So, What are the Technological Innovations to Come?

First of all, the new layered model will be able to support all Dassault Systèmes platforms (Medidata, 3DEXPERIENCE…) by enabling all developers to free themselves from managing the underlying infrastructure thanks to an Abstraction layer (PaaS), and to be able to use infrastructure layers from other hyperscalers (multicloud).

Next, three Cloud models will enable institutions and enterprises with sensitive data and applications to strengthen their digital autonomy through a Cloud experience broken down into three levels:

• The International Cloud: an international public Cloud for secure collaboration, that benefits from internationally recognized certifications (HDS, TISAX, ISO 27001, ISO 26000…) ;
• Sovereign Cloud: a trusted Cloud within a common regulatory and fiscal space, covered by sovereign certifications by country in addition to international certifications (SecNumCloud, ITAR);
• Dedicated Cloud: a Cloud dedicated to sovereign collaboration in the customer’s own environment.

New Features Unveiled

New features will be added in 2023-2024, including DirectLink and virtual DirectLink, available almost immediately and without configuration, enabling a direct datacenter-to-datacenter connection, Dedicated Group to complement the isolation capabilities offered by virtualization, VM Group to create VM templates with common characteristics and manipulate all VMs associated with this template at the same time (the first step towards autoscaling). Other updates include a new version of Cockpit with an improved interface and a new IAM.

As object storage is a key element in the switch to Cloud computing and resilience in the Cloud, a new object storage infrastructure with enhanced performance will be offered (the only SecNumCloud-qualified object storage service on the market to date).

Arnaud Bertrand also announced the availability of a new range of next-generation CPUs (Ice Lake and Kaby Lake) that will enable customers to increase their computing power, the processing speed of their workloads, as well as their energy efficiency. Better adapted to today’s user requirements, this new generation of processors will deliver a better user experience and faster task execution.

The arrival of the much anticipated NVIDIA GPU A100 graphics cards was also announced by OUTSCALE’s CTO. Designed to offer high-performance graphics power, they enable you to explore new horizons and experience total immersion with 3D modeling and other more demanding simulations and more complex projects. OUTSCALE offers unique GPU services in France, available as part of the SecNumCloud qualified public cloud offering.

This year, OUTSCALE is taking steps to obtain SOC 2 type 2 certification: a framework for demonstrating the security controls put in place to protect customer data in the Cloud. This initiative reinforces OUTSCALE’s commitment to offering its customers the highest levels of compliance and security.

Finally, a carbon footprint calculator, which will in time be provided with the invoice, will be able to reconstruct the customer’s energy consumption by service/offer.

Watch the replay below to learn more:

Discover the speech of Philippe Miltin, OUTSCALE’s CEO, and learn more on our new strategy.

Got a project? Contact us!

According to IDC, following the sudden surge in the use of digital technologies, the creation and replication of data continue to grow with a yearly average rate of 23% between 2020 and 2025. Therefore, storage capacity must increase significantly. 

A major change that raises the question of the management of their environmental impact. Indeed, if digital technology represents today less than 4% of global greenhouse gas emissions (GHG), the sector shows nevertheless a growth rate of 9% per year (French only). This trend may be irreversible, but it can be downplayed through the implementation of appropriate measures, if started today. 

CSR Commitment, a Foundation for Building Trust

If the public health crisis has considerably stimulated data consumption, the global geopolitical situation in 2022 raised fears of an unprecedented energy crisis. In this context, and from now on, Cloud actors must also be held responsible for their impact on society and the environment. In an increasingly demanding market, CSR (Corporate Social Responsibility) has become a major competitive factor and a decisive criteria for trust.

3DS OUTSCALE started, in 2017, a CSR certification process labeled LUCIE 26000, the CSR reference label in France, aligned on ISO 26000, the international standard on corporate and social responsibility. An initiative completed in 2020 by the signing of the Climate Neutral Data Center Pact, a European pact for neutral datacenters by 2030. The goal: building a Cloud that enables sustainable and environmentally responsible innovation (French only).

That is why, facing such a crucial issue, 3DS OUTSCALE commits to working exclusively with trusted partners, such as Telehouse, one of our datacenter partners, themselves involved in a sustainable approach. Beyond energy consumption, the operator works on improving all of the datacenter’s lifecycle, from the equipments’ production to their usage.

While Making Data Security a Priority

However, with cyberattacks on the rise, the environmental aspect is far from being the first decision criteria. 1 out of 2 French companies fell victim to a cyber attack in 2022, according to the CESIN (Club des Experts de la Sécurité de l’Information et du Numérique) barometer, reminding the critical importance of data protection. A case in point is the ransomware attack incurred by the Centre Hospitalier Sud-Francilien (CHSF) in Corbeil-Essonnes in August 2022, which was strongly paralyzed for several days. Or the case of André-Mignot hospital in Versailles on December 3, 2022…

Particularly sensitive health data requires very strict conformity standards from a host: HDS certification (Health Data Hosting), SecNumCloud qualification, GDPR compliance and sovereignty (for protection from the enforcement of extraterritorial laws such as Cloud Act).

So many signs of trust that 3DS OUTSCALE services are offering. Security has been a key value in 3DS OUTSCALE’s DNA since its beginnings, over a decade ago. Our cloud infrastructure is SecNumCloud qualified by the ANSSI, and ISO 27001-27017-27018, HDS and TISAX certified. It is also important for us to rely on strategic suppliers [such as Telehouse] to be able to offer a real chain of trust between the customer, the cloud provider which is 3DS OUTSCALE, and the datacenter providers.

How to Prioritize both Security and Environmental Responsibility?

Security and environmental responsibility are not incompatible. But if customers are more and more concerned by environmental issues, the sole involvement of the Cloud provider is not sufficient to reduce the environmental footprint. All of the ecosystem (employees, suppliers, partners, customers…) must be involved to create a virtuous circle and lay the foundations of a strong trust along the technological chain.

The partnership between 3DS OUTSCALE and Telehouse perfectly illustrates this state of mind according to Sami Slim, General manager of Telehouse France: “3DS OUTSCALE has been working with Telehouse for many years, it is a trust-based collaboration. Actors like 3DS OUTSCALE drive us to take our security logic further. They challenge us on security and trust levels such as expected by their own customers, and we are compelled to adapt. Offering a new SecNumCloud qualified infrastructure has been a real challenge, but Telehouse was able to deliver, in due time, a space meeting the criteria of the SecNumCloud qualification defined by the ANSSI.

On the one hand, Telehouse proves itself as a trusted and well-known supplier, able to support 3DS OUTSCALE in its development strategy. On the other hand, 3DS OUTSCALE is an asset in our system approach because they push us to stay at the forefront of innovation.”

Shared responsibility

Datacenters have never played such a crucial role as they do today. The world of tomorrow will definitely be a connected world. And, as Sami Slim reminds us: “Each infrastructure choice is a choice for the planet.” 

Today, the task of Cloud operators is to lead the industry towards more responsibility, security, innovation, expertise and trust. At 3DS OUTSCALE, together with our ecosystem, we are ready to meet the challenge.

Learn more about the partnership between 3DS OUTSCALE and Telehouse and the security standards implemented in their datacenters!

TISAX® certification: Information security in the automotive industry

The profound upheaval in the automotive industry is probably one of the biggest consequences of the latest industrial revolution and the arrival of data in the daily lives of billions of users. The time when a car was just a collection of mechanical parts now seems a distant memory. Electronics are everywhere, and with this omnipresence has come a major challenge that other sectors have also encountered: how to process and manage the data circulating inside and outside of vehicles during their use and manufacturing phase.

To make sure this data is properly handled, third-party audit and certification are essential, and TISAX® (Trusted Information Security Assessment Exchange) has established itself as a leading certification label in automotive data security management.

The importance of data management in the automotive industry

From tyre pressure to traffic analysis, from Electronic Stability Control to protecting manufacturers’ jealously guarded patents and prototypes, there is a considerable amount of data circulating in the automotive sector, be it in the passenger compartment, on the road, at dealerships, or throughout the systems of manufacturers or their partners… And the trend shows no signs of abating.

Though fully autonomous cars are not yet a reality, recent developments have all tended to increase vehicle connectivity in a bid to provide a better, safer, more efficient and more pleasant driving experience. And all these developments have one thing in common: the circulation of data. In an article published in March 2022, Alex Bufalino, Vice-President of Marketing at Quectel, predicted that each connected vehicle could produce nearly 25GB of data per hour.

Edouard Camoin, VP Resilience at OUTSCALE, explains this trend: “We are seeing more and more embedded systems. The information cannot remain local; it has to go through a Cloud Computing system. The challenge then lies in creating a common language between the automotive industry and this new technological dimension, which at first glance seems so far removed from its fundamentals.”

The reason why this issue is so important is that data offers huge opportunities for manufacturers and their partners. As pointed out by Laurence Albinet, Governance, Risk and Compliance Director at OUTSCALE: “The data produced by a car is extremely valuable if used properly, but personal data also needs to be protected. There are two levels of data security: protecting the manufacturer’s know-how (intellectual property) and protecting personal data.” Hence the importance of being able to count on appropriate, reliable and objectively recognised tech solutions. 

The TISAX® label, a mark of reliability

As a trusted partner of automotive industry players, OUTSCALE needs to provide its customers with a guarantee that their data streams will be properly managed, secured and protected. Certification provides reassurance as it observes and verifies every step of the value chain to confirm the Cloud operator’s reliability and expertise. TISAX® certification concerns both the technical and the organisational environment.

In particular, it focuses on two key aspects: information security and data protection. Information security is the umbrella term to describe all the overarching practices and systems from which the information value chain stems. Data protection, meanwhile, can be divided into several categories: confidentiality, integrity, availability and traceability. 

Edouard Camoin reiterates the importance of such certification for customers and users alike: “The certification process involves verification by an independent body. That way, complete trust is established at every stage of the value chain. Since more data means more potential ways in for hackers, such trust is especially important.”

The multiple recent attempts to hack Tesla show how important this security is. TISAX® certification guarantees end-to-end security at every step of the value chain. Out of the three aspects – information security, prototypes and data protection – a Cloud provider can position itself on the first and the last one. 

Strengthening our compliance program

Based closely on ISO 27001 certification, the TISAX® label was designed specifically for the automotive sector and the data exchanges that occur within it. Though the standards it requires are similar to those of other certification systems, obtaining it is no easy task. Edouard Camoin nevertheless insists that pursuing TISAX® certification has not resulted in any fundamental change in the way OUTSCALE operates or manages information systems security.

“Adjusting our management processes to aim at this certification strengthened our compliance program. This is an important adaptation process, as implementation and certification are two completely different things. It’s not just a box-ticking exercise; the entire value chain is audited,” says Laurence Albinet. Having started the process in 2022, OUTSCALE has now officially been awarded TISAX® certification and becomes the only sovereign Cloud that is both SecNumCloud-qualified and TISAX®-certified.

Click here to learn more about the certification.

Dealing with the crisis through resilience and anticipation

Fears that power cuts could affect datacenters are growing, and the rolling blackouts that might happen this winter have companies worried. Rightly so, as any interruption in the electricity supply would theoretically see the operation of Cloud services compromised, and if so, the consequences could also have an impact on the daily lives of citizens and organisations.

To this, OUTSCALE is offering a response to guarantee continuity of service guided by two watchwords: resilience and anticipation.

OUTSCALE has made resilience its priority for years now. This was evidenced by the reliability we showed during the COVID pandemic thanks to our Pandemic Prevention Plan (PPP) and the creation of a VP position dedicated to resilience held by Edouard Camoin. Most of all, OUTSCALE has taken care to build a real chain of trust with its partners and suppliers. This includes datacenter operators such as Telehouse, Equinix and Interxion, who did not wait for the crisis to hit to boost their resilience.

Our partners anticipated taking foolproof measures to guarantee continuity of service and maintenance in their datacenters, which will stand them in good stead during the current energy crisis. Such measures ensure our customers can look forward to a winter without any risk of blackouts or outages.

Reliable and lasting solutions

To offer our customers the best possible service and guarantee quality throughout the technological chain of trust, OUTSCALE has always been very selective in choosing its partners, working with market leaders that share its values and guarantee the highest levels of security, robustness and responsibility.

“We are absolutely confident in our datacenter providers’ ability to deliver full availability of our infrastructure, despite the ongoing geopolitical and energy crisis,” says Ghislain Seguy, Chief Delivery Officer at OUTSCALE. This risk, like any other, has also been subject to a risk analysis as part of the ISO 27001 certification processes.

Consequently, in order to withstand potential interruptions in the power supply, all our partner datacenters are equipped with backup generators that can operate non-stop, night and day, 7 days a week, 365 days a year.

“If the power were to be cut off on both electrical circuits (powered by two different sources), they would automatically switch to the backup generators, with inverters taking over while the generators start up. All datacenters have inverter circuits on each of their electricity supply systems, as well as generators with sufficient fuel tank capacity to run for 72 full-load hours. In the event of a power cut, inverters will take over for the 10 to 30 seconds it takes for the generators to start up, synchronise and begin producing electricity (several megawatts at some sites).

Special priority-supply contracts have been signed to guarantee uninterrupted operation come what may. Once again, these are not measures that have been taken in response to the current geopolitical crisis. These systems were already in place before the crisis hit, because, like us, our partners are firm believers in prevention and anticipation. And these measures will remain in place even if the electricity supply situation returns to normal,” explains Edouard Camoin, VP Resilience at OUTSCALE.

Maintenance and trust

The reliability of these backup generators is assured: every month, our partners test them to ensure that they are working correctly and that there are no problems with their safety or energy supply. Once or twice a year, the transition to the generators is also tested to verify their ability to take over smoothly.

“Making sure that our partner datacenters are equipped with these backup systems in the event of an incident or a power cut is something that we at OUTSCALE pay close attention to when selecting a new partner and check regularly during audits,” says Ghislain Seguy. “We are particularly attentive to the redundancy our suppliers are able to offer us, a key element that enables us to guarantee continuity of service to our users under all circumstances.” 

Organizational continuity

Resilience is not just a technical matter; thorough and appropriate organisation is also required, as our Cloud platforms are administered by our teams. This is an essential aspect for us, and is spelled out in our Business Continuity Plan for our Information Security Management System (ISMS), in accordance with ISO 27001 requirements. Just as our resilience enabled us to maintain continuity of service during the pandemic, so it will allow us to face the energy crisis, thanks to the Business Continuity Plan we have implemented in recent years.

What is more, if our Paris site were to be affected, then our expert teams located throughout France are ready and waiting to step in and take over.

OUTSCALE is a trusted operator that has built its reputation for excellence based on the relationships of trust it forges with its partners in order to provide the best service possible at all times. To find out more, visit our website here and here.

Certifications as proof of trust

In France, the SecNumCloud security visa from the National Cybersecurity Agency of France (ANSSI) allows those who are qualified to prove that they meet the highest cloud computing security requirements. The qualification process is demanding, making it one of the criteria for receiving the government’s trusted cloud label and a reference for the future European certification from the European Union Agency for Cybersecurity (ENISA).

The European Commission asked ENISA, tasked with developing and preserving the EUCS (European Cybersecurity Certification Scheme for Cloud Services), to add sovereignty requirements to the project.

This approach reflects the SecNumCloud qualification requirements and has repercussions for the cloud computing suppliers on the EU market, ensuring that they prioritise European values and commitments. 

A single security reference for Europe

The criteria chosen for the EUCS are all the more important since the scheme is intended to become the single security reference for all European countries. Thus, it must be a certification of Excellence consistent with the data protection and cybersecurity levels that are guaranteed by the reference security visas on the market. 

The European cybersecurity certification must set the bar high to ensure that the security level within each Member State is consistent and to build a European digital ecosystem that can meet the strictest needs uniformly.

With the new ways of using digital technology, European users are entrusting their most strategic assets to digital players. It is therefore essential to preserve them both technically and legally against extraterritorial laws. This way, the European Union shows that it intends to be a self-sufficient global technological power. Implementing an ambitious certification process is in line with European values and commitments in terms of data protection, transparency and sovereignty.

In an ever-changing world, digital sovereignty gives us control over our destiny. It is essential that Europe guarantees the most demanding security framework possible to protect the sensitive data of our citizens, companies, and institutions.

Ultimately, the impact on Europe can only be beneficial in terms of the guarantees provided, confidently fostering the acceleration of the digital transformation with the support of French and European technology champions.

Bug Bounty at 3DS OUTSCALE

3DS OUTSCALE, as an IaaS Cloud provider, is looking for any security-oriented feedback. For this purpose, we opened our Bug Bounty program on the YesWeHack platform in 2016. Security researchers are encouraged to hunt for bugs on our public IaaS platform, especially on the API and the Cockpit web interface.

We want them to find any ways of bypassing segregation measures, or anything impacting their customer experience or the infrastructure itself! To make it possible, we provide security researchers access to a Cloud account that will allow them to test our infrastructure as if they were regular customers. With limited but sufficient quotas, they may spawn private LANs, virtual machines and manage CPUs, RAM, security groups, etc.

Practical Case: Vulnerability in a WordPress Plugin

In 2021, a security researcher (0xspade) submitted a report on our YesWeHack program. This report pointed out an endpoint (a web address at which users can send requests to perform specific actions) on our official website that was not properly escaping input data. The researcher proved that sending some altered data to this endpoint could lead to local code execution. In short, we were facing an XSS vulnerability.

At 3DS OUTSCALE, we use WordPress to power some of our official websites. We had to conduct an investigation to find out which part of the source code was vulnerable, because WordPress works with plugins, which all have their own logic. This investigation led us to apply a hotfix on our servers while waiting for an official patch from the editor. The technical details can be found in the last part of this article.

After a first unsuccessful contact with the plugin editor, we decided to contact ANSSI (the National Cybersecurity Agency of France) as well as WPScan, which is a French CNA (CVE Numbering Authority) specialized in vulnerabilities that can be found within the WordPress ecosystem.

WPScan notably offers a vulnerability scanner as a plugin/CLI, and maintains a database of all vulnerabilities affecting WordPress and its plugins. They were therefore the right contact to help us move forward, acting as our intermediary between the editor and the marketplace during the whole process.

They helped us make the editor realize the severity of the vulnerability and gave them some time to release patches that fixed the problem. We methodically followed the steps and carried out the process successfully.

Ultimately, two CVEs were created regarding this issue. They were recently published under the references CVE-2021-24814 and CVE-2022-0220.

Official advisories are available here:

• https://wpscan.com/vulnerability/94ab34f6-86a9-4e14-bf86-26ff6cb4383e
• https://wpscan.com/vulnerability/a91a01b9-7e36-4280-bc50-f6cff3e66059

Technical Analysis

# Situation

The issue was in the wordpress-gdpr plugin (version 1.9.25). Used for compliance with GDPR requirements in the EU, it asks the user’s consent for the use of cookies.

Each time a page is loaded on a website using this plugin, the latter performs an asynchronous HTTP request (AJAX) to this specific endpoint: /wp-admin/admin-ajax.php. The request is meant to retrieve the user’s choice regarding the use of cookies.

In order for these calls to be made by every visitor, logged in or not, the developers have been using a non-authenticated AJAX call.

The problem was that the function associated with this AJAX call (check_privacy_settings) returned JSON data, but with a wrong Content-Type (text/html) and including non-sanitized input passed during the request.

When the endpoint is typically used making AJAX calls from the client to the backend, there is no problem because the XHR object handles the response and converts it to whatever is suitable (JSON object). But if we create a malicious request (i.e., with malicious HTML & JavaScript user input) that makes a browser go to this endpoint as if it was a normal browsing page, then the browser is unable to interpret this as JSON data, because of the lack of application/json Content-Type. Consequently, it will display an HTML page with the malicious user input interpreted.

# Exploration

First, how does this plugin work? 

When a visitor arrives on a website using this plugin, an AJAX call is made to retrieve some information:

Figure 1 – AJAX call by the vulnerable plugin

Two parameters are sent along with the request, which is supposed to trigger a check_privacy_settings function. This function is actually fired up by a wp_ajax_nopriv_ hook. For those who are not familiar with the WordPress universe, it is a custom AJAX endpoint created by the plugin’s developers and reachable without authentication.

If we look at the function’s code, without going into details, we basically have something like this:

Figure 2 – simplified check_privacy_settings function’s code

We can see that a part of the input (the $setting variable corresponding to the values of the $settings associative array) is reinjected into the function’s output, without sanitization.

Let’s play with it.

# Disillusion

The scenario on which we will base our thinking is the following:

• An attacker creates a malicious webpage (which has a safe-looking URL, or at least not suspicious) and sends the link to the victim;
• The malicious page redirects the victim’s browser to the vulnerable endpoint by passing HTML input as POST parameters;
• Once redirected to the vulnerable endpoint, the victim’s browser executes the payload.

Figure 3 – Try #1: The malicious page

In this example, we simply create a form with the same parameters as in the above screenshot, and we automatically submit it via JavaScript. An HTML payload is included in the value of one of the parameters. When browsing this page, we see a Loading… text, then we are automatically redirected to hxxps://vuln-wp.xyz/wp-admin/admin-ajax.php and we get the following content:

Figure 4 – Try #1: The vulnerable endpoint

As you can see, the <h1> tag is interpreted by the browser because the Content-Type of the response is set to text/html (this is the default Content-Type returned by admin-ajax.php).

But we also have some escaped characters. That is because of the json_encode function which escapes the data to make it JSON valid. This is why ", ', /, and \ are being escaped.

What we have to understand is that it won’t be possible to execute code with <script></script> because the closing tag is mandatory for the JavaScript code to be interpreted. Knowing that, how can we produce a working exploit?

# Motivation

As we want the exploit to be transparent to the victim, we are looking for a way to automatically execute JavaScript code inside a page, without any user interaction needed (click or anything else).

We know that the use of <script> tags is not possible. Another option would be to use HTML events. HTML elements can trigger JavaScript code under some circumstances (e.g. element is clicked, mouse is moved over, image is loaded, window is resized, etc.). The large majority of these events require an interaction between the user and the webpage. Except for the onload event, which is fired up once an element is loaded (image, body, etc.).

The onload event works well with <img> and <body> tags. Moreover, <img> is a void element and HTML does not require to close it, and the <body>‘s closing tag is also not mandatory for the browser to interpret it.

We are now able to execute JavaScript code automatically. We can submit a value without the use of quotes to an HTML attribute and, in this case, we must do so:

Figure 5 – Try #2: The malicious page

And the resulted behavior:

Figure 6 – Try #2: The vulnerable endpoint

However, we are somewhat limited in the code we can run due to escaped characters, as seen earlier. Thus we need to find workarounds.

# Annihilation

We are forced to remove all whitespaces in the JavaScript payload because the browser will cut the script if it encounters a whitespace, thinking that it acts as a separator between the onload value and the next attribute for this HTML element (this is because we didn’t surround the onload content with quotes).

Furthermore, if we want to use variables inside the payload, we have to declare them without the var keyword. This technique is valid and won’t trigger a ReferenceError as long as we don’t use strict mode (and we won’t).

For return statements, we may use return(value) instead of return[space]value.

And remember, we can’t use single and double quotes! Meaning we won’t be able to use standard strings in the script we write for the onload event. We have two options to work around this problem:

• Using backticks (`) instead of quotes given that template literals can be used in the same way as strings;
• Using an array of charcodes without spaces ([104,101,108,108,111]) and converting it into a string with a function such as the following:

// Function.prototype.apply() :
String.fromCharCode.apply(null, charcodes)
// OR Spread syntax :
String.fromCharCode(...charcodes)

Thanks to these little tweaks, we are able to make the victim’s browser execute whatever we want with, for instance, something like eval(atob(`base64encodedPayload`)).

Now, imagine the victim is an administrator of the targeted WordPress, with a valid session cookie (i.e., they are already logged in as admin on the site). Because the admin panel is on the same domain as this vulnerable endpoint, AJAX calls are possible and not restricted (i.e., we don’t need explicit CORS permissions), and iframe manipulation is not restricted by the same-origin policy. We may then perform any action we want on the admin panel on behalf of the administrator (user creation, article edition, plugin installation, etc.), and even upload a webshell to keep full access to the WordPress in the future and try lateral movements or privilege escalation.

# Resolution

The easiest, and fastest, way to protect against this vulnerability is to adapt the Content-Type each time a function returns JSON data.

The plugin’s editor first decided to add a nonce check for this request in their 1.9.26 patch. Unfortunately, this wasn’t enough since it didn’t fix the XSS vulnerability but only slightly reduced the severity. In fact, a nonce has a default validity of 24 hours (twice its default 12 hours lifetime). However, if it’s compromised, the admin may still be exposed to an attack during this time. But above all, the problem is that the nonce is the same for all unauthenticated visitors. All four variables used to create the nonce ($uid, $token, $action, $i) have the same value if the user is not logged in. This means that the endpoint is still vulnerable to phishing issues. One could redirect an unauthenticated victim to this page and execute JavaScript code.  For example, it would be possible to create a fake Login page to steal the admin’s credentials. The only constraint for the attacker is to update the nonce in their malicious code once a day.

Eventually the editor added a casting to integer on to the input data (the famous $setting variable, since the client is supposed to send a number) in the version 1.9.27. Now a string payload is converted to int(0) and there is no more XSS. As there are one partial patch and one complete patch, two distinct CVEs have been opened.

If you are a cybersecurity researcher yourself and would like to discover the Cloud, you are welcome to join our bug bounty program! You just have to create a YesWeHack account and contact us so that we can provide you with free access to the platform. Hope to see you soon

In April 2020, the Italian social security system was the target of multiple cyberattacks that caused a major breakdown for several days, thus disrupting COVID-19 payouts. Hammersmith Medicines Research, a British company specialized in medical trials was also hit by a ransomware attack in March of that same year. The consequences of cyberattacks can be even more serious when it comes to hospitals. “Imagine if this attack had not been stopped and had spread across all networks, making it impossible to access patients’ personal data and medical records, to perform scans or use operating room equipment.” In this statement made on September 7, 2020, Florence Parly, French Minister for Armed Forces, refers to a major ransomware attack on the Sainte-Anne military hospital in Toulon, a city in the southeast of France and the country’s most important naval base. An attack that could have had disastrous consequences on the health of patients without the intervention of CALID (Centre d’analyse de lutte informatique défensive), an analysis center focusing on cyberdefense. Another case was registered in September when Düsseldorf University Clinic, a major hospital in Düsseldorf, fell victim to a cyberattack that caused the failure of its IT systems, forcing the staff to divert patients to other facilities and leading to the loss of a patient’s life. For the first time, this case raised the question of patient safety and the risk patients may be subjected to during hospital cyberattacks.

The market value of medical data—far more specific than anonymized data—is skyrocketing. In the case of hospitals, which have already been severely weakened, cyberattacks have dramatically increased by 475% since the beginning of the health crisis. Therefore, the cybersecurity of organizations handling medical data is becoming a fundamental issue for patients.

Increasingly Connected Medical Devices

 Hospitals face two major threats: the extraction of raw health data on the one hand, and the spread of ransomware in information systems on the other. Hospital networks—made vulnerable by their lack of fragmentation and over-centralization—are further jeopardized by smart devices (IoT). Whether it is blood pressure monitors, insulin pumps or defibrillators, the connection of medical equipment is a major breakthrough for the world of healthcare. However, this same equipment is becoming an entry point for hackers wishing to intrude into information systems. The security perimeter to be defended now also extends to related applications such as chatbots available to patients, appointment scheduling platforms or telemedicine tools.

To protect itself against intrusion attempts through smart devices, the healthcare sector must turn to a certified and perfectly secure Cloud. It is also important to reassert the sovereignty of data in transit and to control their route in order to ensure that they do not fall under legislation other than that guaranteed by the European GDPR. To protect their infrastructures, CISOs (Chief Information Security Officer) must integrate the security issues related to the use of the IoT into their roadmaps. Thus, to preserve data and limit malicious intrusions through the IoT, experts recommend confining smart devices by implementing containers and fragmenting the network, an initiative that remains all too rare in under-resourced public hospitals. Once the network is fragmented, CISOs must remain vigilant by simplifying cybersecurity governance with the implementation of monitoring tools to analyze all network segments efficiently.

Certifications as a Guarantee for Data Protection

 In order to choose the right technology partner, organizations can refer to certifications such as SecNumCloud or HDS in France. These ensure the adaptability of providers to all security and compliance constraints. Let’s see how certifications can help your organization choose a technology partner and guarantee the protection of your sensitive data.

The Health Data Hosting (HDS) certification has been accredited by Cofrac to meet the specific requirements of the medical environment and to assist CISOs in their tasks. The HDS certification ensures the encryption of transmitted personal data as well as their traceability and reversibility. Customers know where their data are stored and how they are used, and can retrieve them at the end of the contract or in the event of loss. This certification specific to the medical environment proves that the data of healthcare organizations are protected and secured. Hospitals can take full advantage of the power of a trusted Cloud to facilitate the management of digital medical records and to protect data in transit between different smart devices.

The HDS certification also comes with prerequisites in terms of cybersecurity, including the implementation, maintenance and continuous improvement of an ISMS (Information Security Management System). An ISMS guarantees that a system is in place to ensure business continuity and recovery in the event of a vulnerability or security incident. This system also aims to verify that the processing of personal data is compliant with the GDPR.

Finally, the SecNumCloud Security Visa delivered by ANSSI (the French National Cybersecurity Agency) makes it possible for public and parapublic organizations and private companies processing sensitive data to identify providers that meet the highest security, confidentiality and sovereignty requirements. In concrete terms, the SecNumCloud qualification validates the security line implemented in organizations according to the strictest criteria. The protection and data processing measures in place are assessed during a series of audits carried out by ANSSI.

The protection of the hospital network is essential, especially with the ongoing pandemic during which a cyberattack aimed at intensive care units could have disastrous consequences. More than ever, the protection of healthcare organizations appears to be a national issue. So, make sure to look out for relevant certifications for your organization!