The Metropolitan Police Service (MPS) has awarded a strategic IT infrastructure contract to services provider Capgemini, with the aim of improving the user experience of its internal platforms.

The contract is said to be worth £600 million and will run for five years, with the option to extend for an additional two years if needed.

The MPS is looking to improve its IT infrastructure services within the Pegasus Programme, a digital policing programme to procure new key IT suppliers for the police.

Capgemini will be working on moving the MPS away from its multi-supplier “Towers” model, essentially separated categories of services that led to unnecessary fragmentation.

The bulk of the contract work will involve amalgamating services such as the service desk, network services, end user services, cyber security services, and others under a single umbrella.

“We are delighted to have been chosen as the strategic infrastructure services provider for MPS, one of the world’s leading police forces and one of the largest public sector organisations in the UK,” said Nive Bhagat, CEO of Cloud Infrastructure Services at Capgemini.

Capgemini has a history of providing services to the police, including helping it to transform its budget control back in 2008. The contract was signed with the London’s Mayor’s Office for Policing and Crime who have used Capgemini in the past in projects involving email services or agile scrum teams.

Angus McCallum, chief digital and technology officer at the Metropolitan Police, said: “Capgemini will help us continue to develop the next stage in our journey towards Met’s digital policing vision.

“Capgemini was chosen as our infrastructure partner based on the strong capabilities demonstrated throughout the bid process. We look forward to working closely with Capgemini in the delivery of critical infrastructure services over the coming years.»

Last year, Capgemini signed a three-year partnership with Barts Health NHS Trust to modernise its ICT estate.

The Metropolitan Police Service (MPS) has awarded a strategic IT infrastructure contract to services provider Capgemini, with the aim of improving the user experience of its internal platforms.

The contract is said to be worth £600 million and will run for five years, with the option to extend for an additional two years if needed.

The MPS is looking to improve its IT infrastructure services within the Pegasus Programme, a digital policing programme to procure new key IT suppliers for the police.

Capgemini will be working on moving the MPS away from its multi-supplier “Towers” model, essentially separated categories of services that led to unnecessary fragmentation.

The bulk of the contract work will involve amalgamating services such as the service desk, network services, end user services, cyber security services, and others under a single umbrella.

“We are delighted to have been chosen as the strategic infrastructure services provider for MPS, one of the world’s leading police forces and one of the largest public sector organisations in the UK,” said Nive Bhagat, CEO of Cloud Infrastructure Services at Capgemini.

Capgemini has a history of providing services to the police, including helping it to transform its budget control back in 2008. The contract was signed with the London’s Mayor’s Office for Policing and Crime who have used Capgemini in the past in projects involving email services or agile scrum teams.

Angus McCallum, chief digital and technology officer at the Metropolitan Police, said: “Capgemini will help us continue to develop the next stage in our journey towards Met’s digital policing vision.

“Capgemini was chosen as our infrastructure partner based on the strong capabilities demonstrated throughout the bid process. We look forward to working closely with Capgemini in the delivery of critical infrastructure services over the coming years.»

Last year, Capgemini signed a three-year partnership with Barts Health NHS Trust to modernise its ICT estate.

Hackers are targeting legacy Linux systems with sophisticated malware believed to have been developed by cyber criminals backed by the Chinese state.

The malware, branded RedXOR, encodes its network data with a scheme based on the XOR Boolean logic operation used in cryptography, and is compiled with a legacy compiler on an older release of Red Hat Enterprise Linux (RHEL).

This, according to Intezer researchers, suggests RedXOR is being used in targeted attacks against legacy systems.

Its operators deploy RedXOR to infiltrate Linux endpoints and systems in order to browse files, steal data, upload or download data, as well as tunnel network traffic. The backdoor is also difficult to identify, disguising itself as a polkit daemon, which is a background process for managing a component that controls system-wide privileges.

“Based on victimology, as well as similar components and Tactics, Techniques, and Procedures (TTPs), we believe RedXOR was developed by high profile Chinese threat actors,” said Intezer researchers Avigayil Mechtinger and Joakim Kennedy.

“Linux systems are under constant attack given that Linux runs on most of the public cloud workload. Along with botnets and cryptominers, the Linux threat landscape is also home to sophisticated threats like RedXOR developed by nation-state actors.”

Upon installation, the malware moves its binaries to a hidden folder dubbed ‘po1kitd.thumb’, as part of its efforts to disguise itself as the polkit daemon. The malware then communicates with the command and control server in the guise of HTTP traffic, from where instructions are then sent.

Researchers have monitored the server issuing a total of 19 separate commands, including requesting system information and issuing updates to the malware. The presence of «on and off» availability in the command and control server also indicates the operation is still active, the researchers claim.

To build the backdoor, the hackers used the Red Hat 4.4.7 GNU Compiler Collection (GCC) compiler, which is the default GCC for RHEL 6. This was first released in 2010.

Mainstream support for RHEL 6 only ended recently, in November 2020, meaning a swathe of servers and endpoints are likely still running RHEL 6. Intezer, however, hasn’t disclosed the number of, or nature of, the victims it’s identified. According to Enlyft, roughly 50,000 companies use RHEL installations.

Although the discovery of Linux malware families has increased in recent times, backdoors attributed to advanced threat groups, such as nation state-backed attackers, are far rarer.

Researchers are confident in their attribution, however, identifying 11 distinct similarities between RedXOR and the PWNLNX backdoor, as well as parallels with the XOR.DDOS and Groundhog botnets – all associated with hackers supported by the Chinese state.

The samples discovered were also uploaded from Indonesia and Taiwan, countries known to be targeted by state-backed hackers operating from China.

Hackers are targeting legacy Linux systems with sophisticated malware believed to have been developed by cyber criminals backed by the Chinese state.

The malware, branded RedXOR, encodes its network data with a scheme based on the XOR Boolean logic operation used in cryptography, and is compiled with a legacy compiler on an older release of Red Hat Enterprise Linux (RHEL).

This, according to Intezer researchers, suggests RedXOR is being used in targeted attacks against legacy systems.

Its operators deploy RedXOR to infiltrate Linux endpoints and systems in order to browse files, steal data, upload or download data, as well as tunnel network traffic. The backdoor is also difficult to identify, disguising itself as a polkit daemon, which is a background process for managing a component that controls system-wide privileges.

“Based on victimology, as well as similar components and Tactics, Techniques, and Procedures (TTPs), we believe RedXOR was developed by high profile Chinese threat actors,” said Intezer researchers Avigayil Mechtinger and Joakim Kennedy.

“Linux systems are under constant attack given that Linux runs on most of the public cloud workload. Along with botnets and cryptominers, the Linux threat landscape is also home to sophisticated threats like RedXOR developed by nation-state actors.”

Upon installation, the malware moves its binaries to a hidden folder dubbed ‘po1kitd.thumb’, as part of its efforts to disguise itself as the polkit daemon. The malware then communicates with the command and control server in the guise of HTTP traffic, from where instructions are then sent.

Researchers have monitored the server issuing a total of 19 separate commands, including requesting system information and issuing updates to the malware. The presence of «on and off» availability in the command and control server also indicates the operation is still active, the researchers claim.

To build the backdoor, the hackers used the Red Hat 4.4.7 GNU Compiler Collection (GCC) compiler, which is the default GCC for RHEL 6. This was first released in 2010.

Mainstream support for RHEL 6 only ended recently, in November 2020, meaning a swathe of servers and endpoints are likely still running RHEL 6. Intezer, however, hasn’t disclosed the number of, or nature of, the victims it’s identified. According to Enlyft, roughly 50,000 companies use RHEL installations.

Although the discovery of Linux malware families has increased in recent times, backdoors attributed to advanced threat groups, such as nation state-backed attackers, are far rarer.

Researchers are confident in their attribution, however, identifying 11 distinct similarities between RedXOR and the PWNLNX backdoor, as well as parallels with the XOR.DDOS and Groundhog botnets – all associated with hackers supported by the Chinese state.

The samples discovered were also uploaded from Indonesia and Taiwan, countries known to be targeted by state-backed hackers operating from China.

The Linux Foundation has launched a free-to-use service for open source developers to cryptographically sign software to reassure users further down the supply chain that the software they’re using is legitimate.

Developed in partnership with Google and Red Hat, the sigstore project will allow the open source community to sign software artefacts including release files, container images and binaries before these elements are stored in a public log.

The aim is to make it easier for developers to sign releases and for users to verify them, with widespread uptake translating to a reduction in the threat of open source supply chain attacks. This is because one of the major issues with open source software is it’s often difficult to determine where the software came from, and how it was built.

​

“Installing most open source software today is equivalent to picking up a random thumb-drive off the sidewalk and plugging it into your machine,” said Google’s product manager Kim Lewandowski and product engineer Dan Lorenc. “To address this we need to make it possible to verify the provenance of all software – including open source packages.

“The mission of sigstore is to make it easy for developers to sign releases and for users to verify them. You can think of it like Let’s Encrypt for Code Signing. Just like how Let’s Encrypt provides free certificates and automation tooling for HTTPS, sigstore provides free certificates and tooling to automate and verify signatures of source code.”

Sigstore takes a unique approach to key management by issuing short-lived certificates based on OpenID Connect grants, and storing all activity in logs backed by the Trillian instant management software. This is so the team can detect compromises, and recover from them, when they do occur.

This approach has been devised in light of the fact that key distribution is “notoriously difficult”, leading developers to design away the need for a management hub by building a Root Certificate Authority (CA) which will be made available for free.

News of this project follows Google’s commitment to help fund two Linux developers in their ambitions to fix kernel security problems. This responded to a need for additional work on open source software security that recent research identified.

“I am very excited about sigstore and what this means for improving the security of software supply chains,” said Luke Hinds, one of the lead developers on sigstore and Red Hat’s security engineering lead.

“Sigstore is an excellent example of an open source community coming together to collaborate and develop a solution to ease the adoption of software signing in a transparent manner.”

The team behind the sigstore project will build on this momentum in the near future with further tweaks, including hardening the system, adding support for other OpenID Connect providers, and updating documentation.

The Linux Foundation has launched a free-to-use service for open source developers to cryptographically sign software to reassure users further down the supply chain that the software they’re using is legitimate.

Developed in partnership with Google and Red Hat, the sigstore project will allow the open source community to sign software artefacts including release files, container images and binaries before these elements are stored in a public log.

The aim is to make it easier for developers to sign releases and for users to verify them, with widespread uptake translating to a reduction in the threat of open source supply chain attacks. This is because one of the major issues with open source software is it’s often difficult to determine where the software came from, and how it was built.

​

“Installing most open source software today is equivalent to picking up a random thumb-drive off the sidewalk and plugging it into your machine,” said Google’s product manager Kim Lewandowski and product engineer Dan Lorenc. “To address this we need to make it possible to verify the provenance of all software – including open source packages.

“The mission of sigstore is to make it easy for developers to sign releases and for users to verify them. You can think of it like Let’s Encrypt for Code Signing. Just like how Let’s Encrypt provides free certificates and automation tooling for HTTPS, sigstore provides free certificates and tooling to automate and verify signatures of source code.”

Sigstore takes a unique approach to key management by issuing short-lived certificates based on OpenID Connect grants, and storing all activity in logs backed by the Trillian instant management software. This is so the team can detect compromises, and recover from them, when they do occur.

This approach has been devised in light of the fact that key distribution is “notoriously difficult”, leading developers to design away the need for a management hub by building a Root Certificate Authority (CA) which will be made available for free.

News of this project follows Google’s commitment to help fund two Linux developers in their ambitions to fix kernel security problems. This responded to a need for additional work on open source software security that recent research identified.

“I am very excited about sigstore and what this means for improving the security of software supply chains,” said Luke Hinds, one of the lead developers on sigstore and Red Hat’s security engineering lead.

“Sigstore is an excellent example of an open source community coming together to collaborate and develop a solution to ease the adoption of software signing in a transparent manner.”

The team behind the sigstore project will build on this momentum in the near future with further tweaks, including hardening the system, adding support for other OpenID Connect providers, and updating documentation.

Google has announced a number of new features for Chrome OS to mark the operating system’s 10th birthday, including some new ones for enterprise users. 

Starting today, businesses can download the Chrome OS Readiness Tool to help them identify which Windows devices in their organisation are ready to switch fully to Chrome OS and which need support from VDI or Parallels Desktop.

This is a free, completely private and customisable tool that allows enterprises to see if apps are compatible or whether they are cloud-ready or not.

Organisations can also now configure over 500 policies in the Google Admin console. New policies have been added over the past year including those affecting new security, updates, accessibility, network file sharing and more. Importantly, all policies default to a Google recommended setting ensuring that users only have to set up the ones they need.

Moreover, to help enterprises configure their policies at scale, Chrome is launching the Chrome Policy API. This allows user and printer settings to be managed via an API and enables users to configure settings through a script or command line. Chrome is looking to expand this in the future so it also applies to apps, extensions and device settings too.

These new additions come on top of other features announced including the Phone Hub, where users can respond to their phone messages, check its battery life and even locate it from their Chromebook.

In the coming months, the company plans to release “Nearby share”, a feature that allows users to securely share files between a Chromebook and other Chrome OS or Android devices without needing to share contact details.

These new features come after Google announced in December it was teaming up with other tech giants such as Intel and Dell to form the Modern Computing Alliance. The group hopes to foster greater collaboration and integration between their different systems.

Google has announced a number of new features for Chrome OS to mark the operating system’s 10th birthday, including some new ones for enterprise users. 

Starting today, businesses can download the Chrome OS Readiness Tool to help them identify which Windows devices in their organisation are ready to switch fully to Chrome OS and which need support from VDI or Parallels Desktop.

This is a free, completely private and customisable tool that allows enterprises to see if apps are compatible or whether they are cloud-ready or not.

Organisations can also now configure over 500 policies in the Google Admin console. New policies have been added over the past year including those affecting new security, updates, accessibility, network file sharing and more. Importantly, all policies default to a Google recommended setting ensuring that users only have to set up the ones they need.

Moreover, to help enterprises configure their policies at scale, Chrome is launching the Chrome Policy API. This allows user and printer settings to be managed via an API and enables users to configure settings through a script or command line. Chrome is looking to expand this in the future so it also applies to apps, extensions and device settings too.

These new additions come on top of other features announced including the Phone Hub, where users can respond to their phone messages, check its battery life and even locate it from their Chromebook.

In the coming months, the company plans to release “Nearby share”, a feature that allows users to securely share files between a Chromebook and other Chrome OS or Android devices without needing to share contact details.

These new features come after Google announced in December it was teaming up with other tech giants such as Intel and Dell to form the Modern Computing Alliance. The group hopes to foster greater collaboration and integration between their different systems.