News for hackers. Stuff that matters.
Re:Active North Korean campaign targeting security researchers by chaps on Thursday September 07, 2023 @01:51PM (#37422837)
Security researchers often have the most access to stuff at big companies.
Re:Active North Korean campaign targeting security researchers by 13of40 on Thursday September 07, 2023 @01:58PM (#37422944)
I don't know about that. I work in security, as a service to customers, but we have a running gag about "the real security people" who give you a phone call if you accidentally step off the path on your work machine.
Re:Active North Korean campaign targeting security researchers by chaps on Thursday September 07, 2023 @02:19PM (#37423297)
I don't work in security anymore, but when I did, access tended to be... loose. Outside of security, there hasn't been a single job (of quite a few) where I didn't have root access.

At one of the hosting companies I worked at -- for example -- I was able to download the root password of every linux host and the domain password for every windows host as a proof of concept for a project. Nobody told me to stop and I ended up telling the manager of the internal SOC that it was possible. He was pretty floored. Apparently they setup monitoring for single queries of passwords, but since my queries returned more than one result, it wasn't caught.

So yeah. Lots of access.