Author: My Office News

By Lily Hay Newman for Wired 

For two hours on Monday, internet traffic that was supposed to route through Google’s Cloud Platform instead found itself in quite unexpected places, including Russia and China. But while the haphazard routing invoked claims of traffic hijacking—a real threat, given that nation states could use the technique to spy on web users or censor services—the incident turned out to be a simple mistake with outsized impacts.

Google noted that almost all traffic to its services is encrypted, and wasn’t exposed during the incident no matter what. As traffic pinballed across ISPs, though, some observers, including the monitoring firm ThousandEyes, saw signs of malicious BGP hijacking—a technique that manipulates the web’s Border Gateway Protocol, which helps ISPs automatically collaborate to route traffic seamlessly across the web.

ThousandEyes saw Google traffic rerouting over the Russian ISP TransTelecom, to China Telecom, toward the Nigerian ISP Main One. “Russia, China, and Nigeria ISPs and 150-plus [IP address] prefixes—this is obviously very suspicious,” says Alex Henthorne-Iwane, vice-president of product marketing at ThousandEyes. “It doesn’t look like a mistake.”

Malicious BGP hijacking is a serious concern, and can be exploited by criminals or nation state actors to intercept traffic or disrupt a target service—like Google. But the technique also has a dopey, well-intentioned cousin known as a prefix leak, or sometimes “accidental BGP hijacking.”

In both cases, rerouting occurs when an ISP declares that it owns blocks of IP addresses that it doesn’t actually control. This can be an intentional deception, but can also simply come down to a configuration error that, while disruptive, is not intentional. On Monday, a Google spokesperson said that the company didn’t see signs of malicious hijacking, and instead suspected that the Nigerian ISP Main One had accidentally caused the problem.

“The problem here is a failure to apply basic best current practices to these routing sessions.”

There are minimum best practices that ISPs should implement to keep BGP routes on the up and up. These are important, because they apply filters that catch errors in the event of a route leak and block problematic routes. Not all ISPs implement these protections, though, and in a prefix leak like the one that affected Google, traffic will flow chaotically across networks, not based on efficiency or established paths, but based on which networks haven’t put the BGP safeguards in place and will therefore accept the rogue routing.

Indeed, on Tuesday morning Main One said in a statement that, “This was an error during a planned network upgrade due to a misconfiguration on our BGP filters. The error was corrected within 74mins.”

In this case, it appears that the Russian and Chinese ISPs, and perhaps others as well, offered a path to the Google traffic because they hadn’t implemented protective configurations.

The protocols underlying the internet were written decades ago, in a different era of computing, and many have needed major security overhauls and additions to improve trust and reliability around the web. There was the effort to encrypt web traffic with HTTPS, and the growing movement to secure the internet’s Domain Name System address lookup process so it can’t be used to spy on users, or for malicious rerouting.

Similarly, ISPs and internet infrastructure providers are starting to implement a protection called Resource Public Key Infrastructure that can virtually eliminate BGP hijacking, by creating a mechanism to cryptographically confirm the validity of BGP routes. Like HTTPS and DNSSEC, RPKI will only start to provide true customer protection when a critical mass of internet infrastructure providers implement it.

“This incident had a non-trivial impact because Google and some other prominent network routes were accidentally leaked,” says Roland Dobbins, a principal engineer at the network analysis firm Netscout. “But the problem here, as it is in most of these cases, is a failure to apply basic best current practices to these routing sessions. The key is for network operators to participate in the global operational community, get these kinds of filters put in place, and move to implement RPKI.”

While Google’s incident wasn’t a hack and instead gets into obscure internet protocol drama, the impact for users on Monday was apparent—and shows the pressing need to resolve issues with BGP trust. The flaw has been maliciously hijacked before, and could be again.

Discovery launches new ‘tech-led’ bank

Source: Fin24

Discovery has launched its much anticipated bank, hailed as the first in rewarding good financial behaviour.

Speaking at the launch of Discovery Bank at the firm’s headquarters in Johannesburg, CEO Adrian Gore said, “The purpose of the bank is making people healthy in a financial sense”.

“It is a tech-led bank that is aimed at incentivising behavioural change,” said Gore.

He said the bank would be mobile-led and accessed from your phone. It will also be linked to the company’s Vitality Rewards programme.

“Everything is on the face of the app, the functionality is amazing with real time EFT payment to all banks,” he said.

Gore said, however, they would not be disclosing the bank fees as yet.

He said 10% of the bank would be owned by black depositors, adding however that it was not a BEE scheme.

In terms of the interest rates structure, Gore said it would be market-related combined with the client’s vitality status.

Clients would also be able to withdraw cash at any ATM while Gore said there are plans to set up one branch inside the company’s Sandton offices.

He said the bank’s target market was “very broad” – from a high LSM to the lower level.

SAPO CEO sets deadline to clear backlog

A backlog of millions of items still waiting to be delivered at the Johannesburg nerve centre of the Post Office is being cleared as fast as possible.

That’s according to SAPO CEO Mark Barnes, who has stated that the provider is looking to clear the backlog by 24 November 2018.

“We started off in April with a 46-million item backlog and we are now down to a 7.8-million backlog.”

The bulk of that is sitting at the Witspos Hub in Johannesburg.

SAPO defines a “backlog” as any item of post five or more days behind schedule.

Barnes says there have been some improvements in clearing the domestic mailing backlog but they still need to catch up with international deliveries.

Listen to the full interview here.

Malusi Gigaba resigns

By Tshidi Madia for News24

Home Affairs Minister Malusi Gigaba resigned from his post following mounting pressure for President Cyril Ramaphosa to give him the boot.

He decided to step down of his own accord, following a meeting with some of his comrades in the ANC on Tuesday morning, one of the provincial party leaders says.

The presidency confirmed Gigaba’s resignation via a statement in the afternoon, saying he decided to do so “for the sake of our country and the movement to which he belongs”.

“He resigned of his own accord, he showed some remorse and decided to step aside,” Ekurhuleni Mayor and ANC chairperson in the region Mzwandile Masina told News24.

“We met with him in the morning, discussed this issue and said the writing is on the wall and that it was best for him to resign.”

“To stay on and wait to be fired is arrogant,” added Masina.

He said the former minister’s friends and comrades advised him to step down and fight his battles outside of government.

“We said he must think of the ANC and his family, telling him it was best to step aside and fight the issues from outside,” said Masina.

Gigaba has been at the centre of numerous controversies, which led to growing calls for President Cyril Ramaphosa to axe him.

In recent weeks Gigaba had: a leaked private video of him engaging in a sexual act; the Constitutional Court’s dismissal of his application for leave to appeal a finding that he lied under oath about approving the Oppenheimers’ private terminal at OR Tambo International Airport; and Public Protector Busisiwe Mkhwebane reaching similar conclusions to the court in her own investigation into the Fireblade scandal.

“He needs to apply for different court processes to clear his name. He cannot be a public representative, he cannot sit on boards… it’s about his integrity,” said Masina.

Masina also said Gigaba, out of his love for the ANC and his own contributions to the liberation movement where he once served as ANC Youth League president, agreed.

Internal battles in the ANC

Masina, who has been publicly defending Gigaba, refused to name others who took part in the Tuesday meeting. But said there appeared to be an understanding that the younger generation of leaders within the party, would not get a chance to lead it.

“There is a whole generation being wiped out of government, it has no prospects,” said Masina.

He told News24 this was linked to internal battles within the ANC.

Gigaba himself has previously said there was a campaign to destroy him, accusing Parliament’s portfolio committee on public enterprises of joining in on the campaign after a report into his role at Eskom was leaked.

“We are blaming no one, he is taking responsibility and he will fight,” said Masina of his comrade and friend.

A guide to buying on Black Friday

Source: News24

Research shows that the Black Friday phenomenon has grown faster in South Africa than any other country in the world.

Black Friday, a retail promotion that takes place on the last Friday of November after the American Thanksgiving holiday, originated in America in the 1950s.

Last year, PriceCheck saw three times the number of daily visits to its online shopping comparison website on Black Friday, and twice the number on Cyber Monday, compared to its 2017 average.

In addition, these visits were on average 30% longer than the 2017 average duration. This year is likely to surpass that, with PayPal predicting that South Africans’ online shopping spend will top R53bn by the end of 2018, up from R37.1bn in 2017. But as the South African online shopping market grows, providing more to choose from, shoppers should put a game plan in place to ensure they get the best deals from the most reliable, and secure retailers.

Lebogang Mokubela, founder of township-based retail marketing company Lemok Group, says: “Black Friday marketing has been exceptional with millions of rand being invested to draw crowds to their offerings.”

Taking a look at shopping centres across the country with a combined GLA of approximately 23.4 million square metres, an average of 3.2% of tenants participated in Black Friday in 2016 and an average of 21% of tenants participated in Black Friday in 2017 – an increase of 17.8% year on year, Mokubela says. Small regional shopping centres indicated a growth average of 31% year-on-year.

Tips for getting the best deals on Black Friday

  • Have a plan. Know what you want, need and can afford before you get enticed by all the shiny offers in front of you
  • Choose a secure way to pay: credit card payments that ask you for a supplementary one-time pin – such as Verified by Visa, Snapscan and PayPal – are all good options
  • Take note of the delivery and return details. Will you get the purchase when you need it, and if you need to return it, will you end up paying more on delivery costs?
  • Look out for hidden costs or additional purchases you might need to make
  • Compare deals: similar deals might be packaged slightly differently, so make sure you are comparing apples with apples
  • Only buy from reputable retailers so you can be sure you will receive authentic products

By Ivan Israelstam, chief executive of Labour Law Management Consulting

Xenophobia deters many South African employers from employing immigrants. However, many other employers are not at averse to employing aliens whether they are in the country legally or illegally.

Some of the reasons for the high number of illegal immigrants gaining employment in South Africa include:

• Job seekers from outside our borders provide potential employers with false identity documents or work permits

• Employers do not always think of asking prospective employees for proof of their right to work here

• Other employers, aware of the holes in the law enforcement system in South Africa, close a blind eye to such legal requirements because they couldn’t be bothered

• Some employers believe that an illegal immigrant will be more likely to do his/her work properly and obey the employer’s rules for fear of being reported to the Department of Home Affairs

• Illegal immigrants are often willing to accept lower remuneration than is paid to legal employees

• Employees without legal papers are often more willing to accept poor treatment, transfers to out of the way locations, extra work and not being registered for unemployment insurance

• Many skills are difficult to find in South Africa and many employers do not care whether they obtain these skills legally or illegally.

It is therefore not surprising that so many employers turn a blind eye to the law’s requirements. However, they do this at their peril because the courts have the power under the Immigration Act to repatriate illegal immigrants and to impose heavy fines on offending employers.

Immigration legislation very strictly prohibits the employment of foreign nationals unless extremely stringent, rigid and unrealistically lengthy procedures are first carried out. That is, the employer is, before employing an immigrant, required to prove that it has done everything in its power to recruit a South African into the post in question and that no such South Africans are available. By the time the employer has dragged itself through this time consuming process the foreign national with the rare skills has accepted a job in another country. These restrictive regulations are, under the latest amendments, currently becoming even more rigid and draconian.

What then must employers do when they discover that some employees are working illegally? Such employers obviously need to terminate the employment of such employees. However, what is not so obvious is how the employer should go about such terminations.

An employer cannot dismiss a suspected illegal alien before checking up on these suspicions. This is because, if the employee is incorrectly fired for being illegal, it may constitute an unfair dismissal and/or unfair discrimination on the grounds of ethnicity. This could result in the employer having to pay the employee compensation up to the equivalent of 24 months remuneration.

The wise employer’s first step is to investigate thoroughly all allegations that employees are working illegally.

Secondly, especially where the employee’s status is unclear, the employer should hold a hearing to establish the truth of the matter before firing the employee. This will give a properly qualified chairperson the opportunity to look thoroughly into the legality of the employee’s status.

Thirdly, where the hearing proves that the employee is working illegally the chairperson should end the employment relationship making it clear that this has been done purely for reasons of immigration law.

Source: Fin24

South African businesses of all sizes, including educational institutions, have been particularly hard hit by an onslaught of cyber-attacks, although this is not always public knowledge, according to Kerry Curtin, cyber risk expert at Aon South Africa.

Cyber risk was ranked as the #1 risk facing educational institutions and is likely to remain so for the foreseeable future, according to Aon’s 2018 global risk management survey.

Curtin says the potential theft or leakage of data, particularly confidential information in an educational setting, should be top of the list in risk planning.

“The need to strengthen institutional resiliency against potential damage, compromising hacks and downtime is crucial,” she adds.

This is because schools, like any other business, are increasingly dependent on technology. The knock-on effect of a cyber incident at an educational facility has the potential to be financially and reputationally catastrophic.

For example, in 2016 it was reported that the University of Limpopo’s website was taken down, leaking exam papers and the details of over 18 000 students, in addition to perpetrators publicly posting what was believed to be the login details for the University’s intranet.

The sheer number of cyber-attacks on educational institutions suggests that the sector is not as prepared as it should be in its efforts to safeguard networks, according to Curtin.

Aon provides the following tips for the education sector:

Safeguard institution-owned devices

All computers, laptops and smart devices owned by the educational institution should at the very least have a current anti-virus programme installed, in addition to adware and malware protection.

One of the biggest threats to any business is the people operating these devices and their naivety regarding cyber risks, so education is key.

BYOD policy

The practice of students and staff members bringing devices to school or university that interact with the institution’s network is very likely. The first line of defence is keeping guest devices separate from the network, allowing the institution to keep data secure on an administrative network, as well as monitor traffic more closely.

When it comes to sending sensitive information, it is crucial to implement a secure file exchange solution that can protect against cyber threats such as phishing scams.

Multi-factor authentication

While passwords alone do not provide adequate levels of security and hackers are able to circumvent physical biometrics such as fingerprint identification as a single layer of authentication, Multi-Factor Authentication (MFA) is fast becoming the next line of defence.

Social media policy

Not only does the policy need to stipulate what is deemed as acceptable behaviour from employees and students, but it also needs to explain what the benefits are of becoming an ambassador for the brand and the legal ramifications inherent to social media platforms.

By Jamie McKane for MyBroadband

Takealot has confirmed that it will open a new customer centre in Johannesburg.

This follows a report by TechCentral that the online retailer was considering opening a new facility on the N1 highway in Midrand, situated on the New Road bridge.

A distribution centre at this location would cater to customers in both Johannesburg and Pretoria, it stated.

Takealot has an existing customer centre in Cape Town for customer collections, but only a distribution centre in Johannesburg – where customers cannot pick up orders.

Takealot’s plans
Speaking in an interview with MyBroadband, Takealot CEO Kim Reid confirmed they will open a new customer centre in Johannesburg where buyers can pick up purchases.

He said that Takealot will announce more information about the customer centre in 2019.

“We are busy with that, and will be able to provide more details next year,” said Reid.

He added that customers can also expect to benefit from Superbalist’s Click + Collect locations in the near future.

“What people can expect next year, is that we have rolled out 23 Click + Collect points for Superbalist and we will make those live [for Takealot deliveries],” Reid said.

Facebook, Google are election winners

By Todd Shields , Gerry Smith and Sarah Frier for Bloomberg

Even before ballots are counted from Tuesday’s elections, some clear winners have emerged, as Google and Facebook reap windfalls from political advertising after a season of controversy over online political speech.

Political ad spending is on course to set a record, exceeding expenditures in the 2016 presidential election year, with a total of perhaps $9 billion. Political ad buyers weren’t deterred by months of furor over election meddling by Russians using Facebook, Twitter and Alphabet’s Google and YouTube.

“This was a test year for political digital,” says Kip Cassino, who works with research firm Borrell Associates after retiring as its executive vice president. “What they wanted to see was how many ads could they put on digital without people getting really upset.”

Digital ad spending rose more than 25-fold from the last non-presidential national elections in 2014, reaching 20 percent of expected political spending this year at almost $1.8 billion, according to estimates compiled by Borrell. Kantar Media/CMAG, which omits some online activity, estimated 2018 online spending at $900 million, up from $250 million four years ago.

The figures show how digital sites, with their ability to target thin slices of the electorate, have assumed a prime place alongside traditional media such as broadcast TV, which is still prized for reaching large numbers of older voters likely to go the polls and accounts for the largest amount of political ad spending.

Kantar estimated providers such as Tegna Inc. and Sinclair Broadcast Group Inc. would see political ad revenue rise to $2.7 billion, up 30 percent compared with 2014. When local races are included, broadcast stations saw a decline in political advertising compared with 2014, to $3.5 billion, but remain the top recipient, according to Borrell’s estimates.

Local cable TV advertising sold by the likes of Comcast Corp. or Charter Communications Inc. was expected to jump 75 percent compared with four years ago, Kantar said.

“Everybody killed it this year,” said Steven Passwaiter, a vice president with Kantar, which monitors political ads.

On Tuesday, Gray Television Inc., which owns more than 100 local broadcast TV stations in smaller markets such as Augusta, Georgia and Omaha, Nebraska, said third-quarter political ad revenue was up 17 percent compared with the same quarter in 2014. That included a windfall four years ago from a hotly-contested senate race in Alaska, executives said.

“Political advertising remains quite alive and exceptionally healthy,” Gray Chief Executive Officer Hilton Howell said on an earnings call. Gray executives said political ad spending exceeded their expectations in states like Tennessee, Kansas and Florida.

A customer service representative responding on the official Telkom Twitter account has accidentally agreed with a negative comment about the company.

The user was complaining about the provider’s service delivery, and the representative replied without having correctly understood the context.

According to MyBroadband, a “professional Fortnite player Dennis ‘Cloak’ Lepore said in a tweet that ‘Spectrum might be the worst internet provider ever’. Spectrum is an ISP which serves users in the US.”

A South African Twitter user named Jonathan Oliver then “responded to Lepore’s tweet, stating ‘Nah @TelkomZA takes the number 1 spot’.”

Although both users were complaining about the service of certain Internet service providers, the Telkom customer representative responded with the following: “Yass and your continuous support keeps us up there! Thank you…”

The reply was widely mocked and shared on social media. It has since been deleted by Telkom.

Follow us on social media: 

               

View our magazine archives: 

                       


My Office News Ⓒ 2017 - Designed by A Collective


SUBSCRIBE TO OUR NEWSLETTER
Top