March 29, 2013

News

• Bruce Schneier: Our Internet Surveillance State

• The Digital Arms Trade [Economist on the vulnerabilities market]

• Egypt: Navy Capture 3 Divers Trying to Cut Undersea Internet Cable

• FBI Pursuing Real-Time Gmail Spying Powers as “Top Priority” for 2013

• First Targeted Attack to use Android Malware Discovered

• House Democrats Press for Action on China’s Alleged Cybertheft

• How Spamhaus’ Attackers Turned DNS Into a Weapon of Mass Destruction

• In Wikileaks Case, State Secrecy in Plain Sight

• Mobile Phone Use Patterns: The New Fingerprint

• Saudi Arabia ‘Threatens Skype Ban’

• Sprint Nears a U.S. Deal to Restrict China Gear

• Top Chinese University Tied to Army’s Cyber-spying Unit

Journal articles

• Analyzing the Security of Windows 7 and Linux for Cloud Computing

• Breaking and Fixing the Android Launching Flow

• Cloud Computing and its Implications for Cybercrime Investigations in Australia

• Cloud Forensics Definitions and Critical Criteria for Cloud Forensic Capability

• A Computer Forensic Method for Detecting Timestamp Forgery in NTFS

• Cyber Security in the Smart Grid: Survey and Challenges

• The Dangers of Surveillance

• Delegate the Smartphone User? Security Awareness in Smartphone Platforms

• The Development of the Architecture of Distributed Network Intrusion Detection System 

• Enhanced Security for Cloud Storage Using File Encryption

• A Metadata-based Method for Recovering Files and File Traces from YAFFS2

• On the Features and Challenges of Security & Privacy in Distributed Internet of Things

• Phishing Detection and Impersonated Entity Discovery Using Conditional Random Field and Latent Dirichlet Allocation

• Secret Image Sharing Using Grayscale Payload Decomposition and Irreversible Image Steganography

• A Secure Correspondent Router Protocol for NEMO Route Optimization

• Smartphone Sensor Data as Digital Evidence

• Semantic Matching of Security Policies to Support Security Experts

• Systematic Mapping Study On Security Threats in Cloud Computing

• A Taxonomy and Survey of Attacks on Digital Signatures

• Unique in the Crowd: The Privacy Bounds of Human Mobility

• Unveiling Zeus

• Validation of Security Protocol Implementations from Security Objectives

Reports

• Consumers and Mobile Financial Services 2013 [US Federal Reserve]

Calls for Papers

• Computers & Security – special issue on trust in cyber, physical and social computing [papers due 12/1/13]

March 22, 2013

[All items full text unless noted]

News

• AT&T Hacker Sentenced to 3.5 Years in Prison
• Amazon and CIA Ink Cloud Deal
• Casino Surveillance Hack Allegedly Nets $32M
• CFAA: Fixing the Worst Law in Technology
• Click-Fraud Botnet Drains $6M Monthly from Advertisers
• CIA’s Gus Hunt On Big Data: We ‘Try To Collect Everything And Hang On To It Forever’
• Consensus Builds for Ban on Warrantless Email Searches
• Feds: No Warrant Needed to Track Your Car With a GPS Device
• Mandiant: Chinese Hacker Unit Attempted to ‘Clean Up’ Online Presence
• New Flaw Allows ‘Total Bypass’ of Android Lock Screen
• NIST to Develop Framework to Protect Critical Infrastructure [download via NIST]
• Norway’s Telenor Suffers Major Breach
• Police: U.S. Law Should Require Logs of Your Text Messages
• South Korea: Banks, Broadcasters Attacked
• What 420,000 Insecure Devices Reveal About Web Security
• $40K Reward for Teen Hacker at Pwnium 

Reports

• 2012 Law Enforcement Requests Report [Microsoft]

• Detecting and Preventing Data Exfiltration Through Encrypted Web Sessions via Traffic Inspection [Carnegie Mellon] 

• IRS Has Improved Controls but Needs to Resolve Weaknesses [Government Accountability Office]

• Justification of a Pattern for Detecting Intellectual Property Theft by Departing Insiders [Carnegie Mellon]

• Tallinn Manual on the International Law Applicable to Cyber Warfare [NATO Cooperative Cyber Defence Centre of Excellence]

• U.S.-China Military Contacts: Issues for Congress [Congressional Research Service via Federation of American Scientists]

Journal Articles

• Anonymous and Distributed Community Cyber Incident Detection
• An Asymptotically Uniformly Most Powerful Test for LSB Matching Detection [Request]
• Digital Droplets: Microsoft SkyDrive Forensic Data Remnants
• Dropbox Analysis: Data Remnants on User Machines
• Employee Negligence: the Most Overlooked Vulnerability
• Flexible Networks for Better Security
• Fraud in Mobile Networks
• Must Social Networking Conflict with Privacy?
• On the Use of Key Assignment Schemes in Authentication Protocols
• Poseidon: Mitigating Interest Flooding DDoS Attacks in Named Data Networking
• The RAppArmor Package: Enforcing Security Policies in R Using Dynamic Sandboxing on Linux
• Security and Privacy Issues in Cloud Computing
• Snoop-Forge-Replay Attacks on Continuous Verification With Keystrokes [Request]
• SSD vs HDD – Data Recovery and Destruction
• StegTorrent: a Steganographic Method for the P2P File Sharing Service
• SVM Training Phase Reduction Using Dataset Feature Filtering for Malware Detection [Request]
• A Timing Channel Spyware for the CSMA/CA Protocol [Request]
• Trust in the Cloud: The Role of SDN
• Unreconciled Collisions Uncover Cloning Attacks in Anonymous RFID Systems [Request]
• Using Smartphones as a Proxy for Forensic Evidence contained in Cloud Storage Services

Hearings

• Cyber Threats from China, Russia and Iran: Protecting American Critical Infrastructure [House Committee on Homeland Security]

Calls for Papers

• 3rd IFIP International Workshop on Security and Cognitive Informatics for Homeland Defense [Regensburg, Germany, Sept. 2-6, 2013 – papers due 4/15]

• 8th International Symposium on Trustworthy Global Computing [Buenos Aires, Argentina, Aug. 30-31, 2013 – papers due 4/15]

• International Conference on Privacy and Security in Mobile Systems [Atlantic City, NJ, June 24 – 27, 2013 – papers due 4/29]

• Workshop on Security Tools and Techniques for Internet of Things [Boston, MA, Sept. 30 – Oct. 2, 2013 – papers due 5/6]

• 20th ACM Conference on Computer and Communications Security [Berlin, Germany, Nov. 4-8, 2013 – papers due 5/8]

• 9th International ICST Conference on Security and Privacy in Communication Networks [Sydney, Australia, Sept. 25-27, 2013 – papers due 5/10]

• Workshop on RFID and IoT Security [Guangzhou, China, Nov. 27, 2013 – papers due 7/1]

March 15, 2013

[All items full text unless noted]

News

• 911 Hack Sends SWAT Team to Security Researcher’s House
• Credit Agencies: Hackers Stole Celebrity Reports
• Danger Lurks in Growing New Internet Nationalism 
  
• DHS Cybersecurity Chief to Head to The Chertoff Group
• Facebook Backs Away from CISPA
• Google Censors AdBlock for Android
• Is Mandiant Wrong About the Chinese Cyberthreat?
• NIST Vulnerability Database Hacked
• The Quest to Crack the Gauss Warhead
• Researchers: Java’s Security Flaws Unlikely to be Fixed Soon
• Retailer Sues Visa Over $13 Million ‘Fine’ for Being Hacked
• Reuters Editor Indicted on Anonymous Conspiracy Charge
• South Korea Braces for North’s Cyberattacks
• North Korea Blames US, South for Attacks
• US Cyber Command Chief Warns of Rising Cyberattacks on Banks
• US Demands China Crack Down on Cyber Attacks
• US to Let Spy Agencies Scour Americans’ Finances
• Why the US Is Not in a Cyber War
• Wiretapping Firm Says Telecoms Handing Over More Data Than Authorized

Journal Articles

• Understanding and Overcoming Cyber Security Anti-Patterns

• Nepenthes Honeypots Based Botnet Detection

• Security Assessment of Software Design using Neural Network

• The Value of User-Visible Internet Cryptography

• Secure Wireless Communications via Cooperative Transmitting

• Principles of Security: Human, Cyber, and Biological

• Data Retrieval over DNS in SQL Injection Attacks

• On the Exact Solution to a Smart Grid Cyber-Security Analysis Problem [Request]

• User Authentication Scheme with Anonymity, Unlinkability and Untrackability for Global Mobility Networks [Request]

• Static Detection of Logic Vulnerabilities in Java Web Applications [Request]

• Physical Layer Security in Wireless Smart Grid [Request]

• Secrecy Capacity of Wireless Channels Subject to Log-normal Fading  [Request]

Conferences & Hearings

• Yale Law School Location Tracking and Biometrics Conference

• DHS Cybersecurity: Roles and Responsibilities to Protect the Nation’s Critical Infrastructure

March 8, 2013

[All items full text unless noted]

News

• Administration Turns to Industry for Support on Cybersecurity Order
• Attorney General: Aaron Swartz Case Was a ‘Good Use of Prosecutorial Discretion’
• Australia Signs up to Europe Convention on Cybercrime 
• Chrome; Firefox; IE 10; Java; Win 8 Fall at #pwn2own Hackfest 
• Evernote Breach: What It Means To Enterprise IT
• $5 Million Class Action Lawsuit Over LinkedIn Data Breach Dismissed 
• FTC Dumps on Scammers who Blasted Millions of Text Messages
  
• India: Attacks on Infrastructure Came from China 
• Mobile Malcoders Pay to (Google) Play
• New Privacy Board Investigates Terrorism Agency’s Data Dragnet
• Researchers Uncover More Details on Attacks Using Fake Mandiant Report
• Transcript of Bradley Manning’s plea statement [via Alexa O’Brien]
• Two Texas Bills Could Shape Mobile Privacy
• US 9th Circuit: Reasonable Suspicion Needed for Border Laptop Searches [decision]
• Vupen CEO Chaouki Bekrar Addresses Zero Day Marketplace Controversy
  
• Where Apps Meet Work, Secret Data Is at Risk

Reports

• 2013 Cybersecurity Executive Order: Overview and Considerations for Congress [Congressional Research Service] 

• Cross Agency Priority Goal: Cybersecurity: FY2013 Q1 Status Update [White House]

• Cybersecurity: A Better Defined and Implemented National Strategy Is Needed to Address Persistent Challenges [Government Accountability Office]

• The Cybersecurity Partnership Between the Private Sector and Our Government [Senate hearing]

• ICANN’s FY 14 Security, Stability and Resiliency Framework [Internet Corporation for Assigned Names & Numbers]

• The MAL: A Malware Analysis Lexicon [Carnegie Mellon]

• Paper, Plastic… or Mobile?: An FTC Workshop on Mobile Payments [Federal Trade Commission]

• The Risk of Insider Fraud: Second Annual Study [Ponemon Institute]

• Task Force Report: Resilient Military Systems and the Advanced Cyber Threat [U.S. Department of Defense]

• Transparency Report: Shedding More Light on National Security Letters [Google]

Journal articles

• A Review On Securing Distributed Systems Using Symmetric Key Cryptography

• Transparent Data Encryption — Solution for Security of Database Contents

• Security Analysis on “An Authentication Code Against Pollution Attacks in Network Coding”

• A Newer User Authentication, File Encryption and Distributed Server Based Cloud Computing Security Architecture

• Longitudinal Analysis of Android Ad Library Permissions

• Securing Web Services Using XML Signature and XML Encryption

• Cloud Computing — An Approach with Modern Cryptography

• Inter-Cloud Data Security Strategies

• Secure Video Streaming Plug-In

• The Case for Online Obscurity

• Real-time Digital Forensics and Triage

• Experimental Design Challenges in Digital Forensics

• Physical Layer Security in Distributed Wireless Networks Using Matching Theory

• Potent and Stealthy Control Flow Obfuscation by Stack based Self Modifying Code

• Non-Cooperative Location Privacy 

• Towards Secure Multi-Keyword Top-k Retrieval over Encrypted Cloud Data 

• NICE: Network Intrusion Detection and Countermeasure Selection in Virtual Network Systems 

• WarningBird: A Near Real-Time Detection System for Suspicious URLs in Twitter Stream 

• Location-Aware and Safer Cards: Enhancing RFID Security and Privacy via Location Sensing

• Malware Clearance for Secure Commitment of OS-Level Virtual Machines 

• CipherXRay: Exposing Cryptographic Operations and Transient Secrets from Monitored Binary 

• DNS for Massive-Scale Command and Control

• To Lie Or To Comply: Defending Against Flood Attacks in Disruption Tolerant Networks

• Entrusting Private Computation and Data to Untrusted Networks

• On the Exact Solution to a Smart Grid Cyber-Security Analysis Problem [Request]

• Smart Meter Privacy: A Theoretical Framework [Request]

• Cyber-Physical Security Testbeds: Architecture, Application, and Evaluation for Smart Grid [Request]

• Neural Network Trojan [Request]

• Spread Identity: A New Dynamic Address Remapping Mechanism for Anonymity and DDoS Defense [Request]

• A Systematic Approach to Practically Efficient General Two-party Secure Function Evaluation  Protocols and Their Modular Design [Request]

• Propagation Modeling of Active P2P Worms Based on Ternary Matrix

• An Enhanced Smart Card Based Remote User Password Authentication Scheme

• Towards Reducing False Alarms in Network Intrusion Detection Systems with Data Summarization Technique [Request]\

• A More Secure and Scalable Routing Protocol for Mobile Ad Hoc Networks [Request]

• Improving Intrusion Detection for Imbalanced Network Traffic [Request]

• Predicate Encryption for Multi-inner-products [Request]

• Secure SIP Authentication Scheme Supporting Lawful Interception [Request]

• Efficient Chosen Ciphertext Secure Public-key Encryption Under Factoring Assumption [Request]

• A Privacy-preserving Acceleration Authentication Protocol for Mobile Pay-TV Systems [Request]

• Designing Role-based Access Control Using Formal Concept Analysis [Request]

Calls for Papers

• 1st International Workshop on Emerging Cyberthreats and Countermeasures [Regensburg, Germany, Sept. 2-6, 2013 – papers due 3/30]

• RECON 2013 [Montreal, Canada, June 21-23 – papers due 3/31]

• Workshop on Foundations of Computer Security [New Orleans, LA,  June 29, 2013 – papers due 4/10]

• Workshop on Risk Perception in IT Security and Privacy [Newcastle, UK, July 24-26, 2013 – paper due 5/30]

• 6th International Conference on Security of Information and Networks [Aksaray, Turkey, Nov. 26-28, 2013 – papers due 6/30]

• 10th International Symposium on Visualization for Cyber Security [Atlanta, GA, Oct. 14, 2013 – papers due 7/8]

March 1, 2013

[All items full text unless noted]

• arXiv [preprints]:

• Mitigating Timing Side Channel in Shared Schedulers
• SecLaaS: Secure Logging-as-a-Service for Cloud Forensics
• Wireless Intrusion Detection Systems
• Cloud Forensics: A Meta-Study of Challenges, Approaches, and Open Problems
• DroidAnalytics: A Signature Based Analytic System to Collect, Extract, Analyze and Associate Android Malware

• Busch, N., & Givens, A. D. (2013). Realizing the Promise of Public-Private Partnerships in U.S. Critical Infrastructure Protection. International Journal of Critical Infrastructure Protection.

• Craig-Wood, K. (2013). Open Source as the Secure Alternative: A Case Study. Computer Fraud & Security.

• Donohue, B. (March 1). The Java Zero-Day Procession Continues. threatpost. [Also: MiniDuke: Espionage via Adobe Exploits / Botnet Shut Down Live at RSA / Researchers Bypass Google 2-Factor Authentication]

• Gao, C., & Liu, J. (2013). Modeling and Restraining Mobile Virus Propagation. IEEE Transactions on Mobile Security.

• Gisolf, F., et al. (2013). The Effects of Switching the Camera Module from BlackBerry Curve 9360 Devices. Digital Investigation.

• IEEE Security & Privacy:

• Federated Identity Management in Industry: We Built it; Why Won’t They Come? 
• Protecting Your Software Updates
• Stringing a Bridge across the Transition Chasm: One Research Team’s Advice to Other Researchers
• Twitsper: Tweeting Privately 
• “All the Better to See You with, My Dear”: Facial Recognition and Privacy in Online Social Networks
• The Personal Data Store Approach to Personal Data Security
• LTE/SAE Security Issues on 4G Wireless Networks
• Mitigating XML Injection Zero-Day Attack through Strategy-based Detection System

• IEEE Transactions on Information Forensics & Security [Abstracts / Request]:

• A Framework for Decision Fusion in Image Forensics based on Dempster-Shafer Theory of Evidence
• Destination Assisted Cooperative Jamming for Wireless Physical Layer Security
• Acoustic Eavesdropping Attacks on Constrained Wireless Device Pairing
• Joint Global and Local Structure Discriminant Analysis
• Estimating EXIF Parameters Based on Noise Features for Image Manipulation Detection
• LDTS: A Lightweight and Dependable Trust System for Clustered Wireless Sensor Networks
• Reversible Data Hiding in Encrypted Images by Reserving Room before Encryption
• Towards Trustworthy Resource Scheduling in Clouds
• Channel Aware Encryption and Decision Fusion for Wireless Sensor Networks
• Enforcing Secure and Privacy-Preserving Information Brokering in Distributed Information Sharing
• Automatic General-purpose Sanitization of Textual Documents
• Tradeoff between Security and Performance in Block Ciphered Systems with Erroneous Ciphertexts
• Multi-contingency Cascading Analysis of Smart Grid based on Self-organizing Map
• JPEG Image Steganalysis Using Multi-variate PDF Estimates with MRF Cliques
• Comparative Study of Trust Modeling for Automatic Landmark Tagging
• Distributed Architecture with Double-Phase Microaggregation for the Private Sharing of Biomedical Data in Mobile Health
• Securing Online Reputation Systems through Trust Modeling and Temporal Analysis

• Information Management & Computer Security:

• Usable Secure Email Communications – Criteria and Evaluation of Existing Approaches
• Psychosocial Risks: Can Their Effects on the Security of Information Systems Really be Ignored?
• Intrusion Detection and the Role of the System Administrator
• Human Aspects of Information Security: An Empirical Study of Intentional Versus Actual Behavior
• ? Method to Calculate Social Networking Hazard Probability in Definite Time

• Langner, R., & Pedersen, P. (2013, Feb.) Bound to Fail: Why Cyber Security Risk Cannot Simply be ‘Managed’ Away [Brookings].

• Martinez, J. (Feb. 28). White House Debating Actions to Retaliate Against Foreign Cyberattacks. The Hill. [Also: House to Consider Email Privacy Bill / Daniel Calls for Industry Help]

• Mozur, P. (Feb. 28). China Alleges Cyberattacks Originated in U.S. Wall Street Journal.

• Network Security:

• Penetrating the Cloud
• Securing your Telemetry: Making DCIM Unsniffable
• A Smart Grid Must Also be Streetwise
• Moving Security Testing Into the Developer’s Domain
• Life’s Certainties: Death, Taxes and APTs

• Ofuonye, E., & Miller, J. (2013). Securing Web-Clients with Instrumented Code and Dynamic Runtime Monitoring. Journal of Systems and Software

• Press, J. (Feb. 26). BlackBerry not as Secure as Believed, Memo Warns [Canada’s] Federal Workers. National Post.

• Research Journal of Information Technology:

• An Optimal Key Management Scheme for Group Key Sharing with Polynomial Expression
• Randomness Improvement of AES using MKP

• Savage, C. (Feb. 26). Justices Turn Back Challenge to Broader US Eavesdropping. New York Times. [Also: Samsung Armors Android / Manning Admits to Giving Files to WikiLeaks]

• Security & Communication Networks [Abstracts / Request]:

• SENSORLock: A Lightweight Key Management Scheme for Wireless Sensor Networks
• Characterization of Attacks Collected from the Deployment of Web Service Honeypot
• Privacy Theft Malware Multi-process Collaboration Analysis
• Performance Comparison Between IBE-HWMP and ECDSA-HWMP
• A Fictitious Play-based Response Strategy for Multistage Intrusion Defense Systems
• Efficient Three-party Encrypted Key Exchange Using Trapdoor Functions
• A Study of IP Prefix Hijacking in Cloud Computing Networks
• Verifying Cloud Service-level Agreement by a Third-party Auditor
• Password-Authenticated Cluster-based Group Key Agreement for Smart Grid Communication
• A Hill Cipher-based Remote Data Possession Checking in Cloud Storage
• New Public Key Cryptosystems Based on Non-Abelian Factorization Problems
• SRC: A Multicore NPU-based TCP Stream Reassembly Card for Deep Packet Inspection

• Soghoian, C. (Feb. 26). New Document Sheds Light on Government’s Ability to Search iPhones [ACLU].

• Symantec. (Feb. 26). Stuxnet 0.5: The Missing Link. 

Proceedings

11th USENIX Conference on File and Storage Technologies [downloads via USENIX]:

• Shroud: Ensuring Private Access to Large-Scale Data in the Data Center 
• Memory Efficient Sanitization of a Deduplicated Storage System