Microsoft has unveiled a set of new features for its flagship Teams platform to appeal to what the company calls «firstline workers» in industries like medicine, retail and manufacturing.

Over the course of 2020, the major Slack rival will introduce a suite of tools, including features like an in-app walkie-talkie, shared device sign-out and off-shift access controls for IT administrators.

The news marks the company’s second major push around ramping up functionality for frontline-workers, hinting that Microsoft is aggressively trying to fill what it sees as a gap in the market.

Microsoft had previously revealed simple sign-in for Microsoft 365 and Teams at its Ignite conference in November. The previously announced SMS sign-in tool would allow frontline workers to log onto Teams using an SMS authentication code obtained by entering their phone number.

Companies in the retail industry, in particular, with high staff turnover, could be the main beneficiaries from this feature, as well as from new tools like off-shift access controls and shared device sign-out.

«Companies at the forefront of digital transformation recognize how critical it is to enable all of their people with the right technology and tools,» said Microsoft’s corporate vice president of modern workplace verticals Emma Williams.

«That’s why, in industries like retail, hospitality, and manufacturing, there’s a movement underway to digitally empower the Firstline Workforce – the more than two billion people worldwide who work in service- or task-oriented roles.

«Giving Firstline Workers the tools they need requires companies to address unique user experience, security and compliance, and IT management.»

Allowing workers to sign in using SMS, for instance, would allow IT departments to avoid the need to set up fully-fledged user accounts for individuals who may not stay in the job for very long.

One of the most eye-catching new features, the walkie-talkie tool, is aimed at supplanting the need to buy additional equipment like radios, with workers able to conduct voice conversations over Wi-Fi and mobile data.

Microsoft sees this walkie-talkie feature as a means to help companies ditch «analog devices with unsecure networks», with workers no longer having to worry about crosstalk or eavesdropping from third-parties.

Principal analyst for digital workplace at CCS Insight, Angela Ashenden, said frontline workers have become a growing area of focus for Microsoft, with this segment of the workforce historically unserved with any apps or tools.

«We’ve seen Microsoft target this group already with its collaboration solution Teams,» she said. «And with its mixed reality applications as part of Dynamics 365, and we’re now starting to see these two worlds coming together as the company focuses on key verticals like retail.»

«Today’s announcements of a new push-to-talk, walkie talkie feature in Teams will be hugely valuable for retail businesses, and SMS sign-in helps address the challenge of the high-turnover storefront workforce who aren’t always given an email address to use to sign in with (this is a feature we’ve also seen Workplace by Facebook rollout).»

The use of off-shift access controls, similarly, gives IT admins the capacity to limit worker access to the app on personal devices outside of working hours. This would ensure employees are not working longer hours than they’re supposed to and helps employers comply with employment regulations.

While these features don’t have fixed release dates, Microsoft has penned broad estimates that range from later this quarter, to over the course of the first half of the year. All capabilities are expected to have been released by midway through 2020 or earlier.

Warner Bros will trial a machine-learning platform to help predict how movies will perform at the box office. 

The iconic film studio said it will use Cinelytics’ AI and cloud-based project management system to inform its decision around talent valuations and release strategies.

Cinelytic is a Hollywood-based business that applies machine-learning models to licensed performance data from the box office, home rentals and even pirated downloads, which it cross-references with information about genres, seasonal release dates and even actors. 

The company claims it can predict the economic value of a film and potentially the total revenues it will have over its lifetime. The deal is only a trial at the moment and will only involve the international side of the studio. 

«Warner Bros is excited to employ Cinelytic’s cutting-edge system,» said Tonis Kiis, Senior VP for international pictures at Warner Bros. «In our industry, we make tough decisions every day that affect what – and how – we produce and deliver films to theatres around the world, and the more precise our data is, the better we will be able to engage our audiences.»

Cinelytics’ platform is a subscription-based interface that works like a questionnaire, similar to an online insurance form. Users can enter information about their projects, such as budget, who is in it, who is directing, when and where it’s being released and the machine learning algorithms match that its dataset. 

The company’s CEO Tobias Queisser spoke to IT Pro last year and used the movie Hellboy as an example. Before its release, Queisser’s team ran the film’s information through the platform and its estimated box office takings were $23.3 million – less than half of its $50 million budget. 

It earned $21.8 million and the reason appeared to be the timing of its release. The film came out in a comic book-heavy spring schedule between DC’s Shazam and  Marvel’s Avengers: Endgame.

​Mozilla has patched a critical flaw in its Firefox browser that’s being actively exploited by criminals in targeted attacks.

The critical vulnerability, branded CVE-2019-17026, allows an attacker to seize control of an affected computer through a mechanism that leads to ‘type confusion’, according to an advisory released by Mozilla. 

The company confirmed that the critical flaw, which has now been patched, affects users running version 72.0.1 of Firefox and version 68.4.1 of Firefox ESR. The developer added that it’s «aware of targeted attacks in the wild abusing this flaw». 

The severity of the flaw is such that the US Cyber Security and Infrastructure Agency has issued a separate warning urging Firefox users to apply the necessary updates.

The attack works by causing ‘type confusion’, which is a potentially critical error that can lead to data being read from or written to locations of memory normally out of bounds. When triggered, this can lead to an exploitable crash because of issues caused when the browser attempts to manipulate JavaScript objects.

It’s the second time within seven months that Firefox has sustained a critical zero-day vulnerability being actively exploited in the wild.

A previous flaw, discovered in June 2019, gave attackers the tools to execute arbitrary code on flawed machines and in some cases take over users’ devices remotely.

The latest emergency fix follows a round of 11 CVE-rated bug fixes Mozilla has issued, five of which were rated ‘high’ and four rated ‘medium’. Among these highly-rated issues were memory safety bugs in Firefox 72, another type confusion issue, and a memory corruption flaw.

The second major security scare within a matter of months is a blow to a developer trying to forge a fresh identity for Firefox as a privacy-centric web browser. Mozilla has teased and rolled out a suite of changes to how Firefox functions in the last year, including tools like a virtual private network (VPN).

In September last year, Mozilla also instigated a change in Firefox that would block known third-party tracking cookies and cryptocurrency mining by default as part of its Enhanced Tracking Protection (ETP).

Data management firm Veeam has been acquired by software investors Insight Partners in a deal worth approximately $5 billion.

The change will see the Swiss firm become a US company, with an American leadership team take the helm.

Veeam offers backup solutions for cloud data management. According to the latest IDC Software Tracker, it’s the number one market share leader in EMEA and number four in the world, behind Dell, Veritas and IBM.

The deal will be completed by the end of the first quarter of 2020 and will enable Veeam to expand its hybrid cloud platform.

«Veeam’s strong growth, coupled with high customer retention, unparalleled data management solutions and the opportunities to expand services into new markets, make it one of the most exciting software companies in the world today,» said Mike Triplett, Insight Partners managing director.

«We are committed to supporting Veeam’s next phase of leadership and growth in the United States, continued market-share leadership position in EMEA and continued global expansion,» Triplett said. 

As part of the deal, former chief of staff to the VP of the United States, Nick Ayers will join Insight Partners managing director Mike Triplett and Veeam CEO, William H. Largent on the board. Co-Founders Andrei Baronov and Ratmir Timashev will step down. Additionally, Insight Partners managing directors Ryan Hinkle and Ross Devor will each serve on the Board once the acquisition has been completed.

«With the acquisition, we are excited that our current US workforce of more than 1,200 will be expanded and strengthened to acquire and support more customers,» said Largent. «Veeam has one of the highest calibre global workforces of any technology company, and we believe this acquisition will allow us to scale our team and technology at an unrivalled pace.»

Google is bringing its real-time translation tools to businesses via Volara and Sonifi. 

Google Assistant’s interpreter mode already translates conversations in 29 different languages in real-time on supported smartphones and smart displays, but Google is now working with the two systems integrator partners to make it easier for businesses to make use of the system. 

The system uses a Google Nest Hub smart display, showing the translations on the screen and speaking them aloud. Volara and Sonifi will help rollout the technology, and offer consulting, training and technical support to customers. 

The aim is to offer instant translations for hotel desks, airports and other places where language challenges occur. Google suggested it was already in use at terminal four at JFK airport in New York, in airport lounges in Los Angeles, at Caesars casinos in Las Vegas, and even used by aid organisations Mercy Corps and Human Rights First. 

Lilian Rincon, Senior Director of Product Management for Google Assistant, explained in a blog post that interpreter mode has been used at JFK airport’s terminal four to help travelers get help finding luggage pickup, navigating the terminal, locating shops, and more, while staff are using the system to communicate more easily with passengers. «Of all customers in T4, 65% are international travelers, many of whom are visiting the US for the first time,» she said. «Flying can be very stressful for passengers, especially when struggling to understand the native language.»

Alongside the systems integrator partnerships for translation, Google announced new features for Google Assistant, including support for scheduled actions — meaning you can finally use Google Home to programme smart home devices for a specific time. 

Announced at CES, Scheduled Actions are one of several new features in Google Assistant, which the company said is now used by half a billion people globally, with support for more brands being added. 

Scheduled Actions means you’ll be able to choose an on/off time for compatible smart home gadgets. «For example, you can say, ‘Hey Google, run the coffee maker at 6 am’,» explained Manuel Bronstein, vice president of product for Google Assistant, in a blog post.

Bronstein added that it’ll now be easier to setup smart home devices using Google Assistant. «When you set up your smart device through the manufacturer’s app, you’ll receive a notification on your Android phone or see a ‘suggestion button’ when you open up the Google Home app that will prompt you to connect the device with your Assistant,» he said. «You’ll then be able to easily complete set-up in just a few taps without needing to re-enter your account credentials.»

Alongside the smart-home features, Google at CES also demonstrated Assistant reading aloud long-form content, such as news articles or short stories. «Unlike traditional screen readers, this experience is built on new voice datasets to create more expressive and more natural sounding voices, so it’s easier to listen for a longer period of time,» said Bronstein. Google is working on automatically translating such documents into different languages, as well as highlighting text as its read aloud.

Google also unveiled tools to share notes with the rest of your household, showing messages on smart displays without anyone needing to sign in — essentially, a digital post-it note — as well as new speed dials to more easily make calls. Both features will arrive later this year.

The foreign exchange company Travelex has confirmed the ongoing disruption to its services, which started on New Year’s Eve, are being caused by a successful ransomware attack.

The outage, which has lasted more than a week, has caused chaos for customers and partners alike who rely on these systems to conduct transactions.

Travelex had previously pinned disruption on a «software virus», in a statement released three days after the attack. The firm confirmed in an updated statement, however, the incident was indeed caused by a ransomware attack.

Additional reports suggest the perpetrators are demanding millions of dollars in exchange for the return of customer data.

Travelex first detected that a virus had compromised its services on 31 December and took all of its systems offline as a precaution to prevent the malware from spreading across its network any further.

Following days of speculation and media reports, the firm has finally confirmed the «software virus» that hit their systems was the ransomware known as REvil, with the name Sodinokibi also sometimes used.

The attack was a success, and the group behind the attack has demanded a ransom to the tune of $6 million (approximately £4.6 million), according to BBC News.

The attackers also claim they have taken approximately 5GB of customer data, and will only return this should the ransom be paid in full. This data is claimed to comprise dates of birth, national insurance numbers as well as credit card information.

The company says it’s taken steps to contain the spread of the ransomware, suggesting that although there has been some encryption, there remains no evidence that any customer data has been compromised.

Travelex also added in a statement that while it does not have a complete picture of all the data that has been encrypted, but «there is still no evidence to date any data has been exfiltrated».

These conflicting reports could suggest the attackers may be bluffing in claiming to have downloaded a cache of customer data. Many less well-resourced firms unable to conduct thorough assessments in the wake of such attacks, however, may deem these ‘bluffs’ as too risky to ignore, and pay any ransom demanded to secure safe return regardless.

«Our focus is on communicating directly with our partners and customers to protect them and their information from any further compromise,» said Travelex chief executive Tony D’Souza.

«We take very seriously our responsibility to protect the privacy and security of our partner and customers’ data as well as provide an excellent service to our customers and we sincerely apologise for the inconvenience caused.

«Travelex continues to offer services to its customers on a manual basis and is continuing to provide alternative customer solutions in the interim.»

A forensic analysis of the incident is underway, and the firm is working to fully recover its systems. Some internal systems have been restored, but disruption still remains on the customer and partner-facing side. This is reportedly affecting services of other firms such as HSBC and Tesco Bank.

Travelex says it’s in discussions with the National Crime Agency (NCA) and the Metropolitan Police, who are each conducting their own investigations into the breach.

There’s doubt as to whether Travelex has approached the Information Commissioner’s Office (ICO), however, despite the potential for data theft. The incident could constitute a violation of the General Data Protection Act (GDPR), should the attackers claims to have made away with customer data prove to be true.

«Organisations must notify the ICO within 72 hours of becoming aware of a personal data breach unless it does not pose a risk to people’s rights and freedoms,» an ICO spokesperson said.

«If an organisation decides that a breach doesn’t need to be reported they should keep their own record of it, and be able to explain why it wasn’t reported if necessary.»

Principal security consultant and head of penetration testing at Bridwell Consulting, James Smith, told IT Pro that Travelex has handled the initial fallout badly. The company should also learn from this incident, as well as past incidents, and build these teachings into a proper cyber resilience plan.

«Transparency is key in maintaining customer trust, especially for firms like Travelex in the financial services industry,» Smith said.

«Travelex has taken a long time to inform customers about what’s taken place, and placing a press statement on the website days after the event simply isn’t enough.

«Financial services firms like Travelex have a responsibility to their customers to keep them informed even if no data has been lost. This is especially important in light of the 2018 breach the company suffered in which the personal details of 17,000 customers were exposed.»

Ransomware is highly common, with this particular form of attack blighting countless numbers of businesses routinely each year.

Many companies and professionals, meanwhile, believe that, actually, paying the ransom is often a cheaper and simpler way to secure data and restore systems.

A Canadian laboratory, for example, was advised in late 2019 to pay hackers in order to retrieve 85,000 stolen data records, despite this action being against the general consensus among security experts.

Asked whether Travelex should pay the ransom, Smith added there is a debate to be had, but the negatives always outweigh the positives.

«If you pay, in theory, you regain access to your data and systems and business can continue. However, there’s no guarantee you’ll actually get access restored.

«There’s also no guarantee that the data hasn’t been stolen already, before it was encrypted. This is happening more and more in the industry and the likelihood that the data will be sold or stored by the hacker is great.

«Then, of course, there are the wider ethical considerations about paying attackers who could use the money to fund other criminal enterprises.

«If organisations have the right plans in place, such as replicating their data, having off-site backups and segregated networks, for example, the likelihood of having to answer the «pay or not pay» question is greatly reduced.»