Lapsus$ back? Researchers claim extortion gang attacked software consultancy Globant Extortion gang Lapsus$ may to be back at work, despite the arrest of seven alleged operatives. VX-Underground – an organization that analyzes malware samples and trends – has shared evidence it states was sourced from security researcher Dominic Alvieri, detailing an intrusion of Luxembourg-based software development …
In other news, Anonymous successfully deletes 65 Tb of data from Russian Civil Aviation Authority (Rosaviatsia) sending their system back to basic, pen and paper.
And no, there are no backups: No backup of these data exists due to lack of funds allocated by Russia's Ministry of Finance.
It ought to be clear that by outsourcing you're increasing your attack surface. What might not be quite as clear is that if the outsourcer also outsources some aspect of its operations it's increasing your attack surface still further. What's entirely unclear is why a corporation in the business of managing clients' security doesn't recognise the significance of a security issue when it's pushed under their nose.
If even "skiddies" as you mockingly call them can hack NVIDIA, and some other major players in the IT industry, what can the state-sponsored entities do?
They should be thanking Lapsus$ for exposing their piss poor security practices.
That said, guessable admin passwords, admin password reuse, domain admin passwords in LastPass? WTF?!?
Where is MFA? Hardware tokens? Smart cards?
Oh I know, IT is just a cost center for beancounters, a go-to OU for budget cuts and outsourcing, at least until shit like this hits the fan.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
