Fortune

Security

<div class="cryptonews">
 <p class="is-style-lead">Experts from Aqua Security are calling for urgent attention to the public disclosure of Kubernetes configuration secrets.</p>
 <p>According to recent research, experts are warning that hundreds of source code projects and organizations are vulnerable to “ticking <a rel="noopener noreferrer nofollow" title="supply" href="https://thebittimes.com/tag/supply.html">supply</a> <a rel="noopener noreferrer nofollow" title="chain" href="https://thebittimes.com/tag/chain.html">chain</a> bomb.”</p>
 <p>Aqua analysts Yakir Kadkoda and Assaf Morag claim they found Kubernetes secrets in public repositories. They allow access to sensitive software development life cycle (SDLC) environments and pose a serious threat of <a rel="noopener noreferrer nofollow" title="supply" href="https://thebittimes.com/tag/supply.html">supply</a> <a rel="noopener noreferrer nofollow" title="chain" href="https://thebittimes.com/tag/chain.html">chain</a> <a rel="noopener noreferrer nofollow" title="attack" href="https://thebittimes.com/tag/attack.html">attack</a>.</p>
 <p>Those affected include two leading block<a rel="noopener noreferrer nofollow" title="chain" href="https://thebittimes.com/tag/chain.html">chain</a> firms and various other Fortune 500 companies that used the GitHub API to obtain all entries containing .dockerconfigjson and .dockercfg, which store credentials to access the container image registry.</p>
 <div class="cn-block-related-link">
  <svg class="cn-block-related-link__icon icon" aria-hidden="true"><use xlink:href="#"></use>
  </svg> <span class="cn-block-related-link__prefix"> You might also like: </span> Role of decentralization in ensuring security
 </div>
 <p>Of the 438 records are at risk of containing valid registry credentials, 203 records (around 46%) contained valid registry credentials.</p>
 <p>Of these, 93 passwords were manually set by individuals, as opposed to 345 computer-generated passwords. Moreover, almost 50% of the 93 passwords were considered weak. These included password, test123456, windows12, ChangeMe, and dockerhub.</p>
 <p>According to the latest data from&nbsp;DefiLlama, cybercriminals&nbsp;stole $1 billion in 75 <a rel="noopener noreferrer nofollow" title="attack" href="https://thebittimes.com/tag/attack.html">attack</a>s in 2023. This is significantly less than in 2022, when hackers lost $3.2 billion in 60 incidents. Now <a rel="noopener noreferrer nofollow" title="attack" href="https://thebittimes.com/tag/attack.html">attack</a>ers are committing small but frequent hacks. In just 11 of the 75 incidents recorded this year, cybercriminals stole more than $10 million, indicating that cybercriminals are committing smaller, more frequent thefts.</p>
 <div class="cn-block-related-link">
  <svg class="cn-block-related-link__icon icon" aria-hidden="true"><use xlink:href="#"></use>
  </svg> <span class="cn-block-related-link__prefix"> You might also like: </span> Staying safe in web3: your guide to dapps security
 </div> <span class="google-news-banner__label">Follow Us on Google News</span>
</div>
<p>Source: <a rel="noopener noreferrer nofollow" target="_blank" href="https://thebittimes.com/experts-warn-of-ticking-bomb-for-supply-chain-attack-tbt71496.html">https://thebittimes.com/experts-warn-of-ticking-bomb-for-supply-chain-attack-tbt71496.html</a></p>

Experts warn of ‘ticking bomb’ for supply chain attack

TheBitTimes

Other articles published on Nov 24, 2023

Binance Nears Settlement with SEC: Maximize Profits with BNB and BTCS ICO-End Bonus Event

Cryptocurrency Scammers Target Paradigm Co-Founder Matt Huang

Spot Bitcoin ETF news driving prices, Chainlink, Meme Moguls, and XRP may benefit

Sam Bankman-Fried’s ‘Mackerel Currency’ Creates A Stir In Prison

Expert Analysis Unveils Potential Turning Points for $INJ and $MATIC

Mina Coin: Latest Update and Price Analysis

Join our free newsletter for daily crypto updates!