November 26, 2014

News

• After Threatening Hacker With 440 Years, Texas Prosecutors Settle for Misdemeanor

• Belgacom Hack Investigators Did Not Disclose Malware for Fear of Outing NSA / GCHQ

• Canada Revenue Agency Leaks Tax Details of Wealthy Canadians

• Civil Lawsuits Continue to Accumulate Over Home Depot Breach

• Ecuador’s Correa Alleges US Hack of His Devices, Accounts

• Judge Unseals Trove of Docs on Warrantless Police Cell Surveillance

• ‘Large-scale’ Breach Underway at Virgin Islands Banks

• Prince George’s County School Employees’ Data Exposed in Breach

• Security Auditor May be Drawn Into Class Action for Failing to Identify Vulnerabilities

• Sony Pictures Knocked Offline by Hack

• Target Fights to End Bank Suits a Year After Data Breach

• Twitter Exec Reveals Acquisition Plans via Mistaken Tweet

• UK Considers Forcing ISPs to Hand Over User Data

Journals / Preprints

• An Enciphering Scheme Based on a Card Shuffle

• Length-based Attacks in Polycyclic Groups

• Modified Apriori Approach for Evade Network Intrusion Detection System

• MUSE: Asset Risk Scoring in Enterprise Network with Mutually Reinforced Reputation Propagation

• A Pair-wise Key Distribution Mechanism and Distributed Trust Evaluation Model for Secure Data Aggregation in Mobile Sensor Networks

• Privacy-Aware Access Control for Message Exchange in Vehicular Ad Hoc Networks [Request Full Text]

• Privacy-Friendly Collaboration for Cyber Threat Mitigation

• Warp2: A Method of Email and Messaging with Encrypted Addressing and Headers

• New issue: ACM Transactions on Information and System Security
• New issue: Network Security

Reports / Blogs / Etc.

• Android Password Managers Remain Open to Sniffing Attacks [Ars Technica]

• The Cyber Security Syndrome [Canadian International Council]

• Hikvision DVR Devices – Multiple Vulnerabilities [Metasploit]

• NSA Reform – The Consequences of Failure [Just Security]

• Regin: Top-tier Espionage Tool Enables Stealthy Surveillance [Symantec / summary]

• The US Needs a New International Strategy for Cyberspace [Just Security]

November 21, 2014

News

• Amnesty Debuts Anti-spying Tool for Activists

• Analysis Casts Doubt on FBI Claims of Tor Site Seizures

• ATM Default Codes Used to Steal $400K

• AT&T Claims It Has Stopped Using Persistent Mobile Tracking ID

• Before Snowden, A Debate Inside NSA

• China Blocks Access to HSBC Corporate Banking

• Citadel Malware Attacking Open Source Password Managers

• DHS: US Grid Attacked 79 Times This Year

• Europol Begins Crackdown on RAT Hackers

• Fitbit Data Now Being Used In The Courtroom

• Let’s Encrypt Promises Free Digital Certificates for HTTPS

• MD Judge Threatens Detective with Contempt for Declining to Reveal Cell Tracking Methods

• Postal Service Hackers May Have Accessed Pay Records

• Privacy Concerns for ClassDojo and Other School Tracking Apps

• Senate Rejects NSA Reform

• Staples Hit By Credit Card Breach

• State Dept. Shuts Down Email After Suspected Attack

• Thousands of Sites Affected as China Blocks EdgeCast

• UK ISPs to Introduce ‘Jihadi and Terror Content’ Reporting Button

• UK: Troops in Poland Banned from BYOD Over Russian Hacking Fears

• Vodafone-Linked Company Aided British Mass Surveillance

• WhatsApp Rolls Out End-to-end Encryption

• WireLurker Suspects Arrested in Beijing

Journals / Preprints

• AndroSimilar: Robust Signature for Detecting Variants of Android Malware

• Application Layer Intrusion Detection with Combination of Explicit-Rule- Based and Machine Learning Algorithms and Deployment in Cyber-Defence Program

• ASH-512: Design and Implementation of Cryptographic Hash Algorithm Using Co-ordinate Geometry Concepts

• Authentication Using Piggy Bank Approach to Secure Double-Lock Cryptography

• Caching and Auditing in the RPPM Model

• CBM: A Crypto-Coded Modulation Scheme for Rate Information Concealing and Robustness Boosting

• Content and Popularity Analysis of Tor Hidden Services

• Corporate Avatars and the Erosion of the Populist Fourth Amendment

• Cross Site Request Forgery on Android WebView

• Cyber Geopolitics and Sovereignty: An Introductory Overview

• Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data

• Foreign Surveillance: Law and Practice in a Global Digital Environment

• From Porn to Cybersecurity Passing by Copyright: How Mass Surveillance Technologies are Gaining Legitimacy… The Case of Deep Packet Inspection Technologies

• Holistic Collaborative Privacy Framework for Users’ Privacy in Social Recommender Service

• How to Covertly Leak Data from iOS?

• Lawful Illegality: What Snowden Has Taught Us About the Legal Infrastructure of the Surveillance State

• A New Key Establishment Protocol and Its Application in Pay-TV Systems

• No Superluminal Signaling Implies Unconditionally Secure Bit Commitment

• Nothing to Fear or Nowhere to Hide: Competing Visions of the NSA’s 215 Program

• A Novel Fast and Provably Secure (t,n)-threshold Secret Sharing Construction for Digital Images

• On the Effectiveness of Traffic Analysis Against Anonymity Networks Using Flow Records [download via Columbia University]

• On the Security of Fully Homomorphic Encryption and Encrypted Computing: Is Division Safe?

• Open Season for Data Fishing on the Web: The Challenges of the US PRISM Programme for the EU

• On The Longest Chain Rule and Programmed Self-Destruction of Crypto Currencies

• Pouring Cloud Virtualization Security Inside Out

• Privacy-Preserving Content-Based Image Retrieval in the Cloud

• Privacy-Preserving Loyalty Programs

• Privacy-Preserving Vehicular Announcements Aggregation Scheme Based on Threshold Ring Signature

• A Quantum Approach to Fully Homomorphic Encryption

• Rabin-p Cryptosystem: Practical and Efficient Method for Rabin based Encryption Scheme

• Reasonable Expectations of Anonymity

• The Red Storm in Uncharted Waters: China and International Cyber Security

• Security Analysis of the Unrestricted Identity-Based Aggregate Signature Scheme

• Security Evaluation for Mail Distribution Systems

• Sequestration of Malevolent Anchor Nodes in Wireless Sensor Networks using Mahalanobis Distance

• A Specification-based Intrusion Detection Engine for Infrastructure-less Networks

• To Share or Not to Share in Client-Side Encrypted Clouds

• Using Volunteer Computing for Mounting SAT-based Cryptographic Attacks

Reports / Blogs / Etc.

• Additional Actions Needed to Address Vulnerabilities That Put VA Data at Risk [Government Accountability Office]

• American Surveillance Now Threatens American Business [The Atlantic]

• The Big Counterterrorism Counterfactual [Foreign Policy]

• The Brazilian Underground Market: The Market for Cybercriminal Wannabes? [Trend Micro]

• Congress Is Irrelevant on Mass Surveillance. Here’s What Matters Instead [Glenn Greenwald]

• Cybersecurity Threats: The Way Forward [House Intelligence Committee / analysis]

• The FBI Doesn’t Need More Access: We’re Already in the Golden Age of Surveillance [Just Security]

• Full Virginia State Court Opinion on Passcodes vs. Fingerprints [Just Security]

• G20 2014 Summit Lure Used to Target Tibetan Activists [ESET]

• Keeping Secrets [RE: NSA effort to control 1970s cryptographic research / Stanford]

• PrivacyGrade: Grading The Privacy Of Smartphone Apps [Carnegie Mellon]

• Private Interests: Monitoring Central Asia [download via Privacy International / summary]

November 14, 2014

News

• Australia Warns of State Backed Attacks on G20 Summit

• Automakers Issue Privacy Guidelines For Connected Cars

• Coca Cola Hit by Class Action After Laptop Theft

• Condemnation Mounts Against Cricket for Sabotaging Encryption

• DHS: Widespread Russian Attack on US Infrastructure Underway

• DOJ Admits Perjuring Itself in Federal Court Over National Security Letters

• 85,000 Exposed in Hack of Indian Government Agency

• Feds: Silk Road 2.0 Taken Down by Social Engineering

• Home Depot: Breach Happened via 3rd-Party Vendor Credentials

• iPhone, Galaxy S5, Nexus 5, and Fire Phone All Hacked on 1st Day of Pwn2Own

• Pew: Most Americans Don’t Feel Safe Online

• Postal Service Discloses Major Data Theft / Suspends Teleworking / Subject of NLRB Complaint

• Retailers Demanding Federal Action on Data Breaches

• Stuxnet Infected Other Targets Before Hitting Iranian Enrichment Site

• US Banks Lobby for Retailers to Pick up Breach Bills

• US: China Hacked Weather Systems, Satellites

• US-CERT: Microsoft Server 2003 End-of-Life a Critical Threat

• US Law Enforcement Seized Tor Nodes, May Have Run Its Own

Journals / Preprints

• An Administrator’s Guide to Internet Password Research

• Analysis of Applicability of ISO 9564 PIN based Authentication to Closed-Loop Mobile Payment Systems

• A Cult of Rules: The Origins of Legalism in the Surveillance State

• Dissecting Pattern Unlock: The Effect of Pattern Strength Meter on Pattern Selection

• Distributed Private Heavy Hitters

• Efficient Suspicious URL Filtering Based on Reputation

• An Enhanced and Secured RSA Key Generation Scheme (ESRKGS)

• A Formal Approach to Distributed System Security Test Generation

• Handcrafted Fraud and Extortion: Manual Account Hijacking in the Wild [download via University of California]

• Identifying User Behavior from Residual Data in Cloud-based Synchronized Apps

• Instruction Sequence Expressions for the Secure Hash Algorithm SHA-256

• JellyFish Attack: Analysis, Detection and Countermeasure in TCP-based MANET

• ${l_p}$-norms in One-Class Classification for Intrusion Detection in SCADA Systems [Request Full Text]

• Mining a High Level Access Control Policy in a Network with Multiple Firewalls

• Modifying an Off-the-Shelf Wireless Router for PDF Ballot Tampering

• A New Class of Scalable Parallel Pseudorandom Number Generators Based on Pohlig-Hellman Exponentiation Ciphers

• One-sided Leakage-resilient Privacy Only Two-message Oblivious Transfer

• A Provenance-Policy Based Access Control Model For Data Usage Validation In Cloud

• Road-to-Vehicle Communications with Time-Dependent Anonymity: A Light Weight Construction and its Experimental Results [more from Cryptology ePrint Archive]

• Secure Patrol: Patrolling Against Buffer Overflow Exploits [Request Full Text]

• A Secure Remote User Mutual Authentication Scheme Using Smart Cards

• Trust-based Privacy-aware Participant Selection in Social Participatory Sensing

• Unshared Secret Key Cryptography: Finite Constellation Inputs and Ideal Secrecy Outage

• Vulnerabilities of Smart Grid State Estimation against False Data Injection Attack

• Wireless-Delimited Secure Zones with Encrypted Attribute-Based Broadcast for Safe Firearms

Reports / Blogs / Etc.

• BadUSB Update: It is Hard to Discriminate Patchable USB Devices [Security Affairs]

• Chinese Routing Errors Redirect Russian Traffic [Dyn Resarch]

• The Darkhotel APT: A Story of Unusual Hospitality [Kaspersky Labs]

• Embracing HTTPS [New York Times]

• Extending Privacy Protections to Foreigners Will Benefit Americans [Just Security]

• How the Justice Dept. Spies on You From the Air [Vice]

• New Phishing Technique Outfoxes Site Owners: Operation Huyao [Trend Micro]

• OnionDuke: APT Attacks Via the Tor Network [F-Secure]

• Polaris Privacy Initiative to Accelerate User-focused Privacy Online [Mozilla]

• Predator Pain and Limitless: When Cybercrime Turns into Cyberspying [Trend Micro]

• Son of Stuxnet: The Digital Hunt for Duqu, a Dangerous and Cunning US-Israeli Spy Virus [The Intercept]

• Stingrays: How Local Law Enforcement Uses an Invasive, Unreliable Surveillance Tool [Slate]

• Wirelurker: A New Era in iOS and OS X Malware [download via Palo Alto Networks / summary]

November 7, 2014

News

• Cell Carrier Weakest Link in Google, Instagram Hacks

• China: ‘Unhackable’ Quantum Network Will Launch in 2016

• College Students Still Trust Snapchat, Despite Hack

• Dell: Security Concerns Holding Enterprise Technology Adoption Back

• Facebook: Government Data Requests Rise by Nearly a Quarter

• FBI Lobbying to Expand Its Ability to Hack Suspects

• Luck Played a Role in Discovery of JP Morgan Breach

• Navy Adopting New Cybersecurity Strategy

• Nigeria Passes Broad Cybercrime Bill

• Raytheon Acquires Cyber Firm Blackbird Technologies for $420 million

• Secrecy, Denials Obscure Warrantless Cell Surveillance by Georgia Police

• VA Defendant Required to Provide Smartphone Fingerprint, but Not Passcode

• UK: Illegal Police Spying on Journalists is Systemic, Parliament Told

• UK: MI5, MI6, GCHQ Spy on Confidential Attorney-Client Communications

• Verizon’s New Tech News Site Bans Reporting on US Spying

Journals / Preprints

• Advanced Password Based Authentication Scheme for Wireless Sensor Networks

• AirHopper: Bridging the Air-Gap between Isolated Networks and Mobile Phones using Radio Frequencies

• Analysis of an Attenuator Artifact in an Experimental Attack by Gunn-Allison-Abbott Against the Kirchhoff-law-Johnson-noise (KLJN) Secure Key Exchange System

• Combining Technical and Financial Impacts for Countermeasure Selection

• Connected Choices: How the Internet Is Challenging Sovereign Decisions

• Data Privacy Laws in Asia – Context and History

• Designing User Incentives for Cybersecurity

• An Empirical Study on Android for Saving Non-shared Data on Public Storage

• Intelligence Legalism and the National Security Agency’s Civil Liberties Gap

• Interview on the Black Box Society [new UMD Legal Studies Research Paper]

• On the Physical Robustness of RF On-chip Nanostructured Security

• Privacy Considerations for a Pervasive Eye Tracking World

• The REESSE2+ Public-key Encryption Scheme

• Secret Key Agreement: General Capacity and Second-Order Asymptotics

• Secure Garbage Collection: Preventing Malicious Data Harvesting from Deallocated Java Objects Inside the Dalvik VM

• Storms in Mobile Networks

Reports / Blogs / Etc.

• BE2 Custom Plugins, Router Abuse, and Target Profiles: New Observations on BlackEnergy2 APT Activity [Kaspersky Labs]

• Case Study: Security Assessment of WebRTC [Strews / summary]

• Cyber Attacks Likely to Increase [Pew Research]

• A Glimpse Into the Psychology of Facebook Scam Victims [download via Bitdefender]

• Consumers’ Perception About Privacy & Security: Do They Still Care? [Ponemon / RSA – download via EMC]

• Contactless Cards Fail to Recognize Foreign Currency [Newcastle University]

• Exposing the Flash ‘EITest’ Malware Campaign [Malwarebytes]

• The False Promise of Anonymity [Center for Democracy + Technology]

• Hackers Could Decide Who Controls Congress Thanks to Alaska’s Terrible Internet Ballots [The Intercept]

• Inside the Unending ‘Cyber Siege of Hong Kong’ [Vice]

• The Invisible Becomes Visible: Security Predictions for 2015 and Beyond [Trend Micro]

• National Change of Address Program: Audit Report [download via Postal Service Inspector General]

• Smartphone Data Encryption: A Renewed Boundary for Law Enforcement? [Congressional Research Service]

• 2013-14 Privacy Act Annual Report to Parliament: Transparency and Privacy in the Digital Age [Privacy Commissioner of Canada]

• Where’ve You Been? Your Phone’s Wi-Fi is Telling Everyone [Ars Technica]