April 25, 2014

News

• Apple Patches Critical Crypto Flaw

• Bank of England to Hire Penetration Testers to Attack Financial Firms

• Brazilian Senate Approves Internet Bill of Rights

• Eroding Trust Prompts Data Center Construction Boom in Germany

• Facebook, Google, Skype Face Ban Under Russian Surveillance Plan

• Fake Porn App is First SMS Trojan to Land on US Soil

• FBI Informant Sabu Tied to Foreign Cyberattacks

• Iowa State University Servers Hacked for Bitcoin Mining

• Low-level Federal Judges Balking at Law Enforcement Data Requests

• Maryland Focuses on Cybersecurity with Cloud Security Startup Grant

• Maryland State Agencies Hit by Cyberattacks, Records Show

• NIST to Retire NSA-Subverted Dual_EC_DRBG Algorithm

• NIST Releases Tool for Vetting Mobile App Security

• Parents Win Against Cloud Storage of Students’ Private Data

• Siemens Among SCADA Systems Vulnerable to Heartbleed

• Tech Giants, Chastened by Heartbleed, Agree to Fund OpenSSL

• University of Virginia Attacked Again by NullCrew

Journals / Preprints

• Buying Private Data Without Verification

• Cyberterrorism: An Overview

• Data Framing Attack on State Estimation

• Graph-based Anomaly Detection and Description: A Survey

• Handycipher: A Low-tech, Randomized, Symmetric-key Cryptosystem [more from Cryptology ePrint Archive]

• Light Weight Implementation of Stream Ciphers for M-Commerce Applications

• Multidimensional Zero-Correlation Linear Cryptanalysis of the Block Cipher KASUMI

• On the Achievable Error Region of Physical Layer Authentication Techniques over Rayleigh Fading Channels

• PeerRush: Mining For Unwanted P2P Traffic

• PrivLoc: Preventing Location Tracking in Geofencing Services

• Previous Messages Provide the Key to Achieve Shannon Capacity in a Wiretap Channel

• Security Risk Analysis in Peer 2 Peer System; An Approach towards Surmounting Security Challenges

• Using Covert Topological Information for Defense Against Malicious Attacks on DC State Estimation

• New issue: International Journal of Electronic Security and Digital Forensics [Request Full Text]
• New issue: International Journal of Information and Computer Security [Request Full Text]
• New issue: International Journal of Information Security [Request Full Text]

Reports / Blogs

• Cloud Security Report – Spring 2014 [Alert Logic]

• Fourth Quarter, 2013 State of the Internet Report [download via Akamai]

• Heartbleed as Metaphor [Lawfare / Dan Geer]

• iOS Malware Campaign “Unflod Baby Panda” [SektionEins]

• Reference Note on Russian Communications Surveillance [Center for Strategic & International Studies]

• WhiteHat Security Website Stats Report 2014 [summary]

 

April 18, 2014

News

• Americans Report Big Jump in Theft of Personal Data

• Android Malware Repurposed to Thwart 2-factor Authentication

• Appeals Court Overturns Conviction of AT&T “Hacker” Weev

• Berkeley National Lab Claims No Exploits of Heartbleed Prior to Disclosure

• Crimeware Helps File Fraudulent Tax Returns

• Fingerprint Lock in Galaxy 5 Easily Defeated by Hackers

• Half of Personal Data in Bulgaria ‘Completely Compromised’

• Hardware Giant LaCie Acknowledges Year-Long Credit Card Breach

• Heartbleed Use to Hack Through Multifactor Authentication

• Mandiant: China-backed Cyber Threats Show No Signs of Abatement [report – PDF]

• Mt. Gox Founder Unwilling to Answer Questions in US

• Obama Lets NSA Exploit Some Internet Flaws, Officials Say

• Romanian Point-of-Sale Hacker Lured to US by Agents

• Snowden Questions Putin on Surveillance of Citizens

• Supreme Court Likely to Hear NSA Spying Case

• Suspected Arrested in Heartbleed Breach at Canada’s Tax Agency

• 3 Million Cards Stolen in Michaels Breach

• Tor Relay Servers Cut by Heartbleed

• Trove of Software Flaws Used by Spies at Risk

• TrueCrypt Audit Finds No Backdoors or Malicious Code

• 27,000 University of Pittsburgh Employees May be Affected by Breach

Journals / Preprints

• Analyzing Android Browser Apps for file:// Vulnerabilities

• Answering Query Workloads with Optimal Error under Blowfish Privacy

• Cryptanalysis of Sun and Cao’s Remote Authentication Scheme with User Anonymity

• Deciphering a Novel Image Cipher Based on Mixed Transformed Logistic Maps

• Detecting Criminal Organizations in Mobile Phone Networks

• Generating Pseudo-random Numbers by Combining Two Systems with Complex Behaviors

• A Hybrid Analysis for Security Protocols with State

• Information Security Management of Web Portals Based on Joomla CMS

• Low-power Distance Bounding

• Mitigating Moral Hazard in Cyber-Risk Insurance

• Network-on-Chip Firewall: Countering Defective and Malicious System-on-Chip Hardware

• A New Way to Prevent UKS Attacks Using Trusted Computing [more from Cryptology ePrint Archive]

• On the Communication Complexity of Secure Computation

• Practical LDPC Coded Modulation Schemes for the Fading Broadcast Channel with Confidential Messages

• A Qutrit Quantum Key Distribution Protocol with Better Noise Resistance

• On the Security of the Automatic Dependent Surveillance-Broadcast Protocol

Reports / Blogs

• A Curriculum Model for Industrial Control Systems Cyber-Security with Sample Modules [CERIAS]

• Global Phishing Survey: Trends and Domain Name Use in 2H2013 [APWG / summary]

• Hackonomics: Street Prices for Black Market Bugs [ZDNet]

• Improved Kernel Security Through Code Validation, Diversification, and Minimization [CERIAS]

• Information Security: SEC Needs to Improve Controls over Financial Systems and Data [Government Accountability Office]

• Information Security: From Business Barrier to Business Enabler [Infosecurity Europe / summary]

• IT Threat Evolution Q1 2014 [Kaspersky Lab]

• Mapping Water Sector Cyber-Security Vulnerabilities [CERIAS / Also: Mapping Dams Sector Cyber-Security Vulnerabilities]

• A Wake-up Call for SATCOM Security [IOActive / summary]

April 11, 2014

News

• Botnets Take to Mobile Dating Apps

• Cisco, Juniper Hardware Affected by Heartbleed

• DOJ and FTC Issue Guidelines on Sharing Cybersecurity Information

• 80,000 Federal Contractors at Risk after Deltek Breach

• EU Data Retention Directive Thrown Out by European Court of Justice

• Hackers Lurking in Vents and Soda Machines

• Heartbleed Draws Attention to the Chaotic Nature of the Internet

• (ISC)2 Introduces Global Academic Community for Cybersecurity Education

• Judge Backs FTC’s Authority in Data-Breach Case

• 9 Charged in Use of Zeus Banking Malware

• NSA Said to Exploit Heartbleed Bug for Intelligence for Years

• NSA Spies on Human Rights Groups, Snowden Tells EU

• 100,000 Customers’ Data Stolen from Korean Card Processors

• 60,000 Credentials Leak from Syrian Sites

• US to Boycott Brazil’s Anti-Surveillance Plans

Journals

• Android Security Framework: Enabling Generic and Extensible Access Control on Android

• Bypassing Cloud Providers’ Data Validation to Store Arbitrary Data

• Detecting False Data Injection Attacks on Power Grid by Sparse Optimization [Request Full Text]

• Enhanced Chosen-Ciphertext Security and Applications [more from Cryptology E-print Archive]

• Evaluation of the Ability of the Shodan Search Engine to Identify Internet-Facing Industrial Control Devices

• GeoGraphical Passwords

• A Graphical Adversarial Risk Analysis Model for Oil and Gas Drilling Cybersecurity

• Memory-only Selection of Dictionary Pins

• Model-Based Attack Detection and Mitigation for Automatic Generation Control [Request Full Text]

• New Approach for CCA2-Secure Post-Quantum Cryptosystem Using Knapsack Problem

• A New Clustering Approach for Anomaly Intrusion Detection

• A Novel Anonymous Cloud Architecture Design; Providing Secure Online Services and Electronic Payments

• NSA Said to Exploit Heartbleed Bug for Intelligence for Years

• Privacy Implications of Health Information Seeking on the Web

• Possibilistic Information Flow Control for Workflow Management Systems

• Reference-Frame-Independent Quantum-Key-Distribution Server with a Telecom Tether for an On-Chip Client [Request Full Text]

• The Role of Client Isolation in Protecting Wi-Fi Users from ARP Spoofing Attacks

• Secure Node Localization in Mobile Sensor Networks [Request Full Text]
  

• Securing Vehicle Communication Systems by the KLJN Key Exchange Protocol

• Securing Virtualized Datacenters

• To Share or Not to Share in Client-Side Encrypted Clouds

• Smart Grid Mesh Network Security Using Dynamic Key Distribution With Merkle Tree 4-Way Handshaking [Request Full Text]

• Threats Management Throughout the Software Service Life-Cycle

• Towards Automating the Construction & Maintenance of Attack Trees: a Feasibility Study

• Towards the Model-Driven Engineering of Secure yet Safe Embedded Systems

• Two-sources Randomness Extractors for Elliptic Curves

• New: Proceedings First International Workshop on Graphical Models for Security
• New issue: International Journal of Security & Networks [Request Full Text]

Reports / Blogs / Etc.

• Answering the Critical Question: Can You Get Private SSL Keys Using Heartbleed? [Cloudflare]

• Cyberculture and Personnel Security [download via Defense Personnel Security Research Center]

• Executive Order 13636: Privacy and Civil Liberties Assessment Report [download via Department of Homeland Security]

• How a Website Flaw Turned 22,000 Visitors Into a DDoS Botnet [Ars Technica]

• Identifying Personality Disorders that are Security Risks: Field Test Results [download via Defense Personnel Security Research Center]

• IRS Needs to Address Control Weaknesses That Place Financial and Taxpayer Data at Risk [Government Accountability Act]

• Overview of Constitutional Challenges to NSA Collection Activities and Recent Developments [Congressional Research Service – download via Federation of American Scientists]

• What is Heartbleed? The Video [Zulfikar Ramzan]

April 4, 2014

News

• Android Botnet Targets Middle East Banks

• Anti-media Attacks Continue: Al-Arabiya Hacked by NullCrew

• Boxee.tv Hack Exposes Passwords, Messages of 158,000

• Clapper Confirms Warrantless NSA Spying on Americans

• DOJ Silent on Congressional Requests to Investigate Clapper

• DVR, Router Attacks Evidence of Surge in IoT Malware

• Facebook Paid $1.5 Million in Bug Bounties in 2013

• Federal Law Enforcement Pierces Tor

• GCHQ, NSA Targeted Private German Companies

• German Police Confirm Discovery of User Data of 18 Million

• Germany Opens Hearing on US Spying

• Google Asks SCOTUS to Review WiFi Sniffing Case

• (ISC)² Teams with U. of Phoenix for Cybersecurity Scholarships

• NSA Overhaul May Require Phone Companies to Store More Data

• Police Data Collection on Michigan Residents Growing

• Poll: NSA Spying Eroding Trust in IT Companies, Government

• RSA Caught in Further Subversion of Dual EC Encryption

• SEC Defends Email Privacy Practices

• Tax Phishes Spawn on Both Sides of Atlantic

• Tech Start-ups Targets of DDoS Ransoms

• To Instill Love of Bitcoin, Backers Work to Make It Safe

• 2 Banks Withdraw Suits Against Target

• TX Liquor Chain May Have Leaked 550,000 Cards

• US Secretly Created ‘Cuban Twitter’ to Stir Unrest

• US States Investigating Breach at Experian

• Yahoo Encrypts Datacenter Traffic

Journals / Preprints

• Active Linkability Attacks

• Cookies That Give You Away: Evaluating the Surveillance Implications of Web Tracking

• Constant Time Encryption as a Countermeasure Against Remote Cache Timing Attacks

• Countermeasures Against Bernstein’s Remote Cache Timing Attack

• Device-independent Quantum Key Distribution Based on Hardy’s Paradox

• DDoS Attack and Interception Resistance IP Fast Hopping Based Protocol

• Distinguisher-Based Attacks on Public-Key Cryptosystems Using Reed-Solomon Codes

• Efficient Fuzzy Search on Encrypted Data [more from Cryptology ePrint Archive]

• FPGA Acceleration of a Pseudorandom Number Generator Based on Chaotic Iterations

• Human Computable Passwords

• Improving the Throughput of the AES Algorithm with Multicore Processors

• Noise Properties in the Ideal Kirchhoff-Law-Johnson-Noise Secure Communication System

• On Defendability of Security Properties

• On the Incremental Asymmetric Signatures

• On the Privacy of Private Browsing: A Forensic Approach

• Privacy-Preserving Social Network with Multigrained and Multilevel Access Control

• Privacy Tradeoffs in Predictive Analytics

• Relevant Feature Selection Model Using Data Mining for Intrusion Detection System

• Resistance of Statistical Attacks of Parastrophic Quasigroup Transformation

• Secure and Scalable Match: Overcoming the Universal Circuit Bottleneck Using Group Programs

• Secure Protocols for Accountable Warrant Execution

• Seeking Anonymity in an Internet Panopticon

Reports / Blogs / Etc.

• Brokerage Model for Network and Information Security in Education [EU Agency for Network + Information Security]

• The Continuing Public/Private Surveillance Partnership [Bruce Schneier]

• Federal Agencies Need to Enhance Responses to Data Breaches [Government Accountability Office]

• Financial Cyberthreats in 2013: Phishing [Kaspersky Lab – also: New Cyberthreat Real-Time Map]

• Forced Decryption in Government Investigations [Business Crimes Bulletin]

• Garfield Garfield True, or the story behind Syrian Malware, .NET Trojans and Social Engineering [Kaspersky Lab]

• Large Scale UDP Attacks: The 2014 Trend and How to Face It [EU Agency for Network + Information Security]

• Mission Impossible: Hardening Android for Security and Privacy [Tor Project]

• Targeted Attacks and Ukraine [F-Secure]

E-books

• Advanced Persistent Threats: How to Manage the Risk to Your Business