June 27, 2013

News

• Chinese Defense Ministry Accuses U.S. of Spying Hypocrisy

• EU Cybersecurity Strategy Harshly Criticized by Data Protection Supervisor

• EU Now Requires Telecomm / ISP Breach Disclosure 

• Ex-US General Target of Stuxnet Leak Investigation, Sources Say

• Facebook Says Technical Flaw Exposed 6 Million Users

• India Mulls WeChat ban

• In WikiLeaks Probe, Feds Used a Secret Search Warrant to Get Volunteer’s Gmail

• Malicious Campaign Targets Government Security News
  

• Microsoft Wants to Disclose US Government Data Queries

• Opera Breached, Code Cert Stolen, Possibly Spreading Malware

• NSA Collected Email Records in Bulk Under Obama Administration

• NSA Leak Vindicates AT&T Whistleblower

• Russia and US Establish Cyberwar Hotline

• Syrian Electronic Army Spear Phishes Financial Times

• Senators Say NSA Phone Records Played Little Role in Stopping Terror Plots

• Texas Becomes First State to Ban Warrantless Email Surveillance

• Texas Students Hack Drone in DHS Demo

• US Army Reviews Rules of Engagement over Cyber Threat

• US Charges Snowden with Espionage

• US Troops’ Personal Data Leaked in Cyber Attacks Aimed at South Korea

• Web’s Reach Binds N.S.A. and Silicon Valley Leaders

• WikiLeaks Volunteer Was a Paid Informant for the FBI

• Yahoo: US Made 13,000 Requests for User Data

Journal Articles

• ACTIDS: An Active Strategy For Detecting And Localizing Network Attacks

• An Algorithm to Find Optimal Attack Paths in Nondeterministic Scenarios

• Attack Planning in the Real World

• Building a Practical and Reliable Classifier for Malware Detection  [Request Full Text]

• Contradictions in Improving Speed of Virus Scanning

• Cryptocat: Adopting Accessibility and Ease of Use as Security Properties

• A Detailed Survey on Various Aspects of SQL Injection in Web Applications: Vulnerabilities, Innovative Attacks, and Remedies

• Efficient Authentication for Fast Handover in Wireless Mesh Networks

• ESPOON: Enforcing Encrypted Security Policies in Outsourced Environments

• Finding and Solving Contradictions of False Positives in Virus Scanning

• Hacking Smart Machines with Smarter Ones: How to Extract Meaningful Data from Machine Learning Classifiers

• Information-Theoretic Security for the Masses

• Malware Analysis Performance Enhancement Using Cloud Computing [Request Full Text]

• Penetration Testing == POMDP Solving?

• A Secure and Effective Anonymous Authentication Scheme for Roaming Service in Global Mobility Networks

• A Security Protocol for the Identification and Data Encrypt Key Manage of the Secure Mobile Device

• ScreenPass: Secure Password Entry on Touchscreen Devices

• Understanding the Spread of Malicious Mobile-phone Programs and their Damage Potential [Request Full Text]

• New issue: Computer Networks
• New Issue: Information Management & Computer Security
• New Issue: International Journal of Electronic Security and Digital Forensics [Request Full Text]

Reports

• Dimming the Internet: Detecting Throttling as a Mechanism of Censorship in Iran [Center for Global Communications Studies]

• The Evolution of Phishing Attacks, 2011-2013 [Kaspersky Lab]

• Going Global: New Citadel Trojan Automatically Localizes Fraud Content [Trusteer]
• Special Publication 800-124: Guidelines for Managing the Security of Mobile Devices in the Enterprise [NIST]

• An Analysis of Canada-based Netsweeper’s Role in Pakistan’s Censorship Regime [University of Toronto]

• Schrodinger’s Catnip: A Review of the NSA Phone Surveillance Program [CERIAS]

June 14, 2013

News

• ACLU Sues NSA Over Mass Phone Surveillance

• American Targeted by Spyware Sold to Foreign Governments

• Android Trojan Attempts to Spread via Bluetooth

• Anonymous Leaks more NSA-related Docs as Obama Defends PRISM

• Child Porn Suspect Avoids Having to Decrypt Hard Drive

• China Claims ‘Mountains of Data’ Pointing to U.S. Hacking

• Data Breach Puts DHS Employees at Risk of Identity Theft

• Energy Secretary Creates Cybersecurity Council

• EU ‘Assessing U.S. Relationship’ Amid PRISM Spying Claims

• EU Wants Increased Penalties for Hackers, Botnet Operators

• FBI and Microsoft Shut Down ~1000 Citadel Botnets

• Gartner: Most Companies Will Have Data on Assets They Don’t Own or Control By 2019

• Google Bans Facial Recognition from Glass

• Google Must Comply with National Security Letters, Court Rules

• Hacker Who Exposed Steubenville Attack Faces Longer Sentence Than Rapists

• Massachusetts High Court Recognizes Right to be Free From GPS Surveillance 

• NATO to Set Up Cyber-Defence Rapid Reaction Teams

• NSA Revelations Only ‘The Tip of the Iceberg,’ Says CA Rep. Sanchez

• Obama Asked Intel Agencies to Draw Up List of Possible Cyber Targets Overseas

• Pentagon Asks $23 Billion to Combat Cyberthreats

• Self-Propagating Zeus Trojan Variant Identified

• Spanish Police May be Allowed to Hack Suspects

• Thousands of Iranian Gmail Users Targeted in Attempted Hacks Before Election

• Top Obama Appointees Using Secret Email Accounts

• U.S. Agencies Said to Swap Data With Thousands of Firms

• U.S. Disrupts al-Qaeda’s Online Magazine

• U.S. Upholds Warrantless Laptop Searches at Borders

• Zeus Trojan Thriving on Facebook

Journal Articles

• Against Spyware Using CAPTCHA in Graphical Password Scheme

• An Active Host-Based Intrusion Detection System for ARP-Related Attacks and its Verification

• Anonymous Authentication for Privacy-preserving IoT Target-driven Applications

• [Canadian] Data-collection Program Got Green Light in 2011

• Cloud Security Challenges: Investigating Policies, Standards, and Guidelines in a Fortune 500 Organization

• CUDA Leaks: Information Leakage in GPU Architectures

• Draw a Line on Your PDA to Authenticate

• Introduction: Privacy Self-Management and the Consent Dilemma

• Naturally Rehearsing Passwords

• New Attacks against Transformation-Based Privacy-Preserving Linear Programming [more from Cryptology ePrint Archive]

• A New Graphical Password Scheme Resistant to Shoulder-Surfing

• Obscured by Clouds or How to Address Governmental Access to Cloud Data from Abroad

• One Time Pad Password Protection: Using T.E.C. Steganography and Secure Password Transmission Protocols

• Quantitative Security Analysis for Multi-threaded Programs

• Securing Your Transactions: Detecting Anomalous Patterns In XML Documents

• State Actors’ Offensive Cyberoperations: The Disruptive Power of Systematic Cyberattacks

• A Systematically Empirical Evaluation of Vulnerability Discovery Models: a Study on Browsers’ Vulnerabilities

• Towards a More Systematic Approach to Secure Systems Design and Analysis

• New issue – IEEE Security & Privacy
• New issue- IEEE Transactions on Information Forensics and Security [articles can be requested]

Reports / Opinion

• Bruce Schneier: The Problems with CALEA-II

• FDA Safety Communication: Cybersecurity for Medical Devices and Hospital Networks

• Glossary of Key Information Security Terms [NIST]

• “NetTraveler is Running!” – Red Star APT Attacks Compromise High-Profile Victims [Kaspersky Lab]

• Peer-to-Peer: A Growing Tactic Used in Threat Command-and-Control [Damballa]

• Report of the Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression   [United Nations]

• SSL Performance Problems [NSS Labs]

• 2013 Cost of Data Breach Study: Global Analysis [Ponemon Institute]