Cloud Hosting

This article is an extract from The Privacy, Data Protection and Cybersecurity Law Review, 10th Edition.Click here for the full guide.

I Introduction

As organisations are embracing remote work culture and formulating their strategies based on data-driven analytics to drive productivity, efficiency and revenue growth, so are the cyber threat actors using 'data as a weapon' to increase the impact of cyberattacks and to gain leverage to fulfil their financial motives. Historically, cyber breaches were a matter of discussion for the information security teams working at the heart of the organisations to run and manage digital assets enabling users to perform their duties, but because of the increasing breaches and harsh implications and the several strict government regulations, the subject has also now made its way to board level in majority of organisations.

As the governments mandate stricter data regulations and reporting timelines it becomes essentially important for the organisations to not only know their regulatory obligations but to also prepare for them and it is equally important for the forensic professionals assisting in the investigation to be able to collect and analyse data enabling the organisations to make informed decisions while responding to regulators and their customers.

In this publication we present an overview of the data exfiltration aspects seen in the top cyberattacks faced by organisations and the common challenges faced during such investigations.

II Overview of regulations related to cyber breaches in China, including Hong Kong

Before we begin with taking a deep dive into the cyberattacks and analysing the data exfiltration aspect, let us examine briefly the prevailing data-related regulations in China.

i The China Cyber Security Law

This law is formulated to (1) ensure cybersecurity; (2) safeguard cyberspace sovereignty and national security, and social and public interests; (3) protect the lawful rights and interests of citizens, legal persons and other organisations; and (4) promote the healthy development of the informatisation of the economy and society. According to the Cyber Security Law (CSL), the organisations impacted by the breach are required to report and notify relevant authorities and affected data subjects of actual or suspected personal information breaches in a timely manner.

ii China's Personal Information Protection Law (PIPL)

Personal information processors are required to 'promptly' notify relevant personal information protection authorities and data subjects in the event a data incident has occurred or is likely to occur. Administrative fine up to 50 million yuan or 5 per cent of the turnover in the last year may apply.

iii China's Data Security Law (DSL)

Applicable to data processing activities carried out within the territory of China and data processing activities conducted outside China that harm China's national security or the public interest, or the legal interests of citizens and organisations in China. Requires organisations to have incident planning. Organisation needs to immediately remediate incidents, promptly notify relevant individuals, and report such data security incidents to the regulator.

iv Personal Data Privacy Ordinance (PDPO), Hong Kong

The Personal Data (Privacy) Ordinance (Cap. 486) (the PDPO) is a set of laws that is technology-neutral and provides a set of data protection principles outlining how data users should collect, handle and use personal data. Data users are required to take steps to ensure that personal data is protected against unauthorised or accidental access, processing, erasure, loss or use, if data breaches or leaks were to occur.

v Privacy Commissioner for Personal Data, Hong Kong

The Privacy Commissioner for Personal Data (PCPD) recommends the filling in of a data breach notification as the recommended practice for proper handling of such incidents.

III Analysing data exfiltration aspects of common cyber incidents faced by organisations

Multiple regulations focused on data privacy and breach notification are in place to mandate reporting and motivating organisations to improve their cybersecurity position, which allow for understanding of the various aspects of data exfiltrations during typical cyberattacks faced by organisations and the key challenges faced during investigations.

i Data compromise in a business email compromise breach

Email-based attacks have been on a constant rise, with a steeper rise seen during the pandemic. As the situation evolved, the threat actors changed their lures to more relatable pandemic-related themes to bank on the uncertainty and changing anti-pandemic measures increasing their chances of baiting their victims. Business email compromise is a cyberattack that involves threat actors gaining access to victims' mailboxes and carrying out a financial transaction by hijacking or creating an existing email chain and tricking the victim into making a fund transfer to a bank controlled by the threat actors. In the process of executing the attack, to reach a final motive of making financial gains, the threat actors modify the bank account details on a legitimate pending invoice and trick the victim into transferring funds to the threat actors' bank account.

While it is clear how the threat actors target and execute the attack, the attack also encompasses several other information discovery steps taken by the threat actors. From our analysis and information collected from public threat reports of multiple similar breaches, we have noted that threat actors prior to carrying out the final impact of the attack that is, the financial transaction gathered and reviewed emails and files that may have contained financial information such as pending bills, customer details, etc. In addition to data review to understand the language, terminology or writing style used within the organisation, they also gathered and replicated the user mailboxes to offline access and accessed global address lists (GAL) containing contact cards of all employees of the organisation. The details captured by the threat actors from GAL or from the files and emails accessed may contain details of customers, personal information, sensitive information and may give the threat actors the ability to carry out further cyberattacks based on information collected.

The key challenges in the investigations related to business email compromise cases are as follows:

Case study: business email compromise scam causing a financial impact of over US$5 million

We were engaged by one of our clients in mainland China to investigate a business email compromise attack that resulted in payments of over US$5 million in fraudulent transactions. During our investigation, we noted that the threat actors were able to gain access to the mailbox of several finance team members over a period of four months prior to the initiation of the fraudulent transaction. A common technique used by the threat actors during this campaign for maintaining access to information was forwarding a copy of incoming emails to the email controlled by the threat actors by using an email forwarding rule as a method of data exfiltration. During our review, we noted multiple simultaneous ongoing conversation chains hijacked by the threat actors and were nearing agreements on payments which were then stopped by our team, mitigating a cumulative loss of about US$8 million. On the advice of the clients' legal counsel, potential data exfiltrated was reviewed to determine the nature of information exfiltrated and accordingly impacted customers were notified about the information (such as proforma invoices, letter heads with declarations, etc.) that may have been exfiltrated and stored by the threat actors.

ii Data compromise in a ransomware breach

Threat actors have been increasingly targeting organisations with ransomware and part of the attack locks the files in the system and exfiltrates data from the organisation with a threat to make it public or force organisations to pay and avoid leak. According to Verizon's data breach report 2022,2 ransomware has increased on an upward trend of 13 per cent. The threat actors before exfiltrating data try to identify valuable data in the organisation network to encrypt and exfiltrate the data. In a typical ransomware investigation done by our team, we have noted the use of public file storage websites and cloud servers as one of the file storage methods used by the threat actors.

The key challenges faced during investigations of ransomware cases are outlined below.

Inadequate or absence of network and endpoint visibility leading to gaps in timeline analysis

Systems event logs are available in all operating systems and capture system activity and actions based on the level of verbosity configured. The system logs are used for gathering and determining operating system level activity such as exploitation or malicious activities during a forensic review and provide details of when the activity occurred but the lack of in-depth visibility such as the amount of data transferred over the network, files transferred over USB, etc. leads to gaps in answering questions around files transferred over network or USBs, etc., and can be mitigated by using external software to collect and monitor such logs because of a lack of availability of such logs within the commonly used operating systems.

Unreliable timestamps and file metadata because of encryption

Typically, in a ransomware incident, threat actors exfiltrate data and execute ransomware to encrypt the files, which leads to an update in the file metadata such as 'file modified date'. Due to this filesystem activity, the file metadata becomes unusable for the forensic reviewer and questions such as number of files accessed by threat actors before encryption or files modified before encryption to identify potential malicious activity may not be answered accurately.

Loss of system artifacts becqause of anti-forensic techniques used by threat actors

Threat actors frequently use anti-forensic techniques to evade leaving footprints of the actions carried out by them to delay creation of counter measures by security companies, evade detection of malware and actions performed by the threat actors. From our experience of investigation, sophisticated attacks and information gained from analysis of various reputed threat reports, it was noted that commonly employed anti-forensic measures include clearing of system logs, deletion of malicious files post execution, high obfuscation of the malicious code and malware capability of self-destruction on receiving commands from the threat actors. These anti-forensic techniques lead to loss in the system artifacts and files impacting the root cause analysis resulting in gaps establishing the timeline of events that may have occurred.

The use of the outdated GeoIP database (GeoIP data contains mapping of IP addresses with their allocated country IP range and autonomous system numbers mapping the IP addresses to the organisations controlling the IP blocks) on firewalls leading to enrichment of connecting IP addresses with inaccurate geolocation, ASN organisation, ISP details, etc. Information leading to miscalculation during statical analysis based on these factors, for example: an outdated entry in the GeoIP database for a malicious IP address allocated to a highly reputed ASN org or internet service provider can lead to exclusion of connection from further scrutiny by the forensic analyst because of the reputation of the ASN organisation controlling the IP address block.

The lack of internal network telemetry amd NetFlow data leads to gaps in visibility of lateral movement across devices in the network. One of the tactics used by the threat actors after gaining access to the compromised endpoint is to carry out several discovery steps to identify potential data of importance to the organisation within the network and in some cases dump the collected data to exfiltrate. Limited details of such connection events are stored in operating system logs for connections that are made using an operating system's inbuilt functions and services but lack overall visibility in the amount of data transferred, the method used for connections and may lack any information at all if a custom tool is deployed by the threat actors for data movement and accessing computer systems within the network.

There are jurisdictional issues faced by the law enforcement agencies in securing access to cloud servers used by threat actors. Usage of cloud-based systems has been noted by the threat actors for hosting command and control infrastructure, data exfiltration destination, etc. from our experience in such investigations. In an event where a law enforcement action is involved to cease and desist the servers (based on the server IP address) used by the threat actors, the law enforcement agencies often face challenges because of jurisdictional issues and the inherent nature of the cloud server provisioning that enables the cloud service subscription holder to deploy servers at or for a short duration and the cloud service provider may provide the same IP address to another customer who may not be related to the incident.

Case study: A ransomware incident impacting a client in the mainland China office and Hong Kong

In a recent case investigated by our team, one of our clients in mainland China was impacted by a ransomware incident leading to encryption of systems across several Mainland China offices and Hong Kong region because of the interconnectivity of the networks. We were engaged as first responders to identify the root cause of the incident, gaps exploited by the threat actors and identify data exfiltration activity. During our review, we identified the initial access was carried out by the threat actors using an exposed remote desktop application which was followed by data exfiltration and encryption of files as final impact. During this review, our team carried out digital forensics and identified the threat actors' actions but could not determine the exact number of files accessed by the threat actors as the metadata was updated as a result of file encryption and a fallback method was used after discussion with the clients' legal counsel to determine the activity by relying upon the fact that if a system was accessed by the threat actor, the data was considered as exfiltrated. In other instances where our clients had more network visibility and endpoint logs, the data exfiltration has been very accurate as the logs provide more details of the various processes executed by the threat actors and contain details of the volume of data transferred in terms of packets during execution of the attack.

iii Data compromise because of cloud misconfigurations

As more and more organisations are shifting towards adaptation of cloud infrastructure to expand to scalable operations, utilising cutting-edge interactive web applications functioning on the user behaviour matrix, it was noted in various threat reports that some of the aspects of cloud security have been challenging for the IT professionals working in traditional on-premises infrastructure that gave more control. In the recent IBM Cost of a Data Breach Report 2022,3 the cost of breaches as a result of cloud misconfigurations to totalled US$4.14 million. Some of the impacts because of cloud misconfiguration result in data loss, access to sensitive or personal information, credentials or API keys, which can in turn be used to further access computer systems in the IT environment.

Key challenges faced during investigation are outlined below.

Lack of application logs

Application logs for a web application capture details of system events and actions performed by the users depending upon the configuration. The details captured in the logs can be a useful source to determine the impact of the malicious actions performed in addition to the logs from the webserver or load balancer, which capture limited details of interaction with the application based on the web requests and not the details of the events themselves in the web application.

Lack of cloud server logs for extensive periods

As organisations are moving towards more digitalisation and usage of cloud systems to reduce overheads and automate workflows, this leads to an increase in the usage of cloud systems. The cloud systems are natively designed on optimising performance and tend to provide limited storage space to manage the cost factor. The limited storage on cloud servers and gaps in the technical understanding of the administrators and the logs of such systems are in general kept for short durations on the systems for the best utilisation of storage as other types of data such as databases or code are also stored, leading to availability of a limited period of logs.

Difficulties in forensic image creation of the storage as compared with traditional hard drives

Cloud system (server) file storage is different in architecture than the traditional hard drives obtained in computer systems. The forensic preservation of cloud server storage poses a variety of challenges for the forensic analysts to efficiently collect images without compromising the integrity of the evidence files. Some of the cloud infrastructure providers may offer methods to download the existing operating system image as a virtual machine as part of the backup functionality, which can be used by the forensic analyst as an image because it is system-generated, indicating no possibility to tamper with it during creation and it contains the image hashes but in some cloud infrastructure providers may not provide such backup methods, posing a challenge for forensic collection and limiting the possibility of retrieving deleted evidence, which may in turn impact the investigation.

Case study: Investigation of a compromised web application

We investigated an incident related to an exposed vulnerable web application that was exploited by the attackers to gain initial access. The breach was identified because of security alerts to the storage by the IT security team. During our root-cause analysis, it was noted that the application was vulnerable for at least eight months before exploitation but as a result of the limitation of logs, previous instances of other security breaches resulting from the vulnerability were not discovered, leading to gaps in the investigation and stronger mitigation measures.

iv Data compromise as a result of insider data theft

Insider data thefts have been on a constant rise. With organisations working remotely, instances of such cases are increasing. Analysis of a recent news story4 also indicates potential advertisements by ransomware-related threat actors for rewarding insiders willing to enable the groups in introducing malware to internal systems.

The key challenges are as follows:

v Good practice to utilise to mitigate challenges during forensic investigations

To investigate a cyber incident and gain visibility of actions performed by the threat actors, digital evidence from computer systems and log files serves as a vital source to understand the activities of the threat actor and to determine data exfiltration activity. We list below some of the best practices for maintaining and preserving the critical digital evidence:

Read this article:
The Privacy, Data Protection and Cybersecurity Law Review ... - Lexology

Cutipol Goa salad set

Designed by Jos Joaquim Ribeiro and made by a family-owned business in the village of Sao Martinho de Sande in Portugal, Cutipols Goa salad set features a brushed stainless-steel spoon and fork with contrasting resin handles. Slim and minimalist, theyll add a touch of effortless chic to any refined dining experience. $98

@mudaustralia

Melbourne-based homewares label Fazeek has a track record of creating curvaceous colour-loving glassware. Following suit, its salad servers are made of hand-blown borosilicate glass, with elongated handles that lead to softly rounded spoons. Available in three playful colourways: pink and green, clear and amber, and lilac and teal. $89

Handmade from resin in its Strawberry Hills studio, iconic Sydney label Dinosaur Designs stone servers come in 26 striking hues, from solid colours to textured, marble-like swirls. Go for hot-pink Flamingo, the dappled greys of Abalone, or Sky a mix of blue and white inspired by the vapour of early evening skies. $125

@dinosaur_designs

Loosely resembling the claws of a friendly lobster, cult Sydney-born label Maison Balzacs Cloud serving spoons are made of bamboo polymer with a soft, matte finish. Lightweight yet highly durable, theyre also biodegradable and designed to add a bit of whimsy to your table. Available in sky blue and beige. $49

@maisonbalzac

Known for Aussie-style understated luxury, Country Roads approach to salad servers is unsurprisingly chic. The Nolan features a minimalist design with tapered handles and sleek spoons a timeless style for seasons of dinner parties. Made of high-quality stainless steel in three neutral finishes: soft gold, brushed silver and shiny graphite. $59.95

@countryroad

Wooden salad servers are always a classic. Turkish-inspired, Sydney-based label Saardes are handcrafted using natural olive wood from pruned branches and dead trunks. With a simple pared-back design, the woods textured character does most of the heavy lifting, style-wise. Each piece gets darker and richer in colour as it ages. $45

@saardehome

Looking for more carefully curated buys for your home? Read here.

This article first appeared in Domain Review, in partnership with Broadsheet.

Continued here:
Six To Try: Salad Servers That Make Even Iceberg Lettuce Look ... - Broadsheet

Where many smartphone-makers fill their software with cascading options and heaps of micro features, Pixels have always put a focus on attractive, understated design and proactively useful touches. The new Pixels are crammed full of stuff, its just that it tends to pop up when its required rather than being tucked away in menus or needing to be stacked all over your home screen.

The Pixel 8 has new cameras, more powerful AI and keeps the chunky camera bar. Supplied

As you might expect, a lot of Googly features are baked in and benefit greatly from the Pixel 8s new Tensor G3 chip, which provides on-device machine learning. That includes fast and accurate voice-to-text for sending messages, interpreting other languages and automatically transcribing recordings, as well as powerful photo and video editing, and health-tracking via Fitbit. The tech even extends to using the device for old-fashioned phone calls, with great noise-cancelling that makes the caller sound clear and the ability to have Google Assistant screen your calls.

But while the Pixel 8s continue the tradition of putting the best of Google front and centre, and may be the best Androids on the market, theyre also a testing ground for new features and developments that dont always feel ready for prime time.

Physically not a lot has changed from last years Pixel 7, with the new phones packing the familiar and wonderfully symmetrical chunky camera bar on the back. Both phones have great screens that can get phenomenally bright (2000 nits on the 8, 2400 on the Pro, though youll only get those maximum results in direct sun), and both have 120Hz refresh rates for very smooth scrolling and animation.

In fact, the two phones are the closest theyve been since the introduction of the Pro moniker with the Pixel 6. The main differences are screen size (6.2 inches or 6.7 inches) and an extra camera, with the Pro packing a 5x telephoto lens in addition to the main shooter and ultra-wide. Oh yeah, and the Pixel 8 Pro has a thermometer.

The Pixel 8 Pro and Pixel 8 (right), with the iPhone 15 Pro Max and iPhone 15 (left). Tim Biggs

I have to assume that Google intended this sensor to be for checking peoples foreheads, and then didnt get the appropriate medical approval or gave up on the idea, because theres no other reason for it to be there. When you use it for the first time you have to tick a box to say you understand it is not a medical device, and then youre free to put it five centimetres in front of any object to check its temperature. It seems to work, but I couldnt find a compelling use for it.

Despite a similar hardware design, Googles own take on the new Android 14 software does a lot to give the Pixel 8s a fresh look. There are a lot of lock-screen styles to choose from, which double as always-on-display designs (I especially like the new one that puts the date and temperature against the phones longer sides), and the options to colour theme your phone, widgets and icons automatically to your wallpaper continue to impress.

Embedded in the top of the display is a little selfie shooter similar to last years, but it has a new trick thanks to AI, in that it can recognise you a lot more accurately. The change means you can authenticate banking apps and sign in to services with your face, just like you can on an iPhone, without a big black spot at the top of the phone. The one downside to Googles approach here is it doesnt work in the dark, so you still need a fingerprint or PIN.

Speaking of AI, this years update is big on generative features, both obvious and subtle. One example of the former is the new AI wallpaper feature, which is a DALL-E style text-to-image generator but with a lot of limitations. Choose a theme, pick some keywords, wait 20 seconds and youll be given eight different options to choose from. Theyre always fairly abstract and dont stand up to close scrutiny to be honest, Id always prefer one of the many real photos or paintings from Googles wallpaper collection but as a gimmick it works and will only get better.

Googles Best Take feature can swap peoples faces when you take multiple shots. Supplied

Generative AI is more present in the new Google Photos editing suite too, where it toes the line between allowing you to realise the intention of a photograph and letting you straight-up invent stuff. The marquee feature here is Magic Editor, which is scarily good at replacing a gloomy sky with a nice blue one, shifting the colours for a golden hour look, removing unwanted elements or even completely changing the composition.

For example, I grabbed an older photo of my two kids at mini golf, posing in the left of the frame. Behind them is a giant statue of a cartoon rhino, centre frame. In the Magic Editor I tapped one kid to select him, held down to edit, then dragged him over to the right of the frame. After processing, the image just looks like the kids were naturally standing either side of the rhino. The part where the repositioned kid used to be standing now has some convincing invented detail, including a bit of path, some scattered bark chips and one of the rhinos hands. It even gives you a few options to choose from so you can pick the most natural. The feature is also great at enlarging the moon, or removing dead tree branches. But for whatever reason, any time I tried to change the size of a person I was told it was against the companys ethics policy.

On the left is my original photo, the middle is with Googles AI-generated sky, the right has golden hour turned on. Tim Biggs

Theres also a feature called Best Take, which appears if youve taken a series of photos featuring a group of people. Pick one of the photos, and you can tap on each persons face to cycle through the various expressions they made throughout the set, ending up with one picture featuring everyones best face. Like the Magic Editor its far from foolproof but can result in fakes nobody would pick at a glance.

To be honest, I cant ever see myself using these tools on my own personal photos. Im aware that some level of AI processing has been present in smartphone photography for a long time and is here to stay, but intentionally changing the content feels unnerving. That said, I can definitely see using it in place of Photoshop if I needed a specific edit of a non-human subject quickly.

For video, a new Audio Eraser will analyse clips for sounds and show a few of them as separate waveforms (for example, wind, speech or nature). Then you can watch and listen to the video while moving the levels around to cut out talking or annoying gusts. Like a lot of AI photo editing it works very well but leaves artefacts youll notice if youre specifically looking for them. Other features, like a video enhancer that utilises Googles cloud servers, are not present at the phones launch.

The new Pixels come hot on the heels of new iPhones, and the two families of devices share some similarities despite being fundamentally tough to compare. Googles phones have been becoming more premium and expensive year over year, while Apples have been becoming more open notably this year with the introduction of a USB-C port so theyre closer to equivalent than ever.

Comparing the standard phones, Pixel 8 and iPhone 15, Googles immediately stands out as more premium despite being $300 cheaper. Theyre similar sizes and have similar camera set-ups, but Apples lacks a fast refresh and an always-on display. Under the hood Apple has also withheld some features from the standard iPhone that the Pixel happily supports, including USB 3.2 for much faster charging and data transfer, and autofocus on the ultra-wide camera which makes for a great close-up macro mode.

When it comes to the high end, Pixel 8 Pro against the iPhone 15 Pro Max, the gap is much closer though the prices are farther apart. (The iPhone starts at 256GB here, so a true like-for-like comparison would put the Pixel 8 Pro at $1800, but thats still a $400 gap.)

Click to reload

The phones are evenly matched across almost all specs, though Apple has the strong advantage of an immensely powerful processor that outpaces the Pixel in raw strength. In cameras Google has opted for bigger sensors and more flexibility in editing, and the Pro has an excellent manual control mode, but Apples shots tend to be more pleasant for quick snaps since you can preset your preferred temperature and crop. When it comes to portrait mode and low light photography the Pixel is far more confident, and both phones now support adding a bokeh blur after the fact; Apple by capturing depth data when it detects a face and Google through the Magic Editor.

Both happily shoot 4K HDR video that looks amazing, though Apple supports Dolby Vision and ProRes which may suit professionals better.

iPhone users have access to a pretty full suite of Google products these days, and even features like the Magic Eraser have made their way from Pixel to iPhone, though the opposite is not true; those who choose Apple services tend to have a hard time on Android. The unique strength of the Pixel, then, is hardware thats been specially tuned for Googles AI tasks, and the latest in experimental features that may or may not become widely used in the future.

Still, putting the AI features aside these are still the nicest Pixels Google has yet produced, with some of the most genuinely useful features and best cameras youll find on an Android.

Get news and reviews on technology, gadgets and gaming in our Technology newsletter every Friday.

Originally posted here:
Googles latest smartphones put AI photo-editing in your hands - Sydney Morning Herald