EBay, Stripe join PayPal in exiting Facebook’s cryptocurrency Libra

More setbacks amid major backer exodus.

Facebook’s efforts to establish a global digital currency called Libra suffered several setbacks on Friday as EBay Inc , Stripe Inc, and Mastercard all announced they were leaving the Libra Association, a group of companies aiding Facebook’s efforts to establish the project.

The companies join Paypal Holdings Inc which exited the group just a week ago.

“We highly respect the vision of the Libra Association; however, eBay has made the decision to not move forward as a founding member,” EBay said in a statement.

The Libra Association confirmed the exits of EBay and Stripe. Mastercard’s exit was reported by the Wall Street Journal.

Facebook announced plans to launch the digital currency in June 2020 in partnership with other members of Libra Association, but the project quickly ran into trouble with sceptical regulators around the world.

France and Germany last month pledged to block Libra from operating in Europe and backed the development of a public cryptocurrency instead.

“We look forward to the inaugural Libra Association Council meeting in just 3 days and announcing the initial members of the Libra Association,” said Dante Disparte, head of policy and communication for the Libra Association.

Got a news tip for our journalists? Share it with us anonymously here.

View the Original article

NAB reform push offers discounted Cisco security product

But still no online fraud indemnity for business customers.

The fashion of retail banks giving away free or discounted security software and services is back in vogue.

The National Australia Bank has used what it’s calling “preferential” pricing for Cisco’s cloud-based Umbrella product to spearhead a small business charm offensive aimed at Canberra policymakers as it tries to rehabilitate its public image.

With previous chief executive Andrew Thorburn and chairman Ken Henry already sacrificed at the altar of regulatory contrition, NAB on Monday trotted-out the discount cybersec offer for SMBs at a function at Parliament House in Canberra that attracted both Treasurer Josh Frydenberg and his opposite Jim Chalmers.

The ritual offering to the Hill comes ahead of the arrival of NAB’s new chief executive Ross McEwan later this year, with the business lending heavyweight scouting for feel-good opportunities to display its commitment to social and economic good

But it comes as regulatory pressure builds for banks to help absorb record online credit card fraud rates still passed through to merchants, with the Reserve Bank, ASIC and retail groups all increasingly leaning towards intervention that could cost the Big Four at least $100 million a year.

While both politicians made speeches bemoaning the scourge of cyber fraud, neither went near the elephant in the room, Australia’s $487.5 million a year card-not-present fraud bill that has the Reserve Bank of Australia holding a regulatory stick above the payments industry, especially banks.

Labor reckons there is general progress being made, but the Opposition is still yet to reveal a position as to whether it would allow the passing through of losses to continue.

“Our banks are on the frontline of fighting cybercrime and should be congratulated for the work and leadership they’ve shown in this area,” Shadow Treasurer Jim Chalmers said.
 
“Through multifactor authentication and one time passwords, banks have delivered a safer internet for all Australians – including for resourced constrained small businesses and customers – and improved our knowledge of cyber security.”

Reassuring for consumers, but don’t bother asking for your money back if your online business bank account is robbed.

Treasurer Frydenberg’s comments and speech were not released with a spokesperson indicating they would not be.

And while it’s great to raise cyber awareness, sometimes it’s best to stick to pre-approved discussion points on what can be a thorny topic.

NAB’s soiree on the Hill follows a week where the Australian Cyber Security Centre faced public criticism over its influence over CyberCon conference in Melbourne where more controversial speakers were dropped from the line-up or discussion on contentious topics like Australia’s encryption-busting laws.

Far better to concentrate on the positive developments, like offers of discounted security services, though there is no number on what the depth of the discount will be for what NAB says is its 400,000 SMB customers.

Staying focused on the positive, there is pricing, and a recommended reseller in the form of OutcomeX for NAB clients to buy their new security wares through.

“The monthly subscription charge is $33 (incl. GST) for 1 to 10 users for your business. $3 will be charged for every additional user after 10,” NAB said in its publicity materials.

“Cisco and OutcomeX are separate legal entities and are not financially backed by NAB. Given their expertise and reputation, we’ve partnered with them to offer a cyber security solution,” the bank said.

Which is nice.

But not as nice as having a bank that provides indemnity against credit card fraud for online transactions in the same way as it does for physical transactions.

Why, after a Royal Commission into bad bank behaviour, a $487.5 million a year fraud liability shift to the detriment of merchants has been allowed to continue is a question still too hot to answer.

Got a news tip for our journalists? Share it with us anonymously here.

View the Original article

China’s Huawei says open to ‘no backdoor’ agreement with India

To allay security concerns ahead of launch of 5G networks.

China’s Huawei Technologies is ready to enter into a “no backdoor” agreement with India to allay security concerns, the telecom group’s local head said on Monday, as the giant South Asian country prepares to launch next generation 5G networks.

India, the world’s second-biggest wireless market by users, will hold an airwaves auction for 5G services before March, according to the country’s Telecoms Minister Ravi Shankar Prasad.

It has yet to begin 5G trials and has not taken a decision on allowing or banning Huawei from the test runs amid a US-led push to shut out the Chinese tech and telecoms group, saying its gear contained “back doors” that would enable China to spy on other countries. Beijing denies such a plan.

Huawei, which has a 28 percent global share of the telecoms equipment market, is closely engaging with India to clarify its stand on 5G solutions, network security and Chinese intelligence laws, Jay Chen, the CEO of its India unit, told Reuters in an interview on Monday on the sidelines of India Mobile Congress.

“From the very beginning, I have confidence that Indian industry, the India market will welcome Huawei because I have contributed a lot with my unique value,” Chen said. “I am ready to sign (a no-backdoor agreement).”

Shenzhen-headquartered Huawei has been blacklisted by countries including the United States, Australia and New Zealand while others are still evaluating their position.

Indian telecom carriers Bharti Airtel and Vodafone Idea have used Huawei, as well as its European rivals Nokia and Ericsson, to build their 2G, 3G and 4G networks and have previously underscored the importance of having all three players in India to maintain competition, price and service quality.

“If (the Indian) government wants, we are open to having the source codes in an escrow account,” Chen said, adding that the company was also willing to manufacture more of its telecoms gear locally.

China has asked India not to block Huawei from doing business in the country, warning there could be consequences for Indian firms operating in China, Reuters reported previously.

A potential row over Huawei’s participation in India’s 5G push could revive tensions between Beijing and New Delhi at a time the two countries have been making high-level efforts to ensure their long standing territorial disputes do not escalate.

Chinese President Xi Jinping and Indian Prime Minister Narendra Modi met last week in an Indian beach town in a bid to resolve border disputes, trade rows and ease concerns about China’s close military ties with India’s arch rival, Pakistan.

“India cannot afford to wait longer for 5G,” Chen said, highlighting the importance of Huawei’s participation in the country’s 5G launch. “I always suggest move forward for 5G trial, move forward with 5G auction.”

Got a news tip for our journalists? Share it with us anonymously here.

View the Original article

Facebook’s Libra faces support test after payment giants jump ship

Faces a pivotal meeting of backers on Monday after severe setback.

Facebook’s Libra cryptocurrency faces a pivotal meeting of backers on Monday, days after the ambitious project to bring digital coins into mainstream commerce suffered a severe setback when major payment firms quit.

Mastercard and Visa abandoned the Geneva-based Libra Association on Friday, as did eBay, fintech startup Stripe and payments company Mercado Pago.

The exodus followed warnings from politicians and regulators, from the United States to Europe, that Libra risked upsetting global financial stability, undermining users’ privacy and facilitating money laundering.

The latest withdrawals followed the departure of PayPal from the Libra Association earlier this month, and leave Facebook without the backing of any major payments firms for the project, due to launch by June 2020.

At the meeting, which will take place in Geneva, members will agree interim articles of association, said a spokesman for Vodafone, one of the highest-profile companies remaining in the project.

Articles of association are typically written rules that lay out how a company or organisation is governed.

The Libra Association will also appoint a board at the meeting, the Wall Street Journal reported this month.

A spokeswoman for the Libra Association declined to comment on the meeting.

The group said this month that it would give details after the meeting of the 1,500 “entities” that have indicated “enthusiastic interest” to take part in the project.

The association, whose remaining 22 members include ride-hailing firms Uber and Lyft, also consists of non-profit organisations, venture capital groups and blockchain firms.

But the departure of major financial firms meaning it can no longer count on a global player to help consumers turn their currency into Libra and facilitate transactions. This presents a new stumbling block for Libra’s efforts to convince regulators and politicians about the coin’s safety.

France pledged last month to block Libra from operating in Europe, while the Bank of England laid out high hurdles it must meet before its launch. US Federal Reserve Chairman Jerome Powell has also suggested the project could not advance before concerns were assuaged.

Libra, announced as Facebook expands into e-commerce, will be backed by a reserve of real-world assets, including bank deposits and short-term government securities, and overseen by the Libra Association.

The structure is intended to foster trust and stabilise the price volatility that plagues cryptocurrencies and renders them impractical for commerce and payments.

Factbox: Libra’s exodus

A number of payment processors and fintech companies that joined Facebook Inc’s digital currency project Libra with great fanfare earlier this year, have abandoned the project, dealing a blow to the social media giant’s plans.

The move follows warnings from politicians and regulators around the world about the implications of creating a global digital currency and the threat it will pose to financial stability, undermining users’ privacy and facilitating money laundering.

Following is a list of the companies and partners that have pulled out of the Libra project:

Paypal

The US payments processor was the first member to withdraw from the Libra Association on Oct. 4.

eBAY

The e-commerce firm said on Friday it would no longer be the founding member of the Libra association as it wants to focus on rolling out its managed payments experience for customers.

Visa

A spokesperson said on Friday Visa will not join Libra at this time, but the final decision will be based on different factors including the association’s ability to fully satisfy regulatory expectations.

Mastercard

Mastercard joined the list of companies to pull out of the agreement, and said on Friday it would not join the association, despite believing that there are potential benefits in financial inclusion initiatives.

Stripe

A Stripe spokesperson confirmed on Friday it is exiting Libra. The fintech startup, added it will be following progress on Libra cryptocurrency closely, and will be open to working with the libra association at a later stage.

Mercado Pago

Mercado Pago, a Latin American payments company, has also dropped out of the project.

Booking Holdings Inc

The online travel agency will no longer be supporting Libra, CNBC tweeted on Monday. Booking Holdings did not immediately respond to Reuters’ request for comment.

Got a news tip for our journalists? Share it with us anonymously here.

View the Original article

Facebook’s Libra support shrinks even further as Priceline owner jumps ship

Another defection.

Facebook Inc’s Libra cryptocurrency faced a pivotal meeting of backers on Monday, after the ambitious project to bring digital coins into mainstream commerce suffered another defection, from online travel company Booking Holding.

The owner of Priceline, Kayak and Booking.com, on Monday confirmed that it had pulled out of the group.

Libra lost its last global payments backers on Friday, when Mastercard Inc and Visa Inc abandoned the Geneva-based Libra Association. EBay Inc , fintech startup Stripe and payments company Mercado Pago also pulled the plug.

The exodus followed warnings from politicians and regulators, from the United States to Europe, that Libra risked upsetting global financial stability, undermining users’ privacy and facilitating money laundering.

The latest withdrawals followed the departure of PayPal Holdings Inc from the Libra Association earlier this month. It leaves Facebook without the backing of any major payments firms for the project, due to launch by June 2020.

At the meeting, which will take place in Geneva, members will agree interim articles of association, said a spokesman for Vodafone Group Plc , one of the highest-profile companies remaining in the project.

Articles of association are typically written rules that lay out how a company or organisation is governed.

The Libra Association will also appoint a board at the meeting, the Wall Street Journal reported this month.

A spokeswoman for the Libra Association declined to comment on the meeting.

The group said this month that it would give details after the meeting of the 1,500 entities that have indicated interest in the project.

The association, whose remaining 21 members include ride-hailing firms Uber Technologies Inc and Lyft Inc , also consists of non-profit organisations, venture capital groups and blockchain firms.

But the departure of major financial firms means Facebook’s Libra can no longer count on a global player to help consumers turn their currency into Libra and facilitate transactions. This presents a new stumbling block for Libra’s efforts to convince regulators and politicians about the coin’s safety.

France pledged last month to block Libra from operating in Europe, while the Bank of England laid out high hurdles it must meet before its launch. US Federal Reserve Chairman Jerome Powell has also suggested the project could not advance before concerns were assuaged.

Libra, announced as Facebook expands into e-commerce, will be backed by a reserve of real-world assets, including bank deposits and short-term government securities, and overseen by the Libra Association.

The structure is intended to foster trust and stabilise the price volatility that plagues cryptocurrencies and renders them impractical for commerce and payments.

Got a news tip for our journalists? Share it with us anonymously here.

View the Original article

MacGibbon joins local cyber security push to challenge multinationals

Former national cyber security advisor Alastair MacGibbon and former Optus Business managing director John Paitaridis Departed govt cyber tsar and former Optus Business chief unite penetration testers.

Two of Australia’s most high-profile IT executives have joined forces to form the nation’s largest dedicated cyber security company, a move that directly challenges the dominance of large US-affiliated vendors in securing key contracts with major corporates and government.

CyberCX, which is backed by private equity firm BGH Capital, will bring together 12 of the country’s leading independent cyber firms under the one umbrella.

The firms are Alcorn, Assurance, Asterisk, CQR, Diamond, Enosys, Klein&Co., Phriendly Phishing, Sense of Security, Shearwater, TSS and YellIT, though more are expected to join in the future.

The “full-service cyber security company” will be led by former Optus Business managing director John Paitaridis, who left the telco after seven years in March to lead BGH Capital’s IT arm.

In a major coup in terms of securing staff with national security and public sector kudos, Paitaridis will be joined by former national cyber security advisor Alastair MacGibbon, who will take up the “critical” role of chief strategy officer.

MacGibbon resigned to return to the private sector in May after three years as the federal government’s cyber tsar.

While the transactions are still subject to regulatory approvals, the undisclosed investment by BGH Capital is reportedly the “largest private security investment in cyber security in the country”.

Paitaridis, who is behind CyberCX’s vision, said the company had been created at time when a “rapid increase” in threats was creating “unprecedented risk and exposure” for both businesses and government agencies.

“Cyber security risk should be a number one priority for business owners, senior executives and board directors as organisations increasingly embrace digital connected technologies,” he said.

“It is clear that many businesses, enterprises and government organisations are not yet well enough advised, supported or equipped to defend their mission critical assets.”

Paitaridis said a “consultative end-to-end approach” from an independent cyber security partner was needed to address these risks.

“A partner who is independent, understands the intersection between risk and technology, and has the expertise, scale and know-how to confront any cyber threat,” he said.

CyberCX’s workforce will initially number more than 400 cyber security specialists, with offices based in in Sydney, Melbourne, Brisbane, Canberra, Adelaide and Perth.

Additional offices are also planned at a later date to expand the company’s national footprint.

The company promises expects to become “most comprehensive cyber capability in Australia” by offering the full spectrum of services.

These include consultation and advisory, risk and compliance, security assurance, integration and engineering, training and education, incident response and digital forensics and managed security services.

Got a news tip for our journalists? Share it with us anonymously here.

View the Original article

Pitney Bowes under ransomware attack

Customer access to services disrupted.

Global shipping and postage giant Pitney Bowes has had its operations disrupted by ransomware, with customers being unable to access some of its services.

Pitney Bowes acknowledged the attack early this morning Australian time.

Pitney Bowes was affected by a malware attack which impacted some systems & disrupted client access to some of our services. We apologize for any disruption to your systems. We are working to restore affected systems. Please visit https://t.co/ixUa5FCGUQ for updates.

— Pitney Bowes (

View the Original article

ACIC to deploy archTIS platform for secure inter-agency sharing

On national real-time intelligence sharing system build.

The Australian Criminal Intelligence Commission is set to begin using archTIS’ secure information sharing platform for work relating to the development of the national criminal intelligence system (NCIS).

The cloud-based Kojensi Gov platform from the Canberra-based vendor will be used by the agency’s NCIS team to “facilitate secure collaboration” with other law enforcement agencies.

The NCIS is intended to replace the ageing Australian criminal intelligence database (ACID), which has been used since 1984 and still relies on green screen architecture to share and analyse criminal information and intelligence.

ACIC has been developing the long-awaited system to “provide a national, unified picture of criminal activity” since securing $59.1 million for tranche one of the build in the 2018 federal budget.

The funding followed a two-year program that saw the trial of a pilot system used by 800 users in 20 law enforcement, law compliance and regulatory agencies.

The government’s has since provided an additional $59 million for the first phase of the build, though the investment is nowhere near the $400 million that the project is expected to need to be completed.

The Kojensi Gov platform, which is hosted on Vault Cloud’s ASD-certified cloud platform, is expected to be used by all Commonwealth, state and territory law enforcement agencies involved in the project.

The deal with ACIC, which is initially worth $235,250, will support 150 NCIS members over a 15-month term, though archTIS expects the number of users to grow over time.

The agreement, which can be extended for a further two years, also covers up to 200 hours of additional services.

archTIS said ACIC had chosen Kojensi Gov due to its “strict security protocols required as part of the NCIS program”, as well as its need to collaborate with “geographically dispersed” users.

The ACIC is the second federal government agency to begin using the platform, following take up by the Attorney-General’s Department.

The department, which was the first beta tester for the platform last year, began using Kojensi Gov in September for secure collaboration with external government and non-government agencies.

Got a news tip for our journalists? Share it with us anonymously here.

View the Original article

EU warns of 5G cybersecurity risks, stops short of singling out China

Cites attacks by state-backed entities.

The European Union warned on Wednesday of the risk of increased cyber attacks by state-backed entities but refrained from singling out China and its telecoms equipment market leader Huawei Technologies as threats.

The comments came in a report prepared by EU member states on cybersecurity risks to next-generation 5G mobile networks seen as crucial to the bloc’s competitiveness in an increasingly networked world.

The authors chose to ignore calls by the United States to ban Huawei’s equipment, drawing a welcome from the Shenzen-based company after it faced US accusations that its gear could be used by China for spying.

“Among the various potential actors, non-EU states or state-backed are considered as the most serious ones and the most likely to target 5G networks,” the European Commission and Finland, which currently holds the rotating EU presidency, said in a joint statement.

“In this context of increased exposure to attacks facilitated by suppliers, the risk profile of individual suppliers will become particularly important, including the likelihood of the supplier being subject to interference from a non-EU country,” they said.

Huawei, which competes with Finland’s Nokia and Sweden’s Ericsson, said it stood ready to work with its European partners on 5G network security. It has always denied its equipment can be used for spying.

“This exercise is an important step towards developing a common approach to cybersecurity and delivering safe networks for the 5G era,” a Huawei spokesman said.

“We are pleased to note that the EU delivered on its commitment to take an evidence-based approach, thoroughly analysing risks rather than targeting specific countries or actors.”

Tom Ridge, a former US secretary of homeland security, took a different view of the report. He said Huawei’s close ties to the Chinese government meant it would have to comply with legislation requiring it to assist with intelligence gathering.

“If countries needed more reason to implement stricter security measures to protect 5G networks, this comprehensive risk assessment is it,” said Ridge, a member of the advisory board of Global Cyber Policy Watch.

Fifth-generation networks will hook up billions of devices, sensors and cameras in ‘smart’ cities, homes and offices. With that ubiquity, security becomes an even more pressing need than in existing networks.

“5G security requires that networks are built leveraging the most advanced security features, selecting vendors that are trustworthy and transparent,” a Nokia spokesperson said, adding that the company was the only global vendor capable of providing all the building blocks for secure 5G networks.

EU members have differed on how to treat Huawei, with Britain, a close US ally, leaning towards excluding it from critical parts of networks. Germany is meanwhile creating a level playing field in which all 5G vendors should prove they are trustworthy.

Over dependence

The report warned against over-dependence on one telecoms equipment supplier.

“A major dependency on a single supplier increases the exposure to a potential supply interruption, resulting for instance from a commercial failure, and its consequences,” it said.

European network operators, including Germany’s Deutsche Telekom typically have multi-vendor strategies that they say reduce the security risks that might arise from relying too heavily on a single provider.

“The Commission’s 5G assessment recognises security isn’t just a supplier issue,” said Alex Sinclair, chief technology officer of the GSMA, a global mobile-industry trade group.

“We all have a role to play – from manufacturers to operators to consumers – and we are taking responsibility for our part in the security chain seriously.”

The EU will now seek to come up with a so-called toolbox of measures by the end of the year to address cyber security risks at national and bloc-wide level.

The European Agency for Cybersecurity is also finalising a map of specific threats related to 5G networks.

Got a news tip for our journalists? Share it with us anonymously here.

View the Original article

BPAY reveals API push into core enterprise software

Launches secure sandpit, four new services.

Australian online payments behemoth BPAY has taken another major stride forward in its push to modernise Australia’s payments landscape, opening up a new developer sandpit and releasing four APIs into the market to spur the clean-up of bank legacy systems.

It’s a bold strategic move for the low-cost, high-value money pump, which now pushes approximately $450 billion a year in volume, or $1.8 billion a bank day, with the average transaction size sitting at $900.

Whichever way you look at it, it’s a volume business that puts the likes of Square (which doesn’t disclose dollar volumes) in the shade. More so when you consider Square’s latest clip per transaction is 1.6 percent.

BPAY’s wholesale processing rate is 31.35 cents per transaction, exclusive of what acquiring banks charge merchants on top.  

On Thursday BPAY made public new functionality which lets customers build their own payments batches, retrieve biller details, validate BPAY payments before processing alongside a new customer reference number generator.

The big drop of APIs comes after a year of road testing pilots in BPAY’s customer base, a move that came in response to user demand to securely open up its codebase so that devs can take a stab at creating new and better services.

Assuming uptake is strong – and BPAY is a long game player – the new functionality is set to take a bite out of the credit card and direct debit segments of the payment industry that are ripe for disruption, especially on the domestic payments front.

The sandpit isn’t open slather in terms of access – like the New Payments Platform, it’s a vetted access system to maintain community hygiene and keep miscreants at bay.

And there’s also no getting away from the fact the new API’s are deep, core bank and enterprise tech and as such unlikely to stimulate much publicity from venture capital fueled fintech cheer squads.

Sometimes, quite big shifts happen quietly, especially in mainframe territory. We’ll get to what the APIs do in a moment because it’s easy to miss what they’re about without a little context.

Where BPAY’s customers – that’s banks, big billers like telcos, utilities, real estate agents, appliance retailers (or anyone else that usually takes payments above $200 in value) – will notice a big difference from the APIs is on their own back ends, especially billing and financials systems.

The core offer of the four APIs is essentially streamlined and enhanced connectivity as well as boosted data interchange capability and integrity.

BPAY’s general manager of product, scheme and business development, Keith Brown, told iTnews the process started around two years ago with a design thinking push to target user pain points.

Big users wanted access to APIs, neobanks even more so, Brown said.

A year ago it went to beta and now it’s live. 

Life’s a batch

Back in 2018 BPAY started targeting SMB accounting platforms with a service dubbed “BatchMaker” that plugged into Intuit’s Quickbooks product and let businesses round up different outgoing payments and fire them off all at once.

It also captured the invoice data, validated the payment information and – and this is the killer – automatically figured out the data format each recipient bank need to accept the payment.

That functionality has now been released to the mainstream developer community as an API called (wait for it) “Generate BPAY Batch File” that both validates a set of supplied payments but also creates a batch file in the format of a specified bank.

Batch isn’t going away anytime soon.

Constant, real-time payments are great for smaller payment values – indeed BPAY is a core provider of New Payments Platform overlay services like Osko – but when you hit serious scale it makes more sense to run freight trains than trucks or mini-vans.

What people often don’t realise is that like Australia’s rail gauges, each bank likes their incoming data bowled-up differently, creating a massive headache and on-costs for businesses in the process. So there is serious money to be saved.

At the moment CBA, NAB, Westpac, Macquarie and Bankwest formats are available with more to come soon. And no prizes for guessing which of the big four is missed the curtain raiser.

If, like the languid rollout of Standard Business Reporting, your multinational financials vendor isn’t quite sure when they can offer the batch API solution, it could be worth giving them a sharp poke.

The need to know

If there is one line accounts receivable staff in B2B hate hearing it’s “I don’t know why that payment didn’t go through”, especially when issues later resurface as batch errors. Sometimes it’s a manual error, sometimes a format shift that borks data, but it’s painful, expensive and looks bad.

Live transaction runs are also not a great test environment to figure out what payments will hit their mark, or won’t. That said, the reality is that businesses making payments often don’t know what money has missed its mark until the list of rejects returns.

Until now.

The next API off the BPAY block – “Validate BPAY Payment” – lets enterprise customers do a dry run to check for errors before initiating a payments run to weed out the duds before firing a live batch.

That’s especially useful when customer reference numbers (CRNs) are a bit sloppy for whatever reason, whether it’s formatting or good old fashioned user error.

It also irons out the kink in that when people pay their bills, the quality of the data they submit can be pre-groomed before it’s shunted over to their institution to collect, and it happens in real time.

Numbers up

It’s no secret that payments run according to a set of validation rules and checks, most of which require an identifier in the form of a customer reference numbers (CRNs) that are allocated to an invoice to identify both the customer and the account to be paid.

The functionality to generate BPAY CRNs and iCRNs (intelligent CRNs that denote conditions like expiry dates) has also now been ported to an API available to service providers that also allows QR codes to be created online, on email or on paper.

Unsurprisingly (and you know the devs are in charge of the naming and not the marketers) it’s called “Generate BPAY CRN”.

There’s also a QR code option, a ‘nice to have’ especially useful for enterprises pushing features like discounts for early payments or time limited offers.

While some of the bigger banks might yawn a bit, greenfields neobanks will likely relish the functionality when it comes to snaring business customers who want full integration with cloud accounting tools out of the box.

And BPAY is making no secret it wants neos as customers as much as its existing base.

Go fetch

Like CRNs, it’s also good to be able to grab biller details in real time and check if they are valid. For banks and service providers alike, there’s a substantial amount of legwork to be avoided if things are validated as correct the first time around, and that includes biller info.

Rounding off BPAY’s API beauty pageant is “Retrieve BPAY Biller Details” which, like its cohorts, leaves little to the imagination. Call us unkind, but we reckon the payments industry as a whole has a bit of a problem embracing ambiguity.

But BPAY does like shunting data and there’s plenty to be had in automating biller detail retrieval.

The data menu includes: Biller Short Name, Biller Long Name, Industry (ANZSIC) Code, Variable Customer Reference Number Indicator, Valid Length(s) of Customer Reference Number and Accepted Payment Methods for a supplied Biller Code.

Like we said, this stuff is down in the engine room of the payments giant but it will start to make its way into operations and financials software fairly soon, especially incumbents like SAP and Oracle are increasingly challenged.

Which isn’t a bad thing at all.

Got a news tip for our journalists? Share it with us anonymously here.

View the Original article

Apple CEO Cook defends removal of police-tracking app used in Hong Kong

According to copy of a letter to employees seen by Reuters and confirmed by Apple.

Apple Inc Chief Executive Tim Cook on Thursday defended the iPhone maker’s decision to remove from its app store a police-tracking app used by protesters in Hong Kong, according to a copy of a letter to employees seen by Reuters and confirmed by Apple.

In the message on an internal Apple website, Cook said the information in the app, including crowdsourced locations of police checkpoints and protest hotspots, was on its own “benign.”

“It is no secret that technology can be used for good or for ill. This case is no different,” Cook wrote.

Cook wrote that Apple based its decision on “credible information” from both Hong Kong police and Apple users in Hong Kong that the app was used “maliciously to target individual officers for violence and to victimize individuals and property where no police are present.”

“This use put the app in violation of Hong Kong law,” Cook said. “Similarly, widespread abuse clearly violates our App Store guidelines barring personal harm.”

Apple made the decision a day after a Chinese state newspaper wrote a commentary criticizing the company for approving the app.

“National and international debates will outlive us all, and, while important, they do not govern the facts,” Cook wrote in his letter. “In this case, we thoroughly reviewed them, and we believe this decision best protects our users.”

Apple’s decision to bar the HKmap.live app, which crowdsources the locations of both police and protesters, from its app store plunges the company into the increasingly fraught political tension between China and the protesters that has also ensnared other US and Hong Kong businesses.

Apple had only just last week approved the app after rejecting it earlier this month.

Alphabet Inc’s Google on Thursday said it had dropped a game from its app store that allowed players to pretend they were Hong Kong protesters, saying its policies forbid capitalizing on ongoing sensitive events.

However, Google said it had found no policy violation by HKmap.live, and confirmed that the tracking app was available on its app store.

The Chinese Communist Party’s official newspaper on Tuesday called the tracking app “poisonous” and decried what it said was Apple’s complicity in helping the Hong Kong protesters.

Apple said in a statement on Wednesday it had begun an immediate investigation after “many concerned customers in Hong Kong” contacted it about the app and Apple found it had endangered law enforcement and residents.

“The app displays police locations and we have verified with the Hong Kong Cybersecurity and Technology Crime Bureau that the app has been used to target and ambush police, threaten public safety, and criminals have used it to victimize residents in areas where they know there is no law enforcement,” it said.

Apple did not comment beyond its statement. The company also removed BackupHK, a separate app that served as a mirror of the HKmap.live app.

‘Pressure’

Maya Wang, a senior China researcher with Human Rights Watch, said there could be legitimate concerns of misuse of apps but that the statement from Apple was “disingenuous” because it did not make any reference to pressure from Beijing in the People’s Daily commentary.

“Given the context of how (Apple) has over the years removed apps and removed access to news particularly inside mainland China that the Chinese government doesn’t want, I think that the removal of this particular app strikes me as another shameful incident in which a multinational company bends to Chinese government pressure,” she said.

Apple did not respond to a request for comment on Wang’s remarks.

On Twitter, an account believed to be owned by the HKmap.live app’s developer said it disagreed with Apple’s decision and that there was no evidence to support the Hong Kong police’s claims that the app had been used in ambushes.

“The majority of user review(s) in App Store … suggest HKmap IMPROVED public safety, not the opposite,” it said.

The app consolidates content from public posts on social networks and moderators delete content that solicits criminal activity and would ban repeated attempts to post such content in the app, it added.

Neither China’s foreign ministry nor the information office of the State Council had an immediate comment when asked about the HKmap.live app removal. Hong Kong police also had no immediate comment.

Separately, Apple removed the Quartz news app from its App Store in China because authorities said it violated local laws.

Quartz Chief Executive Zach Seward told technology publication The Verge in a statement: “We abhor this kind of government censorship of the internet, and have great coverage of how to get around such bans around the world.”

A Google spokesman said “The Revolution Of Our Times” app recently pulled from its app store, which lets users role play as Hong Kong protesters, violated a long-standing policy “prohibiting developers from capitalizing on sensitive events, such as attempting to make money from serious ongoing conflicts or tragedies through a game.”

Anger in Hong Kong

The People’s Daily newspaper, in its commentary on Tuesday, said Apple did not have a sense of right and wrong, and ignored the truth. Making the app available on Apple’s Hong Kong App Store at this time was “opening the door” to violent protesters in the former British colony, the newspaper wrote.

The HKmap.live app was taken down from Apple’s App Store globally on Wednesday but continued to work for users who had previously downloaded it in Hong Kong, Reuters found. A web version was also still viewable on iPhones.

Word of its removal spread quickly in Hong Kong, where residents had been campaigning for months, in sometimes violent demonstrations, initially to protest a now-withdrawn extradition bill and now in a broader push for democratic rights.

“Does the entire world have to suck up to the garbage Communist Party?” one commentator, Yip Lou Jie, said in an online forum, LIHKG, used by protesters in Hong Kong.

But Simon Young, associate dean of the Faculty of Law at the University of Hong Kong, said Apple seemed to have a case, given the circumstances.

“It sounds like they are being responsible. To do nothing when it’s being used for a specific purpose that actually facilitates these protests, to do nothing would be rather irresponsible,” he said.

Apple’s action has come amid a furor surrounding the US National Basketball Association after a team official tweeted in support of the protests in Hong Kong, which led Chinese sponsors and partners to cut ties with the NBA.

Got a news tip for our journalists? Share it with us anonymously here.

View the Original article

Victorian hospitals slowly restoring systems after cyber attack

Some systems still offline.

Regional Victorian hospitals and health services hit by a ransomware attack last week are slowly restoring their IT systems after a forced shutdown was required to isolate the infection.

But many systems, including internet and email, remain offline following the cyber security incident, with some systems expected to remain that way until at least early next week.

As mop up efforts continue across the Gippsland Health Alliance and South West Alliance of Rural Health (SWARH), manual workaround are still being used for systems still yet to be restored.

The attack, which occurred on September 30, blocked access to several major systems across hospitals and health services, including financial management, after being infiltrated.

It forced the consortiums to detach a number of systems connected to the internet, including some patient record, booking and management systems, to “quarantine the infection”.

While hospitals and health services impacted by the attack are working with state and federal cyber specialists to urgently restore systems, particularly critical systems, most are still without access to the internet or email.

Health services in this boat include Timboon and District Healthcare Service, Bass Coast Health, Western District Health Service, Portland District Health, South West Healthcare and Colac Area Health.

South West Healthcare said in an update on Wednesday that it was rebuilding “impacted IT system and services”, with other workaround systems developed to all for wage and invoice processing.

“It will continue to be challenging until we restore all computer functions across SWH – which will occur over time and once we have confidence no risks remain,” CEO Craig Foster said.

Barwon Health is another health service within SWARH that is progressively restoring IT systems after the cyber incident.

It was one of four entities identified as being vulnerable to attack earlier this year after Victoria’s auditor-general was able to exploit weaknesses and access patient data.

“Our IT teams has worked around the clock to restore our systems and so far has been able to safely bring back or partly restore almost half of our clinical applications,” the health service said late on Wednesday.

Bass Coast Health said late on Thursday that “great progress in returning our IT system back to full capacity” had been made, with “full restoration … just days away”.

A spokesperson for the Department of Premier and Cabinet told iTnews that there has been “around the clock effort to restore the impacted health service systems”.

“We want to again thank patients for their understanding as we work to resolve this incident, and our hard-working nurses, doctors and other hospital staff for their efforts to manage the issue,” the spokesperson said.

While the investigations are ongoing the Australian Cyber Security Centre and Victoria and Federal Police, there remains no evidence to suggest patient data was accessed.

Got a news tip for our journalists? Share it with us anonymously here.

View the Original article

Fraudsters targeting NSW govt IT suppliers

Using fake quotes, purchase orders.

Scammers impersonating NSW government agencies are attempting to dupe IT suppliers into providing information using spoofing emails that contain fake quote requests and purchase orders.

NSW Treasury issued a warning late last week of the email spoofing scam after being notified by the Australian Cyber Security Centre.

Although not solely limited to IT, the emails invite suppliers to “quote for the supply of goods and services” by referencing senior executives such as an agency’s chief information officer.

“The scammers register realistic looking NSW government websites and email addresses and use these to communicate with suppliers,” the warning states.

“The emails include the contact details of the chief procurement officer, chief information officer and secretary.”

NSW Treasury said that, in some instances, the spoofing emails contained fake “purchase order for the supply of goods and services”.

“We are aware of purchase orders and emails that have been sent from procurement

View the Original article

Flinders Uni builds real-time data system on three-cloud solution

Source: Flinders University Improves security posture.

Before embarking on its 2025 Agenda, Flinders University CIO Kerrie Campbell used to tell the uni’s business units that yes, they could have the information they wanted, it’d just take 12 months to process.

The hold-up was the result of data being held in on-premises Oracle data warehouses coupled with ageing systems — including a six-year-old customer relationship management (CRM) system that was built in-house — Campbell told iTnews.

So when the university settled on its agenda to become an internationally recognised institution for its research, teaching and engagement by 2025, the IT overhaul was given the go-ahead.

The first step in the three-cloud transformation was moving students and staff onto Office 365, Campbell said.

“And then the second component of that was going to Dynamics 365 and putting that into our CRM and our student services.

“We’ve found that this is more valuable to other parts organisation that are really looking to rationalise that CRM and use it more effectively right across the organisation.”

The third and final leg of the journey has been shifting to Microsoft Azure for the university’s new data ecosystem, she said, including Power BI and a dedicated BI team delivery insights in near-real time as opposed to waiting a year.

Together, the three clouds are enabling faster onboarding of students and more targeted marketing campaigns — key components of the 2025 Agenda — as well as significantly faster project delivery for the IT team thanks to a corresponding shift in strategy.

“We moved from a very waterfall environment there were about 12 projects a year to a high-paced agile environment last year with 62 projects, which if you think about it is almost a closed project per week, which is a really high output.”

Project timelines have also been sped up thanks to a decision to buy instead of build, which Campbell said was a more sustainable option moving forward that enabled IT staff to focus on value-add work that contributes to the Agenda, rather than continually fixing and maintaining a house-built system as had been the case with the old CRM.

One of the value-add tools that’s since been rolled out has been Teams, which had initially started off with an academic inquiring about the app as a collaboration platform.

“We ended up rolling it out in a soft roll out and not pressuring everyone to use it. Now we’ve got Teams embedded right through the organisation,” Campbell said.

The soft rollout has inspired a major HR project, the first in a push to become paperless, and reduced the number of emails Campbell receives by around 70 percent.

Cyber warfare institute

Another driving factor behind the decision to move to the cloud has been the security aspect.

Campbell said that, while there haven’t been any known breaches at this point in time, current concerns in the Australian tertiary sector driven by successful breaches at the Australian National University and Australian Catholic University, and the theft of laptops containing 30 years of student data at the University of Western Australia served as a good reminder to the sector to remain vigilant.

Flinders’ new cyber warfare institute, the Jeff Bleich Centre for the US Alliance In Digital Technology, Security, and Governance has put pressure on the university to ensure its own practices are pass the muster.

“That’s really put us up as DEFCON 1 here now.

“We are looking to utilise that value that’s in Microsoft to harden our services, to keep that openness but also to maintain that control,” she added.

Got a news tip for our journalists? Share it with us anonymously here.

View the Original article

Scads of Aussie Exim mail servers need patching again

“Simple coding error” opens up Exim for remote code execution.

Administrators of the popular open source Exim internet mail server have been warned to patch their installations once more, following the discovery of a string expansion bug that could be used for denial of service attacks and remote code execution.

Exim code maintainers have issued a patch in version 4.92.3 of the mail server, to fix a heap-based buffer overflow vulnerability.

A proof of concept has been published by Exim coder Jeremy Harris that shows how sending extended HELO (EHLO) commands with large amounts of data will trigger and crash a mail server.

Harris described the trivially exploitable bug as “a simple coding error, not growing a string by enough”.

Exim versions 4.92, 4.92.1 and 4.92.2 are vulnerabile to the CVE-2019-16928 bug and should be upgraded to 4.92.3.

Shodan.io scans by iTnews found 50,531 vulnerable Exim version 4.92 servers on multiple networks in Australia, 97 running 4.92.1 and 215 version 4.92.2 variants; only 12 Exim installations running the patched version 4.92.3 were found.

Worldwide, Shodan.io found over 200,000 vulnerable Exim installations.

No known mitigation beyond updating the server software exists for the bug, which follows a serious vulnerability in June this year that saw millions of Exim systems being attacked.

Chinese researchers QAX A-Team which is connected to the Qi An Xin Group security vendor are credited with finding the bug.

 

Got a news tip for our journalists? Share it with us anonymously here.

View the Original article

Victorian hospitals go offline after ransomware attack

“No suggestion” personal data has been accessed.

A number of regional Victorian hospitals and health services have been forced to shutdown their IT systems, including some electronic health records, after experiencing a ransomware attack on Monday.

In a statement, the state’s Department of Premier and Cabinet said the “cyber security incident” had blocked access to several major systems, including financial management, after being infiltrated.

Hospitals in the Gippsland Health Alliance and the South West Alliance of Rural Health are said to have been affected, though investigations are continuing to understand the full extent of the attack.

“A number of servers across the state have been impacted. Investigations are still taking place on the full extent of the impact,” DPC said.

“Hospitals have isolated and disconnected a number of systems such as internet to quarantine the infection.

“This isolation has led to the shutdown of some patient record, booking and management systems, which may impact on patient contact and scheduling.

“Where practical, hospitals are reverting to manual systems to maintain their services.”

The DPC said the state’s cyber incident response service had been deployed and spent Monday night working with the impacted health services to respond to the attack.

Victoria Police and the Australian Cyber Security Centre are also working with the government and the health services to manage the incident.

While the investigations are ongoing, DPC said stressed that there was currently “no suggestion that personal patient information had been accessed”.

“The priority is to fix all affected systems and prevent any further compromise,” DPC said.

“The affected hospitals are now working on their bookings and scheduling to minimise impact on patients, but may need to reschedule some services where they don’t have computer access to patient histories, charts, images and other information.”

Earlier this year, Victoria’s auditor-general warned that the state’s public health system was “highly vulnerable” to attack after it was able to exploit weaknesses and access patient data in four hospitals and health services.

One of those identified was Barwon Health, which was one of the health services affected by the ransomware attack on Monday.

“Victoria’s public health systems is highly vulnerable to the kind of cyberattacks recently experienced by the National Health Service (NHS) in England, in Singapore, and at a Melbourne-based cardiology provider, which resulted in stolen or unusable patient data and disrupted hospital services,” the auditor-general said.

The auditor-general was particularly critical of the security awareness of staff, which it said “increases the likelihood of success of social engineering techniques such as phishing”.

More to come

Got a news tip for our journalists? Share it with us anonymously here.

View the Original article

Lawyers for Huawei CFO detail record requests to prove her rights were violated

List of emails, notes and other records sought. Lawyers for Huawei Chief Financial Officer Meng Wanzhou detailed a list of emails, notes and other records they are seeking to prove that her rights were violated before her December arrest at Vancouver’s airport, according to a court document released on Monday.Meng, 47, was arrested at the …

Hi! You’ve reached one of our premium articles. This is available exclusively to subscribers.

It’s free to register, and only takes a few minutes.

Once you sign up you’ll have unlimited access to the full catalogue of Australia’s best business IT content, as well as a daily news bulletin delivered straight to your inbox.

Register now Already have an account? Log in to read this article.

Got a news tip for our journalists? Share it with us anonymously here.

View the Original article

IT contractor arrested, Sydney DC raided over sabotage, data breaches

Multiple swoops by Riot Squad, State Crime Command detectives.

New South Wales police have sent the Public Order and Riot Squad in to execute search and crime scene warrants in multiple raids across Sydney on Wednesday morning after detectives arrested a man in the city’s CBD in relation to the LandMark White data breach incidents.

The man, who police said is a “software contractor” has been detained at the Surry Hills Police complex where it is anticipated he will be charged after swoops by Strike Force Vide.

Update: the IT contractor allegedly involved in the data breaches has now been charged.

The arrest follows repeated public claims by LandMark White’s management that the data breaches that exposed more than 170,000 data records, including personal information and valuation records was an inside job aimed at sabotaging the ASX-listed company.

Banks, who were key customers for LandMark White’s online property valuation service terminated their business with the firm after the breaches despite initial support to try and help the firm back on its feet.

The data breach incidents cratered LandMark White’s shares, which languished at a paltry one cent per share after being lifted from a lengthy suspension. LandMark White’s shares bounced immediately after news of the arrest and raids hit the ASX.

“With the assistance of company staff, investigations identified that unauthorised access was gained into the company’s database,” a police statement said adding that “documents were uploaded to the dark web and the internet.”

Police said that shortly after the man’s arrest “detectives, assisted by the Public Order and Riot Squad, executed a search warrant at a home at Rozelle, and a crime scene warrant at a business data centre at Ultimo.”

Aside from the heavy damage to its market valuation and reputation, Landmark White has previously estimated the breaches cost it around $7 million to investigate and remedy.

In a statement to the ASX hailing the police raids and arrest,LandMark White said it was “grateful that the person arrested today was not one of our employees.”

“Investigations have revealed that the breach was carried out by someone with trusted inside access and we believe we were deliberately targeted by someone with an intent to damage our business and reputation,” LandMarkWhite’s ASX statement said.

“We are working with the Cybercrime Squad to understand the motives for these actions.”

The battered valuer also trumpeted that after all its troubles, its information security safeguards have been substantially upgraded and hardened. 

“We have made considerable investment and system enhancements this year. We are fully compliant with the International Standard ISO27001 – Information Security Management, and will soon be externally certified to this Standard.

“We are pleased that a number of financial institutions have reinstated LMW to their panels of valuation providers, and we continue to work with all our partners to provide them with the information they need to be satisfied our operations are secure and/or best practice.”

Got a news tip for our journalists? Share it with us anonymously here.

View the Original article

Qld govt cyber defences fail ethical hack test

Sensitive information accessed with relative ease.

Ethical hackers from Queensland’s Audit Office were able to exploit vulnerabilities in the IT systems of three state government entities to access sensitive information during recent cyber security testing.

In a damning audit report

View the Original article

Net neutrality rules could return at state level under mixed US court decision

Repeal of Obama-era net neutrality protections upheld.

Internet providers could face a variety of state internet regulations after a US court ruled on Tuesday that the federal government cannot block states from passing their own net neutrality laws, while largely upholding the 2017 repeal of landmark rules barring providers from blocking or throttling traffic.

The US Court of Appeals for the District of Columbia said the Federal Communications Commission erred when it declared that states cannot pass their own net neutrality laws and ordered the agency to review some key aspects of its 2017 repeal of rules set by the Obama administration. But it left open the possibility the FCC could seek to block state efforts on a case-by-case basis.

The decision could subject internet providers to a variety of state regulations on internet traffic. Verizon Communications said the ruling “underscores the need for Congress to adopt national legislation that provides protections for consumers while avoiding a disruptive, inconsistent patchwork of state Internet regulation.”

The court also found that the FCC acted properly when it overturned a 2015 decision that had classified broadband internet as a utility-style service that handed the FCC sweeping authority to regulate it and instead classified it as less regulated information service.

But the court also found the agency “failed to examine the implications of its decisions for public safety” and must also review how its decision will impact a government subsidy programme for low-income users.

The decision means the more than 10-year-old debate over net neutrality will continue to drag on for months or more likely years as Congress has refused to pass legislation that would end the debate.

The 2017 FCC decision handed internet providers sweeping powers to recast how Americans use the internet, as long as they disclose changes. The new rules took effect in June 2018, reversing rules adopted under former President Barack Obama in 2015 which barred internet service providers from blocking or throttling traffic, or offering paid fast lanes, also known as paid prioritisation.

FCC Chairman Ajit Pai said the decision affirmed the FCC’s “decision to repeal 1930s utility-style regulation of the internet. A free and open internet is what we have today. A free and open internet is what we’ll continue to have going forward.”

Pai added that the FCC would address “the narrow issues that the court identified.”

John Bergmayer, legal director at Public Knowledge, said the decision “leaves states with a clear path forward to enact state net neutrality laws to protect internet users and provide certainty for participants in the digital economy. States should move expeditiously to protect consumers where the FCC has refused to do so.”

A senior FCC official told reporters on a conference call that the decision is “not a green light” for states to pass any internet rules they want and said the FCC has not decided whether to appeal portions of the decision.

Championed by large tech companies and consumer groups, net neutrality was formally adopted by the FCC in 2015. Major telecommunications companies argued it limited their ability to offer new services to content providers, and under the Trump administration, the FCC overturned the policy.

California adopted sweeping state net neutrality protections in October 2018 but agreed not to enforce the measure pending the court challenge.

House Speaker Nancy Pelosi, a California Democrat, said the decision was a “disappointing blow to the promise of a free and open internet” but she said “California’s leadership in enacting the strongest net neutrality protections in the country is a model that will ensure that the internet remains an engine of innovation, job creation and free speech for all Americans.”

California Attorney General Xavier Becerra said the decision “blocks the FCC’s effort to preempt state net neutrality laws through regulation.”

The court threw out the part of the order that barred all states from setting net neutrality rules.

“The commission lacked the legal authority to categorically abolish all 50 states statutorily conferred authority to regulate intrastate communications,” the court said.

The FCC could still make “provision-specific arguments” to seek to block individual aspects of state net neutrality rules.

Judge Stephen Williams wrote in his dissenting opinion that “On my colleagues’ view, state policy trumps federal; or, more precisely, the most draconian state policy trumps all else.”

The Internet Innovation Alliance, a group representing companies including AT&T, said the decision “allowing rules that differ among all 50 states could spell disaster for advancement of the internet.”

The Trump administration rules were a win for internet providers like AT&T, Comcast and Verizon but opposed by companies such as Facebook, Amazon and Alphabet Inc.

Got a news tip for our journalists? Share it with us anonymously here.

View the Original article