April 26, 2013

News

• App Flaw Allows Lock Bypass on 100 Million Android Phones

• ‘Aurora’ Cyber Attackers Were Really Running Counter-Intelligence

• Chinese Hackers Take Aim at American Drones

• CISPA Dies in Senate Over Privacy Concerns

• Congress to Tackle Email Privacy

• Cyberattack Deprives Millions of Dutch of Online ID

• Dubai Firm Agrees to $2.8 Million Fine Over Syria Spyware Sale

• Germany Fines Google Over Wi-Fi Snooping

• Google Joins FIDO’s Crusade to Replace Passwords

• Hacked AP Twitter Reports White House Attacks, Affects Markets 

• Israel Tourists Face Email Inspections

• Java: Exploit Circulating for Just-Patched Critical Flaw

• Judge Denies FBI Request to Hack Computer in Probe

• MD State Servers Outdated and Vulnerable, Audit Finds

• NIST Announces Plan to Sponsor First Cybersecurity FFRDC

• Twitter to Debut Two Factor Authentication After AP Hoax

• UK Shows Increasing Willingness to Fine for Private Sector Breaches

• Thousands of Serial Port Servers Left Open to Attackers

• U.S. Gives Big, Secret Push to Internet Surveillance

Journals

• Active Cyber Defense With Denial and Deception: A Cyber-Wargame Experiment

• Analogical Reasoning and Cyber Security

• Analysis of the Effects of Distributed Denial-of-service Attacks on MPLS Networks

• Enemies Within: Redefining the Insider Threat in Organizational Security Policy

• Logging Safely in Public Spaces Using Color PINs

• A New Trusted and E-Commerce Architecture for Cloud Computing

• On Weak Keys and Forgery Attacks Aainst Polynomial-based MAC Schemes [more from Cryptology ePrint Archive]

• Towards a Networks-of-Networks Framework for Cyber Security

• When Privacy Meets Security: Leveraging Personal Information for Password Cracking

• New issue of Computers & Security – request full text of any article

Reports

• HackingTeam Spyware [Securelist]
• Verizon 2013 Data Breach Investigations Report

Calls for Papers

• 8th International Workshop on Critical Information Infrastructures Security [Amsterdam Sept. 16-18, 2013 – papers due 5/10]

• 14th International Workshop on Information Security Applications [Jeju Island, Korea, Aug. 19-21, 2013 – papers due 5/31]

• 8th International Workshop on Data Privacy Management [Egham, UK, Sept. 12-13, 2013 – papers due 6/2]

• 2nd International Workshop in Quantitative Aspects in Security Assurance  [Egham, UK, Sept. 12-13, 2013 – papers due 6/5]

April 19, 2013

News

• ACLU Files FTC Complaint Over Android Service Provider Security

• Bank Sues Cyberheist Victim to Recover Funds

• CISPA Passes US House

• Cyber Center in Maryland to Sign Partnership Agreements

• DARPA Cyber Chief Peiter “Mudge” Zatko Heads To Google

• Hackers Steal 2.4 Million Card Numbers from Midwestern Grocery Chain

• LulzSec Hacker Gets One Year for Sony Breach

• Massive Botnet Brute Force Attack on WordPress 

• Win32/Nemim.gen!A Trojan Can Delete Its Own Components to Evade Forensics

• Mozilla Takes Hard Stance on Protecting Web Site Certificates

• Phishing Campaign Exploits Boston Marathon Bombing

• Pirate Bay Cofounder Indicted on Hacking Charges

• Potential Targeted Attack on Drone Tech Developers

• Gartner: Security as Service Capturing Enterprise Attention

Journal Articles

• Current Studies On Intrusion Detection System, Genetic Algorithm And Fuzzy Logic

• Cyber-Physical Security: A Game Theory Model of Humans Interacting over Control Systems

• A Defense Against Clock Skew Replication Attacks in Wireless Sensor Networks

• Efficacy of Attack Detection Capability of IDPS Based on it’s Deployment in Wired and Wireless Environment

• Forensic Analysis of Instant Messenger Applications on Android Devices

• A Framework for Risk Assessment in Access Control Systems

• I Think, Therefore I Am: Usability and Security of Authentication Using Brainwaves

• Joint Operation in Public Key Cryptography

• Privacy Preserving Data Mining by Using Implicit Function Theorem

• The Pursuit of Privacy in a World Where Information Control is Failing

• Structural Entropy and Metamorphic Malware [Request]

Reports

• Exploiting Small Office / Home Routers [Independent Security Evaluators]

• Microsoft Security Intelligence Report [summary]

April 12, 2013

News

• Cyberattacks Abound Yet Companies Tell SEC Losses Are Few

• Dutch Banking System Hit by DDoS Attacks

• FBI Smartphone Surveillance Detailed in Court Fight

• House to Take Up Key Cybersecurity Bills Next Week

• Impact of Anonymous’ Attack on Israel Disputed

• ICS-CERT Reports Building Management System Hacks

• IRS: We Can Read Your Email Without a Warrant

• Microsoft Moving Toward 2-Factor Authentication

• MMOGs Fall Victim to Chinese Hackers

• Obama Budget Makes Cybersecurity a Priority 

• Oregon Bank Sued Over Fraudulent Wire Transfers

• Six U.S. Air Force Cyber Capabilities Designated “Weapons”

• South Korea Probe Says North Behind Cyber Attack: Report

• ‘Swatting’ Hoax Tests the Police and Stars Alike

• UMBC Expands Cybersecurity Offerings

• White House Criticizes Amended CISPA for Not Addressing Civil Liberties

• Why Won’t the IRS Deploy Basic Web Security?

Journal Articles

• Analytical Models for Risk-Based Intrusion Response

• Automated Anomaly Detector Adaptation Using Adaptive Threshold Tuning

• Cryptographic Puzzles and DoS Resilience, Revisited [Request]

• Efficient Wireless Security Through Jamming, Coding and Routing

• Fragmentation Considered Vulnerable

• Mohawk: Abstraction-Refinement and Bound-Estimation for Verifying Access Control Policies

• Privacy-preserving Data Mining, Sharing and Publishing

• Role Mining with Probabilistic Models

• RSA Signature: Behind the Scenes

• A Secure Correspondent Router Protocol for NEMO Route Optimization

• A Stochastic Model of Attack Process for the Evaluation of Security Metrics

Reports

• Anatomy of an Exploit: Linksys Router Remote Password Change Hole [Naked Security]

• Managing SSH Keys for Automated Access – Current Recommended Practice [draft – IETF Datatracker]

• Outcome-Based Measures Would Assist DHS in Assessing Effectiveness of Cybersecurity Efforts [Government Accountability Office]

• Reference Certificate Policy [draft – National Institute of Standards & Technology]

• Securing BYOD With Network Access Control, a Case Study [SANS]

April 5, 2013

News

• Activists on Front Lines Bringing Computer Security to Oppressed People

• Anonymous Hacks North Korean Twitter, Flickr Accounts

• ‘Darkleech’ Malware Infects 20,000 Apache Powered Sites

• DHS: Spear Phishing Campaign Targeted 11 Energy Sector Firms

• Google Takes on Rare Fight Against National Security Letters

• Intelligence Lawmakers to Amend Cybersecurity Bill Behind Closed Doors

• Privacy Groups Urge Open Mark-up of House Cyber Security Legislation

• The Real Reason the Feds Can’t Read Your iMessages

• Russians Selectively Blocking Internet

• Security Threats Loom Over New Top Level Domains

• Should the U.S. Limit China-government Influenced IT Systems?

• Who Wrote the Flashback OS Worm?

• ‘Wiped’ Smartphones a Treasure Trove of Personal Data

Journal articles

• An Approach to Secure Mobile Enterprise Architectures

• Autonomous Shared Key Management Scheme for Space Networks [Request]

• Avoiding a War on Unauthorized Computation

• Balancing Trajectory Privacy and Data Utility Using a Personalized Anonymization Model

• A Capability Maturity Model for Digital Investigations

• Cloud Computing 

• Composition of Password-based Protocols [Request]

• Crossing the Great Divide: Transferring Security Technology from Research to the Market 

• Crossing the “Valley of Death”: Transitioning Cybersecurity Research into Practice

• DAG-Based Attack and Defense Modeling: Don’t Miss the Forest for the Attack Trees

• Efficient and Effective Realtime Prediction of Drive-by download Attacks 

• A Formal Study of Two Physical Countermeasures Against Side Channel Attacks [more from Cryptography E-Print Archive]

• Government Risk Management Lags behind Vendor Practices

• The Insecurity of Cloud Utility Models 

• IT for Oppression

• Network Service Authentication Timing Attacks

• Predicting Network Attacks Using Ontology-Driven Inference

• A Shortage of Privacy Engineers

• When Does Targeting Make Sense for an Attacker?

Reports

• 2012 Information Technology Workforce Assessment for Cybersecurity [US CIO Council]

• Cloud Computing: Constitutional and Statutory Privacy Protections [Congressional Research Service – download via Federation of American Scientists]

• Trojan.APT.BaneChant: In-Memory Trojan That Observes for Multiple Mouse Clicks [FireEye]

• Improvements Needed with Tracking and Configuring Army Mobile Devices [DOD Inspector General]

• Report of the Senate Committee on Intelligence Covering the Period January 5, 2011 to January 3, 2013

Calls for Papers

Conferences

• IEEE International Conference on Green Computing and Communications, Security, Privacy, and Trust Computing Track [Beijing, Aug. 20-23, 2013 – papers due 4/17]

Journals

• IEEE Transactions on Reliability – special issue on trustworthy computing, 2014 [papers due 11/1/13]