skip navigation

More signal. Less noise.

Daily briefing.

The cybervandals of NullCrew and HorsemenLulz continue to swat at media outlets. This time Al Arabiya is the victim, and, in addition to leaving the usual occupy-the-x digital gasconade, the attackers hackers compromise mail servers.

A hacker of somewhat cheerier mien defaces an Egyptian Armed Forces training website, enjoining everyone to put politics aside and live happily.

Nominum reports on the DNS-amplification denial-of-service threat compromised home routers present.

Researchers publish vulnerabilities discovered in Oracle's Java Cloud Service platform.

A phony offer of "Bitdefender Antivirus Plus 2015" exploits the company's good name and leads the gullible to malware.

Bots go catphishing for lonely Tinder users.

Oldboot.A Android malware is being displaced by a more sophisticated version, "Oldboot.B." Android users in China are particularly at risk.

More cryptocurrency vulnerabilities and exploits are reported. Bitcoin exchange Coinbase denies suffering a data breach, and defends what some analysts call its "spamming friendly" features. Degraded battery life may be a sign a smartphone is infected with Bitcoin-mining malware. And the SANS Institute reports finding similar malware in DVRs.

In industry news, Lockheed Martin talks about the advantages it sees in adding CyberPoint to its Cyber Security Alliance. KEYW will open a new research center.

Dark Reading advises companies on how to staff their SOCs (and notes that cyber talent is pricey). eSecurity Planet reports on the lesser-known forms of cyber insurance coverage. Boeing describes how it keeps data secure in clouds by breaking it into "puzzle pieces."

Banks drop their Target breach lawsuit against Trustwave.


Today's issue includes events affecting Australia, Canada, China, Cuba, Egypt, Ireland, Japan, Russia, United Arab Emirates, United Kingdom, United States..

The CyberWire will cover ITSEF 2014 in special issues next week. See the Events section below for information on the conference.

Cyber Attacks, Threats, and Vulnerabilities

Anti-media cybercrime spree continues: Al Arabiya hacked by NullCrew (ZDNet) After hacking and humiliating Comcast in February, NullCrew is back with HorsemenLulz in a successful hack on the mail servers of the second biggest media company in the Arab world, Al Arabiya

Egyptian Armed Forces Training Authority Website Hacked and Defaced (HackRead) On 31st March, 2014, a hacker going with the handle of "YMH" hacked and defaced the official website of Egyptian Armed Forces Training Authority. Hacker left a deface page along with a message in Arabic language. However, it does not appose or support the opposition or the government, infect it talks about leaving politics aside and enjoy

DDoS fear as 24 million home routers fuel hidden DNS amplification attacks (TechWorld) Nominum discovers home router pwnage

24 million routers expose ISPs to DNS-based DDoS attacks (Help Net Security) DNS-based DDoS amplification attacks have significantly increased in the recent months, targeting vulnerable home routers worldwide. A simple attack can create 10s of Gbps of traffic to disrupt provider networks, enterprises, websites, and individuals anywhere in the world

Researchers Divulge 30 Oracle Java Cloud Service Bugs (Threatpost) Upset with the vulnerability handling process at Oracle, researchers yesterday disclosed more than two dozen outstanding issues with the company's Java Cloud Service platform

Win32/Sality newest component: a router's primary DNS changer named Win32/RBrute (We Live Security) Win32/Sality is a family of malware that has been using a peer-to-peer botnet since at least 2003. It is a file infector and a trojan downloader, the latter of which is mainly used to send spam, although it has been used for different purposes such as faking advertising network traffic, distributed denial of service or VoIP account cracking. All commands and files exchanged through Sality's P2P network are digitally signed, making it resilient to protocol manipulation. Its modular architecture as well as the longevity of the botnet shows good programming practice and an efficient software design

GameOver Zeus: Three Things You Should Know (Malcovery) The Zeus banking trojan is a popular topic in the security world these days. It's not new, but it still garners attention as one of the most successful and prolific trojans in use today

Fake Bitdefender Antivirus Plus 2015 offers lead to malware and scams (Help Net Security) Scammers are taking advantage of Bitdefender's good reputation and are luring victims in with promises of free downloads of "Bitdefender Antivirus Plus 2015," the company warns

Tinder users targeted by spamming bots (Help Net Security) Spammers are taking advantage of the popularity of the Tinder dating app to promote a game via bots posing as attractive women

Most Sophisticated Android Bootkit Malware ever Detected; Infected Millions of Devices (The Hacker News) Hardly two month ago we reported about the first widely spread Android Bootkit malware, dubbed as 'Oldboot.A', which infected more than 500,000 Smartphone users worldwide with Android operating system in last eight months, especially in China

Macro-Enabled Files Used as Infection Vectors (Again) (TrendLabs Security Intelligence Blog) Macro-based attacks were popular in the early 2000s, but they gained much notoriety with the much publicized coverage of the Melissa virus. However, macro-based attacks soon began to drop off the radar. One major reason for this would be the security measures implemented by Microsoft to address malicious macro files. Another probable reason would also be that cybercriminals simply moved on, exploiting the latest and popular

Coinbase denies security breach, defends spamming-friendly features (Help Net Security) Popular Bitcoin exchange and online wallet service Coinbase has denied that it had suffered a breach and claims that the list of some 2,000 Coinbase user names and emails recently published on Pastebin was probably compiled from other sources

Crap battery life? Criminals may be using your phone to mine bitcoins (Silicon Republic) Shorter battery life on your Android smartphone may be caused by malware that is involved in mining for various digital currencies, including bitcoin and dogecoin, according to security firm Trend Micro

DVR Infected with Bitcoin Mining Malware (Threatpost) Johannes Ullrich of the SANS Institute claims to have found malware infecting digital video recorders (DVR) predominately used to record footage captured by surveillance camera systems

Cyber attack creates mortgage meltdown, freezes VA mortgages (WWBT NBC 12) A malicious cyber attack froze mortgages and put home ownership in jeopardy for thousands this week, leaving moving trucks and future plans in Virginia on standby

Passwords, messages of 158k+ users leaked (Help Net Security) The forum database of Web TV service has been ransacked and the attacker made off with — and has subsequently made available for download — a dump containing personal and account information of over 158,000 of its users

Unauthorized access gained to about 800 JSTOR accounts (SC Magazine) Digital library JSTOR is notifying approximately 800 users that their personal information may be at risk after their MyJSTOR accounts were accessed by an unauthorized third party

SendGrid hands customer to hacker (ITNews) Silver-tongued swindler sways staffer. A staffer at popular email delivery system SendGrid was tricked by a hacker who used access granted to them to break into US-based cloud hosting provider ChunkHost

Medical staffers fall for phishing emails, data on 8,300 compromised (SC Magazine) About 8,300 patients of Washington-based Franciscan Medical Group (FMG) are being notified that their personal information may have been compromised after nearly 20 employees responded to information requests in phishing emails purporting to come from FMG's parent company, Catholic Health Initiatives

550k+ card details stolen in 17-month long Spec's breach (Help Net Security) Texan liquor chain Spec's has been breached, and personal and financial information of over half a million of its customers has been compromised in a breach that lasted nearly a year and a half

Parliamentary computers crash 90 minutes after IT assurances (ComputerWeekly) Parliament was hit by another computer crash within 90 minutes of an assurance to MPs, peers and their staff that the system had been fixed

CryptoDefense ransomware attacks 100 countries but has 'fatal flaw' (SC Magazine) The US and UK are the biggest targets of CryptoDefense, a major new ransomware campaign that has stolen over £20,000 in its first month - but which has one major design flaw

Who Built the ID Theft Service (Krebs on Security) Previous stories on this blog have highlighted the damage wrought by an identity theft service marketed in the underground called ssndob[dot]ru, which sold Social Security numbers, credit reports, drivers licenses and other sensitive information on more than four million Americans. Today's post looks at a real-life identity behind the man likely responsible for building this service

Who's Behind the 'BLS Weblearn' Credit Card Scam? (Krebs on Security) A new rash of credit and debit card scams involving bogus sub-$15 charges and attributed to a company called "BLS Weblearn" is part of a prolific international scheme designed to fleece unwary consumers. This post delves deeper into the history and identity of the credit card processing network that has been enabling this type of activity for years

You don't have to be a major Hollywood studio to see the IP risks in cloud file locker services (Graham Cluley) Andy Green of Varonis argues that to better protect their intellectual property and sensitive data, companies need to take more proactive measures — closely auditing and monitoring access to confidential documents

Security Patches, Mitigations, and Software Updates

With just days to go, just how many PCs are still running Windows XP? (We Live Security) Next Tuesday, April 8 2014, Microsoft will release the last ever security patches for Windows XP. And if you look at the figures from Net Market Share, things aren't looking too good

A Banking View on Windows XP and the End of Support: See it, block it (Trend Micro Simply Security) We are less than a week away from a proverbial red letter day: the end of security support for Windows XP on April 8, 2014

The dangers of using outdated software (Help Net Security) Buy something and keep it long enough, and in time it will become vintage: cool, unique and a throwback to days gone by. But while vintage works for fashion, furniture and cars, when it comes to business software, old is a blatant security risk. An F-Secure survey shows that many businesses are risking company assets by using outdated software

Cyber Trends

Kaspersky Lab Study: About One Third of All Phishing Attacks Aimed at Online Financial Institutions (MarketWatch) Kaspersky Lab today released results from the study, Financial Cyber Threats in 2013 , which found that about one third (31.45 percent) of phishing attacks targeted online financial institutions including, banks, online stores and e-payment systems. Of those financial phishing attacks, 70.6 percent used fake bank webpages to acquire confidential user information and steal money from bank accounts, showing the strong trend of cyber criminals exploiting online financial services

Cyber attack biggest terrorist threat for UK (The HR Director) UK's Cyber Emergency Response Team (CERT-UK) goes live. As part of a £650m government investment in cyber security, the unit's aim is to bolster the country's online defences. With the number of cyber-attacks on the rise though, it is questionable whether these steps go far enough

Study: Security Fears Continue To Block Cloud Deployment (Dark Reading) "Fear of the unknown" still haunts cloud adoption


Consumers are souring on Web, post-NSA, survey says (USA Today) The National Security Agency has left more than a black mark on the reputations of tech companies: It is now hurting them financially. Americans are less likely to bank and shop online because of lingering doubts over the NSA's digital-snooping activities

Lockheed taps local startup to join tech heavyweights (Baltimore Daily Record) A young Baltimore startup has been pulled up to the big league of cybersecurity warriors. CyberPoint International, a 4-year-old, 160-employee tech firm, is the newest addition to Lockheed Martin Corp.'s Cyber Security Alliance, becoming the youngest and only privately held company to join a team that includes the likes of Microsoft, Verizon and Cisco…"This company is not only innovating, they're growing," said [Lockheed Martin's] Mann. "We don't have concerns of them going away at all"

KEYW Launches New Advanced Cyber Research and Training Center (Nasdaq) Names Greg Dixon as Sector Vice President for Advanced Cyber Operations and signs lease for 90,000 square-foot facility to build KEYW's Advanced Cyber Research and Training Center

Mandiant Deal Not Disrupting Partners, Says FireEye Channel Chief (CRN) FireEye's $1 billion acquisition of endpoint security and incident response services firm Mandiant is having no serious impact on the ability of the company's partners to deliver services, said FireEye Channel Chief Steve Pataky

Rob Zitz on Leidos' Transition to a Standalone Business, Cyber Trends and Infrastructure Support for DHS (ExecutiveBiz) Rob Zitz joined Leidos in August 2011 — when it was known as Science Applications International Corp. — as senior vice president and chief ISR systems architect after a three-decade government career that culminated in a deputy director role at the National Reconnaissance Office

The Right Stuff: Staffing Your Corporate SOC (Dark Reading) What makes a top-notch security analyst? Passion, experience, and communication skills trump certifications and degrees. But you get what you pay for

Cyber Insurance Covers That? 7 Items You Might Not Know (eSecurity Planet) Data breaches and data losses are just the beginning when it comes to cyber insurance. Policies may also cover such items as data forensics

BrightLine Joins Cloud Security Alliance as Corporate Member (Broadway World) BrightLine CPAs & Associates, Inc., a leading provider of compliance and attestation reporting services, is pleased to announce that it has joined the Cloud Security Alliance (CSA) as a Corporate Member Read more at

Mark Owen, Former Air Force 1-Star General, Named Civergy CEO (GovConWire) Mark Owen, a retired U.S. Air Force brigadier general and formerly an executive vice president at Civergy, has been appointed CEO of the Landover, Md.-based contractor

Fortinet bolsters UK team with former F5 staffers (Microscope) Fortinet continues to develop its UK management team with the arrival of a regional sales director for UK and Ireland tasked with working with the channel to expand the reach for the networking security specialist

Products, Services, and Solutions

Trend Micro Deep Discovery Earns Top Breach Detection Score in NSS Labs Testing (Trend Micro Simply Security) With a number of security companies talking a big game about detecting targeted attacks and advanced threats, Trend Micro is going beyond the hype. And, we can back it up—big time. In the NSS Labs Breach Detection Appliance Report released today, Trend Micro Deep Discovery 3.5 achieved the highest performance rating in overall breach detection among a field of six providers

FireEye, AhnLab score low in lab test of breach detection systems (NetworkWorld) NSS Labs gives 'below average' score to both vendors' breach-detection products

Yahoo adds more security to thwart surveillance (AP via Bloomberg BusinessWeek) Yahoo has added more layers of security in its effort to shield people's online lives from government spying and other snooping

LastPass adds two-factor authentication from Duo Security (Help Net Security) LastPass integrated Duo's mobile-based two-factor authentication solution to the LastPass password management platform to provide an additional layer of credential security

Post Breach Security: The CARM After the Storm (InfoSecurity Magazine) An initiative that cuts across the security vendor landscape is one way that Exclusive Networks helps customers turn their preventive technologies into a problem solver in the aftermath of a data breach incident

AlcaLu Extends SDN, DPI in Enterprise Gear (Light Reading) The Enterprise division of Alcatel-Lucent (Euronext Paris and NYSE: ALU) is today unveiling new technology to address the challenges created by pervasive mobility and the explosion of new applications being introduced within enterprises

Arbor Networks Unique Global Attack Intelligence Integrated into Local Protection (Broadway World) Arbor Networks, Inc., a leading provider of DDoS and advanced threat protection solutions for enterprise and service provider networks, announced today a new reputation-based threat feed as part of its ATLAS Intelligence Feed (AIF) service. AIF is a research-driven feed of security policies designed to update Arbor's Pravail products quickly and accurately by identifying threats based on real-world attack activity, reputation and behavior

Technologies, Techniques, and Standards

CESG defends CCP as UK cyber security skills foundation (ComputerWeekly) GCHQ's information assurance arm has defended the validity of its cyber security professional certification scheme as a foundation for cyber skills development in the UK

Cloud Security Strategy: Encryption Keys (Midsize Insider) A strong cloud security strategy is important for midsize firms to truly innovate with the cloud. One way of approaching that strategy is by using encryption keys. Midsize firms that have a better understanding of encryption can better protect their cloud data

Updating Your Awareness Training (SANS Securing the Human) A common mistake I often see organizations make with their security awareness program is failing to plan long term. Quite often organizations get caught up in the initial roll-out of their training, but forget to plan on updating their program at some point. Its key that you update your program at a minimum once a year

Whose fault is it that users are the weakest link? (CSO) An organization can spend mountains of cash on best of breed network defenses and security tools, but it can all come crashing down with one click from a user. Users are the weakest link when it comes to network and computer security, but a new survey from Globalscape reveals that the users themselves aren't entirely to blame

Talking insider threats at the CSO40 Security Confab and Awards (CSO) These days, the threat landscape for most companies is massive. But while there is a litany of outside threats that their security teams need to worry about, there is often an even greater danger much closer to home. Insider threats are an issue that no company is safe from, with breaches not just occurring at the hands of a disgruntled or malicious employee, but also unintentionally as a result of ignorance

Watching the watchers (Internet Storm Center) A lot of companies today have various IDS and IPS devices implemented in their internal network (especially if you must be compliant with PCI DSS, for example). So these devices get implemented to monitor various traffic at various interfaces/perimeters in a company, but the question I got asked is how can we be sure that the IDS/IPS is doing its job?

Using the Immunity Debugger API to Automate Analysis (Sourcefire VRT) While analyzing malware samples I came across many simple but annoying problems that should be solved through automation. This post will cover how to automate a solution to a common problem that comes up when analyzing malware

Operation Stop The Exfiltration (Dark Reading) Determined cybercriminals and cyberspies will find their way to the data they want, but there are ways to trip them up on their way out

API-First: 3 Steps For Building Secure Cloud Apps (Dark Reading) When it comes to protecting data traveling to and from the cloud, today's choices are daunting. Here are three steps for making the application programming interface your new best friend

How Boeing merges its data centers with the Amazon and Microsoft clouds (Ars Technica) Carving data up into "puzzle pieces" keeps sensitive information secure

Research and Development

New algorithm classifies everything from gene data to POTUS speeches (Ars Technica) Accurately determines whether a State of the Union is pre- or post-Reagan


UMBC receives $750 million grant from NSA (The Retriever Weekly) Funds to establish new hacking education program and security/data analytics lab

Knowing Is Half the Battle: Combating Big Data's Dark Side Through Data Literacy (Slate) The White House Office of Science and Technology Policy is nearing the end of its 90-day review of big data and privacy. Soon, industry leaders, privacy advocates, engineers, and developers expect to learn regulators' key questions and priorities for balancing innovation in predictive analytics while protecting against harm or discrimination

Why CTF (Plaid Parliament of Pwning) A recent blog post has been going around talking about the differences between competitions like CCDC (Collegiate Cyber Defense Competition) and CTFs (Capture the Flag). It's a good read and I thought a lot of interesting points were brought up, and figured it could be beneficial to try to respond to them some place to encourage discussion (and besides, our blog needs any excuse it can get for new content). For what it's worth, I didn't watch Chris Eagle's presentations, though I imagine I don't agree with everything he said. Likewise, I don't disagree with everything from Matt Weeks' blog post. This post is mostly motivated by the fact that while a discussion on security competitions is going, it makes sense to talk about some related things I have been thinking about

Legislation, Policy, and Regulation

While Warning Of Chinese Cyberthreat, U.S. Launches Its Own Attack (NPR) The U.S. government has long complained about Chinese hacking and cyberattacks, but new documents show that the National Security Agency managed to penetrate the networks of Huawei, a large Chinese telecommunications firm, gathering information about its operations and potentially using equipment it sells to other countries to monitor their computer and telephone networks as well

Democratic senators: Obama was 'misleading' about NSA surveillance (Washington Examiner) Two Democratic senators denounced the National Security Agency for conducting "warrantless searches of the content of Americans' personal communications," and, more broadly, the senior government officials — including President Obama — who were "misleading" in denying that such searches took place

Conor Friedersdorf: NSA reforms should go beyond phone calls (Orange County Register) Snooping limits should include Internet use, other records. Almost 10 months after Edward Snowden revealed that the U.S. government is spying on virtually all of us, using dragnet surveillance that tracks and stores all phone numbers we dial, President Obama has finally issued a proposal for reforming the National Security Agency

What's Behind the NSA Battle (US News and World Report) This is another round in the long tug of war between Congress and the president over national security

NSA's domestic surveillance draws both sides together to debate issue (New Hampshire Union Leader) The National Security Agency's monitoring of domestic communication is either a violation of Constitutional rights or is a valid tool to provide security and safety for the American populace

Ralph Nader talks whistleblowers and national security at Yale (New Haven Register) Political firebrand Ralph Nader tore into the Obama administration's claims of transparency Tuesday at Yale University, saying government spying and unchecked executive authority leaves the U.S. teetering on the verge of being a police state

NAPOLITANO: What if secrecy, NSA trump the Constitution? (Washington Times) Spying on Americans elicits many questions but few answers

Is whistleblower advocate for nation's spies under attack? (McClatchy) The Pentagon's inspector general is trying to suspend and possibly revoke the top secret access of the Defense Department's former director of whistleblowing, triggering concerns in Congress that he's being retaliated against for doing his job

Big data need not end Americans' privacy, argues CDT (FierceBigData) The era of big data need not herald the end of traditional privacy, argues the Center for Democracy and Technology in comments submitted to the White House

Cuba's rulers were right: The US was trying to use social media to overthrow the regime (Quartz) The Associated Press has a bombshell: The US Agency for International Development (USAID), which is responsible for administering American foreign aid and development funds, spent years covertly establishing an SMS-only social network in Cuba, in the hopes that it might develop into a "Cuban Twitter" that would undermine the island's communist government

EU votes net neutrality into law, abolishes mobile roaming charges (IT World) Blocking and throttling Internet traffic will become illegal in the European Union following a parliamentary vote on Thursday

Litigation, Investigation, and Law Enforcement

Banks withdraw lawsuit against Chicago's Trustwave (Crain's Chicago Business) The two banks that sued technology-security firm Trustwave Holdings Inc. in connection with the Target Corp. hacking incident have withdrawn their suit

Target catches a break in data breach lawsuit (FierceRetailIT) While Target (NYSE: TGT) executives would love to be able to pin the retailer's massive card data breach on IT vendors, it may not be able to do so

Secure protocols for accountable warrant execution (Freedom to Tinker) Last week the press reported that the White House will seek to redesign the NSA's mass phone call data program, so that data will be held by the phone companies and accessed by the NSA, subject to a new warrant requirement. The Foreign Intelligence Surveillance Court will issue the warrants. Today Josh Kroll and I, with colleagues at Stanford University, released a draft paper on how to use cryptography to implement warrants to data in a secure, private, and accountable way

What, besides phone records, does the NSA collect in bulk? (Ars Technica) Gun purchases? Financial transactions? A coalition of orgs wants answers

Bankruptcy judge orders Mt. Gox CEO to answer questions in US by April 17 (Ars Technica) Mark Karpeles needs to answer questions in person to proceed with Chapter 15

For a complete running list of events, please visit the Event Tracker on the CyberWire website.

Upcoming Events

SyScan 2014 (Singapore, March 31 - April 4, 2014) SyScan is a deep knowledge technical security conference. It is the aspiration of SyScan to congregate in Asia the best security experts in their various fields, to share their research, discovery and...

NIST IT Security Day (Gaithersburg, Maryland, USA, April 8, 2014) The Office of the Chief Information Officer, OCIO, is hosting NIST IT Security Day as a means to heighten awareness for all NIST users on the many aspects of operational information technology security...

2014 GovCon Cyber Summit (McLean, Virginia, USA, April 9, 2014) The U.S. Computer Emergency Readiness Team (US-CERT) noted that last year federal networks saw a substantial increase in hacking incidents, with 48,000 attacks reported by agencies. In recognition of this...

2014 GovCon Cyber Summit (McLean, Virginia, USA, April 9, 2014) The U.S. Computer Emergency Readiness Team (US-CERT) noted that last year federal networks saw a substantial increase in hacking incidents, with 48,000 attacks reported by agencies. In recognition of this...

2014 Computer Security Day (Eugene, Oregon, USA, April 11, 2014) The Fourth Computer Security Day at the University of Oregon will feature a slate of distinguished speakers from academia, industry, and government, discussing current challenges and future opportunities...

Women in Cyber­security Conference (Nashville, Tennessee, USA, April 11 - 12, 2014) WiCyS is an effort to bring together women (students/faculty/researchers/professionals) in cybersecurity from academia, research and industry for sharing of knowledge/experience, networking and mentoring.

NSA Procurement in today's business arena (Elkridge, Maryland, USA, April 16, 2014) An opportunity to gain inside perspective on market trends in NSA Procurement. The guest speaker will be William Reybold, National Security Agency's Deputy Senior Acquisition Executive (SAE), who manages...

East Africa Banking and ICT Summit (Kampala, Uganda, April 25, 2014) The global event series for Banking and ICT Summit enters its third year. The summit will continue to provide delegates with technical & practical sessions, lectures and showcase for banking and ICT innovations,...

Grow your brand and reach new customers.

Grow your brand and increase your customer base by educating our audience about your products, services, and events by advertising on The CyberWire. We’ve built trust with an influential (and often hard to reach) audience of CISOs, CSOs, and other senior execs in the security space, across a wide array of industry verticals. Learn more.

Be a part of the CyberWire story.

People ask us (a lot) how they can support what we do. We have our sponsorships and services, of course, but those are not always within every supporter's financial reach, or it might just not be the right time for you to do those things. That's why we launched our new Patreon site, where we've created a wider variety of support levels, each with some new benefits. Our patrons are important to our future, and we hope you'll consider becoming one. We invite you to become part of the CyberWire story. Become a patron today.