Author: HackWatchit
President Trump last week revoked security clearances for Chris Krebs, the former director of the Cybersecurity and Infrastructure Security Agency (CISA) who was fired by Trump after declaring the 2020 election the most secure in U.S. history. The White House memo, which also suspended clearances for other security professionals at Krebs’s employer SentinelOne, comes as CISA is facing huge funding and staffing cuts. Chris Krebs. Image: Getty Images. The extraordinary April 9 memo directs the attorney general to investigate Chris Krebs (no relation), calling him “a significant bad-faith actor who weaponized and abused his government authority.” The memo said the…
A Pennsylvania man has been charged with attempted murder, terrorism and other offenses after a fire at the Governor’s Residence in Harrisburg forced Gov. Josh Shapiro and his family to evacuate the home early Sunday morning, according to court documents filed in Dauphin County. Cody Balmer (Photo:Pennsylvania State Police) Officials said Cody Balmer, 38, hopped a fence and intentionally set a fire at the residence early on Sunday, April 13, while Shapiro and his family were home. Balmer, of Harrisburg, was charged Monday with criminal homicide/attempted murder, terrorism, aggravated arson and more. Balmer was arraigned on the charges on Monday…
Just days after the United States was implicated in launching a series of cyberattacks on the telecom sector under the guise of the “Volt Typhoon” campaign, China has leveled direct accusations against the U.S. National Security Agency (NSA) for conducting advanced cyberattacks on critical Chinese infrastructure. This marks a dramatic shift in the narrative, as China—often the target of similar allegations in the past—now asserts itself as a victim of U.S. cyber aggression. In a notable escalation, China’s state-run media outlet Xinhua has named three NSA agents in connection with the attacks. These individuals—Robert Snelling, Stephen Johnson, and Katheryn Wilson—are…
Beau Bullock // Overview On offensive engagements, such as penetration tests and red team assessments, I have been seeing inconsistencies in how MFA is applied to the various Microsoft services. Across Microsoft 365 and Azure, there are multiple endpoints. These endpoints can all be configured under different Conditional Access policy settings, which sometimes lead to variations in how MFA is applied. An organization that is trying to prevent single-factor access to email and/or Azure may need to double-check their configurations to ensure MFA is enforced on all access portals. To help both offensive operators and defenders check for MFA coverage…
Organizations are fixing less than half of all exploitable vulnerabilities, with just 21% of GenAI app flaws being resolved, according to Cobalt. Big firms take longer to fix pentest issues 94% of firms view pentesting as essential to their program. This captures the assurance role of pentesting and reflects the reality that most breaches don’t occur because the victim had no defenses. Rather, the defenses they had weren’t as solid as they thought.It’s probably no surprise to learn that 91% of respondents chose compliance as a major reason why they do pentests. What may surprise some is that 92% say…
Car rental giant Hertz Corporation warns it suffered a data breach after customer data for its Hertz, Thrifty, and Dollar brands was stolen in the Cleo zero-day data theft attacks. “On February 10, 2025, we confirmed that Hertz data was acquired by an unauthorized third party that we understand exploited zero-day vulnerabilities within Cleo’s platform in October 2024 and December 2024,” reads the Hertz data breach notification. “Hertz immediately began analyzing the data to determine the scope of the event and to identify individuals whose personal information may have been impacted.” The company says that the data varies per individual…
Malicious NPM packages target PayPal users Pierluigi Paganini April 14, 2025 Threat actors deploy malicious NPM packages to steal PayPal credentials and hijack cryptocurrency transfers. Fortinet researchers discovered multiple malicious NPM packages that are used to target PayPal users. The packages were uploaded to the repository in early March by a threat actor known as tommyboy_h1 and tommyboy_h2, and were used to steal PayPal credentials and hijack cryptocurrency transfers. “Using PayPal-related names helps these malicious packages avoid detection, making it easier for attackers to steal sensitive information. By including “PayPal” in the name of the malicious packages, such as oauth2-paypal and buttonfactoryserv-paypal, the attackers also create a false…
Slides They say it “takes a village” to help raise a child… well, it also takes a village to help raise an infosec professional. With so many technologies, techniques, and tools and the need for soft-skills and the ability to navigate different types of relationships, we all need help. That’s where a formal mentor can be your guide into the unknown. We ALL can benefit from being mentored and being a mentor. In this live Black Hills Information Security (BHIS) webcast, we’ll discuss:– How to know if you need a mentor– How to find a mentor– How to be a…
Trend Micro found major flaws in the NVIDIA Container Toolkit and Docker, risking container escapes, DoS attacks and AI infrastructure. Users should audit setups and apply fixes. Trend Micro Research has recently exposed a critical security vulnerability affecting the NVIDIA Container Toolkit and Docker and threatening systems utilizing these technologies. The research, shared with Hackread.com, indicates that this issue is caused by a previously issued security update by NVIDIA in September 2024, intended to address a vulnerability identified as CVE-2024-0132 within the NVIDIA Container Toolkit, which was incomplete. This oversight leaves systems susceptible to probable container escape attacks. Trend Micro’s…