Tag Archive for: hours

US Department of Labor finds Salt Lake City restaurant supply company illegally employed 22 minor-aged workers beyond hours allowed

/in


SALT LAKE CITY – A federal investigation has found a Salt Lake City restaurant supply company allowed 22 employees – ages 14 and 15 – to work as many as 46 hours per workweek, and to begin work after midnight – both illegal practices under child labor laws. 

Investigators with the U.S. Department of Labor’s Wage and Hour Division found Specialty Consulting Services LLC – operating as Standard Restaurant Supply – violated child labor work hours standards of the Fair Labor Standards Act. The employer also failed to keep accurate time records including the date of birth for one minor-aged employee, in violation of the FLSA’s recordkeeping  provision.

The division assessed $16,595 in penalties to resolve the child labor violations.

The investigation follows a March 2022 announcement by the division’s Southwest Region reminding Salt Lake City-area employers of the importance of complying with federal child labor laws, and its stepped up enforcement efforts. 

“Minors as young as 14- and 15-years-old not only worked beyond permitted hours, but more than half of them were employed in violation of the Fair Labor Standards Act by being allowed to work long shifts often exceeding eight hours,” explained Wage and Hour Division District Director Kevin Hunt in Salt Lake City. “Our investigators continue to see an increase in child labor violations in several industries. We will take vigorous action whenever we discover young workers’ safety and well-being are being jeopardized by employers who fail to follow the law.”

Federal labor law prohibits the employment of workers under the age of 14 in non-agricultural settings. 14- and 15-year-olds must work outside of the hours of school and cannot work:

  • More than 3 hours on a school day, including Friday.
  • More than 18 hours per week when school is in session.
  • More than 8 hours per day when school is not in session.
  • More than 40 hours per week when school is not in session.
  • Before 7 a.m. or after 7 p.m. on any day, except from June 1 through Labor Day, when nighttime work hours are extended to 9 p.m.

“We urge employers in the region to gain a full understanding of child labor regulations and ensure…

Source…

Despite word of ‘radical malware attack,’ it took hours to shut down Suffolk’s computer network

/in


The email sent at 11:18 a.m. on Sept. 8 from a top computer manager at the Suffolk County Clerk’s Office to the Bellone administration’s technology commissioner was as blunt as it was chilling.

“We are currently experiencing a radical malware attack and we shut down all outside access to the systems until such time as we are safe,” said the email, which was obtained by Newsday.

Yet, more than four hours had elapsed before the rest of the county’s computer networks, encompassing nearly 600 servers from Hauppauge to Riverhead, were severed from access to the outside world, starting the clock on the county’s broader response to one of the most devastating ransomware attacks faced by a U.S. municipality of any size in the history of such cyberattacks.

A series of emails obtained by Newsday from the day of the attack and the day prior show that awareness of the attack had been slowly dawning on technology staff and officials in the 24 hours preceding the shutdown. Among those was the actual ransomware message, first circulated at 10:53 a.m. on Sept. 8, 25 minutes before the clerk’s office shut down.

WHAT TO KNOW

  • More than four hours passed between the time Suffolk County was warned of a “radical malware attack” and most of the county’s computer networks were shut down.
  • Emails obtained by Newsday show that awareness of the attack had been slowly dawning on technology staff and officials in the 24 hours preceding the shutdown.
  • The cyberattack on Suffolk could be one of the most expensive attacks in U.S. history on municipal governments.

Whether the four-hour lag in shutting down all county computer networks caused a sizable loss of data is open for debate. One tech expert called it “significant,” but said that considerably more data could have been taken in the days and weeks before the Black Cat/ALPHV message was first noted in a 10:53 email. Suffolk Comptroller John M. Kennedy Jr. said it likely made the difference between the clerk’s unscathed backup data and the impacts that continue to ripple through Bellone administration operations. 

The emails obtained by Newsday provide a limited look inside the attack at the time it was happening, chiefly…

Source…

Microsoft’s third mitigation update for Exchange Server zero-day exploit bypassed within hours

/in


Microsoft has published its third update for its mitigation of an exploit abusing two zero-day vulnerabilities in Microsoft Exchange Server.

It marks the latest step towards providing a fix for the exploit, dubbed ‘ProxyNotShell’, in what has been a confusing week for system admins attempting to understand the threat.

Security researcher Kevin Beaumont highlighted on Friday that there is already a bypass for the Microsoft-provided mitigation. It means every one of the company’s attempts to prevent the exploit from harming customers has been circumvented within hours of publication.

The issue is in the way Microsoft’s signatures detect the exploit. Signatures monitor the w3wp.exe internet information services (IIS) module but for customers of Windows Server 2016 and above, w3wp.exe is excluded automatically by Exchange Server when IIS is installed.

“The only way to correct this is to turn off automatic exclusions,” he said, but Microsoft states explicitly in its documentation to not do this.

The original vulnerability disclosure for the ProxyNotShell exploit was atypical in nature and the information regarding potential fixes has been fragmented and confusing to follow for many. 

Discovered last week by security researchers at Vietnam-based company GTSC, the pair of zero-days has received a number of attempted fixes – the first of which was bypassed “easily”.

GTSC said in its report that it had noticed in-the-wild exploitation of both vulnerabilities for at least a month before publishing its findings.

The security issues are related to, but different from, the ProxyShell exploit which was developed in 2021 and are not protected by the patch Microsoft provided for ProxyShell that year. 

Tracked as CVE-2022-41040 and CVE-2022-41082, they each received a CVSSv3 severity score of 8.8/10. Microsoft Exchange versions 2013, 2016, and 2019 are affected.

Exploitation requires access to an authenticated user account but initial tests indicated that any email user’s account, regardless of the level of privileges they had, could be used to launch an attack. 

Microsoft Exchange Server customers are advised to monitor the official mitigation page and apply new ones as they become…

Source…

Stock brokers to report cyber threats within 6 hours of detecting them: Sebi

/in


Market regulator Sebi has asked stock brokers and depositories participants to report all cyber attacks, threats and breaches experienced by them within six hours of detecting such incidents.

The incident will also be reported to the Indian Computer Emergency Response team (CERT-In) in accordance with the guidelines issued by CERT-In from time to time, Sebi said in a circular.

Additionally, the stock brokers and depository participants, whose systems have been identified as ‘protected system’ by National Critical Information Infrastructure Protection Centre (NCIIPC) will also report such incidents to NCIIPC.

“All cyber attacks, threats, cyber incidents and breaches experienced by stock brokers/ depositories participants shall be reported to stock exchanges/ depositories and Sebi within six hours of noticing/ detecting such incidents or being brought to notice about such incidents,” Sebi said in the circular.

The quarterly reports containing information on cyber attacks, threats, cyber incidents and breaches experienced by the stock brokers and depository participants and measures taken to mitigate the vulnerabilities, including information on bugs vulnerabilities, threats that may be useful for others, will have to be submitted to the exchanges and depositories within 15 days from the end of every quarter.

Earlier this month,  the capital markets regulator tweaked the cyber security and cyber resilience framework for asset management companies (AMCs) and mandated them to conduct a comprehensive cyber audit at least twice in a financial year.

AMCs have been asked…

Source…