News of the Cyber World

[kyonides]

Ex-CIA Coder Joshua Schulte Sentenced to 40 Years in Prison for Leaking Hacking Tools to WikiLeaks

Former CIA officer Joshua Schulte faces 40 years in prison for leaking a trove of classified hacking tools to WikiLeaks, the U.S. Attorney’s Office of the Southern District of New York announced Thursday. He was also found guilty of possessing child abuse images.

Prosecutors accused the onetime coder of passing on the CIA’s “Vault 7” tools, which allow intelligence officers to hack smartphones and use them as listening devices in what was variously described as one of the most “brazen” leaks in U.S. history.

Schulte, 35, shared some 8,761 documents to WikiLeaks in 2017, the U.S. justice department found. It was the single largest data leak in the agency’s history.

He denied the allegations, but was convicted on the various counts of espionage at three separate federal trials in New York in 2020, 2022, and 2023.

On Thursday, he was sentenced for charges of espionage, computer hacking, contempt of court, making false statements to the FBI and possession of child abuse images.

Schulte defended himself at trial. An earlier trial ended in a hung jury in 2020.

U.S. Attorney Damian Williams said in a statement Schulte’s activities saw him “rightly punished not only for his betrayal of our country, but for his substantial possession of horrific child pornographic material,”...

Federal Agency Issues Security Warning for Apple Devices, Gives Three Weeks to Comply

This week, a federal agency sent a warning about a vulnerability that impacts iPhones, iPads, Macbooks, and other Apple devices, saying that it could lead to major security breaches.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), an arm of the U.S. Department of Homeland Security, said on Jan. 30 that the issue, marked as CVE-2022-48618, can bypass “pointer authentication.” It said that not fixing the bug could pose a “significant” risk to the U.S. “federal enterprise.”

The bulletin also said that it issued a “binding operational directive” to issue updates to fix the problem, requiring federal civilian agencies to “remediate identified vulnerabilities by the due date to protect” its “networks against active threats.”

According to CISA, the agencies were given about three weeks to patch the issue. The deadline was set for Feb. 21, 2024.

But CISA also warned that it “strongly urges all organizations,” such as companies, to respond to the bug.

On a separate website, officials say that the issue has been fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and, iPadOS 16.2, and tvOS 16.2. “An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited against versions of iOS released before iOS 15.7.1,” the bulletin said.

In a separate instance last month, CISA sent out an advisory for iPhone and other iOS users to update their products for another security issue.

“Apple has released security updates for iOS and iPadOS, macOS, Safari, watchOS, and tvOS. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system,” said the agency on Jan. 23. It then recommended that users update their software.

British Columbia Supreme Court Mulls Class-Action Against iPhone for Allegedly Slowing Older Phones

A judge in British Columbia will decide next month whether to approve a multimillion-dollar settlement of a class-action lawsuit against Apple for allegedly slowing down older model iPhones with its software updates.

Lawyers for the company and class members in a lawsuit originally filed in 2018 were in a Vancouver courtroom on Jan. 29, urging approval of the settlement, where consumers would receive between $17.50 and $150, depending on the number of claims that are successful.

Michael Peerless, a lawyer for the class, told Justice Sharon Matthews that the amounts will be paid out to those who can prove ownership of affected phones that include several iPhone 6 and 7 models.

He said the settlement was “hard fought” after “lengthy and difficult negotiations” with the company, and said the amounts proposed to be paid out is “in the range that a consumer should hope for.”

Mr. Peerless told the judge that similar litigation in the United States provided a “valuable road map” during settlement negotiations, which could see Apple pay out a maximum of about $14.4 million to class members.

Similar lawsuits were filed in Ontario, Saskatchewan and Alberta. The settlement agreement would apply for residents in all provinces except Quebec.

The U.S. case in California saw the company settle with iPhone users whose devices were throttled by software updates, diminishing the phones’ performance and battery life.

The California case settlement range was between $310 million and $500 million.