Latest / Tech Talks With Kinsoft / NBN Co Data Breach - Sentap's Infrastructure Data Sale

Transcript

NBN Co Data Breach - Sentap's Infrastructure Data Sale · Tech Talks With Kinsoft

• 0:00
  Welcome to Tech Talks with Kinsoft. We're your
• 0:02
  guide through, well, the sometimes pretty complex
• 0:04
  work in tech. I'm your host. And today we were
• 0:07
  doing a deep dive. We're looking at something
• 0:09
  really fresh. An alleged incident reported just
• 0:12
  back on June 5th, 2025. It involves NBNCO. That's
• 0:16
  Australia's National Broadband Network. And honestly,
• 0:19
  it raises some pretty big questions because this
• 0:22
  is recent news, right? But you're probably not
• 0:24
  seeing it blasted across major news sites. And
• 0:26
  that's kind of the core of our deep dive today.
• 0:28
  Why might something like this potentially involving
• 0:31
  critical infrastructure not get wider public
• 0:33
  discussion immediately? What's that say about
• 0:35
  transparency, especially when it's a government
• 0:37
  linked body like NBNCO? The source here. is interesting
• 0:40
  to a platform called Dark Web Informer. So that
• 0:43
  tells you something straight away about where
• 0:44
  this info is surfacing. Exactly. So our mission
• 0:47
  today really is to walk you through what we know
• 0:49
  about this alleged incident and try to understand
• 0:51
  the implications, sure, but also peel back the
• 0:54
  layers on how this sort of information actually
• 0:56
  surfaces. Or maybe more importantly, why it sometimes
• 0:59
  doesn't hit the mainstream right away. It's all
• 1:01
  about understanding, you know, the life cycle
• 1:04
  of cyber threat intelligence, why that matters
• 1:05
  for you. OK, right. Let's unpack it then. The
• 1:08
  basic claim, according to the report from Dark
• 1:11
  Web Informer on June 5th, it points squarely
• 1:14
  at NBN Co., the National Broadband Network. The
• 1:17
  threat actor, the group or person claiming they
• 1:19
  did this, is called CENTAP. And the size of the
• 1:21
  data they claim to have. It's pretty staggering.
• 1:24
  306 gigabytes. Now, 306 gigs. I mean, that's
• 1:27
  a huge number, obviously. But when the report
• 1:29
  says sensitive infrastructure data, what does
• 1:32
  that actually mean? What kind of information
• 1:33
  are we potentially talking about here? Is it
• 1:35
  like truly critical stuff? Well, that's where
• 1:37
  it gets really fascinating and maybe a bit concerning.
• 1:39
  The specificity. It's not just like. General
• 1:42
  NBN files. The claim is the data is tied to specific
• 1:46
  technologies. Hybrid fiber coaxial, HFC, and
• 1:50
  fighter -to -the -curb FTTC projects. These are
• 1:53
  the actual methods used to connect millions of
• 1:55
  homes and businesses across Australia. HFC uses
• 1:58
  existing cable lines. FTTC brings fiber much
• 2:01
  closer. Okay, so the actual tech infrastructure.
• 2:03
  Precisely. And it gets even more specific than
• 2:05
  that. The report mentions specific regions, just
• 2:07
  in Queensland, apparently. Places like Bald Hills,
• 2:10
  Ashgrove. Albany Creek, Kenmore, Stafford. And
• 2:14
  Centap, the actor, claims this data is highly
• 2:16
  detailed, technical, and valuable. Valuable for
• 2:19
  analysts, researchers, and crucially, adversaries
• 2:22
  targeting telecom infrastructure. Right, adversaries.
• 2:24
  Yeah. So if this is true, we're not just talking
• 2:27
  about, say, customer names and addresses, although
• 2:30
  the source does mention PII, personally identifiable
• 2:33
  information, might be included in their general
• 2:36
  reports. We could be talking about the actual
• 2:37
  blueprints, network diagrams, maybe equipment
• 2:40
  details, possibly even physical locations for
• 2:43
  key infrastructure. It's like having an operational
• 2:45
  map of parts of the network. Highly valuable
• 2:48
  for anyone wanting to understand it, exploit
• 2:50
  it. Or maybe even disrupted. Wow. OK, that level
• 2:54
  of technical detail sounds, yeah, quite chilling.
• 2:57
  It's like the schematics for the nation's Internet
• 2:59
  backbone or parts of it anyway. But that just
• 3:01
  brings us right back to the big question, doesn't
• 3:03
  it? If it's potentially that sensitive information
• 3:05
  that adversaries would find incredibly useful.
• 3:07
  Why isn't this front page news? Why the apparent
• 3:10
  quiet from official channels? Yeah. And this
• 3:14
  is where understanding that information lifecycle
• 3:16
  is key. A lot of these alleged breaches, especially
• 3:20
  maybe involving critical infrastructure, they
• 3:22
  often pop up first on these private intelligence
• 3:25
  feeds. Dark Web Informer. Despite the name, it's
• 3:29
  not some hacker form itself. It's more like a
• 3:32
  specialized newswire for cyber threats. So it's
• 3:35
  a business. A subscription service. Exactly.
• 3:38
  Subscriber only. It's aimed at cybersecurity
• 3:40
  professionals, corporate security teams, government
• 3:42
  agencies, people who need early warnings. They
• 3:46
  aggregate intelligence, track leaks, provide
• 3:48
  alerts. The source itself mentions having thousands
• 3:51
  of posts, alerts, and unredacted threat feed.
• 3:55
  Even high -raise images as proof sometimes. Unredacted,
• 3:58
  so potentially sensitive stuff right there. Potentially,
• 4:00
  yes. Their own disclaimer notes reports may include
• 4:02
  unredacted personally identifiable information,
• 4:05
  PII. gathered from publicly available sources.
• 4:07
  But they also state very clearly it's for cybersecurity
• 4:10
  awareness and threat intelligence purposes only,
• 4:12
  and they condemn misuse. So you see this tiered
• 4:15
  flow of information, right? It starts with the
• 4:17
  threat actor making a claim, maybe on a dark
• 4:20
  web forum. Then it gets picked up by these private
• 4:23
  intelligence services like Dark Web Informer.
• 4:25
  And only then, maybe, possibly much later, does
• 4:28
  it filter through to wider public knowledge or
• 4:31
  get officially confirmed. So there's this whole
• 4:33
  hidden layer of information exchange happening
• 4:36
  before anything hits the public eye. Pretty much.
• 4:39
  And it exists because, well, the immediate needs
• 4:42
  of cyber defense teams often come first, before
• 4:44
  a full public announcement is feasible or even
• 4:47
  wise. Which brings us right back to NBN Co.,
• 4:50
  a government -linked entity, vital infrastructure.
• 4:54
  Why aren't they out there talking about this
• 4:56
  alleged breach? Is it strategic silence or something
• 5:00
  else? It feels uncomfortable, you know? It is
• 5:02
  uncomfortable and it highlights a real tension,
• 5:04
  a fundamental tension, actually. On one side,
• 5:06
  yes, a government body managing critical infrastructure.
• 5:09
  You expect transparency. The public has a right
• 5:11
  to know about potential risks. But on the other
• 5:13
  side, managing a major security incident, especially
• 5:16
  one that's still just alleged, is incredibly
• 5:18
  complex. Well, first, verification. Dark web
• 5:22
  claims aren't always true. Threat actors exaggerate.
• 5:25
  Sometimes they bluff entirely, announcing something
• 5:27
  prematurely before it's verified. That could
• 5:30
  cause needless panic. OK, fair point. It could
• 5:33
  also give the actual attackers, if they exist,
• 5:35
  way too much information about what NBN Co. knows
• 5:38
  or doesn't know. It could compromise an ongoing
• 5:41
  investigation. Think about it. Confirming a breach
• 5:44
  too early might show your hand. Revealing details
• 5:47
  could help other attackers. So there are genuine
• 5:49
  strategic reasons for maybe holding back information.
• 5:53
  at least initially. Absolutely. Verifying a claim
• 5:55
  like this takes time. It involves deep forensic
• 5:58
  work, internal checks, maybe liaison with intelligence
• 6:01
  agencies. During that whole process, maintaining
• 6:04
  a degree of strategic silence can be critical.
• 6:06
  It's a balancing act, a really difficult one.
• 6:09
  Public right to know versus operational security
• 6:11
  and investigation integrity. That makes the situation
• 6:14
  feel a lot more complex than just, why aren't
• 6:16
  they telling us? The source, Dark Web Informer,
• 6:19
  they rated this incident's severity as medium.
• 6:22
  What does that tell us? Does medium downplay
• 6:25
  the risk for national infrastructure? That medium
• 6:27
  rating is interesting, yeah. It likely suggests
• 6:30
  that, based on the initial assessment from the
• 6:32
  intelligence provider, the immediate widespread
• 6:35
  operational impact might not be seen as critical.
• 6:38
  Perhaps NBN's core systems aren't thought to
• 6:41
  be immediately compromised for disruption, or
• 6:43
  their defenses are considered robust enough to
• 6:45
  contain the immediate fallout. So not DEF CON
• 6:48
  1, maybe? Perhaps not for immediate network collapse,
• 6:51
  no. But... And this is a really big, big, but
• 6:53
  medium severity absolutely does not diminish
• 6:57
  the long -term strategic value of this kind of
• 6:59
  data if the breach is real. For an adversary,
• 7:02
  getting hold of detailed technical specs, HFC,
• 7:05
  FTTC project details, network layouts, that's
• 7:09
  gold. It's not about a quick hit. It's about
• 7:11
  reconnaissance. Building up intelligence for
• 7:13
  future, potentially much more targeted and effective
• 7:15
  attacks down the road. It's like intelligence
• 7:18
  gathering for a future campaign. Okay, so medium
• 7:20
  might relate to immediate operational risk, but
• 7:23
  the long -term strategic risk could still be
• 7:25
  very high. Precisely. And that's why understanding
• 7:27
  this whole picture is so important. Knowledge
• 7:29
  is valuable, but context is everything, right?
• 7:32
  This alleged incident, surfacing the way it did,
• 7:35
  it really underscores that critical information
• 7:37
  doesn't always come neatly packaged or through
• 7:39
  the channels you expect. You have to ask, who's
• 7:42
  reporting it? Why are they reporting it? Who's
• 7:43
  their audience? And what are the legitimate,
• 7:46
  complex reasons why an organization like NBN
• 7:49
  Co. might be navigating this carefully, balancing
• 7:51
  security, investigation, and that public right
• 7:54
  to know? forces you to think more critically
• 7:57
  about where information comes from and why some
• 8:00
  stories take time to emerge, or maybe never fully
• 8:03
  do. Understanding the source, like knowing this
• 8:07
  came via a specialized Intel platform, is key
• 8:10
  to evaluating it properly. This dive, I think,
• 8:13
  should definitely make you, our listeners, think
• 8:15
  about those different layers of information out
• 8:17
  there, and why some things, even really important
• 8:19
  things, might not hit the headlines immediately.
• 8:21
  It challenges you to look deeper. So, okay. We've
• 8:25
  walked through this alleged NBN Co. breach. The
• 8:28
  claim from Centap, 306 gigs of potentially sensitive
• 8:31
  HFC and FDTC data, the source being dark web
• 8:34
  informers sparking that whole discussion about
• 8:36
  why it wasn't more public and the really tough
• 8:38
  questions around transparency for government
• 8:40
  -linked critical infrastructure. It's a fascinating
• 8:42
  case study in how information flows or doesn't
• 8:45
  flow in our digital age. Thanks for taking this
• 8:47
  deep dive with us on Tech Talks with Kinsoft.
• 8:49
  Yeah, absolutely. And as we've kind of touched
• 8:51
  on throughout navigating this stuff, whether
• 8:53
  it's understanding these big potential threat
• 8:56
  landscapes like this MB &Co situation or just
• 8:59
  making sure your own digital security, your business's
• 9:02
  security. is up to scratch. It really requires
• 9:05
  staying informed and often getting expert help.
• 9:09
  Understanding the threats is always that crucial
• 9:11
  first step to building a proper defense. So for
• 9:13
  anyone listening who wants to discuss their own
• 9:15
  security posture or their IT needs in general,
• 9:18
  you can find a lot more information and support
• 9:20
  over at www .kinsoft .com .au. Definitely worth
• 9:24
  checking out. Keep asking questions, everyone.
• 9:26
  Keep thinking critically about the tech news
• 9:27
  you see and hear. And always consider the story
• 9:30
  behind the story. What else is moving beneath
• 9:31
  the surface? We'll be back soon with more deep
• 9:33
  dives right here on Tech Talks with Kinsoft.