Vault 7 Leaker Joshua Schulte Convicted of Nine Counts Related to Largest Theft in CIA History
Hackers potentially stole Bandai Namco user data, Cyber Safety Review Board says log4j flaw less significant than feared, Ring gave footage to police without user permission, much more
Former Central Intelligence Agency (CIA) software engineer Joshua Schulte was convicted by a federal jury of nine counts, including illegally gathering national defense information and illegally transmitting that information, related to the largest theft of classified information in the agency’s history.
The verdict came two years after a previous jury failed to agree on eight of the ten charges he faced then. Schulte dumped a massive cache of CIA documents on Wikileaks in March 2017, known as the Vault 7 leak, which the agency said created “catastrophic” damage to national security. Reports characterize Schulte as emotionally unstable and driven by a grudge against his CIA co-workers. Schulte, who defended himself at the most recent trial, has argued that he was being made a scapegoat for the C.I.A.’s own failings. (Ed Shanahan / New York Times)
Related: CNET News, Law & Crime, emptywheel, New York Times, Forbes, Associated Press, The Times of Israel, Security Week, BBC News - World, ABC.net.au, AFP, CNN, New York Post, Politico, CBS News, Reuters, The Verge, Wall Street Journal, Al Jazeera
Bandai Namco, the Japanese video game publisher behind titles including Pac-Man, Tekken, and Elden Ring, admitted that hackers accessed its systems and potentially stole customer data.
Bandai Namco said it detected unauthorized access to its systems by a third party on July 3 and has since taken measures, such as blocking access to the affected servers, to prevent the damage from spreading. The confirmation comes days after the Alphv ransomware gang, also known as BlackCat, added the Japanese company to its dark web leak site.
The Alphv ransomware group, believed to be the latest incarnation of the DarkSide ransomware gang responsible for the Colonial Pipeline attack, threatened that the stolen data would be released soon but gave no exact deadline. Bandai Namco declined to say whether it had been given a ransom demand. (Carly Page / TechCrunch)
Related: The Nerd Stash, WCCFtech, PC Gamesn, Techradar, Teiss, TechCrunch, Security - Computing, Security - Computing, Eurogamer, Altchar, PCMag.com, Bleeping Computer, Slashdot, The Record by Recorded Future, SVG, Kotaku
In its first report, the newly established Cyber Safety Review Board (CSRB) said that the vulnerability in the widely used open-source logging utility log4j revealed late last year is an “endemic vulnerability” that could persist for more than a decade as an avenue for hackers to infiltrate computer networks but has been less significant than initially feared.
The findings by the CSRB, a panel of experts from various government agencies and the private sector, include recommendations for businesses to guard against the Log4j threat. In its report, the CSRB said that it had not found evidence of any “significant Log4j-based attacks on critical infrastructure systems.” It added that exploitation levels had “occurred at lower levels than many experts predicted” but acknowledged limitations with its ability to comprehensively gauge such trends, especially because reporting cybersecurity problems by companies is often voluntary. (Dustin Volz / Wall Street Journal)
Related: Cyberscoop, Nextgov, The Record, CBS News, Federal News Network, CISA.gov, Luta Security, DHS.gov, Inside Cybersecurity
In a letter Amazon sent to Senator Ed Markey (D-MA), Amazon said it handed Ring video doorbell footage to police without owners’ permission at least eleven times this year.
Brian Huseman, Amazon’s vice president of public policy, wrote in the letter to Markey that each of the eleven times it shared video without the consent of the device’s owner, it was because “Ring made a good-faith determination that there was an imminent danger of death or serious physical injury to a person requiring disclosure of information without delay.” Senator Markey said in a statement, “As my ongoing investigation into Amazon illustrates, it has become increasingly difficult for the public to move, assemble, and converse in public without being tracked and recorded.” (Alfred Ng / Politico)
Related: Tech Advisor - Security, POLITICO, Associated Press, TechHive, TechCrunch, Gizmodo, Security News | Tech Times, Engadget, geekinteger, Slashdot, Politico, Vox, Senator Edward Markey, Reuters, Amazon, The Guardian, Input, PCMag, International Business Times, The Hill, The Intercept, iTnews - Security, BiometricUpdate, Daily Beast
Laptop maker Lenovo released updates for three vulnerabilities that researchers found in the UEFI firmware used to boot up a host of its laptop models, including the Yoga, ThinkBook, and IdeaPad lines, that can allow malicious actors.
The company assigned a medium severity rating to the vulnerabilities, tracked as CVE-2022-1890, CVE-2022-1891, and CVE-2022-1892, that affect the ReadyBootDxe, SystemLoadDefaultDxe, and SystemBootManagerDxe drivers, respectively. Security firm ESET said the flaws could allow a malicious actor to achieve arbitrary code execution in the early phases of the platform boot, possibly allowing the attackers to hijack the OS execution flow and disable some essential security features. (Dan Goodin / Ars Technica)
Related: Security Week, Slashdot, Reddit - cybersecurity, Slashdot, Lenovo
Researchers at Proofpoint say they have witnessed a “sustained effort” by nation-state hackers to compromise the accounts of journalists.
The firm detailed the numerous campaigns it says were carried out by state-sponsored and state-aligned hacking groups against members of the media. The APT actors monitored by Proofpoint are believed to be aligned with the state interests of countries such as China, North Korea, Iran, and Turkey. While some targeted journalists merely for painting their countries in a poor light, others timed their attacks around major political events in the U.S. (Mikael Thalen / Daily Dot)
Related: Proofpoint, Infosecurity Magazine, The Hill, CNN.com, Cyberscoop, TechRepublic, Duo.com, TechCrunch
According to researchers at Cyble, a new ransomware operation has launched under the name 'Lilith,' and it has already posted its first victim on a data leak site created to support double-extortion attacks.
Lilith is a C/C++ console-based ransomware designed for 64-bit versions of Windows that performs double extortion attacks. Upon execution, Lilith attempts to terminate processes that match entries on a hardcoded list, including Outlook, SQL, Thunderbird, Steam, PowerPoint, WordPad, Firefox, and more, freeing up valuable files from applications that may be using them at the moment, thus making them available for encryption. (Bill Toulas / Bleeping Computer)
Related: The Tech Outlook, Heimdal Security, Cyble
Microsoft published the exploit code for a vulnerability in macOS, identified as CVE-2022-26706, that could help an attacker bypass sandbox restrictions and run code on the system.
Microsoft explained how the macOS App Sandbox rules could be avoided to allow malicious macro code in Word documents to execute commands on the machine. Microsoft reported the vulnerability to Apple last year in October, and a fix was delivered with the macOS security updates in May 2022 (Big Sur 11.6.6) (Ionut Ilascu / Bleeping Computer)
Related: The Hacker News, Microsoft
During a ceremony commemorating the 11th Information Security Day, South Korean President Yoon Suk-yeol promised that reserve forces for cyber warfare would be established to better respond to growing cyber threats.
Yoon pledged to launch "cyber reserve forces" composed of civil and government sectors to strengthen the country's capacity to conduct cyber warfare. He also vowed to address the shortage in cyber personnel by expanding related courses in universities and graduate schools and fostering a 100,000-strong workforce, including 40,000 new personnel. (Yonhap News)
Related: News - English [KBS WORLD Radio], Gadgets Now, Insider Paper
The head of Facebook-owned WhatsApp, Will Cathcart, warned users of fake WhatsApp apps circulating online, saying they may look innocent but can cause severe damage to smartphones.
In a tweet, he said that “Recently our security team discovered hidden malware within apps – offered outside of Google Play - from a developer called “HeyMods” that included "Hey WhatsApp" and others.” (Hindustan Times)
Related: Financial Express The Sun, The Paradise News, Malwarebytes Labs, Digital Information World
Researchers at Cisco Talos say a new ongoing phishing campaign targeting students at various educational institutions in India at least since December 2021 is attributable to an advanced persistent threat (APT) group known as Transparent Tribe, also known as APT36, Operation C-Major, PROJECTM, and Mythic Leopard.
Transparent Tribe is suspected to be of Pakistani origin and is known to strike government entities and think tanks in India and Afghanistan with custom malware such as CrimsonRAT, ObliqueRAT, and CapraRAT.The new campaign also suggests that the APT is actively expanding its network of victims to include civilian users. (Ravie Lakshmanan / The Hacker News)
Related: Cisco Talos
Colorado Springs Utilities says it was notified on July 6 that an unauthorized party accessed customer data stored by one of the company's subcontractors.
According to Springs Utilities, the breach happened on June 15, 2022. The information included customer names and addresses, account numbers, and in most cases, phone numbers and email addresses. However, Springs Utilities said no sensitive financial data, like social security numbers or cred card information, was compromised. (Jordan Good / KRDO)
Related: KKTV
Former Mesa County Elections Manager Sandra Brown, fired for her involvement in the breach of the county’s elections system last year, was arrested on two felony counts this week. Her arrest affidavit contains new details about the conspiracy theorists involved in making hard drive images of the elections machines.
Prosecutors allege the breach was coordinated by Mesa County Clerk and Recorder Tina Peters as part of her quest, along with other conspiracy theorists, to show there were irregularities and fraud in the 2020 election, which she still has never proven. Brown’s arrest warrant carries charges of conspiracy to commit criminal impersonation – gain a benefit (class 6 felony) and attempt to influence a public servant (class 4 felony). (Blair Miller / The Denver Channel)
Related: Associated Press, Daily Kos, The Daily Sentinel, Affidavit and Warrant
W. Stephen Muldrow, U.S. Attorney for the District of Puerto Rico, announced that Iván Santell-Velázquez pled guilty to cyberstalking before United States District Court Judge Silvia Carreño-Coll.
Santell-Velázquez, while a student at the University of Puerto Rico at Cayey, sent unauthorized emails to faculty, administration, and students under the moniker “Slay3r_r00t”. Santell targeted over 100 student email accounts and successfully broke into multiple university e-mail accounts, collecting personal information through phishing and spoofing schemes.
In addition, between 2019 and 2021, Santell-Velázquez hacked into several female students’ Snapchat accounts, some of which contained nude images that he shared with third parties who published the images online. The plea agreement encompasses fifteen female victims of Santell-Velázquez’s conduct and the University of Puerto Rico. Cyberstalking carries a maximum prison sentence of five years. The sentencing hearing is scheduled for October 12, 2022. (D1Softball News)
Related: El Nuevodia, Justice.gov
Brendan Carr, a Republican member of the Federal Communications Commission, told the National Security subcommittee of the House Committee on Oversight and Reform during a hearing that U.S. military members are risking national security with their use of the TikTok social media service.
Several military branches bar TikTok from official devices, but there’s “pervasive use on personal devices, so I think that’s a challenge we need to address,” Barr said. (Todd Shields and Alex Barinka / Bloomberg)
Related: NTD News, House Oversight Committee
Image by David Mark from Pixabay