Pakistan's tax office services go dark after migration project goes awry
(2021/08/17)
- Reference: 1629169201
- News link: https://www.theregister.co.uk/2021/08/17/pakistan_federal_board_of_revenue_outage/
- Source link:
Pakistan's Federal Board of Revenue – the nation's tax office – has experienced a lengthy outage after a migration project went bad, perhaps as the result of a cyber-attack.
The Board (FBR) has [1]acknowledged that an upgrade process encountered "unforeseen anomalies" that resulted in an outage to its public-facing services from the evening of August 13th.
A subsequent [2]update said only some Customs-related services went down, but local media [3]report the problem was not of the FBR's making, and that the Board was attacked and all its virtual machines rendered inoperable.
[4]Huawei stole our tech and created a 'backdoor' to spy on Pakistan, claims IT biz
[5]In Pakistan, a car company will soon be making Samsung mobile phones
[6]Pakistan bans TikTok, for the fourth time
A statement reported by multiple Pakistani news outlets – some of which say it came from an FBR official while others say it was an official speaking without authorisation – says the incident was the result of malicious actors cracking the Board's implementation of Microsoft's Hyper-V hypervisor. Some reports say the FBR advised it needed 48 hours to restore services, which suggests decent disaster recovery infrastructure and processes were in place.
Other local reports suggest FBR data has been seen for sale on the dark web.
[7]
Whatever happened, the FBR's last word on the matter, issued on August 16th, says it restored all public-facing services.
[8]
A Hyper-V attack is certainly a plausible explanation for the incident, as [9]CVE-2021-28476 can crash hosts. The bug was patched in May 2021 but the FBR would hardly be alone in being a few months behind on patching. ®
Get our [10]Tech Resources
[1] https://www.fbr.gov.pk/pr/fbr-issues-clarification-regarding-service-op/163118
[2] https://www.fbr.gov.pk/pr/fbr-issues-clarification-regarding-customs-op/163123
[3] https://tribune.com.pk/story/2315712/fbr-reels-under-a-major-cyberattack
[4] https://www.theregister.com/2021/08/13/huawei_accused_of_trade_secret/
[5] https://www.theregister.com/2021/08/11/in_pakistan_a_car_company/
[6] https://www.theregister.com/2021/07/21/pakistan_fourth_tiktok_ban/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YRs0eIS4iJ2ZVLZAlfBTmwAAAMs&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YRs0eIS4iJ2ZVLZAlfBTmwAAAMs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2021/06/02/hyperv_bug_that_until_recently/
[10] https://whitepapers.theregister.com/
The Board (FBR) has [1]acknowledged that an upgrade process encountered "unforeseen anomalies" that resulted in an outage to its public-facing services from the evening of August 13th.
A subsequent [2]update said only some Customs-related services went down, but local media [3]report the problem was not of the FBR's making, and that the Board was attacked and all its virtual machines rendered inoperable.
[4]Huawei stole our tech and created a 'backdoor' to spy on Pakistan, claims IT biz
[5]In Pakistan, a car company will soon be making Samsung mobile phones
[6]Pakistan bans TikTok, for the fourth time
A statement reported by multiple Pakistani news outlets – some of which say it came from an FBR official while others say it was an official speaking without authorisation – says the incident was the result of malicious actors cracking the Board's implementation of Microsoft's Hyper-V hypervisor. Some reports say the FBR advised it needed 48 hours to restore services, which suggests decent disaster recovery infrastructure and processes were in place.
Other local reports suggest FBR data has been seen for sale on the dark web.
[7]
Whatever happened, the FBR's last word on the matter, issued on August 16th, says it restored all public-facing services.
[8]
A Hyper-V attack is certainly a plausible explanation for the incident, as [9]CVE-2021-28476 can crash hosts. The bug was patched in May 2021 but the FBR would hardly be alone in being a few months behind on patching. ®
Get our [10]Tech Resources
[1] https://www.fbr.gov.pk/pr/fbr-issues-clarification-regarding-service-op/163118
[2] https://www.fbr.gov.pk/pr/fbr-issues-clarification-regarding-customs-op/163123
[3] https://tribune.com.pk/story/2315712/fbr-reels-under-a-major-cyberattack
[4] https://www.theregister.com/2021/08/13/huawei_accused_of_trade_secret/
[5] https://www.theregister.com/2021/08/11/in_pakistan_a_car_company/
[6] https://www.theregister.com/2021/07/21/pakistan_fourth_tiktok_ban/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YRs0eIS4iJ2ZVLZAlfBTmwAAAMs&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YRs0eIS4iJ2ZVLZAlfBTmwAAAMs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://www.theregister.com/2021/06/02/hyperv_bug_that_until_recently/
[10] https://whitepapers.theregister.com/