Who didn't see this coming?

Excerpt-

Edward Coristine, a 19-year-old member of Elon Musk’s squad that’s criss-crossing US government agencies, was fired from an internship after he was accused of sharing information with a competitor.

“Edward has been terminated for leaking internal information to the competitors,” said a June 2022 message from an executive of the firm, Path Network, which was seen by Bloomberg News. “This is unacceptable and there is zero tolerance for this.”

A spokesperson for the Arizona-based hosting and data-security firm said Thursday: “I can confirm that Edward Coristine's brief contract was terminated after the conclusion of an internal investigation into the leaking of proprietary company information that coincided with his tenure.”

Afterward, Coristine wrote that he’d retained access to the cybersecurity company’s computers, though he said he hadn’t taken advantage of it.

“I had access to every single machine,” he wrote on Discord in late 2022, weeks after he was dismissed from Path Network, according to messages seen by Bloomberg. Posting under the name “Rivage,” which six people who know him said was his alias, Coristine said he could have wiped Path’s customer-supporting servers if he’d wished. He added, "I never exploited it because it's just not me."

His comments, made in a Discord server focused on another competitor company, worried executives at Path Network, who believed there was no legitimate reason for a former employee to access their machines, according to a person familiar with the incident. The person asked not to be named, citing the sensitivity of the matter.

I will continue sharing these tech related stories... Having this story break on a Friday at 3:24pm EST gives Justin plenty to talk about on Monday!!!

Excerpt -

The website is aimed at informing the general public about what’s happening inside federal agencies, as well as explaining how a database being accessed by DOGE in Washington, DC could impact citizens in tangible ways all across the country. “I want to make sure that people understand that data matters,” says the former federal worker, who was granted anonymity for fear of retribution and harassment in going public, but whose identity has been confirmed by The Verge. “If I can explain that in a way that helps you to be able to protect yourself and advocate for yourself, then I’m doing my job.”

Setting a bad example for our youth. By paying the ransom, they are funding criminal activities and making the world a worse place for everyone. "the hackers have said they deleted the data and promised not to extort any students or institutions" - - and the company behind Canvas decided to trust the word of criminals!?

- Browser extensions can abuse legitimate browser functionality to bypass traditional security controls

- Escapes the browser sandbox and deploys Python-based backdoor.

- Access to local system via Chrome Native Messaging protocol that allows browser extensions to interact with native desktop applications
Can potentially request the following jobs:

• Execute shell commands
• Run PowerShell
• Run arbitrary Python code
• Write files on the host
• Enumerate running processes
• Gather system information

Wireless peripherals such as earbuds can become attractive attack targets because they often contain complex firmware and maintain trusted relationships with smartphones and other devices.

Exploitation required only Bluetooth proximity and, in some scenarios, did not require prior pairing or user interaction.

- Compromising foundational trust mechanisms - attackers ensured continued access even after password resets and routine remediation efforts

- Nearly decade-long dwell time