Skip to main content

Don't want your Kubernetes Windows nodes hijacked? Patch this hole now

3 months 2 weeks ago
SYSTEM-level command injection via API parameter *chef's kiss*

A now-fixed command-injection bug in Kubernetes can be exploited by a remote attacker to gain code execution with SYSTEM privileges on all Windows endpoints in a cluster, and thus fully take over those systems, according to Akamai researcher Tomer Peled.…

Jessica Lyons

FBI: North Korean IT Workers Steal Source Code To Extort Employers

3 months 2 weeks ago
The FBI warned this week that North Korean IT workers are abusing their access to steal source code and extort U.S. companies that have been tricked into hiring them. From a report: The security service alerted public and private sector organizations in the United States and worldwide that North Korea's IT army will facilitate cyber-criminal activities and demand ransoms not to leak online exfiltrated sensitive data stolen from their employers' networks. "North Korean IT workers have copied company code repositories, such as GitHub, to their own user profiles and personal cloud accounts. While not uncommon among software developers, this activity represents a large-scale risk of theft of company code," the FBI said. "North Korean IT workers could attempt to harvest sensitive company credentials and session cookies to initiate work sessions from non-company devices and for further compromise opportunities." To mitigate these risks, the FBI advised companies to apply the principle of least privilege by disabling local administrator accounts and limiting permissions for remote desktop applications. Organizations should also monitor for unusual network traffic, especially remote connections since North Korean IT personnel often log into the same account from various IP addresses over a short period of time.

Read more of this story at Slashdot.

msmash

Walgreens Replaced Fridge Doors With Smart Screens. It's Now a $200 Million Fiasco

3 months 2 weeks ago
Walgreens Boots Alliance has ended a $200 million digital display venture with startup Cooler Screens after widespread technical failures and poor revenue, removing thousands of smart screens from its store freezer doors [non-paywalled link]. The screens, which displayed product information and ads, frequently crashed, showed incorrect inventory, and occasionally caught fire, Bloomberg reports. Cooler Screens CEO Arsen Avakian cut data feeds to over 100 Chicago-area stores in December 2023 during a contract dispute, prompting Walgreens to obtain a restraining order. Walgreens completed removal of 10,300 screens from 700 stores in August 2024, replacing them with traditional glass doors. The screens generated just $215 per door annually, less than half the contractual minimum, according to Walgreens. Nearly $50 million worth of custom-made screens now sit unused in a Texas warehouse.

Read more of this story at Slashdot.

msmash