Ghosts in the Code
Attackers used stolen GitHub logins to slip fake "security audit" files into developers' projects and tried to pull out thousands of secrets.
Key terms
AP Cybersecurity alignment
- 2.1.C.3In the initial-access phase of an attack, adversaries establish a foothold on the target’s computer, often through social engineering or compromised or weak credentials.Learning objective: Describe the phases of a cyberattack.
- 2.1.C.6In the taking-action phase of an attack, adversaries act on their objectives by collecting targeted data, exfiltrating it, and disrupting services or destroying data.Learning objective: Describe the phases of a cyberattack.
- 2.1.E.4Risk mitigation implements security controls to reduce the likelihood or impact of a risk.Learning objective: Identify strategies for managing risk.
AP Networking alignment
- 4.1.A.3When confidentiality is compromised, systems are vulnerable to having sensitive data exposed or stolen. A breach of confidentiality can be identified by: • unauthorized access • network traffic showing exfiltration of…Learning objective: Identify evidence of compromised confidentiality, integrity, or availability.
- 4.1.A.4When integrity is compromised, systems may contain false or inaccurate data. A breach of integrity can be identified by: • unauthorized data changes • inconsistencies in logs • unauthorized software installations • corruption…Learning objective: Identify evidence of compromised confidentiality, integrity, or availability.