The Daily Index — Monday, March 17, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

A DOGE STAFFER BROKE TREASURY POLICY BY EMAILING UNENCRYPTED PERSONAL DATA

A 25-year-old DOGE staffer violated Treasury policy by sending an unencrypted spreadsheet with personal data to Trump officials. Marko Elez, who previously worked for Musk's companies, had been "mistakenly" granted access to Treasury systems before resigning in February due to racist posts. He was rehired at the Social Security Administration despite ongoing litigation.

theverge.com · 2 min

TLDR InfoSec

GITHUB ACTION TJ-ACTIONS/CHANGED-FILES SUPPLY CHAIN ATTACK: EVERYTHING YOU NEED TO KNOW

The tj-actions/changed-files GitHub Action repository was compromised by an attacker posing as the Renovate bot. The attacker added a malicious payload that caused the CI runner to dump its memory into the Actions work log and redirected all tags to include this payload. Sensitive data in GitHub secrets for this action can be visible in public repos, but the impact on private repositories is more limited.

wiz.io · 5 min

TLDR InfoSec

GUARD YOUR CODEBASE: PRACTICAL STEPS AND TOOLS TO PREVENT MALICIOUS CODE

Apiiro researchers found that targeting specific coding anti-patterns enabled them to detect malicious packages with a 94.3% success rate in Python and 88.4% in npm. They focused on obfuscated code and dynamic code execution and have released Semgrep rules for detection.

apiiro.com · 10 min

TLDR InfoSec

HIERARCHY OF NEEDS

Swannman's Hierarchy of Needs Pyramid model outlines 10 essential layers for establishing effective security functions, with threat hunting as a specialized function at the top. The Hierarchy of Needs aids organizations in planning and assessing incident response capabilities by identifying advanced metrics for complex questions. The Plateaus Model tracks organizational maturity throughout the hierarchy.

huntbook.predefender.com · 7 min

TLDR InfoSec

WHOAMI - GET PRINCIPAL NAME FROM KEYS

Attackers often use get-caller-identity to find IAM roles linked to keys, but this API call can be monitored. This post shares a tactic to bypass these detections by querying an API that returns caller identity on a failed call.

hackingthe.cloud · 2 min

TLDR InfoSec

TUMERYK (PRODUCT LAUNCH)

Tumeryk's AI Trust Scores assesses risk using nine factors, offering CISOs objective security scores for gen AI models.

tumeryk.com

TLDR InfoSec

UK'S SECRET ICLOUD BACKDOOR ORDER TRIGGERS CIVIL RIGHTS CHALLENGE

The UK government's order for Apple to backdoor iCloud encryption has faced legal challenges from Liberty and Privacy International, who deem it "unacceptable and disproportionate" with "global consequences" for non-UK users.

techcrunch.com · 2 min

TLDR InfoSec

DEMS ASK FEDERAL AGENCIES FOR REASSURANCE DOGE ISN'T FEEDING DATA INTO AI WILLY-NILLY

House Democrats have questioned 24 federal agencies about Elon Musk's DOGE team possibly sharing sensitive government data with unauthorized AI systems. Rep. Gerald Connolly raised concerns about legal violations, data privacy, and handling of Americans' personal information, requesting responses on DOGE's AI activities by March 26.

theregister.com · 3 min

TLDR InfoSec

FAKE "SECURITY ALERT" ISSUES ON GITHUB USE OAUTH APP TO HIJACK ACCOUNTS

A phishing campaign on GitHub uses fake "Security Alert" issues to trick users into granting access to a malicious OAuth app, giving attackers complete control over accounts and code. The alerts mention unusual activity from Reykjavik, Iceland, and the 53.253.117.8 IP address, urging users to allow risky permissions. Affected users must revoke access, inspect for suspicious apps, and change credentials immediately.

bleepingcomputer.com · 2 min

TLDR InfoSec

LOCKBIT DEVELOPER ROSTISLAV PANEV EXTRADITED FROM ISRAEL TO THE US

LockBit ransomware developer Rostislav Panev was extradited from Israel to the US on charges related to his role in the global LockBit ransomware cybercrime.

hackread.com · 2 min

TLDR InfoSec

NEW MASSJACKER CLIPPER TARGETS PIRATED SOFTWARE SEEKERS

MassJacker is a new clipper malware that targets users seeking pirated software by replacing their cryptocurrency wallet addresses with those controlled by hackers, facilitating fund theft.

securityaffairs.com · 3 min

TLDR InfoSec

GOVERNMENTS WON'T LIKE THIS: ENCRYPTED MESSAGING BETWEEN ANDROID AND IOS DEVICES COMING, SAYS GSMA

The GSM Association's RCS Universal Profile version 3.0 has been released, promising to unlock interoperable encrypted messages between Android and iOS devices.

computerworld.com · 4 min