E2EE RCS Between iOS and Android; Alexa Verbal Commands Will be Sent to Cloud; UK Holds Closed-Door IPT Hearing Despite Outcry

The Global System for Mobile Communications Association (GSMA) has announced that updated Rich Communication Services (RCS) protocol specifications will allow iPhones and Android phones to exchange messages protected by end-to-end encryption (E2EE). GSMA began working to enable this functionality last fall. While Apple had already added E2EE to their own messaging app, they only introduced RCS in an iOS 18 update in September.

On March 28, users who have chosen for their Amazon Alexa virtual assistant voice commands to be processed locally on their Echo devices will no longer have that option. Instead, all verbal Alexa commands will be sent to the cloud for processing. While the change has not yet been formally announced, Echo users received emails from Amazon, informing them, 'As we continue to expand Alexa's capabilities with generative AI features that rely on the processing power of Amazon's secure cloud, we have decided to no longer support this feature.' The voice commands will be sent to the cloud for processing and deleted once they have been executed.

On March 14, 2025, the UK's Investigatory Powers Tribunal (IPT) held a six-hour closed hearing suggested to be Apple's appeal of a secret Technical Capability Notice (TCN) demanding a government backdoor in the company's end-to-end-encrypted (E2EE) Advanced Data Protection (ADP). Listed as "an application in private," the hearing was attended by Sir James Eadie, King's Counsel. UK-based civil rights groups Privacy International and Liberty legally challenged the TCN and applied to open the hearing, alongside ten major media organizations, but no outside parties were admitted. On March 13, a bipartisan group of US legislators wrote to the IPT requesting they "remove the cloak of secrecy," concurring with a simultaneous open letter from a coalition of civil advocacy groups stating that continued silence is no longer justifiable, that "lawful intercept" systems carry unacceptable risk, and that a closed hearing fails to serve the public interest. In recent months, France, Sweden, and India have also begun efforts to access citizens' encrypted data.

On or before March 14, 2025, attackers added a malicious commit to the tj-actions/changed-files GitHub Action, causing the Runner Worker process to dump secrets associated with Continuous Integration and Continuous Deployment/Delivery (CI/CD) into projects' build logs, some of which were in publicly accessible repositories. CI/CD secrets known to be leaked include AWS access keys, GitHub Personal Access Tokens (PATs), npm tokens, and private RSA Keys; no evidence of exfiltration of leaked secrets has been found, but tj-actions/changed-files is used in over 23,000 repositories. StepSecurity first detected the issue on March 14, and by 10:00PM UTC on March 15, GitHub had removed the changed repository and restored a fixed version. Maintainers state that tj-actions was compromised using a stolen PAT belonging to a bot with privileged access to the repository; the bot's credentials have now been changed and secured using a passkey. Wiz Threat Research has observed leaks from repositories belonging to "large enterprise organizations," and recommends ceasing use of tj-actions/changed-files and removing all references to it; downloading and deleting workflow logs; and rotating secrets, especially if the malicious base64 string is present in any files changed by the Action.

Denmark's Ministry of Societal Safety and Emergency Management has published a threat assessment warning that the country's telecommunications sector is facing a 'heightened cyber threat.' While the document does not mention Salt Typhoon and no European companies or governments have confirmed Salt Typhoon activity on their networks, last year, former U.S. deputy national security adviser for cyber and emerging technologies Anne Neuberger indicated that Salt Typhoon had affected some European organizations.

A critical vulnerability in Apache Tomcat could lead 'to remote code execution and/or information disclosure and/or malicious content added to uploaded files via write enabled default servlet.' According to researchers from Wallarm, 'the attacker uploads a serialized Java session file via PUT request [and then] triggers deserialization by referencing the malicious session ID in a GET request.' The vulnerability is being actively exploited. The flaw affects Tomcat versions 11.0.0-M1 through 11.0.2, 10.1.0-M1 through 10.1.34, and 9.0.0.M1 through 9.0.98. The issue has been addressed in Tomcat versions 11.0.3, 10.1.35, and 9.0.99.

On March 11, the Department of Health Services IT unit at the Micronesian state of Yap detected a ransomware attack affecting their network. The entire network was taken offline and all computers were turned off, so they have no email communication through official servers and no access to digital health records. The department is working with government officials and private IT contractors to remediate the situation. This is the most recent in a series of ransomware attacks targeting Pacific island countries.

Akamai's Security Intelligence and Response Team (SIRT) has identified a critical OS command injection vulnerability in Edimax Internet of Things (IoT) devices that is being actively exploited by multiple botnets. There is currently no fix available. The flaw appears to have been exploited as far back as May 2024; a proof-of-concept exploit was available in June 2023. Multiple botnets have been exploiting the flaw. Akamai's report includes a list of indicators of compromise (IoC).

A ransomware group that appears to have ties to Lockbit is exploiting known vulnerabilities in Fortinet FortiOS and FortiProxy. The series of intrusions was detected by researchers from Forescout Research Ð Vedere Labs; they are calling the threat actor behind these attacks Mora_001. Fortinet has released fixes for both flaws. One of the vulnerabilities, CVE-2024-55591, was added to the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog in January with a one-week mitigation deadline.