Celebgate hacker pleads guilty; all involved will now serve prison sentences

Emilio Herrera and George Garofano are the third and fourth Celebgate cases to reach a sentence.

A Connecticut man charged with breaking into 240 iCloud accounts as part of the Celebgate saga has pleaded guilty for his role in the crime.

George Garofano, 26, pleaded guilty to one count of unauthorized access to a protected computer to obtain information which carries a maximum prison term of five years. Sentencing has not yet been determined.

He was released on $50,000 bond.

The plea comes as another person charged in the ordeal, Emilio Herrera, was sentenced to 16 months in prison for his role in the crime. Herrera, 32, pleaded guilty last year and was sentenced last month.

‘Celebgate’ refers to an incident in August 2014 when nude photographs of celebrities were posted on public online forms. Garofano and Herrera carried out their attacks using spear phishing emails that appeared to be from Apple.

“Garofano used the usernames and passwords to illegally access his victims’ iCloud accounts, which allowed him to steal personal information, including sensitive and private photographs and videos, according to his plea agreement,” according to a Department of Justice statement released when Garofano first agreed to plead guilty. “In some instances, Garofano traded the usernames and passwords, as well as the materials he stole from the victims, with other individuals.”

The Celebgate scandal prompted Apple to encourage users to turn on two-factor authentication. The company also enabled alerts to iCloud users when anyone changes a password and when anyone accesses data or logs in from a new device.

Phishing attacks against mobile devices are extraordinarily effective and increasingly common, according to a new report. Mobile device’s smaller size makes it more difficult to suss out fraudulent emails.

“Mobile devices have opened a profitable new window of opportunity for criminals executing phishing attacks,” the researchers wrote. “Attackers are successfully circumventing existing phishing protection to target the mobile device. These attacks are highlighting security shortcomings and exposing sensitive data and personal information at an alarming rate.”

Herrera’s sentencing and Garofano’s guilty plea wrap up the third and fourth case related to the incident incident. Edward Majerczyk, 28, pleaded guilty in 2016 and was sentenced to a nine month prison term last year. Ryan Collins, 36, also pleaded guilty and was sentenced to 18 months last year.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems