Exposure of Sensitive Credentials within the Cybersecurity and Infrastructure Security Agency (CISA) Network
美國網路安全暨基礎設施安全局 (CISA) 網路內敏感憑證洩露
Introduction
A public GitHub repository containing plaintext credentials and access tokens associated with CISA and the Department of Homeland Security was identified by external security researchers.
外部安全研究人員發現了一個公開的 GitHub 儲存庫，其中包含與 CISA 及國土安全部相關的明文憑證與存取權杖。
Main Body
The vulnerability originated from a repository titled 'Private-CISA,' which was managed by Nightwing, a contractor for the agency. According to Guillaume Valadon of GitGuardian, the repository contained spreadsheets of plaintext credentials, including cloud keys and access tokens. Analysis of the commit logs suggests that the administrator had intentionally deactivated GitHub's default secret-protection mechanisms. Subsequent verification by Philippe Caturegli of Seralys confirmed that these credentials permitted high-privilege access to multiple Amazon Web Services GovCloud accounts.
此漏洞源於一個名為 'Private-CISA' 的儲存庫，由該機構的承包商 Nightwing 管理。根據 GitGuardian 的 Guillaume Valadon 稱，該儲存庫包含明文憑證的試算表，其中包括雲端金鑰與存取權杖。對提交日誌 (commit logs) 的分析顯示，管理員蓄意停用了 GitHub 預設的秘密保護機制。隨後 Seralys 的 Philippe Caturegli 證實，這些憑證允許高權限存取多個 Amazon Web Services GovCloud 帳號。
This incident occurs amidst a period of institutional instability. CISA has lacked a permanent director since January 20, 2025, and has experienced a reduction in personnel by approximately one-third due to layoffs and furloughs. Furthermore, the agency's internal governance has been questioned following a January incident in which acting director Madhu Gottumukkala—subsequently removed in February—uploaded sensitive documentation to ChatGPT despite existing prohibitions. While CISA is the primary authority for civilian federal network security and advocates for the use of secured password managers, the agency has not yet confirmed whether the exposed credentials were utilized by unauthorized parties or if remediation measures, such as credential revocation, have been implemented.
此事件發生在機構不穩定的時期。CISA 自 2025 年 1 月 20 日起一直缺乏正式局長，且因裁員和無薪假導致人員減少約三分之一。此外，該機構的內部治理在 1 月的一起事件後受到質疑，當時代理局長 Madhu Gottumukkala（隨後於 2 月被免職）在已有禁令的情況下，將敏感文件上傳至 ChatGPT。雖然 CISA 是聯邦平民網路安全的主要權威，並倡導使用安全的密碼管理軟體，但該機構尚未確認洩露的憑證是否被未經授權的第三方利用，或是否已採取如撤銷憑證等補救措施。
Conclusion
CISA remains without a permanent director and has not provided a formal response regarding the extent of the data exposure or the current status of the compromised accounts.
CISA 目前仍缺乏正式局長，且尚未就數據洩露程度或受影響帳號的現況提供正式回應。
Vocabulary Learning
The Architecture of Institutional Critique: Nominalization and Passive Agency
To move from B2 to C2, a student must transition from describing events to constructing a formal narrative. The provided text is a masterclass in Nominalization—the process of turning verbs (actions) into nouns (concepts). This shifts the focus from who did what to the state of the situation.
◈ The Pivot from Action to Concept
Compare these two conceptualizations of the same event:
- B2 Level: CISA doesn't have a director, so it is unstable. (Subject Verb Adjective)
- C2 Level: "This incident occurs amidst a period of institutional instability."
In the C2 version, "instability" (a noun) becomes the subject. This allows the writer to categorize a complex socio-political environment as a single, manageable entity. It creates an aura of objective detachment, a hallmark of high-level academic and bureaucratic discourse.
◈ Semantic Precision: The 'Nuance' Lexicon
Note the deployment of specific, high-utility vocabulary that replaces generic B2 descriptors:
| B2 Approximation | C2 Precision | Linguistic Function |
|---|---|---|
| Fixed/Solved | Remediation | Technical systemic correction |
| Banned/Not allowed | Prohibitions | Formal legal/policy restriction |
| Cancelled | Revocation | The formal withdrawal of a privilege |
| Small amount | Reduction by approximately one-third | Quantitative precision |
◈ Syntactic Sophistication: The 'Embedded' Clause
Observe the structure: "...acting director Madhu Gottumukkala—subsequently removed in February—uploaded sensitive documentation..."
By using em-dashes for apposition, the author injects critical biographical data without breaking the grammatical flow of the main sentence. This prevents the 'choppiness' typical of intermediate writing and allows for a higher density of information per sentence.
C2 Axiom: Mastery is not about using 'big words,' but about using nominal structures to transform a sequence of events into a professional analysis.