Vulnerabilities identified across Jamaica's public sector web systems

 

More than 44 vulnerabilities were identified across the Jamaica's public sector web systems after cybersecurity researchers flagged flaws in the PHP programming, the language which powers 70 per cent of the world's websites.

 

The update comes weeks after several government websites in Europe and Asia went dark.

 

This followed the disclosure that there were three critical vulnerabilities in the programming language, which then sent operators around the world scrambling to protect their systems. 

 

The BBC and Wikipedia were among website operators who went offline, while the White House had indicated that it was working with top engineers to fix the vulnerability. 

 

On October 21 the developers released urgent new fixes for two of the issues that had been lurking for years. 

 

Director of the Jamaica Cyber Incident Response Team (JaCIRT), Lieutenant Colonel Godphey Sterling, said the public sector is the most critical, as it has the oldest version of the programming language. 

 

"The public sector has some of the oldest PHP code and other code, but it also holds one of the most sensitive data for our people. And so, what we're seeing is that it's not unique to Jamaica. Governments across the world have been taking their systems offline, patching and coming back online, and we should do the same," he urged.

 

"For the private sector, a lot of it depends on who is hosting their sites. But it also puts responsibility on the owners of the site to understand what are the vulnerabilities but also what are the dependent systems that must also be taken offline. Ransomware continues to be a critical situation for us. For the month of October, including just last week, we're tracking over five successful detonations here in Jamaica, including significant members in some of the critical sectors," Colonel Sterling revealed.

 

He said 897 gaps were flagged across the private sector systems, with 465 patched to date. 

 

Dr. Andrew Wheatley, Minister with responsibility for Science and Technology, said all ministries, agencies and departments were directed to update PHP and all of its systems within 48 hours once the flaw was flagged.

 

"Including systems run on its behalf by outside hosting providers and developers. Any system that could not be updated in that time was to be taken offline until it was updated, with essential public services, of course, agreeing interim protection with the CIRT division. Each entity was also required to report the status of every website and application to CIRT and to report any sign of compromise immediately," noted the minister.

 

JaCIRT has said the region remains exposed as Latin America and the Caribbean region is patching the gaps at half the global pace.