August 30, 2013

News

• China Suffers Massive DDoS Attack

• DDoS Attacks Mask Theft of Millions from Banks

• 55 Character Passwords Cracked

• Google to Implement 5 Year Limit on Digital Certificates

• How Might the Feds Have Snooped on Lavabit?

• How Snowden Did It

• India Will Reportedly Ban Use of US Email Services

• iOS, Android Weaknesses Allow Pilfering of Website Credentials

• Obama Pick for NSA Review Panel Wanted Paid, Pro-government Shills in Chat Rooms

• Open Secret About Google’s Surveillance Case No Longer Secret

• Security Concerns Prompt Brazil to invest R$1bi in First Satellite

• Surveillance Revelations Shake US-German Ties

• Tor Usage Doubles in a Week, and No One Knows Why

• Twitter, NY Times Clash with Hackers for Control of the Sites

• U.S. Spy Network’s Successes, Failures and Objectives Detailed in ‘Black Budget’ Summary

Journal Articles

• Analyzing and Defending Against Web-based Malware

• Building Resilient Cloud Services Using DDDAS and Moving Target Defence [Request Full Text]

• Cookieless Monster: Exploring the Ecosystem of Web-based Device Fingerprinting [download via ieee.org]

• Device-independent Quantum Key Distribution Based on Hardy’s Paradox

• A Distributed and Collaborative Intrusion Detection Architecture for Wireless Mesh Networks [Request Full Text]

• The Fourth Amendment Implications of the Government’s Use of Cell Tower Dumps in its Electronic Surveillance

• The FTC and the New Common Law of Privacy

• Identifying Android Malicious Repackaged Applications by Thread-grained System Call Sequences

• A Mathematical Exploitation of Simulated Uniform Scanning Botnet Propagation Dynamics for Early Stage Detection and Management [Request Full Text]

• Measuring Privacy Leakage for IDS Rules

• Policy Specification in Role-based Access Control on Clouds

• Routing Attacks and Countermeasures in the RPL-Based Internet of Things

• Security Analysis of Pseudo-Random Number Generators with Input: /dev/random is not Robust [more from Cryptology ePrint Archive]

• Security Protocol Review Method Analyzer

• Survey and Taxonomy of Botnet Research Through Life-cycle

• Visual Scheme for the Detection of Mobile Attack on WSN Simulator

• New issue: IEEE Transactions on Dependable & Secure Computing
• New issue: IEEE Transactions on Information Forensics & Security [Request Full Text]

Reports / Blogs / Etc.

• Discussion Draft – Preliminary Cybersecurity Framework [NIST]

• Global Government Requests Report [Facebook]

• Modelling and Analysis on Smart Grid Against Smart Attacks [PhD diss.]

• Radio Frequency Wireless Technology in Medical Devices [FDA – download via fda.gov]

• Statement of Prof. Edward Felton RE: uses of metadata in ACLU et al vs. Clapper [download via archive.org]

• Store Systems Security: Preparing for the Paradigm Shift [download via McAfee]

• Threats to Mobile Devices Using the Android Operating System [DHS/FBI]

• Who Wrote the Pincer Android Trojan? [Brian Krebs – also Who Built the Syrian Electronic Army?]

August 23, 2013

News

• As Worries Over the Power Grid Rise, a Drill Will Simulate a Knockout Blow

• Bradley Manning Sentenced to 35 Years in Wikileaks Case

• FTC Shows Little Interest in ‘Do Not Track’ Mandate

• FTC Targets Firms With Vast Databases

• Google, Facebook Express Concern Over Brazilian Data Privacy Laws

• Groklaw, Popular IT-related Legal Issues Site, Closing Due to “Total Surveillance”

• Hackers Modify Zeus to Create Bogus Social Media Buzz

• Indian Government Buying Web Surveillance Gear

• Microsoft: Windows XP Usage Means Zero-Day Attacks Forever

• National Science Foundation Awards $20 Million for Cybersecurity Research

• New Zealand Narrowly Passes Domestic Spying Legislation

• NSA Paid Millions to Cover Prism Compliance Costs for Tech Companies

• Partner of NSA Leaks Reporter is Detained for 9 Hours at Airport

• UK Government Thought Destroying Guardian Hard Drives Would Stop Snowden Stories

• UK’s Secret Mid-East Internet Surveillance Base Revealed in Snowden Leaks

• US Doesn’t Know What Snowden Took, Sources Say

• Webcam Spying Goes Mainstream as Miss Teen USA Describes Hack

• White House Picks Panel to Review NSA Programs

Journal Articles

• Business and Social Evaluation of DDoS Attacks of Communications Networks in View of Scaling Economic Counter-measures

• A Characterization of Ideal Weighted Secret Sharing Schemes

• Counteracting Security Attacks in Virtual Machines in the Cloud Using Property Based Attestation

• Efficient Intrusion Detection Using Representative Instances

• ESPOON$_{ERBAC}$: Enforcing Security Policies In Outsourced Environments

• Improvement of One Anonymous Identity-Based Encryption [more from Cryptology ePrint Archive]

• Lawful Hacking: Using Existing Vulnerabilities for Wiretapping on the Internet

• Making Sense from Snowden: What’s Significant in the NSA Surveillance Revelations

• A New Fingerprinting Scheme Using Social Network Analysis for Majority Attack [Request Full Text]

• Optimizing Key Distribution in Peer to Peer Network Using B-Trees

• Portfolio Optimization of Computer and Mobile Botnets [Request Full Text]

• Routing-Toward-Primary-User Attack and Belief Propagation-Based Defense in Cognitive Radio Networks

• Timing Analysis of SSL/TLS Man in the Middle Attacks

• Traffic-aware Dynamic Firewall Policy Management: Techniques and Applications [Request Full Text]

• Triage in Digital Forensics

• New issue – International Journal of Security & Networks [Request Full Text]
• New issue – I/S: A Journal of Law and Policy for the Information Society
• New issue – Network Security
• New issue – Security & Communication Networks [Request Full Text]

Reports / Blogs

• Annual Incidents Reports 2012 [European Network & Information Security Agency – summary]

• Anti-decompiling Techniques in Malicious Java Applets [Sophos]

• A Closer Look: Perkele Android Malware Kit [Brian Krebs]

• Guide to Enterprise Patch Management Technologies [NIST – dowload via nist.gov]

• Teens and Mobile Apps Privacy [Pew]

• This Is No BlackOps Game – MitB Malware Targets Steam [Trusteer]

• Unintentional Insider Threats: A Foundational Study [Carnegie Mellon Software Engineering Institute]

August 16, 2013

News

• Amash: Intelligence Committee Withheld Surveillance Document from House

• Brazil Moves to Secure Telecom, Internet Systems After US Spying

• Crypto Experts Blast German E-mail Providers’ “Secure Data Storage” Claim

• Dalai Lama’s Website Compromised and Serving Malware

• Dept. of Energy Breached, 14K Employees’ Information Stolen 

• DHS Awards Contractors $6 Billion for Network Surveillance

• Did the NSA Director Mislead Hackers About NSA Compliance Problems?

• Google Confirms Android Flaw Exploited in Bitcoin Theft

• Google Ups Bug Bounties Again, by Fivefold

• How Laura Poitras Helped Snowden Spill His Secrets

• How the US Government Killed a Secure Email Company

• London Demands Contractor End WiFi Sniffing via Trash Bins

• NSA Broke Privacy Rules Thousands of Times per Year, Audit Finds

• NSA to Fire 90% of Sysadmins to Limit Data Access

• Oracle CEO Ellison Defends NSA Spying as ‘Great’ and ‘Essential’

• Pentagon in PR Fight Over F-35 Fighter’s Cyber Vulnerabilities

• Pirate Bay’s Censor-thwarting Browser Draws 100,000 Users

• Prism Fall-Out Could Cost the US its Domination of Cloud Services

• Russian Pleads Not Guilty in Theft of 160m Credit Cards

• Silent Circle Kills Encrypted Email to Prevent Government Spying

• Syrian Electronic Army Hacks Washington Post

Journal Articles

• Detection and Defense of Application-layer DDoS Attacks in Backbone Web Traffic

• Identifying Hidden Social Circles for Advanced Privacy Configuration

• Network Attacks: Taxonomy, Tools and Systems

• Privacy-Preserving Trust Management Mechanisms from Private Matching Schemes

• Rangzen: Circumventing Government-Imposed Communication Blackouts

• A Spatial Transformation Scheme Supporting Data Privacy and Query Integrity for Security of Outsourced Databases [request]

• A Static Malware Detection System Using Data Mining Methods

• Stuxnet and the Limits of Cyber Warfare [request]

• Tight Exponential Analysis of Universally Composable Privacy Amplification and its Applications
• Two RFID Privacy Models in Front of a Court  [more from Cryptology ePrint Archive]

• New issue – IEEE Security & Privacy
• New issue – Research Journal of Information Technology

Reports / Proceedings / Blogs

• NSA Secrets Kill Our Trust [Bruce Schneier]

• Google Cloud Messaging in Malicious Attachments [Kaspersky Lab]

• Hacking Lightbulbs: Security Evaluation of the Philips Hue Personal Wireless Lighting System [Nitesh Dhanjani]

• How Much Will PRISM Cost the U.S. Cloud Computing Industry? [Information Technology & Innovation Foundation]

• Incentives to Support Adoption of the Cybersecurity Framework [US Executive Office of the President]

• Managing Cyber Security as a Business Risk: Cyber Insurance in the Digital Age [Experian / Ponemon]

• Supply Chain Risk Management Practices for Federal Information Systems (draft) [NIST]

• USENIX 2013 – proceedings [full text]

August 2, 2013

[PLEASE NOTE: Subject pages will be updated beginning 8/19 – thanks for your patience]

News

• $300K ‘Superhackers’ Felled by Simple Mistakes

• Black Hat to NSA Chief: Read the Constitution

• Criminals Mail Heroin to Researcher Brian Krebs

• Edward Snowden Leaves Moscow Airport

• FBI Using Malware to Spy on Suspects

• Famed Hacker Barnaby Jack Dies 

• Fast, Effective Attack on HTTPS Demonstrated at Black Hat

• Gmail, Outlook.com and E-voting Pwned on Stage at Black Hat

• MIT Claims Clean Hands in Suicide of Aaron Swartz

• Momentum Builds Against NSA Surveillance in Congress

• NSA’s XKeyscore Allows Limitless Wiretapping

• Personal Data on 72,000 Taken in University of Delaware Breach

• Poll: Most in US Favor New Limits on Surveillance

• S. Korean Firm Probed for Assisting North in Cyberattacks

• Survey: Most Companies Think Government Spies on Cloud Data

• Hacking a Car’s Brakes and Speed: A New How-to

• Texas Students Fake GPS signals and Take Control of $80 Million Yacht

• Tortilla Tool Makes Tor Anonymizer Simpler to Use

• Twitter: US Government Makes Majority of Information Requests

• UK Researcher Banned from Publishing Codes Used to Start Luxury Cars

• US Declassifies Details on NSA Blanket Phone Surveillance

• White House Staffers’ Gmail Accounts Breached

Journals / Preprints

• Compiling Symbolic Attacks to Protocol Implementation Tests 

• Delegation Management Modeling in a Security Policy-based Environment

• Dynamic Policy Adaptation for Inference Control of Queries to a Propositional Information System [Request]

• Machine-Readable Privacy Certificates for Services

• Near-Optimal Blacklisting

• An Oblivious Password Cracking Server

• POMDPs Make Better Hackers: Accounting for Uncertainty in Penetration Testing

• Poseidon: Mitigating Interest Flooding DDoS Attacks in Named Data Networking

• Privacy in Content-Oriented Networking: Threats and Countermeasures

• Public-Key Revocation and Tracing Schemes with Subset Difference Methods Revisited  [more from Cryptology ePrint Archive]

• RISM — Reputation Based Intrusion Detection System for Mobile Ad hoc Networks

• Secure and Scalable Mobility Management Scheme for the Internet of Things Integration in the Future Internet Architecture [Request]

• Single Password Authentication

• Truthful Mechanisms for Secure Communication in Wireless Cooperative System

• New issue: IEEE Transactions on Information Forensics & Security [Request articles]

Reports / Blogs

• Critical Infrastructure Protection: DHS Needs to Improve Its Risk Assessments and Outreach for Chemical Facilities [Government Accountability Office]

• Custom USB Sticks Bypassing Windows 7/8′s AutoRun Protection Going Mainstream [Webroot]

• NASA’s Progress in Adopting Cloud Computing Technologies [NASA Office of Inspector General]

• ZeroAccess Malware Revisited – New Version Yet More Devious [Naked Security]