each day, an increase in test positivity in some areas—he remains optimistic about an end to the pandemic. He has trust in the vaccine development process, and he thinks we should expect to have proof of a safe, effective vaccine by November or December. But for Fauci, the prospect of a vaccine in the next few months isn’t the only reason to be hopeful. He believes that hope itself is an effective tool in fighting the pandemic. “Despair makes you throw your hands up and say, it doesn’t matter what I do, what’s going to happen is going to happen,” he said. “That is incorrect. It does matter what we do. And if we do it for a while longer, we will look behind us and the outbreak will be behind us, not among us.”

Next, WIRED senior writer Andy Greenberg spoke with Marc Rogers, Nate Warfield, and Ohad Zaidenberg, who cofounded the volunteer group CTI League to protect hospitals and other essential organizations from phishing and ransomware during the pandemic. “It’s almost fair to say that this is a cyber pandemic, because the bad guys, criminal actors, have always exploited big events,” said Rogers. “And there is no bigger event than a global pandemic.” Even when the pandemic ends, however, hospitals, emergency services, and other organizations will still be vulnerable to cyberattacks, and so CTI League is now looking at ways to continue their work going forward.

WIRED senior writer Lily Hay Newman then spoke with another cybersecurity expert, Maddie Stone, who works as a security researcher at Google Project Zero. The goal of Project Zero is to find and eliminate zero-day vulnerabilities—unknown software flaws that could be exploited by hackers. Zero-day vulnerabilities can be difficult to find and use, so hackers deploy them for narrower applications. “They’re really targeted, sophisticated types of attacks, because it takes a lot of expertise to find them and to exploit them,” Stone said. “So they’re usually only used to target high profile, highly valuable targets, such as political dissidents, human rights activists, journalists, things like that.”

Newman stayed online to chat with Ben Adida, the executive director of VotingWorks, which is the only nonprofit maker of US election equipment. Given the complexity of US elections, Adida said, voting machines are a necessity, and they should not be produced by for-profit companies. “We think that elections are the foundation of democracy, and that foundation should be publicly owned,” he said. But despite persistent worries about voting machine hacks and Trump’s constant fear-mongering about voter fraud—including during last night’s presidential debate—Adida believes that the greatest risk to election integrity comes from us. “The biggest concern I have is that a lot of well-meaning folks out there who care about democracy are going to see an alarmist story on their Twitter feed, or in their Facebook feed, and they’re going to say, ‘I need to tell my friends about this,’” he said. “In the process, they become an unwitting participant in this misinformation game of reducing people’s trust in an election outcome.” He left his audience with a stark warning: “If we lose faith in democracy, we lose democracy.”