January 30, 2015

PLEASE NOTE: “★” indicates item containing leaked classified documents

News

• Bug in ‘Secure’ BlackPhone Let Attackers Decrypt Texts, Track Users

• Canada Casts Global Surveillance Dragnet Over File Downloads ★

• Documents Show NSA’s Wiretap Moves Before Congress’s Approval

• Drone Maker Forces Firmware Update to Ban DC Flights After White House Crash

• EU Counter-terror Plan Involves Blanket Collection of Passenger Data

• EU Sets 2015 Deadline for New Data Protection Laws

• House Intelligence Committee Restructures to Focus on Cybersecurity

• DOJ Report Denies CBS Reporter’s Hacking Accusation

• Kaspersky: ‘Regin’ Trojan Was Created by Five Eyes ★ [More]

• FBI: Businesses Lost $215M to Email Scams

• Finland Introduces New Privacy Requirements for Online Services Providers

• France Seeks to Punish Web Companies for ‘Extremist’ Postings
  

• Germany’s Privacy Leaders to Discuss Suspending US Safe Harbor

• Google Says It Fought Gag Orders in WikiLeaks Investigation

• HIPAA 2015 Enforcement Priorities Highlight Cyber Threats

• In China, New Cybersecurity Rules Perturb Western Tech Companies

• Intelligence Agencies Piggyback on Advertisers, Analytics to Monitor Phones ★

• Malaysia Airlines Hackers Threaten to Dump Data

• Prosecutors Seek to Block Xbox Hacking Pioneer From Trial

• Report: Apple Agrees to Chinese Security Audits

• Report: Iranian General Killed in Syria Died Because ‘He Kept His Phone On’

• Rex Mundi Hackers Dump More Data After 2nd Extortion Attempt Fails

• Russian Dating Site Topface Hacked, Exposing 20 Million [then extorted by hackers]
  

• Singapore Establishes Cybersecurity Agency

• Sony Offers Compensation to Millions of Playstation Hack Victims

• Smartwatches, Fitness Trackers May Escape FDA Regulations

• Study Demonstrates Easy Identification via Credit Card Metadata

• Verizon’s Mobile ‘Supercookies’ Seen as Threat to Privacy

• Vietnam: Plainclothes Police Attacking Bloggers

Journals / Preprints

• Anonymously Analyzing Clinical Datasets

• Between Pure and Approximate Differential Privacy

• Bit-oriented Quantum Public-key Encryption

• Characterizing Web Censorship Worldwide: Another Look at the OpenNet Initiative Data

• Covert Policing and the [UK] Regulation of Investigatory Powers Act 2000

• Cyber Attacks and Public Embarrassment: A Survey of Some Notable Hacks

• Design and Analysis on Trusted Network Equipment Access Authentication Protocol

• Eavesdropping in Semiquantum Key Distribution Protocol

• FAIR: Forwarding Accountability for Internet Reputability

• In-Cloud Malware Analysis and Detection: State of the Art

• Identifying the Cyber Attack Surface of the Advanced Metering Infrastructure

• The Influence of Information Security on the Adoption of Web-based Integrated Information Systems: An E-government Study in Peru [Request Full Text]

• Intellectual Privacy: Rethinking Civil Liberties in the Digital Age

• Intelligent Methods for Cyber Warfare [Request Full Text]

• Intrusion Detection Using Execution Contexts Learned from System Call Distributions of Real-Time Embedded Systems

• More Efficient Oblivious Transfer Extensions with Security for Malicious Adversaries [more from Cryptology ePrint Archive]

• Risk, Uncertainty, and Profit for the Cyber Era: Model Risk Management of Cyber Insurance Models Using Quantitative Finance and Advanced Analytics

• Spatio-Temporal Techniques for User Identification by Means of GPS Mobility Data

• Standing Uncertainty: An Expected-Value Standard for Fear-Based Injury in Clapper v. Amnesty International USA

• System M: A Program Logic for Code Sandboxing and Identification

• New issue: Computer Law & Security Report

Reports / Blogs / Etc.

• Bruce Schneier and Edward Snowden @ Harvard Privacy in a Networked World Forum

• Internet of Things: Privacy & Security in a Connected World [download via Federal Trade Commission]

• Is the Cellphone in Your Pocket Public or Private? [Al Jazeera]

• Protecting America from Cyber Attacks: The Importance of Information Sharing [Senate Homeland Security & Govt. Affairs Committee]

• A Review of the U.S. Navy Cyber Defense Capabilities: Abbreviated Version of a Classified Report [National Academies]

• Shmoocon 2015 conference videos [a few good ones: NSA USB Playset, No Budget Threat Intel, The Dark Art of Data Visualization]

• State of Internet Security Q4 2014 [download via Akamai]

• Texts From AT&T Are Easy To Spoof [Medium]

• Threat Landscape 2014 [ENISA]

• TrackerSSL Highlights Insecure Websites and Their Ad Trackers [Citizen Lab]

• The Vast World of Fraudulent Routing [Dyn Research]

• We Should All Step Back from Security Journalism [Quinn Norton]

January 23, 2015

PLEASE NOTE: “★” indicates item containing leaked classified documents

News

• Arrest Made in Xmas DDoSing of PlayStation, Xbox

• Australia Plans to Expand Telecom Surveillance

• Bowie, MD Man Pleads Guilty to 2011-12 Xbox Hack

• China Issues Formal Definition of Consumer Personal Information

• DEA Settles Fake Facebook Profile Suit for $134K

• Europe Considers Surveillance Expansion After Attacks

• Google Reveals 2nd Windows Vulnerability Before Microsoft Can Patch It

• Malware Found in Official Releases of Popular Online Games

• Microsoft Gave Data on Charlie Hebdo Probe to FBI in 45 Minutes

• Most US Arms Program Vulnerable to Cyber Attacks

• New Snowden Docs Reveal Scope of NSA Preparation for Future Attacks ★

• NSA Breached North Korean Networks Before Sony Attack, Officials Say ★

• NY Moves to Strengthen Breach Notification Law

• Obama Argues for Technology Policy Reforms in State of the Union

• Obama Proposes Legislation to Protect Students from Data Brokers

• Obama Seeks to Strengthen and Clarify Cybercrime Law Enforcement

• One of the UKs Largest ISPs is Now Censoring Porn by Default

• Proposed Indiana Law Would Raise Bar for Security and Privacy Requirements

• Report: Biometric App Downloads to Top 770 Million by 2019

• Researchers: China Running MITM Attack on Microsoft Outlook

• Snowden Docs: China Stole F-35 Fighter Plans ★

• Spain Moves to Criminalize Encryption

• Thailand: Junta Approves Mass Surveillance Law

• Travelers Sues Web Designer Over Bank Breach

• UK: GCHQ Intercepted Hundreds of Emails from Journalists

• US Sentences Security Journalist Barrett Brown to 5 Years

• US, UK to Stage Joint Cyber ‘War Games’

Journals / Preprints

• Analysing the Usability of Two-Factor Authentication in UK Online Banking

• Analysis and Design of Secure Cyber-physical Systems [Request Full Text]

• Authentication User’s Privacy: An Integrating Location Privacy Protection Algorithm for Secure Moving Objects in Location Based Services [Request Full Text]

• Autonomic Schemes for Threat Mitigation in Internet of Things

• The Classification of Quantum Symmetric-Key Encryption Protocols

• Controller Synthesis for Linear Time-varying Systems with Adversaries

• Cyber Diligence: A Low-Intensity Due Diligence Principle for Low-Intensity Cyber Operations?

• Cyber Risk: Insuring the Digital Age

• Furtive Encryption: Power, Trust, and the Constitutional Cost of Collective Surveillance

• The Law of Cyber Targeting

• Man-At-The-End Attacks: Analysis, Taxonomy, Human Aspects, Motivation and Future Directions

• More Efficient Privacy Amplification with Less Random Seeds via Dual Universal Hash Function

• New Directions in Anonymization: Permutation Paradigm, Verifiability by Subjects and Intruders, Transparency to Users

• An Optical Image Encryption Scheme Based on Depth-conversion Integral Imaging and Chaotic Maps

• A Proposal for Quantum Rational Secret Sharing

• Quantum McEliece Public-key Encryption Scheme

• Quantum Secret Sharing with a Single d-level System

• A Secure and Efficient User Anonymity-Preserving Three-Factor Authentication Protocol for Large-Scale Distributed Wireless Sensor Networks [Request Full Text]

• Seeking Black Lining In Cloud

• A String-Based Public Key Cryptosystem

• New issue: Security and Communication Networks [Request Full Text]

Reports / Blogs / Etc.

• Cisco 2015 Annual Security Report

• Cyber Warfare: Capitol Staffers Aren’t Ready [Politico]

• DDoS Attacks in the Wake of French Anti-terror Demonstrations [Arbor Networks]

• 11% of Banking Apps are Malicious [Risk IQ]

• How Grindr Makes it Easy to Stalk 5 Million Gay Men [Ars Technica]

• The Hypocrisy of US Cyber Policy [TechCrunch]

• The Internet of Gas Station Tank Gauges [Rapid 7]

• The Latest Rules on How Long NSA Can Keep Americans’ Encrypted Data Look Too Familiar [Just Security]

• Obama’s Cyber Proposals Sound Good, But Erode Information Security [Intercept]

• Our South Korean Allies Also Hack the US – and We Don’t Seem to Care [Daily Beast] ★

• Portal to UK academic security research launched [Market Wired]

• Security MIA In Insurance Dongle Used in 2 Million Cars [Information Week]

• A Spy in the Machine: How a Brutal Government Used Spyware to Hijack One Activist’s Life [The Verge]

• TURNIPSCHOOL – DIY NSA Spying Technology from the NSA Tao Catalog [Security Affairs – also: FiOS Flaw Exposes 5 Million Accounts] ★

• 2015 Global Cybersecurity Status Report [ISACA]

• 2015 State of the Endpoint Report: User-Centric Risk [Ponemon]

• Will Sharing Cyberthreat Information Help Defend the United States? [Brookings]

January 16, 2015

News

• Activists Honeypot Sweden’s Security Elite with Free Conference Wifi

• Banking Trojans Disguised As SCADA Updates Infecting Plants

• Before Bridgegate, Christie Used Port Authority As Political Weapon [RE: illegal disclosure of EZ-Pass data]

• CA Car Data Proposal Sparks Privacy Fears

• Hackers Leak Bank Files After Extortion Fails

• Lizard Squad Hijacks Thousands of Home Routers

• Major Bitcoin Exchange Reopens After Breach, $5 Mil. Theft

• Microsoft Limits Patch Alerts to Paid Subscribers

• NJ Passes Law Requiring Encryption of Health Insurance Data

• North Korea’s Official News Site Delivering Malware

• Senate Report: Homeland Security Cybersecurity ‘Alarming’

• Switzerland Forced to Reveal Buyers, Cost of Surveillance Exports

• Turkey: 50 Million Exposed by Lax Government Security

• UK Threatens to Ban Encryption [along with Iran]

• US Central Command Twitter, YouTube Accounts Hijacked

• US Intelligence Council: Encryption Critical to Preventing Attacks by China, Russia

• US Seeks to Deny Twitter Warrant Canary Challenge

• White House Proposes Breach Notification Standard, Threat Data Sharing Bill [analysis: 1, 2, 3]
  

Journals / Preprints

• An Adaptive Wideband Delphi Method to Study State Cyber-Defence Requirements

• Analysis of Country-Wide Internet Outages Caused by Censorship [Request Full Text]

• Analysis of Docker Security

• Analysis and Enhancement of Desynchronization Attack on an Ultralightweight RFID Authentication Protocol [more from Cryptology ePrint Archive]

• ASArP: Automated Security Assessment & Audit of Remote Platforms Using TCG-SCAP Synergies

• Banking Behavior in Security and Multi-channel Environment [Request Full Text]

• Crowd-ML: A Privacy-Preserving Learning Framework for a Crowd of Smart Devices

• Cybersecurity: What About U.S. Policy?

• Ideal Log Setting for Database Forensics Reconstruction

• LASTor: A Low-Latency AS-Aware Tor Client [Request Full Text]

• Modified Trial Division Algorithm Using KNJ-Factorization Method To Factorize RSA Public Key Encryption

• Multi-phase IRC Botnet and Botnet Behavior Detection Model

• Network Codes Resilient to Jamming and Eavesdropping [Request Full Text]

• New Hashing Algorithm for Use in TCP Reassembly Module of IPS

• OnionBots: Subverting Privacy Infrastructure for Cyber Attacks

• On Vulnerabilities of the Security Association in the IEEE 802.15.6 Standard

• A Polynomial-Time Attack on the BBCRS Scheme

• PriCL: Creating a Precedent A Framework for Reasoning about Privacy Case Law

• Privacy and Data Protection by Design – from Policy to Engineering

• Privacy by Design: On the Conformance Between Protocols and Architectures

• Secure and Trustworthy File Sharing Over Cloud Storage Using eID Tokens

• Survey of Security and Privacy Issues of Internet of Things

• Very Static Enforcement of Dynamic Policies

• Video Manipulation Techniques for the Protection of Privacy in Remote Presence Systems

• New issue: Computers & Security
• New issue: IEEE Transactions on Information Forensics and Security [Request Full Text]
• New issue: IEEE Transactions on Secure and Dependable Computing [Request Full Text]
• New issue: International Journal of Information Security [Request Full Text]

Reports / Blogs / Etc.

• Behind the Rise of the Private Surveillance Industry in Central Asia [openDemocracy]

• Bulk Collection of Signals Intelligence: Technical Options [National Research Council]
  

• The Cost of Malware Containment [Ponemon / Damballa]

• Cybersecurity Issues and Challenges: In Brief [Congressional Research Service – download via Federation of American Scientists / also: Cyber Operations in DOD Policy and Plans: Issues for Congress ]

• Energy Sector Cybersecurity Framework Implementation Guidance [download via Dept. of Energy]

• Fact-Checking the Hype Surrounding FireChat in Hong Kong’s Protests [Global Voices]

• Hopefully the Last Post I’ll Ever Write on Dual EC DRBG [Matthew Green on NSA subversion of NIST standards]

• India’s Surveillance State: An Overview [Software Freedom Law Centre]

• Is it Possible to Ban Autonomous Weapons in Cyberwar? [Just Security – also: Cybersecurity and a New Era of Asymmetric Economic Warfare]

• KeySweeper [$10, DIY wireless keylogger – Samy Kamkar]

• Mass Surveillance: Risks and Opportunities Raised by the Current Generation of Network Services and Applications – Part 1, 2 [European Parliament]

• Need Some Espionage Done? Hackers Are for Hire Online [New York Times]

• Protecting Controlled Unclassified in Nonfederal Information Systems and Organizations [download via NIST]

• Privacy and Data Protection by Design [ENISA – also: Threat Landscape of Internet Infrastructure]

• Privacy, Security and Surveillance: Tackling Dilemmas and Dangers in the Digital Realm [download via Wilton Park]

• The Turn-Verizon Zombie Cookie [Jonathan Mayer]

• UK Exposing Personal Data in Open Datasets [Information Rights & Wrongs]

January 9, 2015

News

• Court: Social Media Photos Not Protected in Civil Discovery

• Credit Union Federation: Data Encryption Rule Unnecessary

• Denmark Invests $75 Million to Develop Cyber Offense Capacity

• Ex-HHS Cyber Chief Gets 25 Years for Child Porn

• FBI in Tough Competition for Cybersecurity Talent

• FBI: No Warrants Needed for Mass Cell Surveillance

• GoGo Inflight WiFi Issuing Fake HTTPS Certificates

• Google Posts Windows 8.1 Vulnerabilty Before Microsoft Can Patch It

• IBM: 61 Million Customer Records Stolen in 2014

• Kenya Expands Surveillance Powers

• Key Hill Cyber Staffer Heads to K Street

• Major Bitcoin Exchange Claims Hack, Suspends Services

• NY’s Top Prosecutor Calls for Law to Fight Apple Encryption

• Obama Won’t Fire US Attorneys Over Aaron Swartz’s Suicide

• Researchers Develop 1st Known OS X Bootkit

• Researchers: AOL Ad Network Exposed Millions to Malware

• Revised Credit Card Data Security Standard Introduced

• Russian Data Localization Law Goes Into Effect Sept. 1st

• Saudi Religious Police Claim Hack of Pornographic Twitter Accounts

• Sony: US Increases North Korea Sanctions / FBI Chief: ‘No Doubt” North Korea Responsible (not everyone is convinced, though)

• Swiss Bank Claims Extortion by Hackers in Wake of Breach

• 3 Million Moonpig Users Exposed by API Flaw

• Ukraine Blames Russia for Attack on German Government Sites

• US Pushing to Undermine Net Neutrality, Privacy in Major Trade Agreements

Articles / Preprints

• Building a Security Reference Architecture for Cloud Systems [Request Full Text]

• A Cache-aware Mechanism to Enforce Confidentiality, Trackability and Access Policy Evolution in Content-Centric Networks

• A Cloud-based Secure Authentication (CSA) Protocol Suite for Defense against Denial of Service (DoS) Attacks

• A Design of a Fast Parallel-Pipelined Implementation of AES: Advanced Encryption Standard

• Designing Securely and Reliably Connected Wireless Sensor Networks

• Device Fingerprinting in Wireless Networks: Challenges and Opportunities

• DFBotKiller: Domain-flux Botnet Detection Based on the History of Group Activities and Failures in DNS Traffic

• Dining Cryptographers are Practical

• Dining Cryptographers with 0.924 Verifiable Collision Resolution

• Do Transparency Reports Matter for Public Policy? Evaluating the Effectiveness of Telecommunications Transparency Reports

• Efficient 2-Step Protocol and Its Discriminative Feature Selections in Secure Similar Document Detection

• Fast Cut-and-Choose Based Protocols for Malicious and Covert Adversaries [more from Cryptology ePrint Archive]

• HMOG: A New Biometric Modality for Continuous Authentication of Smartphone User

• How Perfect Offline Wallets Can Still Leak Bitcoin Private Keys

• Implementation of a Stream Cipher Based on Bernoulli’s Map

• Linear Decomposition Attack on Public Key Exchange Protocols Using Semidirect Products of (Semi)groups

• Managing Key Multicasting Through Orthogonal Systems

• Multipath Routing of Fragmented Data Transfer in a Smart Grid Environment

• On the Anonymizability of Mobile Traffic Datasets

• On KLJN-based Secure Key Distribution in Vehicular Communication Networks

• Predictive Cyber-security Analytics Framework: A Non-homogenous Markov Model for Security Quantification

• Programs as Actual Causes: A Building Block for Accountability

• Protecting Traffic Privacy for Massive Aggregated Traffic

• Quantifying the Leakage of Quantum Protocols for Classical Two-Party Cryptography

• Secure Transmission in Wireless Sensor Networks Data Using Linear Kolmogorov Watermarking Technique

• Security, Privacy and Trust in Internet of Things: The Road Ahead

• Seeking Anonymity in an Internet Panopticon

• Spaced Repetition and Mnemonics Enable Recall of Multiple Strong Passwords

Reports / Blogs / Etc.

• China Adds Yet Another Layer of Control to the Internet [Global Voices]

• CYBERBOK Cyber Crime Security Essential Body of Knowledge: A Competency and Functional Framework for Cyber Crime Management [download via CYBERPOL]

• Digital Peepholes, Remote Activation of Webcams: Technology, Law, and Policy [download via CK Privacy]

• The EU Data Protection Regulation After 3 Years of Negotiation [InsidePrivacy]

• Global Chilling: The Impact of Mass Surveillance on International Writers [PEN America]

• Hackers Can’t Solve Surveillance [Dmytri Kleiner]

• HSTS Super Cookies [Radical Research – RE: defeating private browsing]

• HTTP/2.0 — The IETF is Phoning It In [ACM Queue – also: Securing the Network Time Protocol]

• Infographic: Why the ‘Internet of Things’ Hasn’t Really Caught On Yet [Adweek]

• Keeping Hackers Out of Hospitals [Phys.org]

• Maginot Revisited: More Real-World Results from Real-World Tests [FireEye]

• Privacy and the IoT: Navigating Policy Issues [FTC Chairwoman Edith Ramirez – download via FTC]

• Ransomware on Steroids: Cryptowall 2.0 [Cisco]

• Spying and Prying in an Economic Zone [China Media Project]

• The State of Humanitarian Law in Cyber Conflict [Just Security]

• Website Backdoors Leverage the Pastebin Service [Sucuri]

• Who’s Attacking Whom? Realtime Attack Trackers [Brian Krebs – also: Jackpotting ATMs with a Smartphone]

• Wifiphisher: Automated Phishing Attacks on Wifi Networks {Security Affairs]

• With Power of Social Media Growing, Police Now Monitoring and Criminalizing Online Speech [Intercept]

January 2, 2015

PLEASE NOTE: “★” indicates item containing leaked classified documents

News

• Apple Launches 1st Automatic Security Update

• Bank / Retailer Fight Over Breach Payments Heating Up

• China Blamed in Attack on Afghan Government Sites

• China’s Block of Gmail Partially Lifted

• Facebook Will Face Class Action Over Message Scanning

• India Blocks 20+ Sites

• Internet Systems Consortium Hacked

• Malware Found at South Korean Nuclear Plant

• Mt. Gox Collapse Was Likely An Inside Job

• North Korea Suffers 2nd Internet Outage, Blames US

• NSA Dumps Logs of Illegal Behavior on Xmas Eve

• Researchers Claim 80% of Tor Traffic Related to Pedophilia

• Sony: PlayStation Hackers Selling DDoS Tools / Ex-Exployees, Known Hackers May Be Responsible  / “Interview” Released, Online / Skepticism Grows Over North Korean Responsibility / Bruce Schneier on Attribution / Alleged Hacker Arrested / Lizard Squad Profile /

• South Korea Asks China for Assistance in Nuclear Plant Breach

• Thailand Gives ISPs Authority to Block Content at Will

• Use of Spyware in Domestic Abuse Reaching ‘Epidemic Proportions’

Journals / Preprints

• Attributing Cyber Attacks [Request Full Text]

• Balancing Isolation and Sharing of Data for Third-Party Extensible App Ecosystems

• Bitcoin Meets Strong Consistency

• Bloom Filters in Adversarial Environments\

• A Broken System of Self-Regulation of Privacy Online? Surveillance, Control, and Limits of User Features in U.S. Websites [Request Full Text]

• Challenging Chinese Economic Cyber Espionage with WTO Litigation

• Comparing Intention to Avoid Malware Across Contexts in a BYOD-enabled Australian University: A Protection Motivation Theory Approach

• Cyber Epidemic Models with Dependences [Request Full Text]

• Cyber-Terrorism in a Post-Stuxnet World

• Detecting Fake Anti-virus Software Distribution Webpages

• Detecting Malicious Code by Exploiting Dependencies of System-call Groups

• Did the National Security Agency Destroy the Prospects For Confidentiality and Privilege When Lawyers Store Clients’ Files in the Cloud — And What, If Anything, Can Lawyers and Law Firms Realistically Do in Response?

• A DDoS-Aware IDS Model Based on Danger Theory and Mobile Agents

• Differential Privacy and Machine Learning: A Survey and Review

• Empirical Evaluation of a Cloud Computing Information Security Governance Framework

• Fool Me If You Can: Mimicking Attacks and Anti-Attacks in Cyberspace [Request Full Text]

• Hindering Data Theft with Encrypted Data Trees

• If You Want to Know About a Hunter, Study his Prey: Detection of Network Based Attacks on KVM Based Cloud Environments [Request Full Text]

• Image Encryption and Decryption in A Modification of ElGamal Cryptosystem in MATLAB

• Insurability of Cyber Risk: An Empirical Analysis

• Integrity, Authenticity, Non-repudiation, and Proof of Existence for Long-term Archiving: A Survey

• Jif: Language-based Information-flow Security in Java

• The Mask of ZoRRo: Preventing Information Leakage from Documents [Request Full Text]

• Membership Lists, Metadata, and Freedom of Association’s Specificity Requirement

• Mixing in Random Digraphs with Application to the Forward-Secure Key Evolution in Wireless Sensor Networks

• The Nature of International Law Cyber Norms

• Percolation Model of Insider Threats to Assess the Optimum Number of Rules

• Profiling and Classifying the Behavior of Malicious Codes

• Protecting Encrypted Cookies from Compression Side-Channel Attacks [more from Cryptology ePrint Archive]

• An RGB Image Encryption Using Diffusion Process Associated with Chaotic Map

• Sanitization of Call Detail Records via Differentially-private Summaries

• Secure Multiplex Coding with Dependent and Non-Uniform Multiple Messages

• Software Puzzle: A Countermeasure to Resource-Inflated Denial-of-Service Attacks [Request Full Text]

• A Stochastic Model of Active Cyber Defense Dynamics [Request Full Text]

• Systemization of Pluggable Transports for Censorship Resistance

• Towards More Pro-active Access Control in Computer Systems and Networks

• Verifiable Elections with Commitment Consistent Encryption — A Primer

• New issue: Security and Communication Networks [Request Full Text]

Reports / Blogs / Etc.

• Anunak: APT Against Financial Institutions [Group-IB / Fox IT – dowload via latter]

• Computer Science in North Korea [Will Scott]

• Dept. of Homeland Security IT Security Suffers from Noncompliance [DHS Inspector General]

• Internal Revenue Service Does Not Adequately Manage I.T. Security Risk-Based Decisions [Treasury Dept. Inspector General]

• Normative Voids and Asymmetry in Cyberspace [Just Security]

• Prying Eyes: Inside the NSA’s War on Internet Security [Der Spiegel] ★

• The Slow Death of ‘Do Not Track’ [New York Times]

• 31c3 Conference Video Archive [Chaos Computer Club – a few good ones: SS7: Locate. Track. Manipulate / Beyond PNR: Exploring Airline Systems / Why is GPG “Damn Near Unusable”?]

• TorrentLocker Campaign affecting Spain and Italy [S21sec]

• Virlock: First Self-Reproducing Ransomware is Also a Shape Shifter [welivesecurity]

• We Learned Very Little about Canada’s Cybersurveillance Agency, CSEC, in 2014 [Vice]

• Wireless Medical Infusion Pumps: Medical Device Security [download via NIST / summary]