Preventing supply chain attacks
By Chiueh
Tzi-cker 闕志克
On Dec. 13 last year, cybersecurity company FireEye broke news of the most widespread hacking attack on US government agencies in the country’s history. Government departments affected by the attack, which exploited a vulnerability in proprietary network management software made by the Texas-based software provider SolarWinds, included the US departments of energy, treasury, homeland security, justice and defense.
The SolarWinds incident highlights the severe impact that “software supply chain” attacks can have. Hackers first analyze the software used by the target organization, then identify downstream suppliers to these software products with relatively weak data security practices and infect their software update infrastructure with malicious code. Once the organization updates the software, the malicious code is downloaded onto its systems.
NCC orders phone recall over malware
TAIWAN MOBILE WOES: An implanted program reportedly enabled scammers to obtain peoples’ telephone numbers, which they then used to register for game apps
By Shelley Shan / Staff reporter
The National Communications Commission (NCC) yesterday ordered Taiwan Mobile to recall all of its self-branded, China-made smartphones after the phones’ built-in software was found to contain a malicious program exploitable by scammers.
The telecom in April 2018 launched the Amazing A32 smartphone, which was manufactured in China, to encourage 3G users to upgrade to 4G, the commission said.
The phone cost NT$1,990 (US$70 at the current exchange rate).
NCC orders Taiwan Mobile fix security issue on Amazing A32 phones
01/06/2021 09:00 PM
A Taiwan Mobile store in Taipei. CNA file photo
Taipei, Jan. 6 (CNA) Taiwan Mobile has been ordered to fix a security issue on its Amazing A32 phone model, which has been found to contain malware installed during the manufacturing process, the National Communications Commission (NCC) said Wednesday.
In a statement, the NCC said it notified the company about the security problem after it received information from the Criminal Investigation Bureau (CIB) about the malware, which could allow identity theft, among other issues, as it would give fraudsters remote access to the phone.