Aussie telcos warned of new vulnerability in massive ‘Chinese hack’

A major telco has taken extra security precautions after suspected Chinese hackers infiltrated widely used chatbot software in a ‘supply chain compromise’.

Australian companies have been warned of a “supply chain vulnerability” by a group of suspected Chinese hackers who compromised a widely-used program for customer service chat bots.

Researchers from cybersecurity firm CrowdStrike told News Corp Australia that Canadian-based company Comm100, which has more than 15,000 customers in 51 countries, was compromised by a “trojanized file” at entities across a range of industries.

“The possibility of affected customers and industries is widespread,” a CrowdStrike spokesman said.

The latest threat comes as Optus continues to deal with the fallout from the massive breach of customer data, with its announcement of an independent, external review of the company’s security systems and processes.

CrowdStrike identified the Comm100 vulnerability through advanced machine learning and artificial intelligence. Picture: Supplied

Among Comm100’s top customers is Australian telco Tangerine Mobile. The company’s Chief Operating Officer, Richard Branson, praised the Comm100 bot team in a customer testimonial on the company’s website.

A Tangerine Mobile spokeswoman told News Corp Australia that Comm100 warned them of the vulnerability, but that they do not use the specific version of the program compromised by the latest supply chain attack.

The “supply chain” compromise was made famous by the hack of US company SolarWinds, in which malware targeted a third party with access to more than 30,000 public and private organisations.

“Comm100 has confirmed the vulnerability issues only impacted agents who used Comm100 Agent Console Windows Desktop Application with version 10.0.8 from 10pm PST Sept 28th to 3pm PST on Sept 29th,” the Tangerine Mobile spokeswoman said. “The malicious code did not impact any data about customers’ information and chats, therefore customer information remained intact.”

“We do not use this version of the application. However, as best practice, we have taken extra protection on our Comm100 account to further secure our account.”

CrowdStrike, one of the first to identify the SolarWinds compromise by suspected Russian hackers, said it identified the Comm100 vulnerability through advanced machine learning and artificial intelligence. Comm100 did not return requests for comment.

The Comm100 breach was carried out by suspected Chinese hackers, CrowdStrike said. Picture: Supplied

While the full size of the compromise was unknown, CrowdStrike said with “moderate confidence” that it was a Chinese hacker; based on the code language, the pattern of behaviour, domains hosted on Alibaba, and online gambling victims repeatedly targeted by Chinese hackers in the past.

China’s US Embassy spokesman, Liu Pengyu, told Reuters that officials “firmly oppose and crack down on all forms of cyber hacking in accordance with the law”.

“[The US] has been loudly active in fabricating and spreading lies about so-called ‘Chinese hackers,” Pengyu added.