Slashdot Mirror
Millions of Smartphones in 11 Countries Were Taken Offline Yesterday by an Expired Certificate (theverge.com)
Ericsson has confirmed that a fault with its software was the source of yesterday's massive network outage, which took millions of smartphones offline across the UK and Japan and created issues in almost a dozen countries. From a report: In a statement, Ericsson said that the root cause was an expired certificate, and that "the faulty software that has caused these issues is being decommissioned." The statement notes that network services were restored to most customers on Thursday, while UK operator O2 said that its 4G network was back up as of early Friday morning.
Although much of the focus was paid to outages on O2 in the UK and Softbank in Japan. Ericsson later confirmed to Softbank that issues had simultaneously affected telecom carriers who'd installed Ericsson-made devices across a total of 11 countries. Softbank said that the outage affected its own network for just over four hours.
Although much of the focus was paid to outages on O2 in the UK and Softbank in Japan. Ericsson later confirmed to Softbank that issues had simultaneously affected telecom carriers who'd installed Ericsson-made devices across a total of 11 countries. Softbank said that the outage affected its own network for just over four hours.
You fucking nerds need to figure out how to keep security settings from automatically disabling themselves all the damn time.
Why is this a story again, because someone (thing) forgot to renew a cert that then affected a few (for large values) countries? It should be news if it HADN'T have dropped them out.
OTOH these are the people tasks with keeping your phones and conversations "safe." What OTHER minor things have they overlooked? (Everyone, not just them. They're just at the head of the line right now.)
If the universe is someone's simulation -- does that mean the stars are just stuck pixels?
... about using a major player smartphone. Eyeing and considering Sailfish and old Blackberry on a regular basis.
We suffer more in our imagination than in reality. - Seneca
It canâ(TM)t be considered critical enough. At work we have three teams that get alarms of expiring certificates, just to make sure it doesnâ(TM)t fall through the cracks. The next phase will be complete automation of the renewal process against the internal CA, with a review before the final deployment of the renewed cert.
Only smartphones? Really?
One would have thought that network backbone equipment losing connectivity due to an expired certificate would break all mobile phones...
This wasn't Ericsson brand cell phones going offline because of this certificate. This was *ENTIRE CELL NETWORKS* going offline because the backend hardware's certificates were being rejected because they expired without replacement certificates in place.
Having a different brand of cell phone doesn't help if your phone is rightly rejecting expired certificates from the cell network, or if the cell network is not authorizing new cellular connections because it can't connect to servers.
This was likely a backend problem, either with authentication servers for the basestation/router licenses, or some centralized bckend service that was actually web based.
Time to switch to Huawei.
Have gnu, will travel.
This is a guess but I've seen this sort of thing happen too many times:
They pushed out an update to the network infrastructure which was immediately pulled down and installed. The update had only been QA tested with self signed certs (if at all) because it was easier and just assumed to work with the live certs. Due to update missing correct/valid certs the core network infrastructure then disconnected all secure connections because they couldn't trust the networks they were on, meaning further pushed updates to fix the issue weren't possible (due to untrusting the update server) so physical access on each box was required to roll back. If they were particularly unlucky the update was pushed to partner infrastructure.
Every IT nerd has ballsed up like this at some point usually on a minor scale, e.g. like shutting down a remote host instead of rebooting, however it's something special when it costs companies millions.
Along with half of all malicious websites having TLS / SSLs ...
Goes to show our security systems are more hazardous than the bad guys.
As a thought experiment, what will it look like when this happens to a network of connected self driving cars?
I say "when", not "if". I can't think of a way that this doesn't happen someday.
For starters, emergency vehicles will not be able to get through the resulting traffic jams after a few million cars come to a stop.
On the bright side, you'll probably still be able to read the ads on the entertainment system
the 'faulty' engineers that allowed this to happen. are they also being 'decommissioned'?
We need to start doing IT with professionals. You know, with people that actually have a clue what they are doing. Sure, they will cost more individually, but overall the whole thing will get a lot cheaper as such major pathetic fuckups will become very rare.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
We need to talk about your TPS reports
n/t
Have gnu, will travel.
The entirety of my thought is in the subject!
so do your fucking job or go dig clams for a living...
Sheesh!