October 31, 2014

News 

• California Police Trade Nude Photos from Detainees’ Phones in Multi-year ‘Game’

• Cricket Revealed As Mobile ISP That Was Blocking Encrypted Emails

• Drupal: Assume Systems Have Been Compromised

• FBI Impersonated Seattle Times‘ Site to Serve Suspect Malware

• FCC Fines Two Mobile Carriers $5Mn for Exposing Customer Data

• Feds Identify Suspected ‘Second Leaker’ for Snowden Reporters

• GCHQ Accesses Mass Surveillance Data Without a Warrant 

• Gmail Drafts Used for Malware Command and Control 

• Home Depot Breach Costed Credit Unions $60 Mn

• Latest Android OS Adds Encryption by Default

• Navy Hacker Sentenced to 2 Years in Prison

• Pirate Bay Founder Sentenced to 3.5 Years on Hacking Charges

• Report Reveals Wider Tracking of Postal Mail in US

• Researchers Finds Malicious Tor Exit Node Adding Malware

• Sony Xperia Smartphones Send User Data to China via Malware

• UK Police Arrest Suspect in $2.6Mn ATM Heist

• White House Network Breached

Journals / Preprints 

• Advanced Social Engineering Attacks

• An Agent-Based Socio-Technical Approach to Impact Assessment for Cyber Defense [Request Full Text]

• Andlantis: Large-scale Android Dynamic Analysis

• An Application Package Configuration Approach to Mitigating Android SSL Vulnerabilities

• Classification of Clickjacking Attacks and Detection Techniques [Request Full Text]

• Cyber Security in Developing Countries, a Digital Divide Issue: The Case of Georgia [Request Full Text]

• Data Driven Authentication: On the Effectiveness of User Behaviour Modelling with Mobile Device Sensors

• Design of Binary Quantizers for Distributed Detection under Secrecy Constraints

• Differentially Private Location Privacy in Practice

• Efficient Key Generation for Dynamic Blom’s Scheme

• Elements of Trust in Named-Data Networking

• Enable Portrait Privacy Protection in Photo Capturing and Sharing

• Enter Sandbox: Android Sandbox Comparison

• A First Look at Firefox OS Security

• Hiding Sound in Image by K-LSB Mutation

• Infinite Choices of Data Aggregations with Linear Number of Keys

• Malware “Ecology” Viewed as Ecological Succession: Historical Trends and Future Prospects

• Outsource Photo Sharing and Searching for Mobile Devices With Privacy Protection

• Policing as a Service in the Cloud [Request Full Text]

• Proposed Methodology for Cyber Criminal Profiling [Request Full Text]

• SAT Based Analysis of LTE Stream Cipher ZUC

• Secure Team Composition to Thwart Insider Threats and Cyber-Espionage

• Self-Healing Computation

• A Systematic Security Evaluation of Android’s Multi-User Framework

• Sprobes: Enforcing Kernel Code Integrity on the TrustZone Architecture

• That Ain’t You: Detecting Spearphishing Emails Before They Are Sent

• Toward a Monopoly Botnet Market [Request Full Text]

• Two Novel Defenses against Motion-Based Keystroke Inference Attacks

• Proceedings: Third Workshop on Mobile Security Technologies (MoST) 2014

Reports / Blogs / Etc.

• APT 28: A Window Into Russia’s Cyber Espionage Operations? [FireEye]

• California Data Breach Report [California Attorney General]

• Cyber Insurance: Only Fools Rush In [IT World]

• File Sharing Apps Threaten Enterprise Data Regulation [Digital Guardian]

• Hacking Team Manuals Show Spyware Sold to Despots and Police Worldwide [Intercept]

• How Verizon’s Advertising Header Works [Web Policy]

• Keyless Cars ‘Increasingly Targeted by Thieves Using Computers’ [BBC]

• Metadata and Privacy: A Technical and Legal Overview [Data Privacy Commissioner of Canada]

• Ongoing Sophisticated Malware Campaign Compromising ICS (Update A) [ICS-CERT]

• Operation SMN: Axiom Threat Actor Group Report [Novetta / summary]

• ‘Replay’ Attacks Spoof Chip Card Charges [Brian Krebs]

• Spritz: A New RC4-Like Stream Cipher [Bruce Schneier]

• What is the CyberEurope2014 and Why Is It So Important? [Security Affairs]

October 24, 2014

News

• Aging ATMs Draw Intense Criminal Interest

• Apple Admits MITM iCloud Attack in China

• Apple OS X Yosemite and iOS 8 Broadcast Location by Default

• Australia: Warrantless Government Data Requests Pass 500,000

• Banks: Credit Card Breach at Staples Stores

• Chile’s National Public Transit Ticketing System Hacked

• Cops Need a Warrant to Grab Your Cell Tower Data, Florida Court Rules

• Crypto Wars Return to Congress After FBI Calls for Mandatory Backdoors

• Data of 7.45 Million Pandora TV Users Exposed to Hackers

• Data Protection Officials Adopt Internet of Things Declaration and Big Data Resolution

• DC Police Are Using the ‘Stingray’ Cell Phone Tracking Tool

• FBI: 500 Million Financial Records Hacked in Last Year

• Hacker of Federal Networks Sentenced to Two Years

• In a First, FTC Fines Intel for Exporting Encryption

• New FTC Chief Technologist Worked on Snowden Docs

• Obama Uses Executive Order To Push Chip and Pin

• Online Transcript Broker Exposes Data of ~100,000

• Russia and China Edge Out US With Proposed Cyber Security Pact

• Phone Hackers Dial and Redial to Steal Billions

• Russia Ruled Out in Chase Breach, US Officials Say

• To Comply with EU Law, Amazon Opens German Data Centers

• Virginia Police Have Been Secretively Stockpiling Private Phone Records

• Woman Charged with Using Spyware to Eavesdrop on Police Phone

Journals / Preprints

• Above the Cloud: Enhancing Cybersecurity in the Aerospace Sector

• Beyond Blacklisting: Cyberdefense in the Era of Advanced Persistent Threats [Request Full Text]

• Bitcoin Over Tor Isn’t a Good Idea

• Composing Security Protocols: From Confidentiality to Privacy

• Cryptographic Enforcement of Information Flow Policies without Public Information

• A Cut Principle for Information Flow

• Denial-of-Service Attacks in Bloom-Filter-Based Forwarding [Request Full Text]

• Differential Game-Based Strategies for Preventing Malware Propagation in Wireless Sensor Networks [Request Full Text]

• Differentially Private Empirical Risk Minimization: Efficient Algorithms and Tight Error Bounds

• Distributed Secret Dissemination Across a Network

• DNSSEC for Cyber Forensics

• Dynamic Differential Privacy for Location Based Applications

• Enhanced TKIP Michael Attacks

• IPv6 Implementation Decisions for an Organization [Request Full Text]

• Lattice-based Obfuscation for Re-encryption Functions

• Permission Use Analysis for Vetting Undesirable Behaviors in Android Apps [Request Full Text]

• The Prevention and Mitigation of Breaches of Personal Information Databases: A Theoretical Framework

• Requirements for Standard Elliptic Curves [more from Cryptology ePrint Archive]

• Remote Data Possession Checking with Enhanced Security for Cloud Storage

• Secure ARP and Secure DHCP Protocols to Mitigate Security Attacks

• Securing Smartphones: A µTCB Approach [Request Full Text]

• Security – A Perpetual War: Lessons from Nature

• Strongly Secure Quantum Ramp Secret Sharing Constructed from Algebraic Curves over Finite Fields

• Unshared Secret Key Cryptography

• New issue: IET Information Security [Request Full Text]

Reports / Blogs / Etc.

• Analysis Report: Operation Distributed Dragons [download via Tiger Security]

• Apple, Boyd, and Going Dark [Just Security]

• Content of Premarket Submissions for Management of Cybersecurity in Medical Devices [download via Food & Drug Administration]

• Continuous Breach: A New State of Mind, Especially for Retailers [Damballa]

• Cyber-Espionage and Trade Agreements: An Ill-Fitting and Dangerous Combination [Electronic Frontier Foundation]

• Cybersecurity: Authoritative Reports and Resources, by Topic [Congressional Research Service / download via Federal of American Scientists]

• Flaws in DTM Components Threaten SCADA Systems [Security Affairs / Also: Security “Front Doors” vs. “Back Doors”: A Distinction Without a Difference]

• A Look Behind the Snapchat Photo Leak Claims [New York Times]

• Malware in Ad Networks Infects Visitors and Jeopardizes Brands [Proofpoint]

• Micro-targeted Malvertising via Real Time Ad Bidding [Invincea]

• Penetration Test of the Food and Drug Administration’s Computer Network [FDA Inspector General]

• Q3 2014 State of the Internet – Security Report [Akamai / summary]

• Targeted Attacks: Stealing Information Through Google Drive [TrendLabs]

• Verizon Wireless Injects Identifiers Linking Users to Web Requests [Ars Technica]

• Whisper: The Facts [Guardian]

October 17, 2014

PLEASE NOTE: “★” indicates item containing leaked classified documents

News

• Bahraini Activists Hacked by Their Government Go After UK Spyware Maker

• FBI Director Calls Encryption a Hindrance to Crime Solving 

• FBI Warns Industry of Chinese Cyber Campaign

• Home Depot Facing 21 Breach-Related Class Action Suits

• ICS-CERT: ‘Large, Critical’ US Manufacturer Infiltrated for Months

• JPMorgan Hackers Said to Probe 13 Financial Firms

• Kmart Hit by Point-of-Sale Malware

• Korea Suffers 106 Million+ Breaches in 4 Years

• Oregon Employment Dept. Breach Affects 850K

• UN Finds Mass Surveillance Violates International Treaties 

• Russian Hackers Exploit Windows Bug for Spying, Report Says

• ‘Second Snowden’ Leaker Within US Intelligence Confirmed

• SSL Broken, Again, in POODLE Attack

Journals / Preprints

• An Automated Group Key Authentication System Using Secret Image Sharing Scheme

• Digital Investigation of Security Attacks on Cardiac Implantable Medical Devices

• Do Rogue Websites and High Risk Advertising Undermine Social Policy in Vietnam?

• Higher Order Differentiation Over Finite Fields with Applications to Generalising the Cube Attack

• Imperfect Secrecy in Wiretap Channel II

• Keylogging-Resistant Visual Authentication Protocols [Request Full Text]

• A Language for Describing Attacks on Cyber-Physical Systems

• Location Spoofing Detection for VANETs by a Single Base Station in Rician Fading Channels

• Masking and Leakage-resilient Primitives: One, the Other(s) or Both? [Request Full Text]

• Model the System from Adversary Viewpoint: Threats Identification and Modeling

• Multidimensional Zero-Correlation Linear Attacks on Reduced-Round MISTY1

• On the Oblivious Transfer Capacity of Generalized Erasure Channels against Malicious Adversaries

• On the Vulnerabilities of the Virtual Force Approach to Mobile Sensor Deployment [Request Full Text]

• Polar Coding for the General Wiretap Channel

• POSTER: Privacy-preserving Indoor Localization

• Rate-Distortion Theory for Secrecy Systems

• A Real Time OCSVM Intrusion Detection Module with Low Overhead for SCADA Systems

• Rhetoric Versus Reality: U.S. Resistance to Global Trade Rules and the Implications for Cybersecurity and Internet Governance

• Risk Assessment Algorithm in Wireless Sensor Networks using Beta Distribution

• Risky Business: Lessons for Mitigating Cyber Attacks from the International Insurance Law on Piracy

• Secure Key Establishment for Device-to-Device Communications

• USBcat – Towards an Intrusion Surveillance Toolset

• XSS Peeker: A Systematic Analysis of Cross-site Scripting Vulnerability Scanners

• New issue: IEEE Security and Privacy 
• New issue: IEEE Transactions on Information Forensics and Security [Request Full Text]
• New issue: International Journal of Information Security [Request Full Text]
• New issue: Security and Communication Networks [Request Full Text]
• Proceedings: 2014 International Workshop on Advanced Intrusion Detection and Prevention

Reports / Blogs / Etc.

• Core Secrets: NSA Saboteurs in China and Germany ★

• Cybersecurity Workforce Competencies: Preparing Tomorrow’s Risk-Ready Professionals [University of Phoenix / (ISC)²]

• Democracy in Hong Kong Under Attack [Volexity]

• How Microsoft Appointed Itself Sheriff of the Internet [Wired]

• How Should Health Data Be Used? Privacy, Secondary Use, and Big Data Sales [Yale]

• Regional Advanced Threat Report 1H 2014 [FireEye]

• Is Russia Increasingly Relying on Cyber Warfare for Foreign Policy? [Defence IQ]

• Russian Hi-Tech Crime Trends 2014 [Group-IB / summary]

• SSDP Reflection DDoS Attacks [Prolexic]

• Twitter’s First Amendment Suit & the Warrant-Canary Question [Just Security]

• 2014 Cost of Cybercrime Reports [Ponemon]

• Voiceprints Being Harvested by the Millions [Associated Press]

• Who’s Watching Your WebEx? [Brian Krebs]

October 10, 2014

News

• Attack on JP Morgan Raises Alarms at White House and on Wall Street [More]

• AT&T Hit by Insider Attack, Unspecified Number of Accounts Accessed

• Dairy Queen: 400 Stores Hit by Point-of-Sale Malware

• Department of Justice Clears Cybersecurity Information Sharing Platform

• DoD May Invite Cloud Vendors Into Govt. Data Centers

• DHS No Longer Needs Permission to Monitor Other Agencies’ Networks for Vulnerabilities

• Dubai Police to Use Google Glass Facial Recognition

• FBI Pays Visit to Researcher Who Revealed Yahoo Hack

• Feds Argue Warrantless Hack of Silk Road Would Have Been Legal

• FDA: Medical Device Cybersecurity Necessary, But Optional

• Google Chief on NSA: ‘We’re Going to End Up Breaking the Internet’

• Grindr Disables Proximity Searching Amid Egypt’s Attacks on Gay Men

• ‘Huge’ Data Leak at Largest U.S. Bond Insurer

• ISACA Launches Entry-Level Certificate

• Marriott Slapped With $600K Fine After Blocking Guest Wi-Fi

• New York Quickly Nixes Cellphone Tracking Devices in Phone Booths

• Report: Reddit Used to Hijack 17,000 Apple Devices

• SMS Services Down In Tajikistan After Protest Calls

• Surveillance Drives South Koreans to Encrypted Messaging Apps

• 3rd Party Snapchat Client Leaks 100,000+ User Photos

• UK: Devices Being Remotely Wiped in Police Custody

• Unpatchable USB Malware Open Sourced

Journals / Preprints

• An Anonymous Communication Scheme based on Ring Signature in VANETs

• Anonymous Group-based Routing in MANETs

• Autonomic Intrusion Detection: Adaptively Detecting Anomalies Over Unlabeled Audit Data Streams in Computer Networks

• Brains and Pseudorandom Generators

• Calm Before the Storm: The Challenges of Cloud Computing in Digital Forensics

• Circulant Matrices and Differential Privacy

• A Covert Channel Based on Web Read-time Modulation

• A Cyber Age Privacy Doctrine: More Coherent, Less Subjective, and Operational

• Cyber Scanning: A Comprehensive Survey [Request Full Text]

• Defending Tor from Network Adversaries: A Case Study of Network Path Prediction

• Design of 8-bit Dedicated Microprocessor for Content Matching in NIDPS

• Differentially Private Multi-party Computation: Optimality of Non-Interactive Randomized Response

• Digital information Warfare Trends in Eurasia [Request Full Text]

• Eight Nails into Katz’s Coffin

• An Empirical Evaluation of Information Metrics for Low-rate and High-rate DDoS Attack Detection

• Flow and Threat Modelling of a Context Aware System [Request Full Text]

• A Framework for Analysis and Comparison of Dynamic Malware Analysis Tools

• Fuzzy Multiple Subspace Fitting for Anomaly Detection [Request Full Text]

• Generalized Hash Functions based on Multivariate Ideal Lattices

• Ghost-in-the-Wireless: Energy Depletion Attack on ZigBee

• Human Computable Passwords

• Hybrid Wars: 21st Century’s New Threats to Global Peace and Security

• Impacts of Increasing Volume of Digital Forensic Data: A Survey and Future Research Challenges

• Immune Cooperation Mechanism Based Learning Framework

• Implementing Information Security Best Practices on Software Lifecycle Processes: The ISO/IEC 15504 Security Extension

• An Intrusion Detection System for the Protection of Railway Assets Using Fiber Bragg Grating Sensors

• Loc-Auth: Location-Enabled Authentication Through Attribute-Based Encryption

• Packet Drop Attack Detection Techniques in Wireless Ad hoc Networks: A Review

• Privacy by Design: From Technologies to Architectures

• Quantum Fully Homomorphic Encryption Scheme Based on Universal Quantum Circuit

• Reading This May Harm Your Computer: The Psychology of Malware Warnings

• Retrievable Data Perturbation Method Used in Privacy-preserving in Cloud Computing [Request Full Text]

• Right to Information in Canada: Drawing Analogue Law into a Digital Present

• Robust Authenticated-Encryption: AEZ and the Problem that it Solves [more from Cryptology ePrint Archive]

• A Survey of Fault Attacks in Pairing-based Cryptography [Request Full Text]

• Survey on Zero-Day Polymorphic Worm Detection Techniques [Request Full Text]

• Trust and Privacy Exploitation in Online Social Networks [Request Full Text]

• Vulnerabilities and Mitigation Techniques Toning in the Cloud: A Cost and Vulnerabilities Coverage Optimization Approach Using Cuckoo Search Algorithm with Lévy Flights

• XML Schema-based Minification for Communication of Security Information and Event Management (SIEM) Systems in Cloud Environments

• New issue: IEEE Transactions on Dependable and Secure Computing

Reports / Blogs / Etc.

• Adobe’s E-book Reader Sends Your Reading Logs Back to Adobe – in Plain Text [Ars Technica]

• Analysis of a Cybercrime Infrastructure [RE: Qbot botnet / download via Proofpoint]

• Cybersecurity: A Special Report [Washington Post]

• Data Breaches in Europe: Reported Breaches of Compromised Personal Records in Europe, 2005-2014 [Central European University]

• In the Pursuit of Digital Rights: Spotlight on Turkey [Access]

• Internet Organized Crime Assessment [Europol]

• The Invisible Violence of Cyber War in Hong Kong’s Umbrella Revolution [Global Voices]

• Linking APTs from 2011 and 2014 to an Active Scam Network [Blue Coat]

• Online Activism and Why the Computer Fraud and Abuse Act Must Die [Molly Sauer]

• Public Private Partnerships in Network and Information Security Education [ENISA]

• Revisiting Android Disk Encryption [Nikolay Elenkov]

• Signed Malware = Expensive “Oops” for HP [Brian Krebs]

• Smartphone “Backdoors” and Open Computing [Julian Sanchez]

• 2014 Deloitte-NASCIO Cybersecurity Study

• 2014 State of Consumer Privacy and Personalization Survey [download via Gigya]

• Tyupkin: Manipulating ATM Machines with Malware [Kaspersky Labs]

• War Shipping: Hacking Corporate WLan with a Raspberry Pi Board [Security Affairs]

• Web Application Attack Report [download via Imperva / summary]

• What Default Phone Encryption Really Means For Law Enforcement [Vice]

• What’s Driving the Connected Car [McKinsey]

October 3, 2014

PLEASE NOTE: “★” indicates item containing leaked classified documents

News

• After Legal Threat, Google Says it Removed ‘Tens of Thousands’ of iCloud Hack Pics

• Apple Claims iOS 8 Encryption Unbreakable by Law Enforcement [More]

• China Appears to Attack Yahoo! in Latest Censorship of Hong Kong Protests

• China Blocks Instagram Over Hong Kong Protest Photos

• China OKs iPhone 6 Sale After Apple Addresses Security Concerns

• Debate Brews Over US Disclosing Warrantless Spying

• Delaware Joins List of States Regulating Data Disposal

• Dragonfly/Havex Malware Targeting Pharmaceutical Sector

• Fake App Targets Occupy Hong Kong Activists with Malware

• FBI to Open Its Malware Portal to External Researchers

• For Some Gays Abroad, Social Networking Poses Risk

• German Regulator Warns Google Over Collecting Users’ Data

• GM Appoints 1st Cybersecurity Chief

• Hackers Charged with Stealing $100m+ in US Army and Xbox Tech

• Holder Urges Tech Companies to Leave Back Doors for Police

• Putin Supports Project to ‘Secure’ Russia Internet

• Romania: Mandatory Prepaid SIM Registration Ruled Unconstitutional

• Russia Asks Facebook, Google, Twitter to Comply With Law on Data Storage

• San Diego DA Warns Against Parental Spyware She Helped to Promote [More]

• 76 Million Were Exposed in JP Morgan Breach

• Signature Systems PoS Breach Expands, Affecting Hundreds of Businesses

• Silk Road Lawyers Poke Holes in FBI’s Story

• Supervalu, Albertsons Hit With Second PoS Attack

• US Spy Agencies Urge Caution on Phone Deal

• Yahoo! Says Government Data Requests Slowed in 2014

Journals / Preprints

• Audit Games with Multiple Defender Resources

• Authentication Graphs: Analyzing User Behavior Within an Enterprise Network

• Binomial Transform Based Fragile Watermarking for Image Authentication

• BitTorrent Sync: First Impressions and Digital Forensic Implications

• The Case for a Collaborative Universal Peer-to-Peer Botnet Investigation Framework

• Cryptanalysis of Public-key Cryptosystems That Use Subcodes of Algebraic Geometry Codes

• Cyber Weapons and Export Control: Incorporating Dual Use with the PrEP Model

• Decodability Attack against the Fuzzy Commitment Scheme with Public Feature Transforms

• Dialing Back Abuse on Phone Verified Accounts [download via George Mason University]

• Digital Evidence Bag Selection for P2P Network Investigation

• Exploiting Social Navigation

• A Flow-based Detection Method for Stealthy Dictionary Attacks Against Secure Shell

• Hacking by Law Enforcement: Towards a Public International Law of Cyber Espionage?

• Information Spectrum Approach to Strong Converse Theorems for Degraded Wiretap Channels

• IP Tracing and Active Network Response

• Key Recycling in Authentication

• Model Based Security Verification of Protocol Implementation

• Multidimensional Zero-Correlation Linear Cryptanalysis of the Block Cipher KASUMI

• On KLJN-based Secure Key Distribution in Vehicular Communication Networks

• Privacy, Anonymity, and Big Data in the Social Sciences

• Robust and Imperceptible Dual Watermarking for Telemedicine Applications [Request Full Text]

• Security Collapse in the HTTPS Market

• A Service Oriented Communication Model for High Speed Intrusion Detection Systems [Request Full Text]

• Similarity-based Matching Meets Malware Diversity

• A String-Based Public Key Cryptosystem

• A Survey of Fault Attacks in Pairing Based Cryptography [more from Cryptology ePrint Archive]

• THRIVE: Threshold Homomorphic encryption based secure and privacy preserving bIometric VErification system

• Under the Radar: NSA’s Efforts to Secure Private-Sector Telecommunications Infrastructure

Reports / Blogs / Etc.

• Asia Chats: Update on Line, KakaoTalk, and FireChat in China [Citizen Lab]

• The Criminal Indictment That Could Finally Hit Spyware Makers Hard [Wired]

• Federal Appeals Court Rules Evidence Obtained From GPS Device Without Warrant Is Admissible [ACLU]

• Global State of Information Security Survey 2015 [PwC]

• Inside the NSA’s Private Cloud [CIO]

• Long-Term Secrecy Surrounds Electronic Monitoring [Wall Street Journal]

• The Need for Both Legal and Technical Privacy Protections [Just Security]

• Opinion 8/2014 on Recent Developments on the Internet of Things [download via EU Data Protection Working Party / summary]

• Point-of-Sale System Breach Timeline, 2002-Present [OpenDNS]

• Police-reported Cybercrime in Canada, 2012 [Statistics Canada]

• Police Want Smartphone Backdoors, But You Never Know Who Else Will Open Them [Washington Post]

• Protection of Trade Secrets: Overview of Current Law and Legislation [GAO / download via Federation of American Scientists]

• Retired NSA Technical Director Explains Snowden Docs [Alexa O’Brien] ★

• Riding with the Stars: Passenger Privacy in the NYC Taxicab Dataset [Neustar]

• Secunia PSI Country Report – United States Q3 2014