35 matches found
CVE-2020-8828
CVE-2020-8828 affects Argo CD (v1.5.0 and earlier) where the default admin password is set to the argocd-server pod name. This creates privilege-escalation risk for insiders with cluster or log access due to Argo’s privileged roles. The impact is described as a privileged-escape scenario for atta...
CVE-2020-8828
As of v1.5.0, the default admin password is set to the argocd-server pod name. For insiders with access to the cluster or logs, this issue could be abused for privilege escalation, as Argo has privileged roles. A malicious insider is the most realistic threat, but pod names are not meant to be ke...
Twitter Insiders Allegedly Spied for Saudi Arabia
Hackers are one thing. But too few companies take the threat of an inside job seriously enough...
Pakistani Man Bribed AT&T Insiders to Plant Malware and Unlock 2 Million Phones
United States federal government has charged a Pakistani national for bribing employees at AT&T telecommunication company over a period of five years to help unlock more than 2 million phones and plant malware on the company's network. Muhammad Fahd, a 34-year-old man from Pakistan, was arrested ...
Report: Nearly Half of Security Professionals Think They Could Execute a Successful Insider Attack on Their Organization
As potential threats and entry points into organizations’ databases keep growing, so does the amount of money folks are throwing at detecting and actioning insider threats. In fact, the ballooning amount of money being spent on cybersecurity overall clearly highlights the seriousness with which...
This Malware Can Transfer Data via USB Emissions from Air-Gapped Computers
Air-gapped computers that are isolated from the Internet or other networks and believed to be the most secure computers on the planet have become a regular target in recent years. A team of researchers from Ben-Gurion University in Israel has discovered a way to extract sensitive information from...
EU Struggles to Determine Growing Cost of Cyberattacks
After painstakingly calculating the true cost of cybercrime in the European Union researchers conclude it’s nearly impossible to come up with hard numbers. In a study released this week by the European Union Agency For Network And Information Security ENISA researchers assert that it’s vitally...
VS Code Extension Persistence
This module installs a malicious VS Code extension into the target's VS Code extensions directory. The extension executes the payload each time VS Code is launched, providing persistent code execution. Supports VS Code, VS Code Insiders, VSCodium, VS Code Server, and Cursor. Tested against 1.120....
Verizon DBIR Analysis: Insiders Often Complicit in Breaches of Intellectual Property
Verizon has further dissected breach data from its annual Data Breach Investigations Report DBIR and built a profile of intellectual property theft that points to a disturbing combination of factors leading to successful infiltrations by cybercriminals, competitors, hacktivists and nation-state...
As Uncle Sam Cracks Down on Leaks, A Look At Ten Infamous Insiders
In the wake of Cablegate, the release of hundreds of thousands of pages of confidential diplomatic cables by the whistle blower site Wikileaks, the Obama Administration is cracking down on loose data management practices of the type that made Cablegate possible. But could you spot a malicious...
WikiLeaks and Corporate Security: Lessons from Recent Data Leaks
WikiLeaks' release of secret government communications should serve as a warning to the nation's biggest companies: You're next. Computer experts have warned for years about the threat posed by disgruntled insiders and poorly crafted security policies that give too much access to confidential dat...
DARPA Project CINDER Targets Insider Threats
The U.S. military is looking for new ways to identify malicious insiders and stop them from operating from within government and military networks, which it assumes have already been compromised. The Defense Advanced Research Projects Agency DARPAhttp://www.darpa.mil/ this week issued a call for...
Countrywide Hit By Suit on Data Breach
Customers of Countrywide Financial have filed a class-action lawsuit over the 2008 data breach that enabled company insiders to steal and sell their personal information. Read the full article. Dark Reading...
