August 17

News/Trends

• Pen Testers Breach Perimeter Through Web Apps
• Firewall Still Critical Tool in Network Security
• Smart Home Alert as MQTT Mistakes Expose Users

• ‘Foreshadow’ flaw found in Intel CPUs – what to do

• Intel’s SGX blown wide open by, you guessed it, a speculative execution attack

• US rolls back cyberwarfare rules

• Silk Road founder Ross Ulbricht is dictating tweets from prison

Law/Policy

• Dem requests DOJ probe on law enforcement use of facial recognition technology

• AT&T hit with $224M lawsuit over cryptocurrency loss

• FBI rounds out cyber leadership with key appointments

• House Dems press FCC chairman for answers on false cyberattack claim

Technical

• A Combinatorial-Probabilistic Analysis of Bitcoin Attacks

• Mitigation of Flooding and Slow DDoS Attacks in a Software-Defined Network

• Distributionally Adversarial Attack

• Regulating Access to System Sensors in Cooperating Programs

Reports, Blogs, Etc.

• Making Sense of Microsoft’s Endpoint Security Strategy

• New Ways to Track Internet Browsing

• SuperProf private tutor site massively fails password test, makes accounts super easy to hack

• Hanging Up on Mobile in the Name of Security

• Apple hacked by 16-year-old who “dreamed” of working for firm

• Retired Malware Samples: Everything Old is New Again

Advertisements

August 10

News/Trends

• Windows 10 to get disposable sandboxes for dodgy apps
• Risk of Fraud in Mobile Point-of-Sale Device Flaw
• Lack of Hardened Benchmarks Leads to Poor Cyber Hygiene
• Satellite Flaws Raise Aviation Fears

• Amazon AWS error exposes info on 31,000 GoDaddy servers

• “Stevenkings” charged with creating “Medusa IRC Botnet DDoS” malware used against Bay Area company’s website

• A word to the wise: Skip Microsoft’s July patches

Law/Policy

• Dems want GOP chairman to subpoena State Department over cyber docs

• Dem senator: Russians have ‘penetrated’ some Florida election systems

• GOP chair urges Senate to pass DHS cyber reorganization bill

• Apple jabs ‘other companies’ in defending customer data policies to lawmakers

Technical

• Exploiting ergodicity of the logistic map using deep-zoom to improve security of chaos-based cryptosystems

• Secret Sharing with Binary Shares

• A Secure Multiple Elliptic Curves Digital Signature Algorithm for Blockchain

• Baseline functionality for security and control of commodity IoT devices and domain-controlled device lifecycle management

Reports, Blogs, Etc.

• Smashing Security #090: Fortnite for Android, and the FCC’s DDoS BS

• Snapchat’s source code leaked out, and was published on GitHub

• Making millions out of prisoners’ email
• You’ll have to disable a recommended Android security setting to install Fortnite

• Don’t Fear the TSA Cutting Airport Security. Be Glad That They’re Talking about It.

• Detecting Phishing Sites with Machine Learning

• Making Sense of Microsoft’s Endpoint Security Strategy

August 2

News/Trends

• DHS Launches Cyber-Risk Management Center
• Firms Urged to Scour Dark Web for Breached Data
• Over 600K Shoppers Affected by E-commerce Security Incident
• Facebook Removes Fake Accounts Linked to Russian Firm

• Power Grid Security: How Safe Are We?

• Google Researcher Unpacks Rare Android Malware Obfuscation Library

• How to defend yourself against SamSam ransomware

Law/Policy

• Hackers breached US electric utilities: analysts

• Reddit says hacker gained access to some user data

• Federal prosecutors announce arrest of Ukrainians for alleged hacking of US businesses

• Facebook to face Senate Intel questions following revelation of new disinformation campaign

Technical

• Cognitive Techniques for Early Detection of Cybersecurity Events

• Mapping the Privacy-Utility Tradeoff in Mobile Phone Data for Development

• Load Control and Privacy-Preserving Scheme for Data Collection in AMI Networks

• On the Security Analysis of a Cooperative Incremental Relaying Protocol in the Presence of an Active Eavesdropper

Reports, Blogs, Etc.

• Using In-Game Purchases to Launder Money

• Hacking a Robot Vacuum

• Identifying People by Metadata

• Smashing Security #089: Data breaches, ransomware, Bitcoin robberies, and typewriters
• Android apps infected with umm… *Windows* malware
• Phone scam exploits Russian hacking fears

• The Year Targeted Phishing Went Mainstream

July 27

News/Trends

• New Spectre attack enables secrets to be leaked over a network
• Microsoft offers extended support for Windows, SQL 2008—but with a catch

• 5 Ways Small Security Teams Can Defend Like Fortune 500 Companies

• Every Week Is Shark Week in Cyberspace

• Smart Home Security Camera Bug Exposed
• Exobot Android Malware Targets Banking Apps

• Two-Fifths of IT Leaders regard IoT Security as Afterthought

Law/Policy

• Senator calls on US Government to start killing Adobe Flash now

• Analysts uncover new ‘highly active’ espionage group believed to be from Iran

• House panel approves bill to codify key cybersecurity program at DHS

• Cyber warfare policy included in final version of annual defense policy bill

Technical

• Architectures for Detecting Real-time Multiple Multi-stage Network Attacks Using Hidden Markov Model

• CloudMe Forensics: A Case of Big-Data Investigation

• Shape of the Cloak: Formal Analysis of Clock Skew-Based Intrusion Detection System in Controller Area Networks

• Specification-Based Protocol Obfuscation

Reports, Blogs, Etc.

• From Westworld to Best World for the Internet of Things

• Hackers Breached Virginia Bank Twice in Eight Months, Stole $2.4M

• Scammers Use Breached Personal Details to Persuade Victims

• Google: Security Keys Neutralized Employee Phishing

• DARPA Wants Research into Resilient Anonymous Communications

• Major Bluetooth Vulnerability

• Smashing Security #088: PayPal’s Venmo app even makes your drug purchases public
• Google Chrome users met with ‘Not secure’ warnings when visiting HTTP sites

July 20

News/Trends

• US Retail Weak in Encryption, Security Practices
• Web Forums, Social Media Targets for Credentials

• Military documents about MQ-9 Reaper drone leaked on dark web

• Facebook defends itself against report it allowed hate speech for financial gain

• Here come the first blockchain smartphones: What you need to know
• Could semantic icons replace passwords and PINs?

• Automated money-laundering scheme found in free-to-play games

• US Vote-Counting Computers Had Flaw, Allowed Hackers Access

Law/Policy

• Fed chief casts doubt on benefits, safety of cryptocurrencies

• Election security bill picks up new support in Senate

• Va.-based robocall firm left thousands of voter records exposed online

• Voting equipment maker sold systems with remote-access software

Technical

• Sonification in security operations centres: what do security practitioners think?

• Defend Deep Neural Networks Against Adversarial Examples via Fixed andDynamic Quantized Activation Functions

• Addressing Security and Privacy Challenges in Internet of Things

• SySeVR: A Framework for Using Deep Learning to Detect Software Vulnerabilities

Reports, Blogs, Etc.

• Smashing Security #087: How Russia hacked the US election

• IoT search engine exposes passwords of over 30,000 vulnerable DVRs

• Notorious ‘Hijack Factory’ Shunned from Web

• Suing South Carolina Because Its Election Machines Are Insecure

• Installing a Credit Card Skimmer on a POS Terminal

• Reasonably Clever Extortion E-mail Based on Password Theft

• Cyber is Cyber is Cyber

• Communicating About Cybersecurity in Plain English

July 13

News/Trends

• New Ransomware Rumored to Spread SMB Exploit
• Western E-Tailers Set to Lose Nearly $19bn to Fraud
• New Spectre-like attack uses speculative execution to overflow buffers
• Here come the first blockchain smartphones: What you need to know
• Hyperthreading under scrutiny with new TLBleed crypto key leak
• Microsoft yanks buggy Office 2016 patch KB 4018385, republishes all of this month’s patch downloads
• Hackers are selling access to law firm secrets on dark web sites

Law/Policy

• Senators press federal election officials on state cybersecurity

• Top Senate Republicans question Google over Gmail data practices

• DOJ says fraud case may not be linked to OPM breach

• Lawmakers press Apple, Google on data collection

Technical

• Differentially-Private “Draw and Discard” Machine Learning

• Exploring Robust Property Preservation for Secure Compilation

• Algorithms that Remember: Model Inversion Attacks and Data Protection Law

• When deep learning meets security

Reports, Blogs, Etc.

• Facebook doesn’t want to eradicate fake news. If it did they’d kick out InfoWars

• New iOS security feature can be defeated by a $39 adapter… sold by Apple

• Notorious ‘Hijack Factory’ Shunned from Web

• Why I Use a Single-screen iPhone Configuration

• Gas Pump Hack

• Department of Commerce Report on the Botnet Threat

• Apple Releases Wave of Security Updates

• Recovering Keyboard Inputs through Thermal Imaging

July 6

News/Trends

• Putin Pushes for Global Cybersecurity Cooperation

• New Malware Strain Targets Cryptocurrency Fans Who Use Macs

• Get the Microsoft June patches applied, but watch out for Win7 NICs and old antivirus

• Linux experts are crap at passwords!

• BlackBerry’s Android upgrade track record should give anyone pause
• Malware Delivers Cryptor or Miner, Trojan’s Choice
• Hamas Uses Fake Dating Apps to Infiltrate Israeli Military

• In: Yatra.com breach: How to check if your data is compromised, and what to do if it is

Law/Policy

• Supreme Court: Police Need Warrant for Mobile Location Data

• Huawei: FCC proposal would hurt poor, rural communities

• Senators urge Fla. officials to work with DHS to protect voting systems

• Facebook reveals bug that unblocked users

Technical

• Practical and Scalable Security Verification of Secure Architectures

• Privacy-preserving Machine Learning through Data Obfuscation

• FocusST Solution for Analysis of Cryptographic Properties

• Reflection Analysis for Face Morphing Attack Detection

Reports, Blogs, Etc.

• The NSA’s Domestic Surveillance Centers

• Beating Facial Recognition Software with Face Makeup

• Plant Your Flag, Mark Your Territory

• Ticketmaster breached for months, personal data stolen by hackers

• New Study Shows You Can Predict Credit Rating From Your Online Tech Fingerprint

• Typeform data breach exposes users of many websites

• Hitherto unknown marketing firm exposed hundreds of millions of Americans’ data

• How to Avoid Card Skimmers at the Pump