April 24, 2015

PLEASE NOTE: “★” indicates item containing leaked classified documents

News

• Arkansas Police Send Malware to Whistleblower’s Lawyer

• Armed Services Subpanel Wants Assurances on Cyber Vulnerabilities

• Aviation Security Researcher Detained for Tweeting About Plane Vulnerabilities

• Baltimore Police Reveal 25K+ Uses of Stingray

• Banks Seek to Block Target’s Settlement with MasterCard

• Compromised Govt Data Could Affect Millions in China

• FBI: Police a Target for Hacktivists

• German Intelligence Complicit in NSA Violation of Cooperation Agreement

• Google Moves Toward Encryption of Ads

• Houses Passes Cybersecurity Bill Over Privacy Protests

• Japan’s Nuclear Plants Are Still Running Windows XP

• Jeb Bush Praises Obama Over NSA Spying

• Leaked Docs Reveal New Zealand, NSA Plan to Spy on China ★

• Malaysia Airlines Investigators Reportedly Targeted

• Massive Online Ad Network Merchanta Serving Ransomware

• NATO Plans Vast Cyber Defense Drill

• NIST Official: Internet of Things is Indefensible

• NSA Chief: Cyber Command Will ‘Follow International Norms’

• Raytheon Bids $1.9 Billion for Websense

• Ruling Clears Way for Jury Verdict on Former Goldman Sachs Programmer

• Samsung to Debut Biometric Payment Service in Korea

• 7.85 Million IDs, Passwords Found on Seized Proxy Servers in Japan

• USIS Breach Now Believed to Affect 27K+ Federal Employees

• Virginia Decertifies Voting Machines Open to Trivial Hacks

• Virginia Heeds Call for Cyber Threat-sharing

• WikLeaks Posts Searchable Archive of Hacked Sony Documents

Journals / Preprints

Policy

• Cyber Espionage or Cyber War?: International Law, Domestic Law, and Self-Protective Measures

• Cyber Security in the Gulf Cooperation Council

• Defining Cybersecurity Due Diligence Under International Law: Lessons from the Private Sector

Technical

• Adversarial Wiretap Channel with Public Discussion

• Compute-and-Forward Can Buy Secrecy Cheap

• DDoS Attack Protection in the Era of Cloud Computing and Software-Defined Networking

• Defending Against DDoS Attacks in Bloom Filter-based Multicasting

• Impact Assessment for Vulnerabilities in Open-source Software Libraries

• Information Hiding as a Challenge for Malware Detection

• LookAhead: Augmenting Crowdsourced Website Reputation Systems With Predictive Modeling

• New Algorithms for Decoding in the Rank Metric and an Attack on the LRPC Cryptosystem

• A New Covert Channel over Cellular Voice Channel in Smartphones

• The New South Wales iVote System: Security Failures and Verification Flaws in a Live Online Election [RE: largest deployment of this tech to date]

• On the Generalization Properties of Differential Privacy

• On the Security of a Revised Fragile Watermarking Scheme

• Partial Order Reduction for Security Protocols

• PBF: A New Privacy-Aware Billing Framework for Online Electric Vehicles with Bidirectional Auditability

• Spectral Norm of Random Kernel Matrices with Applications to Privacy

• New issue: IET Information Security [Request Full Text]
• New issue: Security & Communication Networks [Request Full Text]

Reports / Blogs / Etc.

• COZYDUKE [F-Secure /overview of espionage campaign w/US gov. targets]

• DOD Cyber Strategy 2015

• Hacking Airplanes [Bruce Schneier]

• Human Factor 2015 [Proofpoint / summary]

• The Missing MtGox Bitcoins [WizSec]

• Netizen Report: The Spring of Cybercrime Laws [Global Voices]

• Operation Pawn Storm Ramps Up its Activities; Targets NATO, White House [Trend Micro]

• Operation RussianDoll: Adobe & Windows Zero-Day Exploits Likely Leveraged by Russia’s APT28 in Highly-Targeted Attack [FireEye]

• Reminder: Google Remembers Everything You’ve Ever Searched For [Vice]

• 2H 2014 DDoS Threat Report [NSFOCUS / summary]

April 9, 2014

Next update: 4/24

News

• Auburn University Exposes Data of 360,000 for 6 Months

• Australian Officials Attack Researchers for Revealing Online Voting Vulnerability

• Baltimore PD Dismisses Cases Rather Than Reveal Warrantless Cell Surveillance

• Credit Unions, Retailers Continue Sparring Over Payment Security

• DEA/DOJ Monitored US Overseas Calls for Decades

• eBay Set to Comply with Russian Data Storage Law

• FAA Discloses Feb. 2015 Attack

• Facebook Sued Over Facial Recognition Data

• FCC Fines AT&T $25 Mil. for Data Center Breaches

• Firefox Adds Opportunistic Encryption

• 5 Class Actions Filed Against Premera Blue Cross

• FOIA Daylights Law Enforcement’s Legal Agreement With Stingray

• Hackers Claiming ISIS Affiliation Knock French TV Station Off Air

• Lobbyists on Edge About Hackers

• Microsoft Will Not Enable Do Not Track By Default

• Navy’s New Cyber Strategy Includes Offensive Attacks

• New York to Wall Street: Improve Your Security

• NJ Court Dismisses Breach Suit Against Horizon Blue Cross Blue Shield

• PF Chang’s Dodges Another Breach-releated Class Action

• Thailand Moves to Crush Online Free Speech

• Turkey Blocks Facebook, Twitter and YouTube [FB, Twitter now unblocked]

• US and Japan Near Cyber Defense Agreement

• US: State Dept. Hackers Also Attacked White House

Journals / Preprints

Law / Policy

• Assessing the Leakers: Criminals or Heroes?

• The Cyber Combatant: A New Status for a New Warrior

• The Duty of Confidentiality in the Surveillance Age

• A Qualitative Analysis for Evaluating a Cyber Terrorism Framework in Malaysia [Request Full Text]

Technical

• Capture and Analysis of Malicious Traffic in VoIP Environments Using a Low Interaction Honeypot [Request Full Text]

• Computing on Masked Data to Improve the Security of Big Data

• CPIndex: Cyber-Physical Vulnerability Assessment for Power-Grid Infrastructures [Request Full Text]

• Cryptographic Theory Meets Practice: Efficient and Privacy-Preserving Payments for Public Transport

• Cyber Capabilities and Intent of Terrorist Forces [Request Full Text]

• The Design Space of Lightweight Cryptography [more from Cryptology ePrint Archive]

• Internet Censorship Detection: A Survey

• Malware Detection System by Payload Analysis of Network Traffic [Request Full Text]

• Private Data Transfer over a Broadcast Channel

• Secret key-based Authentication with a Privacy Constraint

• Security Challenges for Medical Devices

• Security Concerns and Countermeasures in Network Coding Based Communication Systems: A Survey

• Security Toolbox for Detecting Novel and Sophisticated Android Malware

• Somebody’s Watching Me? Assessing the Effectiveness of Webcam Indicator Lights

• New issue: Designs, Codes, & Cryptography [Request Full Text]

Reports / Blogs / Etc.

• Android Security State of the Union 2014  [Google]

• The Dyre Wolf: Attacks on Corporate Bank Accounts [IBM]

• An Emerging US (and World) Threat: Cities Wide Open to Cyberattacks [IOActive / summary]

• Heartbleed One Year Later: Vast Majority of Global 2000 Organizations Remain Vulnerable [Venafi Labs / summary]

• How to Make a Secret Phone Call [Fast Company]

• The Lack of HTTPS at Amazon: Identifying Items Purchased Using Information Leakage [Smerity]

• Report on Cybersecurity and Critical Infrastructure in the Americas [Trend Micro / summary]

• Talking About Section 215: A Readers’ Guide [Just Security]

April 3, 2015

Highlighted: Cybersecurity: Authoritative Reports and Resources, by Topic [UPDATED – Congressional Research Service]

News

• China Suspends Bank Technology Restrictions

• China’s Main Certificate Authority Blacklisted by Google

• DHS: Drug Pumps Vulnerable to Trivial Hacks

• EFF: China Exploiting US’ Lack of Encryption

• EU Court Hears Oral Arguments in Pivotal Safe Harbor Case

• EU: Leave Facebook if You Value Your Privacy

• Europol: Encyption the ‘Biggest Problem’ in Combating Terrorism

• Feds Subpoena Reddit for Personal Info of Dark Web Forum Members

• FinFisher Lawsuit to be Heard in Pakistani Court

• Forrester: NSA Spying Will Cost US Tech $47 Billion

• Hackers Claiming ISIS Affiliation Attack Hundreds of Russian Sites

• Hollywood Embraces Digital Security

• House Holds Internet of Things Hearing

• Lawsuits Over Google’s Concealed Cookies Move Ahead in UK

• Mandatory Data Retention Passes Australian Parliament, Warrant Canaries Outlawed

• Massive DDoS of Github Tied to China

• Pentagon Buys Encrypted Phones as FBI Condemns Them

• Researchers: Facebook Tracking Even Those Who Opt Out

• Silk Road Was Looted By DEA, Secret Service Agents

• 64% of Americans Now Own a Smartphone

• South Korea Adds Cabinet Level Cybersecurity Post

• Supreme Court: GPS Tracking Equivalent to Search

• Symantec: Targeted Campaign Underway Against Mideast Energy Sector

• Taiwan Seeks Strong US Ties to Counter Chinese Attacks

• TrueCrypt Audit Shows No Evidence of NSA Backdoors [analysis]

• US Declares Cybersecurity a ‘National Emergency’ [executive order / analysis]

• Zappos Breach Lawsuit Settlement Implodes Over Attorneys’ Fees

Journals / Preprints

Law / Policy

• Going ‘Below the Waterline’: The Paradoxical Regulation of Secret Surveillance in the UK

• Internet Governance and Cybersecurity in Brazil

• Looking Forward, Looking Back: Threats to Trust, Confidence and Security on the Internet

Technical

• Android Malware Detection Using Kullback-Leibler Divergence

• BitWhisper: Covert Signaling Channel Between Air-Gapped Computers Using Thermal Manipulations

• Bringing Deployable Key Transparency to End Users [more from Cryptology ePrint Archive]

• DDoS Attack Protection in the Era of Cloud Computing and Software-Defined Networking

• DEFIDNET: A Framework for Optimal Allocation of Cyberdefenses in Intrusion Detection Networks

• Gradual Release of Sensitive Data under Differential Privacy

• Oblivious Transfer Protocol with Verification

• On the Feasibility of Attribute-Based Encryption on Smartphone Devices

• Optimality of the Laplace Mechanism in Differential Privacy

• iPrivacy: a Distributed Approach to Privacy on the Cloud

• Privacy-Preserving Content-Based Image Retrieval in the Cloud

• SecureFind: Secure and Privacy-Preserving Object Finding via Mobile Crowdsourcing

• TLS Proxies: Friend or Foe?

Reports / Blogs / Etc.

• Bulk Collection of Signals Intelligence: Technical Options [National Academies Press]
  

• Canada has a Spy Problem [Christopher Parsons / Citizen Lab]

• Cyberwarfare and Cyberterrorism: In Brief [Congressional Research Service]

• Domestic Drones and Privacy: A Primer [Congressional Research Service]

• English Court of Appeal Decision Significantly Expands UK Privacy Law [Inside Privacy]

• Privacy Is Becoming a Premium Service [Slate]

• State of the Internet Q4 2014 [Akamai / summary]

• Their Eyes on Me: Stories of Surveillance in Morocco [Privacy International]

• Using Baidu 百度 to Steer Millions of Computers to Launch Denial of Service Attacks [GreatFire]

• Volatile Cedar, the Cyber Espionage Campaign from Lebanon [Security Affairs / more]

• Why Cybersecurity Dollars Do Not Add Up at the Pentagon [Nextgov]

• Why Data Breaches Don’t Hurt Stock Prices [Harvard Business Review]

• Wikimedia v. NSA: Standing and the Fight for Free Speech and Privacy [Just Security]