Russia's cyber isolation of the Crimean battlespace continues even as kinetic operations slow, and cyber ops are now reported to extend to disruption of political communications in the Ukrainian capital. Russia claims that pro-Moscow militias operating in Crimea are not under Russian control, and so one should expect to see initial stages of a broader cyber offensive against Ukrainian infrastructure conducted beneath the fig leaf of a patriotic hacktivist cyber-riot.
Western observers speculate on the range of cyber responses available should governments (the US, UK, and Germany are most often mentioned) elect to oppose the Russian adventure actively—whatever decisions may be taken, none of the options are as easy as they appear. Russia seems vulnerable to manipulation of certain key markets, and those might offer scope for a cyber counter-campaign.
Since cyber operations are first cousin to information operations, a look at charges and countercharges is instructive—the US Embassy in Moscow "sets the record straight" in a particularly direct and useful communication. Security analysts look for signs of Uroburos malware deployed in support of Russian actions.
Red Hat announces discovery of a critical crypto-bug, "GnuTLS," that could render Red Hat, Ubuntu, and Debian Linux distributions vulnerable to eavesdropping.
Researchers demonstrate a "triple handshake" man-in-the-middle attack against sites and apps running TLS. The approach exploits vulnerabilities in session resumption and client authentication during renegotiation.
Bitcoin bank Poloniex joins Flexcoin and Mt. Gox among cybercrime victims.
In these last days of Windows XP, F-Secure warns that a zero-day is "inevitable."
Today's issue includes events affecting Brazil, China, Cuba, Germany, Finland, Japan, Republic of Korea, Latvia, Morocco, Russia, Sweden, Ukraine, United Kingdom, United States..
Cyber Attacks, Threats, and Vulnerabilities
Ukraine says communications hit, MPs phones blocked(Reuters) Ukraine's telecommunications system has come under attack, with equipment installed in Russian-controlled Crimea used to interfere with the mobile phones of members of parliament, the head of Ukraine's SBU security service said on Tuesday
Cyber's Role in Ukraine-Russia Conflict(BankInfoSecurity) Will West respond in cyberspace to Russia's actions? Russia's offensive military actions in Crimea and its threats to the rest of Ukraine are raising concerns about how the conflict could play out in cyberspace
How to Beat a Russian Cyber Assault on Ukraine(Atlantic Council) Ukraine and its friends in the United States, NATO, and European Union need to prepare now for a probably inevitable (but just possibly preventable) cyber conflict with Russian-backed proxies
Setting the Record Straight on Ukraine(Embassy of the United States, Moscow, Russia) Claim: We need to return to the February 21 agreement, which the opposition failed to implement. Response: As part of the agreement, the Ukrainian Parliament (the Rada) passed a bill to return Ukraine to the 2004 Constitution
Is Uroburos the First Known Russian Cyberweapon?(InfoSecurity Magazine) At a time of heightened tension between Russia and the West over Ukraine, a German security firm describes a sophisticated rootkit that it suggests may have been developed by Russian intelligence services. Named after a string found in the code, Ur0bUr()sGotyOu#, the Uroburos malware is thought to target governments, research institutes and major corporations
Triple Handshake Attacks Target TLS Resumption, Renegotiation(Threatpost) A team of researchers has published a paper that explains a number of attacks against websites and Web-based applications running TLS. The researchers' techniques do not exploit implementation errors, the most common attack vector against encryption securing online communication, instead focus on exploiting features of the protocol that include session resumption followed by client authentication during session renegotiation
Meetup CEO on why he wouldn't pay $300 to stop DDoS attacks(FierceCIO: TechWatch) Social networking site Meetup has been hit by a string of Distributed Denial of Service (DDoS) attacks since last Thursday, and was restored and overwhelmed a few times since. What makes this noteworthy is that company CEO and co-founder Scott Heiferman had apparently received an email that attempted to extort $300 from him as a condition to stop the DDoS, which promptly commenced
F-Secure report warns XP zero-day attack is imminent(PC World) Are you still using Windows XP? In its latest Threat Report, security vendor F-Secure warns that a powerful zero-day attack against Windows XP is a matter of when—not if—and provides some guidance for those stalwart (or foolhardy) PC warriors who plan to ignore the April 8 "XPocalypse" when Microsoft support for the OS officially expires
Thieves Jam Up Smucker's, Card Processor(Krebs on Security) Jam and jelly maker Smucker's last week shuttered its online store, notifying visitors that the site was being retooled because of a security breach that jeopardized customers' credit card data. Closer examination of the attack suggests that the company was but one of several dozen firms — including at least one credit card processor — hacked last year by the same criminal gang that infiltrated some of the world's biggest data brokers
Government spying tools will worsen Internet security: experts(Reuters) Electronic spying tools used by the U.S. government could end up in the hands of organized criminals and hackers, further eroding Internet security, warned industry leaders who called for new restrictions and oversight of government activity
Scammers turn to Facebook for targeting(Help Net Security) Scammers are increasingly taking advantage of Facebook targeting tools and user trust to push cheap pharmaceuticals, designer replicas and other products in a trend reminiscent of traditional spam, according to Bitdefender
How this one innocous tweet could hack a bank account(ZDNet) One inane tweet from mid-2012 was enough to start a chain reaction of information-gathering that could have rivaled the work of a government intelligence agency. And with that dossier of data, a hacker could have ended up ruining one man's life
Mobile Threat Monday: Don't Let Apps Send Your Data in Plain Text!(PC Mag) Most apps are going to snag some piece of your personal information. It might be your device ID, it might be your email address, or it might be your entire address book. Sometimes, this access is warranted, but even when an app really does need this information it should also secure it for transfer. This week, Bitdefender points us to two apps that have a legitimate need for your personal information, but transmit it in plain text that's easily intercepted
Security Patches, Mitigations, and Software Updates
Is the security perimeter gone? IT execs weigh in(FierceITSecurity) Is there an enterprise security perimeter anymore? That was one of the questions tackled by a panel of chief information security officers and other IT execs at the RSA Conference last week
Physicians split on use of mHealth apps(FierceMobileHealthcare) A poll of 1,500 physicians across the country finds that 37 percent have prescribed a mobile medical application to their patients, according to QuantiaMD, a social learning network for physicians
The risk of offshoring security(CSO) Outsourcing across all industries has become commonplace, but as the InfoSec Institute's Kim Crawley points out, the economical and security issues of such a trend may cause irreparable damage
Security Firms Face Crisis Of Trust(Dark Reading) Mikko Hypponen reflects on shift toward rampant government spying and use of malware — and targeted attack attempts on F-Secure
How One Company is Using Maths to Beat the Hackers(CBR) New R&D security hub will collaborate with educational institutions to advance security. FireEye, an advanced cyber attack prevention specialist, has announced the soft opening of a research and development (R&D) centre in Dresden, Germany
Target Invests $100M in Data Security(Retail Info Systems News) Following the data breach announcement and the rapid change in the pace of sales, the Target team reacted quickly making nimble adjustments to minimize its excess inventory. This quick response allowed the retailer to end the year with a clean inventory position
Yahoo says Marissa Mayer has fixed its biggest problem(Quartz) In September 2012, shortly after Marissa Mayer took charge of Yahoo, she moved swiftly to try and rectify what was considered the search giant's biggest problem: a lack of talent. The company's long-serving head of human resources departed, and a former private-equity executive, handpicked by Mayer, replaced him
Who is the reclusive billionaire creator of Bitcoin?(The Telegraph) Public awareness of Bitcoin has never been higher, but few are aware that its origins are a mystery — a secretive programmer called "Satoshi" invented the currency and still holds more than four per cent of all coins in existence. Who is he and what is his plan
DB Networks Partners with AMP Tech Solutions(NewsFactor) DB Networks partners with AMP Tech Solutions to deliver behavioral analysis-based core IDS to federal market — partnership uniquely addresses need for continuous monitoring of database traffic to identify advanced and highly obfuscated attacks within federal agencies
Samsung Galaxy heart-rate sensor ignites regulatory review(FierceMobileHealthcare) Government health officials in South Korea want to take a closer look at the heart-rate sensor built into Samsung's impending Galaxy S5, but the regulatory review likely won't impact the smartphone's scheduled debut on April 11
Exponential-e Gets Certified(Light Reading) Leading technology enabler Exponential-e announced today that it has become one of the first European Cloud Service Providers (CSP) to attain CSA STAR Certification
FreedomPop Announces The Privacy Phone, A Fully-Encrypted Smartphone For $10 A Month(TechCrunch) Meet the Privacy Phone, a device that FreedomPop brags is the only smartphone and mobile service that allows for encrypted communications. Lovingly nicknamed the "Snowden Phone" by FreedomPop, It can even be purchased with Bitcoin to further protect the owner's anonymity. Simply put, if you're in the market for a phone to plan to help run a criminal enterprise or serially
NIST announces security framework…yawn(Help Net Security) Let me start out by saying that I have a bias against regulatory compliance standards; especially those that are non-specific, not prescriptive, require voluntary cooperation for information gathering, and allow auditors to pass judgment on adequacy with little oversight or discussion
Using dynamic ARP inspection to stop sniffing attacks(TechTarget) Securing the network infrastructure has never been more important. Today, employees and co-workers access resources from many different locations ranging from the workplace and mobile networks to free Wi-Fi found at restaurants and other public locations. What's the one thing in common that all these technologies share? All make use of switches. Attackers can exploit switches if they're not properly secured with dynamic ARP inspection (DAI). One common exploit is sniffing. Sniffers can potentially allow an attacker to capture passwords, usernames or other types of sensitive information
7 Ways to Tell If It's a Fake(McAfee Blog Central) Unfortunately in today's world, scammers are coming at us from all angles to try and trick us to get us to part with our hard earned money. We all need to be vigilant in protecting ourselves online. If you aren't paying attention—even if you know what to look for—they can get you
How To Avoid Data Theft When Using Public Wi-Fi(Forbes) Each week seems to bring news of yet another security breach that puts our personal information into the hands of hackers. The username and password theft here at Forbes.com, the hack of Kickstarter users' contact info, and of course, the massive data breach at Target
Building secure applications: A useful primer(Mobile Industry Review) I know quite a few developers looking at the issue of app security so when @DominicTravers tweeted me this excellent app security primer, I thought it was definitely worth a quick post
Refusing to see the elephants on the lawn(CSO Salted Hash) The other day I was walking through the airport in Toronto. For once I wasn't going to catch a plane or was returning from some place. It was nice. I had a meeting that went well and I was walking back to the car. As I made my way down the stairs I noticed that they were all grey with the exception of one black one
Design and Innovation
Facebook looks to buy drone company for "atmospheric satellites"(Ars Technica) On Monday evening, TechCrunch caught wind of a deal in progress between Facebook and Titan Aerospace, an unmanned aircraft startup that is building what it calls "atmospheric satellites." These "satellites" are solar-powered drones designed by Titan to be capable of flying for up to five years without landing, and they will operate at altitudes above commercial airspace. This will allow them to act as low-cost communications relays for wireless networks
UNH to host cyber defense competition(Seacoast Online) Next week, some of the region's brightest up-and-comers in the hot field of cyber security will gather at the University of New Hampshire for the Northeast Collegiate Cyber Defense Competition, hosted by UNH's computer science department March 14-16
President's budget proposes $1.25B for DHS cyber activities(Federal Times) President Obama's fiscal 2015 budget request would pour more than $1 billion into the Homeland Security Department's coffers for cyber initiatives, including funding for a new voluntary program for critical infrastructure companies and money to bolster civilian network security
QDR Emphasizes Cyber, Science and Technology(Defense News) The Pentagon's latest Quadrennial Defense Review (QDR) has emphasized the need to protect science, technology, research and development, specifically cyber capabilities, a key priority of senior defense officials
Spy chief outlines hopes for cybersecurity bill(The Hill) Congress needs to overhaul a pair of privacy laws to allow the government to communicate with private companies and foreign nations, according to National Security Agency (NSA) Director Gen. Keith Alexander
NSA made Snowden leak worse: Senate Dem(The Hill) The National Security Agency's slow response to Edward Snowden's security leaks exacerbated an already devastating national security problem, Sen. Sheldon Whitehouse (D-R.I.) charged Tuesday
Debate on mobile app regulatory oversight heats up(FierceMobileHealthcare) The mHealth Regulatory Coalition says a proposed law to eliminate oversight by the U.S. Food and Drug Administration on mobile healthcare software poses serious risks to patients and that Congress must play a key role in ensuring FDA guidance on mobile applications
Phone Security Legislation Introduced(BankInfoSecurity) Rep. José E. Serrano, D-N.Y., has introduced legislation in the U.S. House of Representatives that would require a kill switch on smart phones. The bill would give consumers the ability to wipe their phone data, helping to deter the rising number of cell phone thefts, the sponsor says
Supreme Court Denies Review of NSA Warrantless Surveillance Case(eNews Park Forest) The Supreme Court announced yesterday that it would not hear Center for Constitutional Rights v. Obama, a lawsuit challenging the National Security Agency's warrantless surveillance of people within the United States. The suit sought an injunction ordering the government to destroy any records of surveillance that it still retains from the illegal NSA program
Journalist: NSA won't give me a secure channel to communicate on(Ars Technica) Barton Gellman, one of the few journalists that has been given access to the entire trove of documents provided by whistleblower Edward Snowden, told the RightsCon conference Tuesday that American federal authorities have declined to provide him with a secure means to communicate with them
Eurocrypt 2014(, January 1, 1970) Eurocrypt 2014 is the 33rd Annual International Conference on the Theory and Applications of Cryptographic Techniques. It is devoted to all aspects of cryptology.
Area41(, January 1, 1970) Area41 is an international security technology and research conference offering both trainings/workshops and traditional presentation tracks.
CYBERSEC 2014(, January 1, 1970) CYBERSEC is a 4-day event geared toward helping you achieve your cybersecurity goals. Whether your focus is on cybersecurity management, investigation, defense, or offense we are offering specialty cybersecurity...
Nuclear Regulatory Commission ISSO Security Workshop(, January 1, 1970) Exhibitors will have the opportunity to showcase cutting-edge products and services available in today's market. All companies specializing in products and services that would benefit the NRC workforce...
ICS Summit 2014(Lake Buena Vista, Florida, US, March 17 - 18, 2014) The 9th Annual North American ICS Security Summit brings together the program managers, control systems engineers, IT security professionals and critical infrastructure protection specialists from asset...
Suits and Spooks Singapore(, January 1, 1970) Our first international Suits and Spooks conference will be held in Singapore with a visit to Malaysia on March 20-21, 2014. The focus will be on how multi-national corporations can profitably operate...
MCT-Congress: Going Mobile with Clinical Trials(Edinburgh, Scotland, UK, March 20 - 21, 2014) It is almost inevitable that mHealth solutions will be adopted across healthcare systems worldwide over the next decade. What is less clear is the impact that mobile solutions are having and could have...
Cyber Security for Energy & Utilities(, January 1, 1970) Following the rapid evolution of the cyber and digital world, IT Security Directors, Information Security Directors, Chief Security Officers, Chief Information Officers and many more will gather at the...
Veritas 2014(, January 1, 1970) At Veritas 2014, hear directly from the big data experts in top tier retail finance who are now implementing strategy and starting to yield real commercial value. Experts dedicated to Big Data in the...
Black Hat Asia(, January 1, 1970) Black Hat is returning to Asia for the first time since 2008, and we have quite an event in store. Here the brightest professionals and researchers in the industry will come together for a total of four...
Cyber Security Management for Oil and Gas(, January 1, 1970) Attend to gain cutting-edge information from oil and gas cyber security experts on: Using the very latest in intelligence techniques to find and neutralize the newest threats in time. Preventing security...
ISSA Colorado Springs — Cyber Focus Day(Colorado Springs, Colorado, USA, March 27, 2014) Join us for the Information Systems Security Association (ISSA) — Colorado Springs Chapter — Cyber Focus Day set to take on Thursday, March 27, 2014 at Colorado Technical University (CTU).
SyScan 2014(Singapore, March 31 - April 4, 2014) SyScan is a deep knowledge technical security conference. It is the aspiration of SyScan to congregate in Asia the best security experts in their various fields, to share their research, discovery and...
Interop Conference(, January 1, 1970) Interop Conference sessions help you find actionable solutions to your current IT headaches and plan for future developments.
SPONSOR & SUPPORT
Grow your brand and reach new customers.
Grow your brand and increase your customer base by educating our audience about your products, services, and events by advertising on The CyberWire. We’ve built trust with an influential (and often hard to reach) audience of CISOs, CSOs, and other senior execs in the security space, across a wide array of industry verticals. Learn more.
Be a part of the CyberWire story.
People ask us (a lot) how they can support what we do. We have our sponsorships and services, of course, but those are not always within every supporter's financial reach, or it might just not be the right time for you to do those things. That's why we launched our new Patreon site, where we've created a wider variety of support levels, each with some new benefits. Our patrons are important to our future, and we hope you'll consider becoming one. We invite you to become part of the CyberWire story. Become a patron today.