June 13, 2014

PLEASE NOTE: “★” indicates item containing leaked classified documents

NEXT UPDATE 7/3

News

• Canadians Have Right to Online Anonymity, Supreme Court Rules

• Cyberattack Insurance a Challenge for Business

• Apple Makes iPhone Tracking Harder for Marketers

• Cyber Threats Put Energy Sector on ‘Red Alert’

• Deutsche Telekom to Follow Vodafone in Revealing Surveillance

• Facebook, YouTube, Twitter Blocked in Iraq Amid Crisis

• FCC Urges Industry-Led Approach on Cybersecurity

• 14 Year Olds Hack Bank of Montreal ATM

• Germany Admits it Operates Nationwide Spy Stations

• Hundreds of Florida Public Employees Exposed in Breach

• ICS-CERT: Federal Highway Signs Are Easily Hackable

• Internet Giants Erect Barriers to Spy Agencies

• Miami Police Move Forward With Facial Recognition Camera System

• Microsoft Fights US Effort to ‘Break Down the Doors’ of its Irish Datacenter

• NSA: Our Systems Are Too Complex to Retain Data Sought in Lawsuits

• NSA Sued for EPA Records

• P.F. Chang’s Confirms Credit Card Breach

• Privacy Experts: Facebook Changes Mean ‘Unprecedented’ Data Collection

• 2nd China Army Unit Implicated in Online Spying

• Target Taps Former GM Exec as CISO

• Turkish Government Invests €40 Million in Software to Suppress Social Media

• 10,000 Detainees Exposed in Australian Breach

• US Court: Warrantless Mobile Tracking Unconstitutional

• World Cup-related Sites DDOSed

Journals / Preprints

• Always Connected, but are Smart Mobile Users Getting More Security Savvy? A Survey of Smart Mobile Device Users

• Beyond the New ‘Digital Divide’: Analyzing the Evolving Role of National Governments in Internet Governance and Enhancing Cybersecurity

• Breaking `128-bit Secure’ Supersingular Binary Curves

• A Conceptual Interdisciplinary Plug-and-Play Cyber Security Framework

• The Cyber-law of Nations

• Deception with Side Information in Biometric Authentication Systems

• Detecting Botnet by Anomalous Traffic

• DP5: A Private Presence Service [download via University of Waterloo]

• From the Aether to the Ethernet – Attacking the Internet using Broadcast Digital Television

• Hacking the Planet, the Dalai Lama, and You: Managing Technical Vulnerabilities in the Internet Through Polycentric Governance

• How the Design and Evolution of the United States Cyber Command Affect Its Operations

• Identity Management Practices in Cloud Computing Environments [Request Full Text]

• Improved Secure Address Resolution Protocol

• It’s All About the Benjamins: An Empirical Study on Incentivizing Users to Ignore Security Advice [download via University of Cambridge / More from Workshop on Security & Human Behavior ’14]

• Limitations on Information Theoretically Secure Quantum Homomorphic Encryption

• More Efficient Privacy Amplification with Non-Uniform Random Seeds via Dual Universal Hash Function

• Multi-user Protocols with Access Control for Computational Privacy in Public Clouds

• A New Approach for Formal Behavioral Modeling of Protection Services in Antivirus Systems

• On the Security of Trustee-based Social Authentications

• A Piggybank Protocol for Quantum Cryptography

• Platform-Centric Android Monitoring—Modular and Efficient

• Protecting the Mobile Enterprise [Request Full Text]

• Quantifying the Utility-Privacy Tradeoff in the Smart Grid

• Reaction to New Security Threat Class

• Scanning of Rich Web Applications for Parameter Tampering Vulnerabilities

• Security Requirements, Counterattacks and Projects in Healthcare Applications Using WSNs – A Review

• SybilBelief: A Semi-supervised Learning Approach for Structure-based Sybil Detection

• A Statistical Model for Higher Order DPA on Masked Devices [more from Cryptology ePrint Archive]

• Systematic Design of Trust Management Systems for Wireless Sensor Networks: A Review

• Untappable Key Distribution System: A One-time-pad Booster

• User Errors in the Performance of Security Critical Tasks in the Context of Adversarial Noise

• Zero-Correlation Linear Cryptanalysis of Reduced Round ARIA with Partial-sum and FFT

Reports / Blogs / Etc.

• Backstage with the Gameover Botnet Hijackers [Brian Krebs]

• Data Breach: The Cloud Multiplier Effect [download via Netskope]

• Egypt Ramps Up Digital Surveillance [GlobalVoices]

• Few Consumers Trust Companies to Keep Online Info Safe [Gallup]

• Net Losses: Estimating the Global Cost of Cybercrime [download via McAfee]

• Hackers Use Weak Passwords Just Like the Rest of Us [Antonín Hýža]\

• 65 Things We Know About NSA Surveillance That We Didn’t Know a Year Ago [Electronic Frontier Foundation] ★

• Testing Internet Surveillance – By Spying On an NPR Reporter [Ars Technica]

• Trickle Down Surveillance: How the NSA’s Covert Tactics Are Being Employed by Local Law Enforcement [Al Jazeera]

• Windows Security Feature Abused, Blocks Security Software [TrendLabs]

June 6, 2014

PLEASE NOTE: “★” indicates item containing leaked classified documents

News

• American Businesses in China Feel Heat of a Cyberdispute

• China, UN Hold 1st Cybersecurity Talks, as State Media Slams US Tech Firms

• DARPA Prepares $2 Million Cyber Warfare Challenge for DEF CON 2016

• Google Offers End-to-End Encryption for Gmail

• New Lawsuit Revives Debate Over Location Tracking by Police

• NSA Collecting Millions of Faces From Web Images ★

• ‘Operation Tovar’ Targets ‘Gameover’ ZeuS Botnet
  • Days After Cryptolocker Seizure, Cryptowall Ransomware Gains Ground

• Sealed Court Files Obscure Rise in Electronic Surveillance

• 16,000 Korean Employees Possibly Exposed in Army Breach

• 62,000 U. of Pennsylvania Employees May Have Been Exposed in Breach

• Still Reeling From Heartbleed, OpenSSL Suffers Crypto Bypass Flaw

• Target Defends Its Oversight of Customer Data

• TrueCrypt Lives On as New Team Relocates to Switzerland

• 216,000+ Exposed in Paytime, Inc. Breach

• Vodafone Reports Its Networks Widely Used for State Surveillance

Journals / Preprints

• Analysis Of Possible Attack On AODV Protocol In MANET

• Cloud Security: A Gathering Storm

• ConXsense – Automated Context Classification for Context-Aware Access Control

• Crypto-Multimedia [more from Cryptology ePrint Archive]

• Cyber-Physical Testbeds

• Decodability Attack against the Fuzzy Commitment Scheme with Public Feature Transforms

• Error Control Codes: A Novel Solution for Secret Key Generation and Key Refreshment Problem

• Mining Attribute-Based Access Control Policies from Logs

• On Covert Acoustical Mesh Networks in Air

• Post-processing of the Oblivious Key in Quantum Private Queries

• Secure Transmission in Amplify and Forward Networks for Multiple Degraded Eavesdroppers

• Subspace Methods for Data Attack on State Estimation: A Data Driven Approach

Reports / Blogs / Etc.

• Automating Cybersecurity [New York Times]

• Canadian Cyberbullying Legislation Threatens to Further Legitimize Malware Sales [Chrstopher Parsons]

• Consumers’ Location Data: Companies Take Steps to Protect Privacy, but Practices Are Inconsistent, and Risks May Not be Clear to Consumers [GAO]

• Databuse and a Trusteeship Model of Consumer Protection in the Big Data Era [Brookings]

• Ensuring a More Secure Internet: Reset the Net and the Cyber Security Delphi [Mozilla]

• Internet Domain Names: Background and Policy Issues [Congressional Research service / download via Federation of American Scientists]

• Job Analysis Results for Malicious-Code Reverse Engineers: A Case Study [Carnegie Mellon]

• Maritime Critical Infrastructure Protection: DHS Needs to Better Address Port Cybersecurity [GAO]

• Mobile Malware Turns 10 [Sophos]

• The National Security Agency Debate: One Year Later [Brookings]

• Peek Inside a Professional Carding Shop [Brian Krebs – also: They Hack Because They Can]

• Performance of Facial Recognition Software Continues to Improve [NIST]

• Supplemental Guidance on Ongoing Authorization: Transitioning to Near Real-Time Risk Management [download via NIST]

• Supply Chain Risk Management Practices for Federal Information Systems [download via NIST]