VMware is urging its customers to update vCenter Server versions 6.5, 6.7 and 7.0 immediately after fixing two vulnerabilities that could allow attackers to launch remote code execution attacks. 

The most severe bug is tracked as CVE-2021-21985 which lies in the vSphere Client. This flaw involves a lack of input validation in the Virtual SAN Health Check plugin, which is enabled by default in the system. 

The vSAN system is a software-defined storage platform that’s used to eliminate the need for additional storage boxes using the local server storage. The health check plugin enhances customer support and user experience by allowing customers to manage their virtual deployments, including dozens of automated health checks.

The vulnerability is rated 9.8 on the CVSS threat severity scale and could allow hackers with network access to port 443 to execute commands with unrestricted privileges on the operating system that hosts vCenter Server. The high base score suggests the effects are particularly devastating, and the vulnerability is relatively easy to exploit.

The second vulnerability, tracked as CVE-2021-21986, is less severe, but nonetheless would allow attackers with network access to port 443 on vCenter Server to perform actions allowed by the impacted plugins without authentication. 

This vulnerability concerns a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager and VMware Cloud Director Availability plugins in the vSphere Client. 

The bugs are extremely serious, VMware has warned, and customers are being advised to patch immediately. 

«With the threat of ransomware looming nowadays the safest stance is to assume that an attacker may already have control of a desktop and a user account through the use of techniques like phishing or spearphishing, and act accordingly,» the firm says in its FAQs. 

«This means the attacker may already be able to reach vCenter Server from inside a corporate firewall, and time is of the essence.»

The issue affects all vCenter Server customers, not just those who use vSAN, because this plugin is shipped with all systems and is enabled by default. The company doesn’t advise disabling the vSAN plugin, because manageability and monitoring will not be possible, and customers using vSAN should only disable the plugin for short periods of time. 

Warning of the dangers, VMware said in its FAQs that customers without perimeter security controls on their virtualisation infrastructure may be in jeopardy. Ransomware gangs, particularly, have demonstrated they can compromise corporate networks and subsequently wait for new vulnerabilities in order to attack from inside a network.

The fear is very real given that ransomware operators had previously exploited critical ESXi and vSphere Client flaws, with Carbon Spider and Sprite Spider gangs exploiting the flaws to encrypt virtual machines (VMs).

Google Cloud is launching three database services across its analytical portfolio that aim to unify its data services. 

Dataplex, Analytics Hub and Datastream are all ‘previews’ that aim to reduce silos and securely predict business outcomes in ‘dynamic’ digital environments. 

Datastream is a serverless offering and replication service that enables customers to replicated data streams from Oracle and MySQL into Google Cloud products like BigQuery or Cloud Spanner.

The Analytics Hubs is a service where companies can create, curate and manage analytics tools. This includes sharing data insights, dynamic dashboards and machine learning models both internally and externally. Google said it builds on BigQuery’s existing sharing capabilities, which have already proven popular with organisations.

The third new service is called ‘Dataplex’ and is described as an ‘»intelligent data fabric». It meshes the best of Google Cloud with open source technology to enables secure and rapid curation, integration, and analysation of data at scale. 

«Data must be thought of as an ability that integrates all aspects of working with it,» said Gerrit Kazmaier, VP and GM of Databases, Data Analytics and Looker, at Google Cloud. «Every industry is accelerating their shift of being digital-first as they recognise data is the essential ingredient for value creation and the key to advancing their digital transformation.»

«At Google Cloud, we’re committed to helping customers build the most powerful data cloud solution to unlock value and actionable, real-time insights, needed to future-proof their business.»

Equifax is an early user of the new previews, working with Google to incorporate Dataplex into the company’s core analytics platform. The firm is hoping to simplify its workloads and build a single interface for policy management and governance across all its analytics data offerings. 

«Google Cloud has been a critical part of the Equifax journey, helping us protect our customers’ sensitive and proprietary data,» said Bryson Koehler, Equifax CTO. «Google Cloud allows us to create a rich, unified and trusted data ecosystem between business units and partnerships – one in which everyone gains immediate value.»

Microsoft has been slowly making Teams a more collaborative environment, including the fall release of Teams Meetings and its subsequent upgrades. At Microsoft Build 2021, the tech giant announced a handful of Teams updates that’ll continue the path toward a more collaborative offering.

At Build 2021, Microsoft announced it’ll give developers significantly more liberty within the interface. This freedom will begin with Teams no longer relegating third-party apps to the sidebars. Instead, Teams is testing a main-stage collaboration tool that’ll allow these apps to live front and centre on the main screen.

This would be useful for a brainstorming session where there’s a whiteboard in the middle of the meeting for jotting down ideas and key points.

Teams will also allow developers to create custom scenes for company meetings. They can also use APIs that allow them to automate key tasks at specific times during a meeting. For example, reminding the host to start a wrap-up Q&A session with at least 15 minutes remaining.

Real-time transcription, translation, and note-taking during meetings are slated to arrive this summer. Of course, admins will have the ability to activate and deactivate these features with ease. This way, if there is a meeting that involves sensitive or confidential details, you can deactivate these services to keep the information secure.

Finally, using Fluid Framework components, Microsoft plans to allow users to work on tables, lists, and text fields in one Teams conversation and copy them into another conversion or into an Office 365 app. These files would also be editable by colleagues in real time.

Since the COVID-19 outbreak, collaboration and video conferencing software providers have been booming. Teams has been among those seeing quite the boost, as the company now says it has over 145 million daily users. And with remote working here to stay for many companies, now’s the perfect time for Microsoft to show off the flexibility of Teams.

Microsoft has launched a set of new Azure services that organisations can now run on any CNCF-conformant Kubernetes cluster using its Azure Arc multiple-cloud service.

At its virtual Build 2021 event, Microsoft said its cloud services, such as Azure App Service, Functions, Logic Apps, API Management, and Event Grid, would now all be Arc-enabled (in preview form). Azure Arc, launched in 2019, is Microsoft’s tool to help firms manage Kubernetes container clusters across clouds and on-premises data centres.

The firm said that these Azure application services can be deployed to any Cloud Native Computing Foundation (CNCF)-conformant Kubernetes cluster connected via Azure Arc.

The services now enabled includes Azure App Service for creating and managing web apps and APIs with a fully managed platform and features like autoscaling, deployment slots, and integrated web authentication; Azure Functions for event-driven programming with autoscaling, and triggers and bindings to integrate with other Azure services; Azure Logic Apps for creating automated workflows for integrating apps, data, services, and backend systems, as well as Azure API Management for dealing with internal and external APIs.

«The app services are now Azure Arc-enabled, which means customers can deploy Web Apps, Functions, API gateways, Logic Apps and Event Grid services on pre-provisioned Kubernetes clusters,» the firm said in a statement.

«This takes advantage of features including deployment slots for A/B testing, storage queue triggers, and out-of-box connectors from the app services, regardless of run location. With these portable turnkey services, customers can save time building apps, then manage them consistently across hybrid and multi-cloud environments using Azure Arc.»

Microsoft added that with this capability now in preview, customers don’t have to choose between the productivity of platform as a service (PaaS) and the control of Kubernetes, as the same app services can run with either model.

Gabe Monroy, vice president for Azure Developer Experience at Microsoft, said in a blog post that one of the challenges he heard from customers was that despite the enhanced control and ecosystem benefits of Kubernetes, Kubernetes is difficult for developers to use directly. Developers must learn many advanced concepts and APIs, which can hurt their productivity.

«With today’s announcement, developers no longer have to choose between the productivity of Azure application services and the control of Kubernetes,» he added.

IBM will provide over-the-cloud access to its quantum systems for Indian institutions to accelerate advanced training and research in quantum computing as it hopes to help build a «quantum-ready» workforce.

Faculty and students will be able to access IBM quantum systems, quantum learning resources, and quantum tools over the IBM Cloud for education and research purposes. The company hopes this will enable them to work with actual quantum computers and programmes using the Qiskit open-source framework.

«IBM is committed to growing a quantum-ready workforce and building an ecosystem to nurture the quantum community in India. With this engagement, we can take it a step further to scale up this ecosystem in India, for India and the world,» said Gargi Dasgupta, director of IBM Research India and CTO of IBM India/South Asia.

The institutions taking part are the Indian Institute of Science Education & Research (IISER) – Pune, IISER – Thiruvananthapuram, Indian Institute of Science (IISc) Bangalore, Indian Institute of Technology (IIT) – Jodhpur, IIT – Kanpur, IIT – Kharagpur, IIT – Madras, Indian Statistical Institute (ISI) Kolkata, Indraprastha Institute of Information Technology (IIIT) Delhi, Tata Institute of Fundamental Research (TIFR) Mumbai, and the University of Calcutta.

This partnership will also be part of the IBM Quantum Educators programme that helps faculty in the quantum field to connect with one another and provides them with educational resources.

Plus, IISER- Thiruvananthapuram, ISI-Kolkata, and IIT-Madras will host their own Quantum Computing Lab courses for students which will include lab sessions using IBM quantum systems.

Earlier this year, IBM offered the quantum industry’s first developer certification to help workforces become «quantum-ready». Developers have to display their knowledge of Qiskit, the company’s open source quantum development kit, and answer 60 questions in the certification exam.

Using the knowledge of how to utilise Python and basic linear algebra, Qiskit allows users to programme quantum computing hardware. Since it was launched in 2017, thousands of users have developed applications and maintained and improved code, according to the company.

​

The Home Office has published plans for its long-awaited digitisation of border controls and immigration. 

The new strategy promises a «fully end-to-end digital customer experience» for online applications, proof of identity and also crossing the border. 

It includes a new digital visa system to help count the number of people coming into the UK, which is said to be similar to the US Esta electronic travel authorisation. This would apply to any entrant that does not have an existing visa or immigration status.

«Our new fully digital border will provide the ability to count people in and count people out of the country,» home secretary Priti Patel told an online conference on Monday, according to the Guardian. 

The project was originally scheduled for completion in 2019 and has reportedly cost upwards of £173 million. The plans still appear to have missing details, such as the cost of the digital visa and specific details on when it will be finished. The move to a fully digital border system has been heavily criticised by MPs for being too slow. 

«As part of this, we are looking at further ways to remove physical documents from the process and streamline the system, such as potentially removing the need for separate vignettes and Biometric Residence Permits, taking out the cost and time for the user and the Home Office and improving security,» the department said in a statement.

«This would be supported by increased use of the online services to prove right to work and rent, simplifying the process for employers, landlords and individuals and reducing the number of documents relied on to prove status.»

In March, the Public Accounts Committee slammed the Home Office for failing to make progress on its digital border transformation, labelling it «miserable» and «exorbitantly expensive». 

A McKinsey survey of over 20,000 European citizens revealed that 86% of Brits have used e-commerce or online services in the past six months.

The report suggests that this makes the UK the most digitally advanced country in Europe, ahead of France (82%) and Germany (65%), and only behind India (88%) and Brazil (97%) on a global scale. 

Around seven million people in the UK have accessed new digital services since Christmas, mostly grocery and education services as a result of the pandemic, with McKinsey estimating a total of 43 million digital users in 2021.

Over the last six months, digital growth has remained the same, according to McKinsey, but it may drop once the pandemic is fully over. The report suggests that over nine million Brits are expected to return to physical stores as soon as they are safe to do so. 

«With consumers having reached high levels of digital penetration in most regions and industries, the acceleration into digital channels now seems to have levelled off in both Europe and the United States,» McKinsey said. 

«As a result, even as total digital adoption remains above pre-pandemic levels, many industries and regions may see a modest negative net change in post-pandemic digital use relative to 2020.» 

Consumer expectations of the post-pandemic future suggest a strong return of physical channels, according to the report, with some expecting to fully return to pre-pandemic behaviour. The main sectors here include travel, banking, telco carriers and entertainment. 

In the UK, 35-44 year-olds plan to use fewer digital services after the pandemic, citing «distrust» as a result of data handling. This was also apparent in questions around security, with 44% of the respondents suggested they didn’t fully trust digital services. 

Sabre Systems experienced an outage on Friday 21 May that impacted a number of airlines around the world and interrupted their scheduled flights.

Sabre is a third-party IT system used for check-in, boarding and flight bookings. The outage affected global airlines including Virgin Australia, Jet Blue, Alaskan Airlines and American Airlines.

A spokesperson for Virgin Australia confirmed the company had experienced an outage with the Sabre booking system which had resulted in over 30 flights cancelled on Friday and a «small number of flights» cancelled or delayed on Saturday.

Tweets from the airline suggested that the outage affecting Virgin Australia lasted for around three hours.

A JetBlue spokesperson told IT Pro: «JetBlue systems are back online following a Sabre outage impacting multiple airlines. We apologise for any inconvenience this caused.» 

Moreover, when IT Pro asked the company for comment, Sabre blamed the outage on Dell EMC.

«Dell/EMC has confirmed it experienced a hardware redundancy failure that impacted Sabre’s system, including PSS and check-in. The issue has been resolved. Dell/EMC is working to understand why the failure occurred,» said the spokesperson.

IT Pro has contacted Dell for comment.

Meanwhile, Air India stated that a cyber attack which took place three months ago on the systems of its data processor has exposed information belonging to around 4.5 million of its customers worldwide.

The breach which affected SITA, the data processor, involved personal data registered over a ten year period which exposed information such as passport information, date of birth and credit card data. The airline is now encouraging passengers to change passwords to ensure the safety of their personal data.

Amazon has announced it is retiring its standalone Prime Now service, with its app and website shutting down globally by the end of 2021.

Prime Now has been available since 2014 as a way for members of Amazon’s Prime subscription service to get items delivered straight to their doors within a few hours for an extra fee.

However, the e-commerce giant is now directing users that want these fast deliveries to the Amazon app and website where a two-hour delivery option will be made available. This also includes Amazon Fresh and Whole Foods, which are both available in the app and website.

The move will also incorporate any third-party retailers or local stores that were offered within Prime Now, such as the supermarket chain Morrisons. Available retailers differed slightly from region to region, but the service was used in more than 5,000 cities and towns and even operated out of dedicated Prime Now warehouses.

«To make this experience even more seamless for customers, we are moving the experience from a separate Prime Now app onto the Amazon app and website so customers can shop all Amazon has to offer from one convenient location,» the company’s vice president of grocery, Stephenie Landry, said in a blog post.

«In 2014, I wrote a six-page document outlining a service that would allow customers to get last-minute items in about an hour. We even gave the project the internal code name ‘Houdini.’ In just 111 days, our team took the concept outlined in that six-page document and turned it into Prime Now, which became the foundation for Amazon’s ultrafast grocery and same-day delivery businesses.»

The change has been planned for some time with pop-up notifications in Prime Now directing users to the new website and app. The service has also been discontinued in India, Japan, and Singapore.

Chinese digital retail firm Hanshow will use Microsoft’s technology to expand globally, undergo digital transformation, and produce cloud-based software for its clients around the world, as part of a new deal.

Through the new collaboration, Hanshow is set to adopt Microsoft Azure while prioritising Microsoft technology in its products to retail clients. Hanshow said this will allow it to unify its global information systems, improve efficiency and security, and consequently enhance the company’s competitiveness.

Microsoft will also provide technical support to the digital retail firm in co-creating cloud-based products that use the tech giant’s machine learning, IoT, and data technology.

“Hanshow’s solutions empowered by Microsoft Azure are at the heart of digital transformation in the retail industry, and by partnering with Hanshow we can enable retail customers around the world together,” said Joe Bao, VP of Microsoft in China.

Hanshow claims to be one of the world’s leading electronic shelf label (ESL) providers, with products in use at over 20,000 stores across 50 countries. It said many of its clients are some of the world’s top retailers, operating hundreds of stores across multiple geographies.

Hanshow stated that managing ESL across a retailer’s multiple stores requires significant investment in IT infrastructure and technology. However, as the company has already seen in Europe and Australia, by adopting a SaaS solution using Microsoft Azure, it can manage over 10 million ESL and other IoT devices across geographies through a remote network, and it can be done without new infrastructure or other investments.

“This partnership with Microsoft not only helps streamline our company’s operations,” said Hou Shiguo, Hanshow CEO, “it also provides us with the lightweight and highly adaptable technology our retail clients need to dramatically increase their efficiency and drive profits for their business.”

Microsoft announced its new retail-focused cloud service in January this year, which includes features from Azure, Microsoft 365, Dynamics 365, Power Platform, and Microsoft Advertising. It’s unified through a common data model and built on a compliant and secure platform.

The tech giant’s services already operate across several retail chains, with, for example, Microsoft Azure delivering 200 million purchase forecasts a day to Walgreens to help the retail company ensure the right items are in stock at the right time. Microsoft also has a deal with Chipotle to supply the firm with analytical tools to help it better understand customer preferences and expand its loyalty programme.