- KICTANet - KICTANet

KICTANet Newsletter: 5th Edition Update (2024) 📰
by Neema MASITSA 08 Apr '24

08 Apr '24

Dear listers, We are thrilled to share with you the latest updates and highlights from KICTANet's dynamic initiatives in March! In our latest newsletter, you will find insightful discussions on various topics, including tackling digital IDs, empowering vulnerable groups in cybersecurity practices, revitalizing Kenya's ICT sector, and much more. We have been actively working towards fostering inclusivity, driving innovation, and advocating for positive change in Kenya's digital landscape. We invite you to dive into our newsletter to learn more about our impactful initiatives and the strides we are making toward shaping a more resilient and inclusive digital future. Read the newsletter here: https://tinyurl.com/37cynp29 Thank you for your continued support and interest in our work. Stay tuned for more updates and exciting developments from KICTANet! Best regards, Neema Mujesia, Communications Officer, KICTANet

1 0

Fwd: Opportunity for Kenyan Companies to Exhibit at the May 2024 AI Expo for National Competitiveness
by Grace Githaiga 07 Apr '24

07 Apr '24

Listers This might be of interest to some of you. Please note the deadline. ---------- Forwarded message --------- From: Campbell, Yanique (Nairobi) <CampbellY(a)state.gov> Date: Sat, Apr 6, 2024 at 8:14 PM Subject: Opportunity for Kenyan Companies to Exhibit at the May 2024 AI Expo for National Competitiveness To: Campbell, Yanique (Nairobi) <CampbellY(a)state.gov> Dear friends and colleagues, Flagging an opportunity to exhibit at the Special Competitive Studies Project’s (SCSP) *to join the first **AI Expo for* *National Competitiveness **in Washington, D.C., on May 7-8, 2024, at the D.C. Convention* *Center. *Founded in 2021, SCSP is a bipartisan, not-for-profit project that is the premier institution in Washington D.C. working on technology and national competitiveness. *The Expo will be a first-of-its-kind event in Washington D.C., *bringing together leaders in innovation from around the world to spark new conversations on public-private cooperation in critical technology areas. *Approximately 200 exhibitors from government, industry, and academic partners will showcase the latest technological breakthroughs *in AI, biotechnology, next generation networks, augmented reality, microelectronics, and beyond. *A program of global leaders will speak on the strategic importance that technology holds for national competitiveness*. The lineup will be similar to SCSP’s most recent event, the 2023 Global Emerging Technology Summit <https://www.scsp.ai/summit23/>, which included Nvidia CEO Jensen Huang, Intel CEO Pat Gelsinger, U.S. Secretary of State Antony Blinken, Japanese Minister for Digital Transformation Taro Kono, Ukrainian Minister of Strategic Industries Oleksandr Kamyshin, and others. They are welcoming Kenyan officials and private sector partners to exhibit. Registration and attendance to the event will be free and they are willing to cover transportation and accommodation as needed. If you would be interested in exhibiting at the expo (SCSP is charging $35/sq foot on the exhibit floor for exhibitors), please send me an email sharing your company’s expertise in emerging tech and why this would be a good fit for you and I’d be happy to connect you to my colleagues organizing the program. Appreciate if you could share *by Monday (4/8) COB in Nairobi*. Thanks, enjoy the weekend, and see below additional info for your perusal. ************************ *SCSP's work that might be of interest to you*: *Mid-Decade Challenges to National Competitiveness* <https://www.scsp.ai/reports/mid-decade-challenges-for-national-competitiven…> - https://www.scsp.ai/reports/mid-decade-challenges-for-national-competitiven… This was the report we released in September 2022 that identified the global technology challenges America and its allies and partners will face in the next decade through ~2030. *Generative AI: The Future of Innovation Power * <https://www.scsp.ai/reports/gen-ai/>*- *https://www.scsp.ai/reports/gen-ai/ This September 2023 report considered the implications of GenAI on the work of our government - we wrote this as a series of memos to U.S. government agencies working on economic issues, AI governance, intelligence, defense, foreign policy, and future tech platforms/innovation. *Global Emerging Technology Summit Recap* <https://scsp222.substack.com/p/global-emerging-technology-summit-1f4>* -* https://scsp222.substack.com/p/global-emerging-technology-summit-1f4 This newsletter recapped our last big Summit event in September 2023. *Mapping the U.S.-PRC Tech Competition Landscape* <https://scsp222.substack.com/p/mapping-the-us-prc-tech-competition> - https://scsp222.substack.com/p/mapping-the-us-prc-tech-competition This recent piece by Channing maps the state of the competition between the U.S. and the PRC is a few key technology platforms - we are doing more research to build out additional maps of other platforms. *Yanique Campbell* Economic Officer U.S. Embassy Nairobi -- Kind regards, Dr. Grace Githaiga*,* CEO@*KICTANet* <https://www.kictanet.or.ke/> @ggithaiga <http://twitter.com/ggithaiga> | LinkedIn <https://www.linkedin.com/in/gracegithaiga/> ___________________________ KICTANet.or.ke <https://kictanet.or.ke/> | Twitter <https://twitter.com/kictanet> | LinkedIn <https://www.linkedin.com/company/kictanet/> | Facebook <https://www.facebook.com/KICTANet/> | Instagram <https://www.instagram.com/kictanet/> | Youtube <https://www.youtube.com/channel/UCbcLVjnPtTGBEeYLGUb2Yow/videos> | TikTok <https://www.tiktok.com/@kictanet> KICTANet: *Transformed communities through the power of ICTs*

1 0

Global Digital Compact Zero Draft released
by Barrack Otieno 02 Apr '24

02 Apr '24

Listers, For those following global Internet and Digital Governance issues, this might be of interest. https://www.un.org/techenvoy/sites/www.un.org.techenvoy/files/Global_Digita… It would be great if we can submit our comments at the conclusion of the Kenya Internet Governance Forum 2024. Best Regards -- *Barrack Otieno* *Trustee* *Kenya ICT Action Network (KICTAnet)* *Skype:barrack.otieno* *+254721325277* *https://www.linkedin.com/in/barrack-otieno-2101262b/ <https://www.linkedin.com/in/barrack-otieno-2101262b/>* *www.kictanet.or.ke <http://www.kictanet.or.ke>*

1 0

Securing the Internet, Open Source and Other Easter Stories : CVE-2024-3094
by Lawrence Muchilwa 31 Mar '24

31 Mar '24

Dear listers, Once in a while, we are reminded of how the internet is fragile and how securing it is even more fragile. Someone or a team managed to add a backdoor to software that's used by approximately 80% of the internet. This backdoor would have allowed unauthorized remote access to any affected system. This was detected by sheer luck and is being tracked as CVE-2024-3094; see attached. This attack is suspected to be the work of a nation-state actor and might have started in 2022. It shows the threat posed by supply chain attacks and open-source software. It also highlights the challenges involved in maintaining open-source software and how a malicious threat actor can exploit these challenges to their advantage. Organizations should invest in processes and tools that maintain a software bill of materials (SBOM). This ensures that attacks like this can be detected faster and improves organizational mean time to detect (MTTD). Security is a layered approach. As much as CVE-2024-3094 would have gone unnoticed, a reduced threat surface would have reduced the possibility of the threat. -- with kind regards Muchilwa Lawrence https://overwatch.or.ke www.testmyids.ke

1 0

(Urgent!) Potential Backdoor in a Compression Package used in Linux Distributions [CVE-2024-3094]
by Jacinta Wothaya 31 Mar '24

31 Mar '24

Dear Listeners, A critical security vulnerability [*CVE-2024-3094]* has been discovered in XZ Utils versions *XZ 5.6.0* (released Feb. 24) and *XZ 5.6.1* (released March 9). This backdoor could potentially allow a malicious actor to compromise sshd authentication, granting unauthorised access to the entire system remotely. Andres Freund, a security researcher working as a PostgreSQL developer at Microsoft discovered the vulnerability and reported it to OpenWall on March 29, 2024. The XZ Utils is a FOSS software suite that provides tools for data compression and decompression. It is commonly used due to its high compression ratio and efficiency. It also contains the liblzma library, which developers can integrate into their applications. XZ utils is widely used in the FOSS, especially in many Linux distributions hence, the vulnerability threatens the entire Linux ecosystem. As a result, Red Hat, Inc. has issued it a *CVSS Score of 10*, the highest possible score for any vulnerability. Specifically, the backdoor: - Can allow an attacker to access the system from anywhere. - Doesn't require any privileges to exploit. - Works silently without requiring user interaction. - Can allow the attacker to change objects outside the affected component. - Can affect the confidentiality, integrity, and availability of the entire system. The Open source community and government agencies are monitoring the issue and will provide advice as investigations continue. So far it has been confirmed that testing, unstable, and experimental distros of *Fedora 41, Fedora Rawhide, and Debian *contain the vulnerable XZ versions. It was also included in *Tumbleweed and MicroOS distros of openSUSE*. Users of these Linux systems are advised to check the version of XZ Utils installed and immediately update their systems using the advisory provided by their distribution’s website. Several artifacts of a stable release of *Arch Linux* (NOT used in production systems) are also affected. These mirrors have been removed and users are advised to update to the latest version. In addition, a technical steering committee member for Homebrew confirmed that they downgraded the untrustworthy versions of XZ 5.6x. *Homebrew* is an open-source package manager that *installs* *UNIX tools for macOS systems*. Further information about *CVE-2024-3094* can be found on the following websites: 1. National Institute of Standards and Technology’s National Vulnerability Database <https://nvd.nist.gov/vuln/detail/CVE-2024-3094> 2. The US Cybersecurity and Infrastructure Security Agency <https://www.cisa.gov/news-events/alerts/2024/03/29/reported-supply-chain-co…> 3. Red Hat <https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-…> 4. Kali Linux <https://www.kali.org/blog/about-the-xz-backdoor/> 5. Openwall <https://www.openwall.com/lists/oss-security/2024/03/29/4> 6. Arch Linux <https://archlinux.org/news/the-xz-package-has-been-backdoored/> 7. OpenSUSE <https://news.opensuse.org/2024/03/29/xz-backdoor/> 8. Tenable gives a summary of the affected systems <https://www.tenable.com/blog/frequently-asked-questions-cve-2024-3094-suppl…> *On a more interesting note*, I did some digging and here is what I have so far: Andres <https://mastodon.social/@AndresFreundTec> is one of the leading contributors to the Postgres community. He was testing a Debian unstable release for possible portability problems with Postgres when he noticed a series of coincidences including a 500ms latency on many failed sshd processes using wrong usernames. He then discovered the liblzma package was the one draining the CPU. He also recalled seeing an odd complaint a few weeks before in automated testing of Postgres using a Linux tool called Valgrind. Upon further investigation, Adres realised that the XZ repository and the XZ tarballs had been backdoored. What is concerning is that the compromise was not injected into released Debian packages but was introduced by a community maintainer of the XZ package through the source code uploaded to the GitHub repository. The Github commits were performed over several weeks by the account ‘Jia Tan <https://github.com/JiaT75>’ whose owner remains unknown. However, it was created in 2021 and made its first commit to the XZ repository on 2022/02/06. They have made changes to XZ between 2022 and 2024 and the most recent commit was on 2024/03/09. Alone, these commits may not be suspicious, however, Jia Tan's changes are what caused the Valgrind errors in configurations that didn't meet the updated code’s expectations. Several conversations emerged in different open-source communities about what could be causing the valgrind errors and possible solutions. The persona Jia Tan participated in these conversations and claimed that the errors were due to versions of XZ earlier than 5.6x. They then contacted Fedora to push for an update of XZ to 5.6x versions in stable distributions of Linux and continued to push for this update in other open-source communities. There are also messages from other anonymous accounts pushing for the original XZ maintainer to add a new maintainer right after Jia Tan started helping with the project. This high-interest vulnerability will spark conversations about the integrity of Free and Open Source Software, especially for critical libraries like XZ. I am keen to follow the discussion and will compile a timeline of the attack to update interested listeners. Regards, Jacinta Wothaya

1 0

China bans American foreign microchips and software
by Mwendwa Kivuva 30 Mar '24

30 Mar '24

After Donald Trump banned Chinese companies from using American-made microchips, it appears that the law of unintended consequences is working against America. Over the past four years, China has significantly increased its computer chip production. This growth has led to Huawei becoming the second-largest mobile phone brand in China, marking a remarkable turnaround. The rapid advancement of China in producing high-end microchips, such as the level 7nm chip powering the Huawei Mate 60 and iPhone XS, has surprised the US intelligence network. This is in contrast to the more advanced 5nm chip in the iPhone 13 and the 3nm chip in the iPhone 15 produced by Western companies. China has taken a further step by implementing measures to replace US-based operating systems (Microsoft), database products, and microprocessors (Intel and AMD) with locally developed Chinese alternatives in government offices. This will have a spillover effect across the Chinese business sector. The Chinese government has cited "safety and reliability" as the primary reasons for this shift, mirroring the security concerns raised by the US regarding Chinese-based systems. In 2023, China accounted for 27% of Intel's $54 billion and 15% of AMD's $23 billion revenue. The implications of these actions are significant, and the future actions of the US under the current Biden administration or any future administration will be closely watched. The broader question raised by these developments is who benefits when superpowers engage in such conflicts. While the competition may lead to advancements in technology, the aggressive pursuit of dominance in microprocessor technology raises concerns about the impact on global innovation and collaboration. Chris Miller, author of Chip War, aptly summarizes the situation by stating, "If you import most of your chips, you're not a manufacturing superpower; you're just assembling high-value components produced elsewhere." The US-China tech war has escalated into a multifaceted conflict encompassing technology, economic dominance, national security, and global influence. This battle for technological supremacy between the two superpowers has reshaped global alliances, trade relationships, and the trajectory of technological innovation. Taiwan and Malaysia's pivotal role in semiconductor production has positioned the Asian countries as key players in this tech war, underscoring the intricate interplay between geopolitics and technology. The unintended consequences of Donald Trump's ban on Chinese companies using American-made microchips have catalyzed China's rapid advancement in computer chip production. This growth has propelled Huawei to become a major player in the mobile phone market, showcasing China's technological prowess. China's strategic measures to replace US-based technology with domestic alternatives in critical sectors like government offices reflect a broader trend of self-reliance and security concerns driving national policies. The implications of these actions, with China accounting for a significant portion of Intel and AMD's sales, highlight the profound impact of the US-China tech war on global tech markets. The competition between the US and China in microprocessor technology raises questions about the balance between technological advancement, market dynamics, and national interests. The conflict not only shapes the tech industry but also influences broader international relations and the future trajectory of global technological development. As the US and China navigate this complex tech war, the broader question of who benefits from such conflicts remains pertinent, with implications for global innovation, collaboration, and the evolving geopolitical landscape. Interesting times ahead. I would love to see what retaliatory or olive branch the US will use under the current Biden administration or the incoming one. And where does Africa, and the Global Majority sit in the global scale of things? Great heading here: China blocks use of Intel and AMD chips in government computers, FT reports https://www.reuters.com/world/china/china-blocks-use-intel-amd-chips-govern… US-China tech war: Is Huawei's new chip a threat? https://amp.dw.com/en/us-china-tech-war-is-huaweis-new-chip-a-threat/a-6691… Rough politics: How Huawei surprised the US with a cutting-edge chip made in China https://www.ft.com/content/327414d2-fe13-438e-9767-333cdb94c7e1 Sources Retrieved on 28 March 2024. Best Regards ______________________ Mwendwa Kivuva https://www.linkedin.com/in/mwendwa-kivuva

2 1

KICTANet Working Groups Deliver Recommendations to the the ICT Task Force
by David Indeje 27 Mar '24

27 Mar '24

Dear Listers, The KICTANet Working Groups explored challenges and opportunities in our digital landscape. Stakeholders offered valuable contributions to draft recommendations for an inclusive and equitable ICT ecosystem, which were presented to the ICT Task Force on March 13, 2024. This report outlines a roadmap towards a vibrant digital ecosystem. https://tinyurl.com/3vmt3tn5 -- *Kind Regards,* *David Indeje* *KICTANet Communications *_____________________________________ +254 (0) 711 385 945 | +254 (0) 734 024 856 KICTANet portals KICTANet.or.ke <https://kictanet.or.ke/> | Twitter <https://twitter.com/kictanet> | LinkedIn <https://www.linkedin.com/company/18428106/admin/> | Facebook <https://www.facebook.com/KICTANet/>

1 0

Nigerian Court Ruling on Truecaller Raises Privacy Concerns
by David Indeje 26 Mar '24

26 Mar '24

Dear Listers, A recent Nigerian court ruling has sparked debate on the balance between technological advancements and individual privacy rights. The case centred around Truecaller, a mobile app for caller identification, and allegations of data privacy breaches. For more details https://tinyurl.com/yf29xber -- *Kind Regards,* *David Indeje* *KICTANet Communications *_____________________________________ +254 (0) 711 385 945 | +254 (0) 734 024 856 KICTANet portals KICTANet.or.ke <https://kictanet.or.ke/> | Twitter <https://twitter.com/kictanet> | LinkedIn <https://www.linkedin.com/company/18428106/admin/> | Facebook <https://www.facebook.com/KICTANet/>

1 0

Worldcoin tokens (WLD)
by Lydia gachungi 21 Mar '24

21 Mar '24

What is this Worldcoin tokens (WLD)? Are Issues of privacy, data protection taken into account as Kenyans flock to be registered? I am lost on what the objective is and the benefits Lydia

21 33

FCC Officially Raises Minimum Broadband Metric From 25Mbps to 100Mbps
by Josphat Karanja 20 Mar '24

20 Mar '24

New developments. Impact on our national Broadband Policy? https://www.pcmag.com/news/fcc-officially-raises-minimum-broadband-metric-f… Regards ........................................................... Josphat Karanja, *PMP®* *"We who cut mere stones must always be envisioning cathedrals"**. The Pragmatic Programmer*

4 5