3 ms·
> How many ops teams out there would notice if you pwned oneof their lappys Why are their lappys on the internet? Aren't we discussing online vulnerabilities?
by vacri 10y ago
> How many ops teams out there would notice if you pwned oneof their lappys
Why are their lappys on the internet? Aren't we discussing online vulnerabilities?
After all, if you pwn an admin-credentialled computer, you can do all sorts of damage in any but the most locked-down shop. Puppet has little to do with it per se - it's the privileges an ops laptop will have that matters.
- cyberpunk 10y agoWhy is a laptop on the internet? I mean, it's much easier to pwn an employee laptop and then use that to get everywhere then it is owning breaking into an infra over the internet... Even if you can't spearphish 'em; several beers at a meetup or three followed by a subtle rpi install when you're somewhere useful usually has better results. So I've.. Been told. (edit: The point was though that in almost all targets, all you need is commit rights to a single repo to own everything; so you don't even need a sysadmin just a dev... Hell, PM's and BA's sometimes even have commit rights...)