Tuesday, February 19, 2019

Mobile security is a relatively new field in the world of cybersecurity. The rise of mobile computing calls for an increased vigilance in regards to our personal information. Smart phones and the like are now the standard. In fact, according to the Pew Research Center, 95% of Americans own a cellphone of some kind.
The obvious risk increase stems from the fact that cellphones are no longer primarily for calling people. Smart phones store everything from our emails to our banking information. We use them as calendars, GPS systems, and everything in between. Anyone who uses apps have the majority of their passwords stored on their phones. While these features are convenient for the user, they open the door for a plethora of mobile security risks.

Physical Theft

One of the most obvious risks to mobile security is someone stealing your phone. Due to the portable nature of phones, it is easier to leave your phone somewhere. Additionally, it is easier to steal a phone than a desktop or laptop. If your phone is unguarded, or has a mediocre password (1234, 0000, etc.), whoever has your phone has access to your passwords, and all of your data. However, your data is not the only thing at risk. Smart phones are incredibly customization and personal. Therefore, they are a prime target for identity theft. After all, the information on a smart phone can easily paint a very clear picture of a person; their spending habits, their account information, and other sensitive information.

Malicious Apps

Google is currently undergoing criticism due to their play store hosting malicious apps. Google has a history of poorly vetting their apps and it is important to remember that literally anyone can create an app.  Therefore, many apps can pose a significant risk to your mobile security by hosting malicious ads, or using social engineering tactics.
The most common issue is the access process, in which apps ask you to give them access to your data. Often this is plausible for certain apps. For example, Skype needs access to your microphone, so you can speak into it and others can hear you on the app. However, apps will often use your information in ways that you only implicitly consented to. In fact, the majority of apps that ask for your location use this information for marketing purposes. In worse situations, predatory apps marketed at children have asked for outlandish permissions, such as texting the contacts in your phone, posting on your behalf, and even access to your memory card. These apps are obviously a blatant violation of your mobile security. Some apps even eschew all pretenses and end up just being malware disguised as an app.

Unsecured Wi-Fi

For the many unfortunate people who do not have unlimited data, airport or coffee shop Wi-Fi can be your only option. Unfortunately, most public Wi-Fi setups are not very secure. Mobile security can be easily compromised if an attacker decides to take advantage of a weak wireless network. Additionally, an attacker could easily take advantage of your smartphone’s automatic remember feature, in which a phone will automatically connect to a previously used Wi-Fi system. The attack could achieve this by access point spoofing, a method of created a fake Wi-Fi access point that hosts the same characteristics, parameters, and name as the original access point. A phone could easily confuse the two networks, granting the attacker easy access to intercept your data.

We Need to Take Our Mobile Security Seriously!

Botnets, malware, spyware, and backdoor communication channels all pose a significant threat to your mobile security. On a personal level, your data, identity, and money can easily be stolen. On a business level, your systems security can be compromised by an employee’s unprotected phone, as explored in our previous article, Bringing Your Phone Into Work COuld Cause a Data Breach.
Therefore, it is important to take take measures to protect and control your mobile security. Limit app access. Be wary of signing into public Wi-Fi. Use multi-factor authentication like a strong password and biometrics. Avoid storing your passwords on apps. Allow space on your phone for antivirus software. Update your phone regularly. However, perhaps most importantly, be skeptical. You should not always believe everything that is presented to you. Phishing attacks and and malicious distribution is the bread and butter of cyber attackers. Therefore, make sure to check the reputation of all downloaded apps, and learn the signs of legitimacy regarding links you come across.

Monday, February 18, 2019

Internal paths disclosure due to improper exception handling

This bug could allowed a malicious user to expose internal paths of Facebook main server. The leaked paths were not previously known to the public. 

Demonstration

The bug occurs in an upload functionality which enable Facebook users to upload big files as chunks. With each upload of a file part, the user has to specify the part/chunk number to upload along with the session_id of the file to upload. While testing i noticed that if we try to upload data after specifying an already used chunk id , an exception is raised and returned in the response along with directories to blame.
To demonstrate this, first we start an upload session for the desired file:
POST /intl/request/upload/start/
Host: www.facebook.com


file_type=text&file_size=555&file_name=ex.txt&__a=1&fb_dtsg=XXXXXXX
The response should contain a “session_id”, we’ll note it XXXXXXXXXXX
Then we use the session_id to make a second request :
POST /intl/request/upload/chunk/?__a=1&fb_dtsg=YYYYYYYYYYYYYY Host: www.facebook.com ------WebKitFormBoundaryoG5U8hFBDDDDwLwN Content-Disposition: form-data; name="chunk_number" 1 ------WebKitFormBoundaryoG5U8hFBDDDDwLwN Content-Disposition: form-data; name="session_id" XXXXXXXXXXX ------WebKitFormBoundaryoG5U8hFBDDDDwLwN Content-Disposition: form-data; name="file_chunk"; filename="XXXXXXXXXXX-1" Content-Type: text/html SOME DATA ------WebKitFormBoundaryoG5U8hFBDDDDwLwN--
This request should be made twice which will raise the exception and leak the internal paths

Over 92 Million New Accounts Up for Sale from More Unreported Breaches


Unreported Data Breaches
All these numbers….

"More than 5 billion records from 6,500 data breaches were exposed in 2018" — a report from Risk Based Security says.

"More than 59,000 data breaches have been reported across the European since the GDPR came into force in 2018" — a report from DLA Piper says.

…came from data breaches that were reported to the public, but in reality, more than half of all data breaches actually go unreported.

Just last week, we disclosed the existence of some massive unreported data breachesin two rounds, which a hacker has now started monetizing by selling stolen user databases publicly.

Now, a new set of databases containing millions of hacked accounts from several websites has been made available for sale on the dark web marketplace by the same hacker who goes by online alias Gnosticplayers.

Gnosticplayers last week made two rounds of stolen accounts up for sale on the popular dark web marketplace called Dream Market, posting details of nearly 620 million accounts stolen from 16 popular websites in the first round and 127 million records originating from 8 other sites in the second.

The third round, which the hacker told The Hacker News would be his last round, published Sunday contained more than 92 million hacked users’ accounts stolen from 9 websites, including the popular GIF hosting platform Gfycat.

New List of Hacked Websites

data breaches database sale darkweb
Gnosticplayers told The Hacker News in an email that the third round up for sale on Dream Market belonged to the following 9 hacked websites:

  • Pizap (Photo editor) — 60 million
  • Jobandtalent (Online job portal) — 11 million
  • Gfycat (GIF hosting service) — 8 million
  • Storybird (Online publishing platform) — 4 million
  • Legendas.tv (Movie streaming site) — 3.8 million
  • Onebip (Mobile payment service) — 2.6 million
  • Classpass (Fitness and Yoga center) — 1.5 million
  • Streeteasy (Real estate) — 990,000 (1 million)
  • Btcturk (Cryptocurrency exchange platform) — 516,000

The hacker is selling each of the above listed hacked databases individually on Dream Market for a total worth 2.6249 Bitcoin (roughly $9,700).

In an interview with The Hacker News, Gnosticplayers said none of the services listed in the third round was aware of the data breach of its network and has previously disclosed any such security incident.

Since the majority of compromised services listed in the first and second batches have confirmed the previously-unreported or undetected data breaches, it's likely that the new round of stolen accounts being sold on the underground market is also legit.

While the third round of the stolen accounts has been up for sale on the Dream Market, the first and second collections have already been removed from the underground market (except a round-2 database from interior designing service Houzz) by the hacker to avoid them from getting leaked or land on security initiatives like Google's new Password Checkup tool.

What's next? If you are a user of any of the above-listed services or websites disclosed in the previous two rounds, you should consider changing your passwords and also on other services in the event you re-used the same password.

How facebook can be hacked !!!!

how to hack facebook account
It's 2019, and just clicking on a specially crafted URL would have allowed an attacker to hack your Facebook account without any further interaction.

A security researcher discovered a critical cross-site request forgery (CSRF) vulnerability in the most popular social media platform that could have been allowed attackers to hijack Facebook accounts by simply tricking the targeted users into clicking on a link.

The researcher, who goes by the online alias "Samm0uda," discovered the vulnerability after he spotted a flawed endpoint (facebook.com/comet/dialog_DONOTUSE/) that could have been exploited to bypass CSRF protections and takeover victim's account.

"This is possible because of a vulnerable endpoint which takes another given Facebook endpoint selected by the attacker along with the parameters and makes a POST request to that endpoint after adding the fb_dtsg parameter," the researcher says on his blog.

"Also this endpoint is located under the main domain www.facebook.com which makes it easier for the attacker to trick his victims to visit the URL."

All the attacker needs to do is trick the victims into clicking a specially crafted Facebook URL, as mentioned on his blog, designed to perform various actions like posting anything on their timeline, change or delete their profile picture, and even trick users into deleting their entire Facebook accounts.

1-Click Exploit to Completely Take Over Facebook Accounts


Taking over full control of the victims' accounts or tricking them into deleting their entire Facebook account requires some extra efforts from the attacker's side, as victims need to enter their password before the account is deleted.

To do this, the researcher said it would require the victims to visit two separate URLs, one to add the email or phone number and one to confirm it.

It's "because the 'normal' endpoints used to add emails or phone numbers don't have a 'next' parameter to redirect the user after a successful request," the researcher saysHowever, the researcher still made the full account takeover possible with a single URL by finding the endpoints where the 'next' parameter is present and authorizing a malicious app on behalf of the victims and obtaining their Facebook access token.


With access to the victims' authentication tokens, the exploit automatically adds an attacker-controlled email address to their account, allowing the attacker to fully take over accounts by simply resetting their passwords and locking the legitimate users out of their Facebook accounts.

Though the full Facebook account takeover hack involved multiple steps, the researcher said the complete one-click exploit would have allowed any malicious user to hijack your Facebook account "in the blink of an eye."

Such account takeover attacks can be mitigated if you have enabled two-factor authentication for your Facebook account, preventing hackers from logging into your accounts until or unless they verify the 6-digit passcode sent to your mobile device.

However, any mitigation could not prevent hackers from performing some actions on your behalf leveraging this vulnerability, like changing or deleting your profile pictures or albums or posting anything on your timeline.

Samm0uda reported the vulnerability with the details of his exploit to Facebook on January 26. The social media giant acknowledged the issue and addressed it on January 31, rewarding the researcher with $25,000 as part of Facebook's bug bounty program

MTN uganda on is on fire because of espionage,fraud,tax evasion and unfair competetive tendencies

MTN uganda must have faced the toughest times in its business spel for the beginning of this year.But as many may be aware,MTN's problem are not of today only but a series of mistakes and misunderstanding that gradually escalated from around mid 2010 through to early days of 2019.The most alarming of these mistakes was the unsurety of the customers privacy and the unrealistic licence it got after a long sacffle with the government of the republic of uganda.
Many people have been wondering how or if its true that mtn and its staff was involved in data leakages,exposing customers privacy to intrusion or any sort of espionage.on the first two i can assure you that mtn face data leakages and its customers were exposed to dangers of loosing their private data to dubious intruders,plus fraudulent acts that did occur mostly on mobile money services,its really annoying that mtn when contacted on these fraudulent issues alway would take a low pace and in most case ignore it in tge long end.many Ugandans have lost alot of money to these fraudulent acts where people even started alleging that such fraudsters may be in connivance with the employees of mtn.This allegation is true because its not easy for an intruder to know the time and amount of money one has on his Mobile money account.If it isn't,then its a vivid proof that customers privacy was subjective to intrusion and worse oo it all for a long period of time.To many who used Mtn simcards ti access internet or did register with their phone numbers on some social media networks,then what i can tell is that you are not safe!!To prove tha,try to read posts i wrote earlier.Mtn has been a failure in responding to customers' issues and mainly issues relating to mobile money.There are alot of scenerios where money is accidentally sent on phone numbers which are not already registered especially when one needs to use them immediately,and on some simcards when one forgets his pin,it takes lot time to be given another pin or some times the money ends up geting stuck on the simcard forever!!!! I do not know why customer care for mtn is so reluctant on mobile money issues. A lot of money is stuck on mobile money accounts!!!!! Now,if its on these simcards and stuck there,who uses them?i know of many cases which have been presented in 2014 and mtn did nothing to help them retrieve that money!!!However, this problem shouldnt be solely blamed on mtn,for all communication companies are too reluctant in solving mobile money issues!!!!
Mtn has also been also carrying out some indirect robbery in many ways:
Setting up promotional adverts that send sms to customers who at times are deductions made on airtime even if the owner does not know or didn't subscribe!! Imagine,if mtn has over ten million subscribers and sends messages that leads to deduction of 50-200 shillings,calculate the amount mtn bags?
There are services that mtn sets that are mainly unrealistic and in long end customers loose even if there money is taken!!!imagine a service like mtn AYO *296#, how many people have ever benefited from this? And its annoying that most people in villages end up subscribing to these services without knowing what they are!i meet an old woman in kyenjojo town complaining that mtn always takes her 50 shillings ...and when i took a look into her message box,it was AYO!!! I asked her if she did reguster for it and she told me that mtn agents came telling them that it was a must ti register for the service!!!!!!
There is also another question i have always been asking myself"why is mtn only interested in employing people who in most cases do not care about customers or those who do not have much knowledge about communication technology "....MTN should stop running for these cheap people!!!it is not a must that people who work at the receiption or correspondence desk must be beautiful ladies who in most cases are dull and arrogant!!!!!!

There are alot of mtn simcards that are registered with names that are not of the real names of people using them.These are the simcards that are used fraud.It is even extra dangerous for such cards can be used by cyber criminals or other criminals like terrorists and the one whom they used their real names may follow victim.It is even worse because in such incidents the police crime investigators get alot of confusion and its in this confusion that the terrorists and other criminal can continue to expand their terrible acts.MTN uganda is real confused,how does some register a phone in names not the same as those registered on his mobile money account?This grave ambiguity is too dangerous for on such phone numbers registered in names not similar to ones holding ans using them,if he or she is a fraudulent character, can register in names of another person mainly to vindicate him or her in his criminal acts.
I really do not know if MTN and other companies know thatsome foreigners do carry on the business of simcard registration, its shocking how a Congolese or rwandese can register a ugandan for a simcard?how can he prove that he is really who he says or claims he is?These foreigners do not mind about the requirements, they only need money!! Its not only in telecom busness ,i recently saw a rwandese making bottled drinks and am sure it has no quality!!! We may in long end find ugandans facing dangers while UCC and UNBS are just sleeping!!! Where and how do people get authority to selk beverages not certified by UNBS?
On espionage i do not have much say on MTN as a company or its employee but as i ealier wrote and later his excellence Kaguta Museveni talked about it that now uganda has a sophisticate technological equipments to smoke out these spies and all others trying to carry on espionage against Uganda.i just beg you to stop before you become the next to be deported! Am not writing because i support the government, or because am a government spy as many allege me to be or because am a supporter of Museven,Am just making you aware that its totally hard to carry on espionage against uganda through the phones now!!!! These warning goes to those who think VPNs will help you.....
Lets get a look at how MTN's problems started periodically!
On 14/06/2011,UCC issued a tarrif guideline as a way of trying to fight"anti competitive peicing practices " where telephone companies were prevented from charging on net rates less than 79% of the then ugx 131 per minute of interconnection that gave a ug x 92a minute floor price a thing that MTN did not like.As a result on 2nd september 2011,MTN uganda increased its on net tariff to ug x 4 per second on which MTN uganda CEO themba khumalo by then said that the tarriff needed to be adjusted to prevent mtn from self destruction.. Even the overall CEO of mtn by then,Sifiso Dabengwa described the direction on the market as unsustainable and would hamper investment in the communication sector.On 25/10/2012,MTN Uganda and its senior officials faced a tax evasion lawsuit, brought by a former employee charged with stealing from the company. The Daily Monitor cites the CEO of the cellco Mazen Mroue as saying: ‘In mid-September, MTN Uganda discovered suspicious supply chain payments made to several service providers. The MTN Group forensic team and Uganda police were engaged to investigate the suspicious transactions. This resulted in the charging of two staff members implicated in the investigation.’
Naphtal Were, one of the former employees involved accused of stealing an estimated USD4.1 million from the operator, has accused MTN’s bosses of evading payment of UGX70 billion (USD26.68 million) in taxes. Mroue dismissed Were’s allegations as ‘vague and baseless.’ Were’s lawyers have called for Ugandan authorities to issue arrest warrants for twelve MTN officials – mainly based in South Africa, rather than Uganda – for failing to attend pre-trial proceedings.
Moreover,at the beggining of 2012,MTN Uganda had been targeted by a scam, costing the company ‘billions of shillings’ (one billion Ugandan shillings =USD 400,000). According to IT News Africa which cited a statement released by the company, the scam involved two companies and may have exploited new features of MTN’s Mobile Money services. The police said that customers’ finances remained secure. The statement read: ‘MTN Uganda’s internal Money Laundering System recently detected incidents of internal fraud. The police were notified and are conducting investigations into the extent of the fraud, which restricts us from providing any specific details.’Did the investigation come to a meaningful conclusion?
23rd november 2012,MTN filed a complaint against one of Uganda’s chief magistrates after the group’s senior executives were summoned to face charges of fraud and tax evasion. MTN filed its grievance with the Ugandan judicial service, accusing the magistrate of unprofessional conduct, claiming that the 13 MTN officials called to appear before the court had not been made aware of the summons, only hearing of them through media reports.
A statement from the MTN Group said: ‘The complaint notes that the magistrate issued summons for the Directors and Executives of MTN to take a plea, yet the court record has no formal charges and the said summons were not reflected in the court record. It is further noted that the summons are dated 7th November 2012, a day after the same magistrate had transferred the case to the Director of Public Prosecutions to investigate the allegations….A perusal of the summons showed that, although the order to issue them was made on the 19th November 2012, they were dated 7th November 2012. There was no charge sheet on the record nor was there a record of proceedings before her between 6th November, when she pronounced her ruling in an open court with counsel for all parties present, and 19th November, when the order was supposedly issued.’
As previously noted by CommsUpdate, MTN’s executives are charged with evading UGX70 billion (USD26.68 million) in taxes. The accusations were made by former MTN employee, Naphtal Were, who had been sacked over suspicions that he had stolen from the company. Following an investigation, Were is now facing charges for defrauding MTN Uganda of USD5 million and attempted fraud of UGX600 million. In addition, Ugandan authorities recovered eleven solar power inverters – with an estimated value of UGX140 million – believed to have been stolen from the operator.
MTN’s complaint added: ‘For the Magistrate to have allowed that obviously ill-intentioned private person to obtain criminals summons in the manner she did, thus affording him the opportunity to have the same published to the world, knowing the negative consequences that portray, demonstrates gross recklessness and absolute indifference against our clientUSD
On 15/3/2013,The Director of Public Prosecutions (DPP) has withdrawn a case against South African-backed MTN Uganda accusing the operator of tax evasion. IT News Africa wrote that the charges were dropped on the basis that there was no evidence to prosecute. As previously had been reported by CommsUpdate, a group of MTN’s executives were charged with evading UGX70 billion (USD26.68 million) in taxes. The accusations were made by former MTN employee, Naphtal Were, who had been sacked over suspicions that he had stolen from the company.why and how was the case dropped?
On 10/9/2012,MTN Uganda,alleged that it had been ‘conned’ out of UGX9.5 trillion (USD3.772 billion) in undelivered network equipment. The daily monitor paper claimed that Ugandan authorities investigated a fraud case filed by South-African backed MTN against Threeways Shipping Group Ltd, with the courts blocking the accounts of the shipping company at the behest of investigators. Threeways has been accused of ‘submitting fictitious invoices totalling to over USD3.8 billion’ between 2009 and 2012 as shipping charges for network equipment that was paid for by MTN yet no goods had been shipped by the supplier. On the need to block the accounts of Threeways, police told the Anti-Corruption Court: ‘If the… accounts are not blocked, [Threeways] may transfer/withdraw the monies on the accounts and as such MTN Uganda Limited and the government of Uganda will lose a colossal amount of money which may be difficult to recover.’
Jeff Baitwa, the managing director of Threeways said that the company was not aware of any fictitious invoices given to MTN rather, Baitwa held that the cellco had queried two invoices ‘which we clarified and the matter went quiet and the next thing we see is the correspondences with the police.
 January 2018,a group of operators under the umbrella of the Wireless Applications and Service Providers Association of Uganda (WASPA-U) accused the mobile market leader of violations of regulations. They filed a petition which raised a number of charges against MTN, ranging from the under-declaring of revenues, to unethical business practices, anti-competitive behaviour, the illegal takeover of their businesses, violation of laws, and withholding of payments to local companies.



A new body had been set up on 17/8/2010 to protect the interests of mobile phone users in Uganda. A report from AllAfrica says that the Mobile Telephone Watchdog will help guard consumers against bad practice by the country’s cellular operators. Uganda’s wireless sector was home to more than 4.4 million subscribers at the end of June 2010 according to TeleGeography’s GlobalComms Database. MTN Uganda controlled around 46% of the market, with Zain Uganda claiming around 19%, and Uganda Telecom and Warid Telecom accounting for approximately 16% each. The remaining 3% is split between Orange Uganda and I-Tel.In 2012, Uganda Communications Commission (UCC) started follow up on its threats to impose penalties on wireless providers for failing to meet quality of service (QoS) standards. The watchdog announced that it would inform operators within the next two weeks if they were to be issued fines. Godfrey Mutabazi, UCC executive director said: ‘We started doing benchmarking and we are compiling the results and within the next two to three weeks, we shall release the results and once we approve the sanctions, then the fines will be imposed.’
UCC responded in February of that year to a ‘public outcry’ over the poor quality of service delivered by the nation’s cellcos: Mutabazi was quoted as saying that the UCC was ‘overwhelmed by the number of complaints from the public.’ The regulator’s QoS survey, conducted from May to September 2011, demonstrated that none of the country’s half-dozen operators met minimum standards for service quality. The report showed that, despite improvement from the regulator’s previous survey, several cellcos still blocked more than 10% of calls, far in excess of the 2% maximum stipulated by the UCC. Dropped calls were less problematic, with no operator prematurely disconnecting more than 5% of calls: nevertheless, all cellcos exceeded the 2% maximum in this field.
In March 2011 MTN threatened to terminate its interconnection agreement with UTL, preventing UTL customers from making calls to MTN customers and vice versa. The watchdog had threatened punitive measures against UTL should it fail to comply. Rival cellco Airtel Uganda has raised similar complaints against UTL, claiming UGX8 billion in unpaid interconnection fees, but no decision had yet been reached.

On 13/6/2011,Uganda Telecoms Limited (UTL) appealed to the High Court decision that ruled in favour of MTN Uganda regarding unpaid interconnection fees. A spokesperson for the telco has sought to clarify the situation and claims the amount under dispute was UGX5 billion (USD2.04 million), not UGX20 billion as reported by the Uganda Communications Commission (UCC).
As you may be knowing,. 69% of UTL was owned by the Libyan government through its investment vehicle, Libyan Africa Portfolio (LAP), with the remaining 31% owned by the Ugandan government. UN sanctions in March required the freezing of Libya’s assets for the duration of its on-going civil war, but in order to prevent the loss of jobs, the Ugandan government took over complete control of the company. Sanctions or fines imposed by the UCC on UTL in the short term will only undermine the government’s efforts to keep the telco afloat.

On 6th november 2014,Uganda’s Court of Appeal ordered incumbent fixed line operator Uganda Telecom Limited (UTL) to pay the full UGX6 billion (USD2.2 million) which is owed to cellco MTN Uganda for unpaid interconnect fees covering the period March to December 2007. The court has also ordered UTL to pay interest at 8% plus a late-payment fee of UGX100 million. UTL had already paid half of the money owed following an earlier legal challenge by MTN and was ordered to hand over the remaining UGX3 bilhadn, the court said.
By 18/9/2018,Uganda’s state-owned fixed and mobile operator Uganda Telecom Ltd (UTL) had lost a legal appeal in a long-running interconnect dispute with domestic rival MTN. The country’s Supreme Court had upheld earlier rulings by the Higher Court and Court of Appeals which ordered UTL to pay overdue interconnect fees to MTN, which have been owed since 2008. UTL was then to pay more than UGX6 billion (USD1.65 million) to MTN, including UGX3.4 billion in outstanding interconnect payments and the remainder to cover interest and fees.
The case centred on a 2007 agreement between UTL and the South Sudanese operator Gemtel. Prior to gaining independence from Sudan and without an international dialling code of its own, South Sudan requested permission to use Uganda’s international code of +256. MTN classified Gemtel calls as local as the customer dialled a local number, whilst UTL defined them as international(you must take a good note here). For the period March to December 2007, MTN invoiced UTL UGX6.5 billion for interconnect fees, but UTL paid only UGX3.47 billion, based on the international interconnect fee of USD0.50 rather than the local tariff of UGX100.


On 14th march 2014,Ugandan consumer advocacy groups petitioned the government to protect the rights of telecoms customers at a meeting with the Uganda Communications Commission (UCC). A representative from the Uganda Consumers’ Protection Association (UCPA) called for subscribers to be compensated for poor quality of service (QoS), billing errors and other issues: ‘We demand for consumer redress by way of reasonable compensation of losses made by consumers arising from charges on unsolicited services [and] unsuccessful delivery of services.’ The spokesperson claimed that the current process for consumer complaints takes too long, and that there was no solution in place to tackle unsolicited messages and dropped or blocked calls. Other advocacy groups, meanwhile, complained about issues of unexplained charges, money transfers and fees for unsolicited services.
Representatives from telcos argued that the majority of issues were not their fault, blaming vandalism and theft for the QoS troubles: Uganda Telecom Ltd’s (UTL’s) chief executive noted that in 2013 the company’s fibre-optic backbone network was cut 1,500 times, whilst a senior official from Airtel added that it had had 106,000 litres of fuel stolen from its sites, in addition to cuts along its fibre network. MTN’s chief legal officer, Anthony Katamba claimed that it is the operators that lose out, rather than customers: ‘When there is a bad experience, the operator suffers more than the customer. We lose money,meaning that MTN was interested in money more than offering good services to ugandans. Operational environment has not been easy with power cuts, fuel stolen; access roads to sites are terrible. The supporting infrastructure impacts on our services.’
Upon receiving the petition, ICT minister Nyombi Thembo gave no indication of what action, if any, would be taken to address the issues raised, except to note that the government’s focus was no longer on affordability and availability, but on quality and privacy.

On 16th august 2018, authorities in Uganda asked MTN Group’s Ugandan unit to list some of its shares on the Uganda Securities Exchange (USE) as a condition for the renewal of its operating licence, which is due to expire in October. Reuters quoted the head of the Uganda Communications Commission (UCC), Godfrey Mutabazi, as having said that Ugandans should be able to own a stake in MTN Uganda, which has been operating in the country for 20 years. ‘We are evaluating the conditions of [the licence] renewal and that’s one of the points we are discussing,’ Mutabazi said referring to a possible USE listing. Further, when pressed on whether the condition was a requirement for extending MTN Uganda’s licence, he said, ‘that’s right’ and added that the firm had ‘not shown any resentment to that proposal’.
On 25/10/2012,MTN Uganda and its senior officials faced a tax evasion lawsuit, brought by a former employee charged with stealing from the company. The Daily Monitor cites the CEO of the cellco Mazen Mroue as saying: ‘In mid-September, MTN Uganda discovered suspicious supply chain payments made to several service providers. The MTN Group forensic team and Uganda police were engaged to investigate the suspicious transactions. This resulted in the charging of two staff members implicated in the investigation.’
Naphtal Were, one of the former employees involved accused of stealing an estimated USD4.1 million from the operator, has accused MTN’s bosses of evading payment of UGX70 billion (USD26.68 million) in taxes. Mroue dismissed Were’s allegations as ‘vague and baseless.’ Were’s lawyers have called for Ugandan authorities to issue arrest warrants for twelve MTN officials – mainly based in South Africa, rather than Uganda – for failing to attend pre-trial proceedings.
Moreover,at the beggining of 2012,MTN Uganda had been targeted by a scam, costing the company ‘billions of shillings’ (one billion Ugandan shillings =USD 400,000). According to IT News Africa which cited a statement released by the company, the scam involved two companies and may have exploited new features of MTN’s Mobile Money services. The police said that customers’ finances remained secure. The statement read: ‘MTN Uganda’s internal Money Laundering System recently detected incidents of internal fraud. The police were notified and are conducting investigations into the extent of the fraud, which restricts us from providing any specific details.’Did the investigation come to a meaningful conclusion?
23rd november 2012,MTN filed a complaint against one of Uganda’s chief magistrates after the group’s senior executives were summoned to face charges of fraud and tax evasion. MTN filed its grievance with the Ugandan judicial service, accusing the magistrate of unprofessional conduct, claiming that the 13 MTN officials called to appear before the court had not been made aware of the summons, only hearing of them through media reports.
A statement from the MTN Group said: ‘The complaint notes that the magistrate issued summons for the Directors and Executives of MTN to take a plea, yet the court record has no formal charges and the said summons were not reflected in the court record. It is further noted that the summons are dated 7th November 2012, a day after the same magistrate had transferred the case to the Director of Public Prosecutions to investigate the allegations….A perusal of the summons showed that, although the order to issue them was made on the 19th November 2012, they were dated 7th November 2012. There was no charge sheet on the record nor was there a record of proceedings before her between 6th November, when she pronounced her ruling in an open court with counsel for all parties present, and 19th November, when the order was supposedly issued.’
As previously noted by CommsUpdate, MTN’s executives are charged with evading UGX70 billion (USD26.68 million) in taxes. The accusations were made by former MTN employee, Naphtal Were, who had been sacked over suspicions that he had stolen from the company. Following an investigation, Were is now facing charges for defrauding MTN Uganda of USD5 million and attempted fraud of UGX600 million. In addition, Ugandan authorities recovered eleven solar power inverters – with an estimated value of UGX140 million – believed to have been stolen from the operator.
MTN’s complaint added: ‘For the Magistrate to have allowed that obviously ill-intentioned private person to obtain criminals summons in the manner she did, thus affording him the opportunity to have the same published to the world, knowing the negative consequences that portray, demonstrates gross recklessness and absolute indifference against our clientUSD
On 15/3/2013,The Director of Public Prosecutions (DPP) has withdrawn a case against South African-backed MTN Uganda accusing the operator of tax evasion. IT News Africa wrote that the charges were dropped on the basis that there was no evidence to prosecute. As previously had been reported by CommsUpdate, a group of MTN’s executives were charged with evading UGX70 billion (USD26.68 million) in taxes. The accusations were made by former MTN employee, Naphtal Were, who had been sacked over suspicions that he had stolen from the company.why and how was the case dropped?

 On 16/01/2019,Ugandan President Yoweri Museveni has said he is ‘astonished’ that the local telecoms regulator, the Uganda Communications Commission (UCC), has renewed the operating licence of MTN Uganda at a lower fee than originally announced. The firm has paid USD58 million for the ten-year renewal instead of the USD100 million fee which was set initially. The reduction has reportedly come after MTN said it would have to invest at least USD200 million to meet the conditions of a new national broadband policy, which aims to improve internet connectivity in rural areas.
A report from Reuters says President Museveni had written to the country’s ICT Minister and the Attorney General to say that he was ‘astonished’ by the UCC’s decision. He said that South African-owned MTN Uganda had ‘reaped vast profits, most of which have obviously been repatriated’. It has been suggested that MTN is required to list shares on the local bourse as part of the conditions for the renewal, though this has not yet been confirmed by the cellco.ditions of a new national broadband policy, which aims to improve internet connectivity in rural areas.
A report from Reuters says President Museveni has written to the country’s ICT Minister and the Attorney General to say that he was ‘astonished’ by the UCC’s decision. He said that South African-owned MTN Uganda had ‘reaped vast profits, most of which have obviously been repatriated’. It has been suggested that MTN is required to list shares on the local bourse as part of the conditions for the renewal, though this has not yet been confirmed by the cellco.
As you can read from above, Mtn's problems are not only of today's origin and can be traced from and in:
1.anti competitive behavior
2.evasion of taxes and internal fraud
3.violation of laws
4.withholding of payments to local companies
5unethical business practices
6.un declaration on revenues
7.poor services and uncertainties to consumers privacy/government privacy

Was MTN uganda involved in espionage, tax evasion,fraud? Wait for a through complete report about it tommorrow at 11am

Am wrtting down a complete document about  mtn uganda and its issues and how it has ended in espionage cases!!!just wait for it tomorrow.... Goodnight to all the readers

Sunday, February 17, 2019

Cable Compendium: a guide to the week’s submarine and terrestrial developmedevelopments

The government of the British overseas territory of Montserrat – which is part of the Lesser Antilles chain – is inviting all qualified companies to participate in a request for proposal (RFP) for the installation and operation of the Montserrat Submarine Fibre Optic Cable, with 6 March 2019 given as a deadline for submissions. Respondents are required to provide a turnkey system with initially lit minimum transmission capacity of 10Gbps, upgradeable to at least 10Tbps, connected to a destination (or destinations) with a liberalised telecommunications regulatory framework which offers competitive and reasonably-priced options for onward connectivity. Following a period of negotiations with the chosen supplier, construction of the cable system should commence in the first half of 2019. The island has been without international fibre-optic connectivity since the mid-1990s, when the eruption of the Soufriere Hills Volcano led to the decommissioning of the island’s only undersea cable connection, a branch of the East Caribbean Fibre System (ECFS). Denzil West, director of Montserrat’s Department of Information, Technology and eGovernment Services, said: ‘This project represents a significant step in improving Montserrat’s access and connectivity to the ultrafast international networks and positions Montserrat to attract new and different types of businesses on the island.’
Iceland’s Telecommunications Fund (Fjarskiptasjodur) and state-owned submarine cable operator Farice have signed a Desk Top Study (DTS) work agreement regarding the selection of landing sites for a new submarine cable dubbed IRIS scheduled to run from Iceland to Europe (Ireland and/or the UK), as well as project management for a seabed survey for the cable project. Under the proposed plan, the new cable will land in County Mayo in Ireland and London in the UK, crossing the Irish Sea via Dublin and north Wales. Farice is expected to start surveying the proposed route from the fishing town of Grindavik on Iceland’s southern peninsula to the Irish hamlet of Killala in 2019. TeleGeography notes that four systems currently land on Icelandic shores, namely CANTAT-3 (Iceland-Germany-Denmark), FARICE-1 (Iceland-Faeroe Islands-UK), DANICE (Iceland-Denmark) and Greenland Connect(Iceland-Greenland-Canada).
Georgian ISP Caucasus Online is reportedly planning to sell its submarine fibre-optic cable Caucasus Cable System, which links Poti (Georgia) on the eastern shore of the Black Sea with Balchik on the Bulgarian coast, reports www.arka.am. According to the unnamed sources, the system could be sold to an Azerbaijani company. The 1,200km Caucasus Cable System entered commercial services in November 2008.
The 827km Tonga Cable between Sopu (Tonga) and Suva in Fiji, which was damaged last week, could be repaired by 2 February, according to the operations team on board the cable repair ship Reliance. Matangi Tonga Online cited Tonga Cable CEO Edwin Liava’a as saying that work is underway to splice the cable, which will take up to 18 hours: ‘The work to splice the cable on Tonga’s side started this morning [1 February] … After the splice, several tests will be conducted which will take up to ten hours. By midday tomorrow the international submarine cable should be back online if there will be no major complications.’ The Reliance located the damaged section near Tongatapu on 29 January, with the cable found lying around 100 metres south-east off-course from where it was originally laid. The sole international service in the island nation is currently provided via a Ku-band satellite network, operated by Kacific Broadband Satellite, and supplied in-country by ISP EziNET.
Nepalese ISP Vianet Communications has chosen Ciena’s 6500 Packet-Optical Platform to improve intracity connectivity in Kathmandu and provide international connectivity between Nepal and other countries. Additionally, Ciena’s network management software will enable a greater level of control over Vianet’s network, providing end-to-end visibility of its services across all transport, switching and packet elements.
Bandwidth and Cloud Services (BCS) Group has signed a USD18 million long-term financing agreement with the European Investment Bank (EIB) for the expansion of its fibre-optic network in Eastern and Central Africa. According to a company press release, this includes the deployment of 4,850km of fibre-optic networks in Kenya, Rwanda, Uganda, Zambia and the Democratic Republic of the Congo (DRC). The project comprises of 3,850km of terrestrial fibre cables and around 1,000km of submarine cables in Lake Tanganyika (in Tanzania) and Lake Albert (Uganda and DRC).
Lastly, Hargray has announced an agreement to acquire Jacksonville-based Dark Fiber Systems. The announcement comes on the heels of Hargray’s announced acquisition of USA Communications’ Alabama assets and several other colocation facilities. Financial terms were not disclosed. The transaction is expected to close in the second quarter 2019. Hargray operates through two primary divisions: Hargray Communications operates the company’s incumbent networks, while Hargray Fiber operates a more than 2,000 route-mile fibre-optic network in cities throughout the Southeastern US.