February 25, 2015

 News

• Anthem: Potentially Wide-Ranging Legal Consequences / FBI ‘Close” to Attribution / 18 Mil. Non-Customers May Be Affected

• AT&T Starts Charging Customers Not to Spy on Them

• Belarus Bans Tor and Other Anonymizers

• Europol Leads Takedown Effort on Ramnit Botnet

• Facebook’s Privacy Policy Breaches European Law, Report Finds

• FBI: $3M Bounty for ZeuS Trojan Author

• FedEx Refusing to Ship Legal Digital Gun Mill

• Gemalto: Denies SIM Key Theft by NSA, GCHQ / Finishes ‘Thorough’ Security Audit in 8 Days

• Hackers Said to Remain Active in US State Department E-Mails

• Illinois Police Department Pays Cryptoware Ransom

• KPMG: Security Concerns Keep UK Firms Away from the Cloud

• Insiders Pilfering High-finance Trading Algorithms

• Lenovo: Issues Superfish Removal Tool /  SSL-Breaking Code Found in a Dozen More Apps / 1st Lawsuit Filed

• LinkedIn Settles Class Action Over Leaked Passwords

• Marketing Firm Tracking Mobile Devices via Drones in Los Angeles

• NSA Director Defends Plan to Maintain ‘Backdoors’ Into Tech Companies

• Rejection of NSA Whistleblower’s Retaliation Claim Draws Criticism

• Secrecy Around Police Surveillance Equipment Proves a Case’s Undoing

• TrueCrypt Audit Back on Track After Silence and Uncertainty

• UK: Hacker Accused of US Government Breaches Refuses to Give Up Crypto Keys

• Wall Street, Law Firms Plan Cooperative Security Body

Journals / Preprints

• Defining a Framework for Decision Making in Cyberspace [download via IBM]

• Digital Disaster, Cyber Security and the Copenhagen School

• Digital Document Signing: Vulnerabilities and Solutions [Request Full Text]

• The Emergence of Cybersecurity Law [download via University of Indiana]

• Extended Results on Privacy Against Coalitions of Users in User-private Information Retrieval Protocols [Request Full Text]

• The Impact of Stealthy Attacks on Smart Grid Performance: Tradeoffs and Implications

• A Privacy-Preserving QoS Prediction Framework for Web Service Recommendation

• Secure the Cloud: From the Perspective of a Service-Oriented Organization

• Surreptitiously Weakening Cryptographic Systems [more from Cryptology ePrint Archive]

• Sequential Aggregate Signatures with Short Public Keys without Random Oracles

Reports / Blogs / Etc.

• HP Cyber Risk Report 2015 [summary]

• The Impact of the Dark Web on Internet Governance and Cyber Security [Global Commission on Internet Governance]

• Looking Up Symptoms Online? These Companies Are Tracking You [Vice]

• M-Trends 2015: A View from the Front Lines [Mandiant / summary]
  

• McAfee Labs Threats Report: February 2015 [download via McAfee / summary]

• Public Perception of Security and Privacy: Results of the Comprehensive Analysis of PACT’s Pan-European Survey [RAND]

• Report on Cybersecurity Practices [download via Financial Industry Regulatory Authority]

• 2015 Global Megatrends in Cybersecurity [Ponemon / download via Raytheon]

• Samsung SmartTVs Don’t Encrypt Voice and Text Data [Security Affairs]

• TurboTax’s Anti-Fraud Efforts Under Scrutiny [Brian Krebs]

• Verisign Distributed Denial of Service Trends Report [download via Verisign / summary]

• We Need a Manhattan Project for Cyber Security [Marc Goodman]

• Why Firmware Is So Vulnerable to Hacking, and What Can Be Done About It [Wired]

• What NSA Director Mike Rogers Doesn’t Get About Encryption [Cato Institute]

February 20, 2015

PLEASE NOTE: “★” indicates item containing leaked classified documents

News

• Albuquerque Police Sued Over Encrypted CDs in Shooting

• American Sues Ethiopia for Spyware Infection

• ‘Babar’ Malware Likely Created by French Intelligence [more] ★

• British Army Creates Social Media Unit for Espionage, Propaganda Campaigns

• Canada’s Largest Bitcoin Exchange Folds After Breach

• ‘Equation Group’ campaign: overview / useful FAQ / targeted attacks on scientists / hinted at in 2013 ★

• EU Parliament Bans Internal Use of Outlook Mobile App

• Google: Proposed Government-sanctioned Hacking is a Threat to Us All

• Japanese Government Claims 25 Billion Attacks in 2014

• Lenovo Knowingly Shipped Laptops with Certificate-Forging Adware [more]

• GCHQ and NSA Hacked World’s Largest SIM Producer, Stole Encryption Keys ★

• RedTube Becomes Second Major Porn Site to Serve Malware to Millions

• Russian Linked To Theft of 160m Credit Cards Appears in US Court

• UK Admits Unlawfully Monitoring Legally Privileged Communications

• US Shifts Focus of Morgan Stanley Breach Probe

• White House Pushes to Block, Counter ISIS Social Media

Journals / Preprints

• Behavior Rule Specification-Based Intrusion Detection for Safety Critical Medical Cyber Physical Systems [Request Full Text]

• CDStore: Toward Reliable, Secure, and Cost-Efficient Cloud Storage via Convergent Dispersal

• Comparing Decision Support Approaches for Cyber Security Investment

• Controlled Data Sharing for Collaborative Predictive Blacklisting

• Cryptanalysis of A Secure Remote User Authentication Scheme Using Smart Cards

• Cyber Espionage, Surveillance, and International Law: Finding Common Ground

• Cybersecurity Firms – Cyber Mercenaries?

• Distributed Inference in the Presence of Eavesdroppers: A Survey

• Decentralized Trusted Timestamping using the Crypto Currency Bitcoin

• DEFIDNET: A Framework for Optimal Allocation of Cyberdefenses in Intrusion Detection Networks

• DTKI: A New Formalized PKI With No Trusted Parties

• Don’t Trust the Cloud, Verify: Integrity and Consistency for Cloud Object Stores

• High Technology, Consumer Privacy, and US National Security

• How to Bootstrap Anonymous Communication

• An IDS Scheme Against Black Hole Attack to Secure AOMDV Routing in MANET

• The Impact of China on Cybersecurity: Fiction and Friction

• The Meaning of Attack-Resistant Programs

• A Method and Case Study for Using Malware Analysis to Improve Security Requirements [Request Full Text]

• MLATs and TorBrowser: Mutual Legal Assistance Treaties in Online Anonymity Technology and Domestic Surveillance

• Multi-view Face Detection Using Deep Convolutional Neural Networks [summary]

• Neural Synchronization Based Secret Key Exchange over Public Channels: A Survey

• A Note On Boneh-Gentry-Waters Broadcast Encryption Scheme and Its Like

• The Notion of ‘Objects’ During Cyber Operations: A Riposte in Defence of Interpretive and Applicative Precision

• Rethinking ‘Five Eyes’ Security Intelligence Collection Policies and Practice Post Snowden [Request Full Text]

• Secure Communication over Software-Defined Networks [Request Full Text]

• Sovereignty and Cyber Attacks: Technology’s Challenge to the Law of State Responsibility

Reports / Blogs / Etc.

• The Desert Falcons Targeted Attacks [Kaspersky Labs / summary]

• Emerging Threats in Cybersecurity and Data Protection Legislation in African Union Countries [Access]

• Global Threat Intel Report [CrowdStrike / summary]

• IRS Encourages Poor Cryptography [Bruce Schneier]

• President Obama: I’m A Big Believer In Strong Encryption… But… [Techdirt / more from Lawfare and Washington Post – full transcript]

• Privacy and Cyber Security: Emphasizing Privacy Protection in Cyber Security Activities [Privacy Commissioner of Canada]

• The Rise in State Tax Refund Fraud [Brian Krebs]

• Sexually Explicit Material Used as Lures in Recent Cyber Attacks [Trend Micro]

• Top 10 US Privacy Developments of 2014 [Inside Privacy – good round-up w/useful links]

• “Total Information Awareness”: The Disastrous Privacy Consequences of Canada’s Bill C-51 [Michael Geist]

• What Are the Prospects for the Cyber Threat Intelligence Integration Center? [Brookings]

February 13, 2015

PLEASE NOTE: “★” indicates item containing leaked classified documents

News

• Altegrity Files Bankruptcy After ‘State-Sponsored’ Breach

• Anonymous Targets Islamic State Social Media Accounts

• Anthem: Breach May Have Started in April 2014 / At Least 4 Lawsuits Filed / Phishers Targeting Victims / Ten Years’ Worth of Data Exposed

• Citing Tax Fraud Spike, TurboTax Suspends State E-Filings

• DARPA Announces Deep Web Search Project

• DARPA Training Academy Officer Candidates in Cyber Tactics

• Dutch Government Sites Attacked, Knocked Offline

• Email Fraud Costs Omaha Firm $17.2 Mil.

• Feds Charge NY Private Investigator in Hacking-for-hire Case

• Fearing FBI Raid, Researcher Posts 10 Million Passwords/Usernames

• France: Suspected Terrorist Sites Can Be Blocked Without Court Order

• Hacking Guidelines for UK Spies Published

• HSBC: Insider Breach Fallout Continues for Bank, Clients

• IBM: Dating Apps Threaten Enterprise Security

• In 2008 Mumbai Attacks, Piles of Spy Data, but an Uncompleted Puzzle ★

• Indiana Clinic Notifies 45,000 After Laptops Stolen

• Investors Fear HK$3b Losses in Closure of Bitcoin Exchange

• Judge Rules for NSA in Warrantless Search Case

• Lloyd’s: Cyber Attacks Too Big of a Risk for Private Insurers

• Macedonia’s PM Accused of Large-Scale Wire-Tapping

• NSA Claims Iran Learned from Western Cyberattacks ★

• NSA’s Water, Power Supply Under Threat in State Legislatures

• Obama Heads to Security Talks Amid Tensions with Silicon Valley

• Samsung Smart TVs Are Eavesdropping on Users [good round-up / context from Bruce Schneier]

• Study: More Than 30% of Big Merchants Are Not PCI-Compliant

• Thailand’s Army Recruiting for New Cyberwarfare Unit

• Turkey Cites National Security As it Cranks Up Internet Controls

• Twitter’s CFO Has His Account Hijacked

• Vietnam Closes News Site for Exposing Graft

• White House Announces New Cybersecurity Agency

Journals / Preprints

• Albatross: a Privacy-Preserving Location Sharing System

• Analysis of the Deployment Quality for Intrusion Detection in Wireless Sensor Networks

• Cyber Attacks in La-La Land [RE: Sony hack] / [Request Full Text]

• Cyber House Rules: On War, Retaliation and Escalation / [Request Full Text]

• Cyber Warfare and the Jus Ad Bellum Challenges: Evaluation in the Light of the Tallinn Manual on the International Law Applicable to Cyber Warfare

• Design of Two-Party Authenticated Key Agreement Protocol Based on ECC and Self-Certified Public Keys [Request Full Text]

• Eavesdropping On Our Founding Fathers: How a Return to the Republic’s Core Democratic Values Can Help Us Resolve the Surveillance Crisis [download via Harvard]

• Enhanced Secure Mutual Authentication and Key Agreement Scheme Preserving User Anonymity in Global Mobile Networks [Request Full Text]

• FEEBO: An Empirical Evaluation Framework for Malware Behavior Obfuscation

• A Fingerprint-based Access Control using Principal Component Analysis and Edge Detection

• The Fourth Amendment and the Global Internet

• Game-Theoretic Methods for Robustness, Security, and Resilience of Cyberphysical Control

• Systems: Games-in-Games Principle for Optimal Cross-Layer Resilient Control Systems [Request Full Text]

• How Well Do You Blend Into the Crowd? – d-convergence: A Novel Paradigm for Quantifying Privacy in the Age of Big-Data

• Hybrid Epidemics – A Case Study on Computer Worm Conficker

• Intelligence Legalism and the National Security Agency’s Civil Liberties Gap [download via Harvard]

• A Mathematical Approach to NAND Flash-memory Descrambling and Decoding

• Mutual Authenticated Quantum No-key Encryption Scheme over Private Quantum Channel

• A New DNA Based Approach of Generating Key-dependent ShiftRows Transformation

• PowerSpy: Location Tracking using Mobile Device Power Analysis

• Privacy with Imperfect Randomness [more from Cryptology ePrint Archive]

• Randomness of Spritz via DieHarder Testing

• Weakening the Isolation Assumption of Tamper-proof Hardware Tokens

• New issue: Computers & Security
• New issue: IEEE Security & Privacy [Request Full Text]

Reports / Blogs / Etc.

• Anatomy of a Brute Force Campaign: The Story of Hee Thai Limited [FireEye]

• Anthem Hack Shows There Is No Such Thing as Privacy in the Health Care Industry [Brookings]

• The Connected World: Examining the Internet of Things [hearing, US Senate]

• European Consumer Legislation and Online Privacy Policies: Opening Pandora’s Box? [Inside Privacy]

• Financial Cyber-threats in 2014 [Kaspersky Labs]

• Fuel Station Skimmers: Primed at the Pump [Brian Krebs]

• Go to Prison for Sharing Files? That’s What Hollywood Wants in the Secret TPP Deal [EFF]

• How a German-Arab Shell Corporation Tries to Sell a New State Trojan “Made in Germany” [Netzpolitik]

• Internet of Things Security Study: Home Security Systems Report [download via HP / summary]

• Is Anonymous Attacking Internet Exposed Gas Pump Monitoring Systems in the US? [Trend Micro]

• Jeffrey Sterling’s Trial by Metadata [BBC]

• More iCloud Phishing: Don’t Get Sucked In [Sophos]

• Motive Security Labs Malware Report – H2 2014 [Alcatel-Lucent / summary]

• New DYRE Variant Hijacks Microsoft Outlook, Expands Targeted Banks [Trend Micro]

• NSA’s Section 215 Telephony Metadata Program Should and Can Be Shut Down [Lawfare]

• Once-starving GnuPG Crypto Project Gets a Windfall. Now Comes the Hard Part [Ars Technica]

• One-Bit To Rule Them All: Bypassing Windows’ 10 Protections using a Single Bit [Breaking Malware]

• Round-up of recent global online censorship + persecution of bloggers [Global Voices]

• Surveillance and the Vanishing Right to Know [Just Security]

• Tracking & Hacking: Security & Privacy Gaps Put American Drivers at Risk [Sen. Edward Markey, download via US Senate / summary]

• Uncovering Security Flaws in Digital Education Products for Schoolchildren [New York Times]

 

February 6, 2015

PLEASE NOTE: “★” indicates item containing leaked classified documents

News

• Army Releases Cyber-Forensic Code to Github

• Big Precision Medicine Plan Raises Patient Privacy Concerns

• Brazil Releases Draft Personal Data Protection Bill

• Breach at Insurer Anthem Could Impact Millions [informed speculation RE: Chinese state-sponsorship]

• BMW Fixes Security Flaw Affecting 2.2. Mil. Cars

• Electronic Surveillance by Spy Agencies Was Illegal, British Court Says

• FBI Put Hacktivist Jeremy Hammond on Terror Watchlist ★

• Germany Storing Records on 220 Million Calls Each Day ★

• Gmail, Facebook, Skype Excluded from Australian Data Retention

• Google Adds Research Grants to Bug Bounty Program

• Hackers Use Old Lure on Web to Help Syrian Government

• Home Depot Employee Sentenced for Stealing 36,000+ Cards

• Most Brokerages and Advisers Have Had Cyberattacks: SEC

• Report: Two-Factor Authentication Market Set to Top $1.6 Bn

• Sony: Breach Cost Estimate Reaches $15 Mil., Studio Co-Chair Resigns

• Target Hackers Hit Third Parking Service

• Trade Groups Urge US to Push Against Chinese Security Regulations

• Verizon Will Now Let Users Kill Previously Indestructible Tracking Code

• Western Spy Agencies Secretly Rely on Hackers for Intel and Expertise ★

• White House Budget Includes $14 Bil. for Cybersecurity

Journals / Preprints

• Analysis of Human Awareness of Security and Privacy Threats in Smart Environments

• Authentication Systems in Internet of Things

• Big Data: Opportunities and Privacy Challenges

• Cellular Dragnet: Active Cell Site Simulators and the Fourth Amendment

• Cryptanalysis and Improvement of a User Authentication Scheme Preserving Uniqueness and Anonymity for Connected Health Care [Request Full Text]

• Efficient Secure-Channel Free Public Key Encryption with Keyword Search for EMRs in Cloud Storage [Request Full Text]

• Exploiting Multimodal Biometrics in E-Privacy Scheme for Electronic Health Records

• Gait Authentication on Mobile Phone Using Biometric Cryptosystem and Fuzzy Commitment Scheme [Request Full Text]

• Hash Chain Links Resynchronization Methods in Video Streaming Security Performance Comparison

• Leakage-resilient Cryptography with Key Derived from Sensitive Data

• A Predictive Framework for Cyber Security Analytics using Attack Graphs

• Privacy-preserving Network Functionality Outsourcing

• Protecting Location with Dynamic Differential Privacy under Temporal Correlations

• Repairable Threshold Secret Sharing Schemes

• A Resilient Quantum Secret Sharing Scheme

• Robust and Effective Malware Detection through Quantitative Data Flow Graph Metrics

• A Secure Electronic Prescription System Using Steganography with Encryption Key Implementation

• A Self-Compiling Android Data Obfuscation Tool

• Smartphone Malware Detection Model Based on Artificial Immune System [Request Full Text]

• There’s No Free Lunch, Even Using Bitcoin: Tracking the Popularity and Profits of Virtual Currency Scams

• New issue: Designs, Codes, and Cryptography [Request Full Text]

Reports / Blogs / Etc.

• Asian Governments Embrace Surveillance in the Name of Security [Global Voices]

• Behind the Syrian Conflict’s Digital Frontlines [FireEye]

• China’s Self-Destructive Tech Crackdown [New York Times]

• Cybercrime and the Risks for the Economy and Enterprises at the European Union and Italian Levels [United Nations]

• Debate Over the Progress of the EU General Data Protection Regulation [Hunton & Williams]

• EFF, NYU, and others team up to track warrant canaries

• Facebook Caves to Turkish Government Censorship [EFF]

• Google Chrome Update Spam Drops CTB Locker/Critroni Ransomware [Malwarebytes]

• Google Play Apps Pose As Games and Infect Millions with Adware [Avast]

• Google Redesigns Security Warnings After 70% of Users Ignore Them [Sophos – also: Exploit This: Evaluating the Exploit Skills of Malware Groups]

• Hacked Hotel Phones Fueled Bank Phishing Scams [Brian Krebs]

• If They Can Imprison Barrett Brown, They Can Do It to Anyone [Salon]

• Investigative Journalists and Digital Security: Perceptions of Vulnerability and Changes in Behavior [Pew Research]

• Making Children’s Toys Swear [Pen Test Partners]

• Medical Device Data Systems, Medical Image Storage Devices, and Medical Image Communications Devices: Guidance for Industry and Food and Drug Administration Staff [download via FDA – they won’t be regulating device software]

• Managing Digital Assets: The Challenge of Creating and Sustaining Intangible Value in a Data-Driven Economy [download via Aspen Institute]

• The Newest Reforms on SIGINT Collection Still Leave Loopholes [Just Security – also: International Cyber Governance: Engagement Without Agreement?]

• Pawn Storm Update: iOS Espionage App Found [Trend Micro]

• Snowden and the Dark Sophistry of CSEC [Globe and Mail]

• Tibet: Frontline of the New Cyberwar [Tibet Action Institute]

• Top 10 International Privacy Developments of 2014 [Inside Privacy]

• The Vast Majority of the Government Lacks Clear Cybersecurity Plans [Brookings]

• What Ever Happened to NSA Officials Who Looked Up Lovers’ Records? [The Hill]

• Why Internet Users Worldwide Should be Worried About China’s Great Firewall [Washington Post]

• Why You Shouldn’t Completely Trust Files Signed with Digital Certificates [Kaspersky Labs]

• The World’s Email Encryption Software Relies on One Guy, Who is Going Broke [ProPublica]