informatique et high-tech (les meilleures news) %) - Page 1252

US sues ex-Accenture manager over Army cloud security claimswww.theregister.com: Justice Department alleges federal auditors were misled over compliance with FedRAMP and DoD requirements

The US is suing a former senior manager at Accenture for allegedly misleading the government about the security of an Army cloud platform.

Danielle Hillmer, 53, of Chantilly, Virginia, is accused of deceiving auditors over the capabilities of a service the government commissioned in 2017.

The US alleges that between March 2020 and November 2021, Hillmer obstructed federal auditors and falsely represented the security of the company's cloud platform, which was used by other government customers beyond the Army.

(...)

The DoD has its own risk management framework with Impact Levels 4 and 5 representing the highest levels of security. IL4 requires systems to meet different criteria, ranging from FedRAMP Moderate, FedRAMP High, and DoD-specific controls, while IL5 is the highest level available for unclassified information.

Accenture's contract was worth around $30 million in total, the court documents showed, and required a DoD Impact Level 4 assessment in order to fulfill it.

Hillmer allegedly filed an application to the Joint Authorization Board responsible for administering FedRAMP to raise the platform's compliance level from Moderate to High. The US claimed Accenture would have used this to gain DoD IL5 accreditation.

This application allegedly contained various falsehoods and misleading statements about the platform's security.

"Among other things, Hillmer knew the platform had not implemented required security controls related to access control, incident response, and continuous monitoring, including auditing, logging, monitoring, and alerting," the indictment reads.

"Hillmer also knew customer environments were not managed, monitored, governed, and secured as represented in the platform's system security plan."

Hillmer allegedly did this despite the numerous voices from inside the company, and those from outside cybersecurity consultants, informing her that the platform was not compliant with FedRAMP High requirements.

North Korean infiltrator caught working in Amazon IT department thanks to lag — 110ms keystroke input raises red flags over true location
Tom's Hardware

A North Korean imposter was uncovered, working as a sysadmin at Amazon U.S., after their keystroke input lag raised suspicions with security specialists at the online retail giant. Normally, a U.S.-based remote worker’s computer would send keystroke data within tens of milliseconds. This suspicious individual’s keyboard lag was “more than 110 milliseconds,” reports Bloomberg.

Amazon is commendably proactive in its pursuit of impostors, according to the source report. The news site talked with Amazon’s Chief Security Officer, Stephen Schmidt, about this fascinating new case of North Koreans trying to infiltrate U.S. organizations to raise hard currency for the Democratic People’s Republic of Korea (DPRK), and sometimes indulge in espionage and/or sabotage.

However, Amazon’s success can be almost entirely credited to the fact that it is actively looking for DPRK impostors, warns its Chief Security Officer. “If we hadn’t been looking for the DPRK workers,” Schmidt said, “we would not have found them.”

With this company policy explained, a blip on the Amazon security radar was caused earlier this year when a new sysadmin’s Amazon laptop monitor alerted security personnel about unusual behavior.

Amazon security experts took a closer look at the flagged ‘U.S. remote worker’ and determined that their remote laptop was being remotely controlled – causing the extra keystroke input lag. Schmidt emphasizes that good-quality security software was key to this investigation.

It turns out that the DPRK had access to this Amazon laptop located in Arizona. A woman found to be facilitating this fraud on behalf of North Korean imposter workers was sentenced to several years in prison earlier this year.

"I think we're looking at the peak in 2026," he said, adding that even then he only expects DRAM prices to settle in 2027 before rising again in 2028.

So what's to blame for the sky-high memory prices? Well, as you might have already guessed, it's AI. But it's not the full story. Timing is also a factor.

According to Sanders, the AI boom kicked off at what was very possibly the worst time for memory vendors. "This demand started in the Valley for the DRAM industry. That makes financially trying to build additional capacity really challenging," he said. "If you're rushing, the time to bring additional capacity online is about three years. It's a quirk of bad timing that's led to the circumstances that we're in now."

MongoDB Unauthenticated Attacker Sensitive Memory Leak

Critical MongoDB Memory Leak

The Situation: A major vulnerability allows unauthenticated attackers to remotely leak sensitive data from MongoDB server memory. No login is required.

CVE: CVE-2025-14847

The Story: A flaw in zlib compression allows attackers to trigger information leakage. By sending malformed network packets, an attacker can extract fragments of private data.

Brunni (./37553) :
Mais c'est un bon rappel qu'il faut faire gaffe aux extensions que tu installes.

The certificate that expired is used to secure inter-process communications.

Brunni (./37558) :
Ouais je comprends, mais en pratique les gens que j'associe à ce genre de préoccupations sont toujours les plus désagréables que je connaisse En pratique si c'est pour le lancement d'un logiciel je ne vois pas franchement l'intérêt que ça a de blinder comme ça.