May 29, 2015

News

• China’s Cybersecurity Plan Aims to Protect State Secrets

• Credit Unions, Trades Sue Home Depot

• Data of 4 Million Adult Friend Finder Users Dumped on Open Web

• DOJ Releases Drone Privacy Guidance

• Dutch Firms Face Steep Fines for Not Disclosing Breaches

• FBI: No Cases Cracked Using Expanded Patriot Powers

• Florida Accidentally Doxes Thousands of Its Citizens (Again)

• IRS: Hackers Steal Data on 100K / Recently Cut Infosec Staffing / Blames Russians

• Jawbone Sues Rival Fitbit for Data Theft

• Iran Blames US for Attack on Its Oil Ministry

• $19 Mil. Target, MasterCard Breach Settlement Crumbles

• Researchers Start Effort to Protect ‘Smart’ Cities

• Silent Circle Leaves US Over Surveillance

• Skype Summoned to Belgian Court Over Failure to Share Call Data

• 10 Million Exposed in Breach of Music Streaming Service Ganaa

• USA Freedom Act Fails in Senate

• Yahoo Faces Class Action Over Email Spying Claims

Articles / Preprints

Law / Policy

• Cyberwar & International Law Step Zero

• Governing Cyberspace through Constructive Ambiguity [Request Full Text]

• Towards Data Sovereignty in Cyberspace

Technical

• Adaptive Security Management of Real-time Storage Applications over NAND Based Storage Systems

• Anonymous Online Purchases with Exhaustive Operational Security

• Differentially Private Response Mechanisms on Categorical Data

• DiscoverFriends: Secure Social Network Communication in Mobile Ad Hoc Networks

• Enabling Security Functions with SDN: A Feasibility Study

• A Fast Privacy-preserving Framework for Continuous Location-based Queries in Road Networks

• Interest-Based Access Control for Content Centric Networks

• Multi-Keyword Search Over Encrypted Data with Scoring and Search Pattern Obfuscation [Request Full Text]

• No Place to Hide That Bytes Won’t Reveal: Sniffing Location-Based Encrypted Traffic to Track User Position

• A Novel Cheater and Jammer Detection Scheme for IEEE 802.11-based Wireless LANs

• Oblivious Secure Deletion with Bounded History Independence

• Optimized Password Recovery for Encrypted RAR on GPUs

• Preemptive Security Through Information Analytics [Request Full Text]

• Privacy Games: Optimal User-Centric Data Obfuscation

• Privacy in the Internet of Things: Threats and Challenges

• Privacy-preserving Cross-domain Routing Optimization — A Cryptographic Approach

• Privacy through Fake yet Semantically Real Traces

• Protocols for Mitigating Blackhole Attacks in Delay Tolerant Networks [Request Full Text]

• Quantifying the Utility-Privacy Tradeoff in the Smart Grid

• Reputation Dynamics in Networks: Application to Cyber Security of Wind Farms [Request Full Text]

• Survey of Secure Multipath Routing Protocols for WSNs

• We Can Track You If You Take the Metro: Tracking Metro Riders Using Accelerometers on Smartphones

Reports / Blogs / Etc.

• Dissecting Linux/Moose: The Analysis of a Linux Router-based Worm Hungry for Social Networks [ESET Canada]

• The Emergence of Bluetooth Low Energy [Context – RE: tracking / privacy]

• Meet ‘Tox’: Ransomware for the Rest of Us [McAfee]

• Report on Encryption, Anonymity, and the Human Rights Framework [United Nations]

• Scaremongering about the Patriot Act Sunset [Just Security]

• Stalking Your Friends with Facebook Messenger [Medium]

• Statistics on Botnet-assisted DDoS Attacks in Q1 2015 [Kaspersky]

• The Governance of Telecommunications Surveillance: How Opaque and Unaccountable Practices and Policies Threaten Canadians [Telecom Transparency Project]

May 22, 2015

PLEASE NOTE: “★” indicates item containing leaked classified documents

News

• Chinese Army: Internet ‘Main Front’ in Ideological War With West

• Dept. of Commerce Wants to Restrict Zero Day Exports

• Federal Reserve Bank of St. Louis Confirms Attack

• Germany: Unknown Hackers Hit Bundestag

• Home Depot Breach Costs Now Estimated at $50 Mil.+

• (ISC)²: Federal Security Worse Off Than 2 Years Ago

• Justice Dept.: FBI Ignored Privacy Rules for Years

• Major Asian Data Center, Cable Provider Pacnet Suffers Significant Breach

• Millions of AdultFriendFinder Users Exposed in Breach

• NSA Planned to Hijack Google Play to Serve Spyware ★

• 1.1 Million Hit by Hack at CareFirst Blue Cross Blue Shield

• Penn State Blames China for Attack, Breach

• RadioShack Sells Customer Data After Settling With States [violating its own privacy policy]
  

• Russia Warns Google, Twitter and Facebook on Encryption

• Software Suspected in Crash of Airbus Cargo Plane

• US Vows Tighter Security Cooperation with South Korea

• Yemeni Hackers Breach Saudi Ministry, Dump Classified Docs

Journals / Preprints

Law / Policy

• The Cyber Dimensions of the Syrian Civil War: Implications for Future Conflict [Request Full Text]

• Widening the Aperture on 4th Amendment Interests: A Comment on Orin Kerr’s The Fourth Amendment and the Global Internet

Technical

• A Consensus Based Network Intrusion Detection System

• Constructing Elastic Distinguishability Metrics for Location Privacy

• Cryptocurrencies without Proof of Work

• Differentially Private Exponential Random Graphs

• Enabling Security Functions with SDN: A Feasibility Study

• Evolving Statistical Rulesets for Network Intrusion Detection

• Homomorphic Data Isolation for Hardware Trojan Protection

• How to Detect Unauthorised Usage of a Key [more from Cryptology ePrint Archive]

• Impact of Shared Code on Vulnerability Patching

• Imperfect Forward Secrecy: How Diffie-Hellman Fails in Practice

• Opportunistic Human Observation Attacks: Perils in Designing Zero-Effort Deauthentication

• Profiling User-trigger Dependence for Android Malware Detection

• Protection and Deception: Discovering Game Theory and Cyber Literacy through a Novel Board Game Experience

• Why We Should Worry About the Supply Chain

Reports / Blogs / Etc.

• Americans’ Attitudes About Privacy, Security and Surveillance [PewResearch / summary]

• Building Code for Medical Device Software Security [IEEE]

• A Chatty Squirrel: Privacy and Security Issues with UC Browser [Citizen Lab]

• DOJ Guidance on Cybersecurity Carrots and Sticks [Just Security]

• Free Cyberwar, Surveillance and Security MOOC from University of Adelaide

• Let’s Call Out CSI: Cyber’s Hilariously Absurd Technobabble [Wired]

• NetUSB, IoT and Supply Chain Risk [Security Ledger]

• 2014 Internet Crime Report [FBI IC3 / summary]

• Secretary Of State: We Must Have A Secure Internet; DHS Secretary: Secure Internet Makes Us All Less Safe [Techdirt]

• Why the Current Section 215 Reform Debate Doesn’t Matter Much [Bruce Schneier]

May 15, 2015

News

• Attorney: Spy Chief ‘Forgot’ About NSA Program When He Misled Congress

• China’s Army Bans Wearable Technology

• Drives Stolen from IT Officer’s Car Behind Massive Data Loss at Indiana State Medical Ass’n

• FBI: US Data Breaches ‘Increasing Substantially’

• FDA Warns of Drug Pump Vulnerabilities

• FTC Sued Over Refusal to Disclose Data Security Policies

• House Votes to End Bulk Phone Data Collection [or, to codify it]

• Gulf Leaders Want Cyber Pact With White House

• Mobile Spy Software Maker mSpy Hacked, Customer Data Leaked

• NY’s Banking Regulator to Issue Security Regulations Later This Year

• Ruling May Stop Warrantless Device Searches at US Borders

• Russia and China Sign Cyber Pact

• Target-Mastercard Settlement Moves Ahead Despite Court Doubts

• Third Party Software Was Point-of-Entry for USIS Hackers

• UK Accused of Violating EU Law for Failing to Restore Hacked Site

• UK Moves to Radically Restrict Online Speech

• White House Offensive Against Foreign Hackers Yields Mixed Results

Journals / Preprints

Law / Policy

• An Essay on Domestic Surveillance

• The Wasp’s Nest: Intelligence Community Whistleblowing and Source Protection

Technical

• Authentication Handover and Privacy Protection in 5G Hetnets Using Software-defined Networking [Request Full Text]

• Data Attacks on Power Grids: Leveraging Detection

• A Fully Card-safe Protocol for Securely Aggregating Distributed Information

• A Practical Set-Membership Proof for Privacy-Preserving NFC Mobile Ticketing

• Safeguarding 5G Wireless Communication Networks Using Physical Layer Security [Request Full Text]

• Securing Android: A Survey, Taxonomy, and Challenges

• Securing Software Defined Networks: Taxonomy, Requirements, and Open Issues [Request Full Text]

• SFAMSS: A Secure Framework for ATM Machines via Secret Sharing

• A Survey on Detection of Sinkhole Attack in Wireless Sensor Network

• Taxonomy and Survey of Collaborative Intrusion Detection

• Whispers in the Hyper-Space: High-Bandwidth and Reliable Covert Channel Attacks Inside the Cloud [Request Full Text]

• New issue: IEEE Security & Privacy
• New issue: IEEE Transactions on Dependable & Secure Computing [Request Full Text]
• New issue: IEEE Transactions on Information Forensics & Security [Request Full Text]
• New issue: IET Information Security [Request Full Text]
• New issue: International Journal of Information Security [Request Full Text]
• New issue: Security & Communication Networks [Request Full Text]

Reports / Blogs / Etc.

• Lax Security Opens the Door for Mass-Scale Abuse of SOHO Routers [Incapsula]

• Many of the NSA’s Loudest Defenders Have Financial Ties to NSA Contractors [Intercept]

• Online Copyright Enforcement, Consumer Behavior, and Market Structure [EU Joint Research Centre]

• United Airlines Bug Bounty Program [find vulnerabilities, get free miles]
  

• What ACLU v. Clapper Means [Just Security /also: United States v. Davis – Wrestling With the Third Party Doctrine]

• Who’s Scanning Your Network? (A: Everyone) [Brian Krebs]

May 8, 2015

PLEASE NOTE: “★” indicates item containing leaked classified documents

News

• Anonymous Breaches WTO, Dumps Employee Data

• Canada’s Anti-Spam Laws May Be Working

• China Wants Cyber ‘Sovereignty’ in New Security Law

• Consumer Reports: Data of 70 Million Americans Stolen in 2014

• FAA Replaces Air Traffic Control System Amid Hacking Fears

• FBI Creates Executive Position to Coordinate Security Responses

• Feds Issue 1st Fine Against Virtual Currency Exchange

• France Moves to Vastly Expand Domestic Surveillance

• Germany Accused of Spying on Allies

• Germany Curbs Spying for NSA After Row: Sources

• Home Depot Breach Suits Consolidate, Allege Negligence

• IRS Creates Cybercrime Unit to Combat ID Theft

• Lawyers Threaten Researcher for Disclosing Bug in Popular Digital Lock

• Navy Looks to Dump IBM Servers After Sale to China’s Lenovo

• NSA Phone Spying Ruled Illegal by Appeals Court [analysis: 1, 2]

• State Dept.: Clinton’s Personal Email Use ‘Not Acceptable’

• UK Conservative Victory Opens Door to More Domestic Surveillance

• US Court Rules Police Can Access Location Data Without a Warrant

Journals / Preprints

• Characterizing Seller-Driven Black-Hat Marketplaces

• Danger is My Middle Name: Experimenting with SSL Vulnerabilities in Android Apps

• Dumb Crypto in Smart Grids: Practical Cryptanalysis of the Open Smart Grid Protocol [more from Cryptology ePrint Archive]

• Encoding by DNA Relations and Randomization Through Chaotic Sequences for Image Encryption

• Enhanced Usage of Keys Obtained by Physical, Unconditionally Secure Distributions

• How Far Removed Are You? Scalable Privacy-Preserving Estimation of Social Path Length with Social PaL

• Improving Network Intrusion Detection System Performance Through Quality of Service Configuration and Parallel Technology

• Malware Behavioural Detection and Vaccine Development by Using a Support Vector Model Classifier

• Mitigating Hardware Cyber-Security Risks in Error Correcting Decoders

• A Novel Distributed Intrusion Detection System for Vehicular Ad Hoc Networks

• A Novel Protective Framework for Defeating HTTP-Based Denial of Service and Distributed Denial of Service Attacks

• An Optimization Process to Identify Outliers Generated by Intrusion Detection Systems [Request Full Text]
  

• Practical Covert Channels for WiFi Systems

• Program Actions as Actual Causes: A Building Block for Accountability

• Quit Playing Games With My Heart: Understanding Online Dating Scams

• Taming the Android AppStore: Lightweight Characterization of Android Applications

Reports / Blogs / Etc.

• Ad Injection at Scale: Assessing Deceptive Advertisement Modifications [Google]

• Deconstructing the 2014 Sally Beauty Breach [Brian Krebs]

• An Example of Cell Phone Metadata Forensic Surveillance [Bruce Schneier]

• A Growing Body of Secret Intelligence Law [Federation of American Scientists]

• IT Threat Evolution in Q1 2015 [Kaspersky]

• 5th Annual Benchmark Study on Privacy and Security of Healthcare Data [Ponemon / summary]
  

• Here’s China’s Take on the Pentagon’s New Cyber Strategy [Defense One]

• How the NSA Converts Spoken Words Into Searchable Text [Intercept] ★

• Meeting Snowden in Princeton [Ross Anderson]

• Researcher: Drug Pump the ‘Least Secure IP Device I’ve Ever Seen’ [Security Ledger]

• USA Freedom Act: An Updated Readers’ Guide on Section 215 [Just Security]

May 1, 2015

News

• Alleged $340 Mil. Bank Hack Goes to Court in Nigeria

• Airbus to File Criminal Complaint Over US Spy Claims

• Another Healthcare System Falls to Phishers

• China Blames Pentagon for ‘Internet Arms Race’

• Declassified Report Shows Doubts About Value of NSA’s Warrantless Spying

• FBI Slammed on Capitol Hill for ‘Stupid’, ‘Orwellian’ Ideas About Encryption

• Former CIA Boss Petraeus Gets Probation After Leaking Secrets

• FTC Issues First Censure for In-store Tracking of Shoppers

• House Passes Cybersecurity Information Sharing Bills

• iPad App Update Flaw Grounds American Airlines Fleet

• London Police Still Running 35,000 Windows XP Machines

• Online Test-Takers Feel Anti-Cheating Software’s Uneasy Glare

• Oregon Hasn’t Fixed State Data Center Vulnerabilities Found in 2012

• Pentagon to Open Silicon Valley Office, Provide Venture Capital

• Popular Android Apps Still Suffer from HTTPS Defects 7 Months After Notification

• Researchers: Samsung Galaxy S5 Flaw Allows Hackers To Clone Fingerprints

• Romanian Police Arrest 25 in Offensive Against Bank Hackers

• Ryanair Loses $5 Mil. in Bank Hack

• SANS: Iran Likely Not Behind Attacks on US Infrastructure

• Slovakia Rules Mass Surveillance Unconstitutional

• SSL Bug Exposes 25,000 iOS Apps to MITM Attack

• TransUnion, OneVault to Develop National Voice Bank in South Africa

• White House Unveils Cyber Pact with Japan

Journals / Preprints

Law / Policy

• Cyber War: Law and Ethics for Virtual Conflicts

Technical

• Analysis of a “/0” Stealth Scan From a Botnet [Request Full Text]

• Decomposing, Comparing, and Synthesizing Access Control Expressiveness Simulations

• Differentially Private Release and Learning of Threshold Functions

• Distributed Denial of Service Attacks in Software-defined Networking with Cloud Computing [Request Full Text]

• Dynamic Provable Data Possession

• Financial Cryptography: Algorithmic Mechanisms for a Hedonic Game [more from Cryptology ePrint Archive]

• Gatling: Automatic Performance Attack Discovery in Large-Scale Distributed Systems

• Heterogeneous Differential Privacy

• Location-aware Sign-on and Key Exchange Using Attribute-based Encryption and Bluetooth Beacons

• Preventing SQL Injection Attack Using Pattern Matching Algorithm

• Private Disclosure of Information in Health Tele-monitoring

• Quantum Secret Sharing with Error Correction

• Secret Key Agreement: General Capacity and Second-Order Asymptotics

• Secure and Verifiable Electronic Voting in Practice: the use of vVote in the Victorian State Election

• Secure Zones: An Attribute-Based Encryption Advisory System for Safe Firearms

• Two Trends in Mobile Security: Financial Motives and Transitioning from Static to Dynamic Analysis

• New issue: Computers & Security
• New issue: Designs, Codes, & Cryptography
• New issue: IEEE Transactions on Information Forensics & Security [Request Full Text]
• New issue: Security & Communication Networks [Request Full Text]

Reports / Blogs / Etc.

• Best Practices for Victim Response and Reporting of Cyber Incidents [Department of Justice]

• A Day in the Life of a Stolen Healthcare Record [Brian Krebs]

• Dirty Hands: Why Biometric Voting Fails in Africa [Guardian]

• Encryption, Anonymity, and the “Right to Science” [Just Security]

• The Further Democratization of Stingray [Bruce Schneier]

• How to Discover NSA Quantum Insert Attacks on Your Systems [Security Affairs]

• How the Pentagon Could Soon Share Americans’ Data With Foreign Militaries [Defense One]

• Internet Security Marketing: Buyer Beware [CircleID]

• The Minimalist Surveillance Reforms of USA Freedom [Just Security]