Reports suggest that, as foreign diplomatic missions in Yemen decamp, some may have abandoned sensitive information, which lends additional interest to stories on "visual hacking" — that is, seeing stuff left lying around.
Cyber rioting appears in another corner of the former Soviet empire, this time in Azerbaijan, where allegations of Armenian hacktivism surface.
Lenovo attracts general odium for pre-installing Superfish adware in its machines, thereby allegedly exposing users to man-in-the-middle attacks and other threats. Lenovo says it thinks Superfish represents no real security issue, but out of sensitivity to its customers' legitimate security concerns, the company will at once stop shipping products with the feature installed. Several experts offer advice on how to detect and remove the adware.
Newly discovered Android malware is said to be able to spy on users even after their phones are (apparently but not really) shut down.
An Australian security researcher demonstrates a proof-of-concept Android credit-card-cloning app.
New Snowden documents appear to show a 2010 GCHQ/NSA operation that compromised SIM cards.
Canadian Bitcoin exchange Cavirtex is compromised by hackers and suspends operations.
A variety of Microsoft patch news is out, including an increase in Windows XP afterlife support costs.
Intel Security urges all not to declare digital bankruptcy — that is, to decide their personal data is valueless. (AT&T, for one, thinks its customers' personal data are worth $29 per month.)
JPMorgan beefs up its in-house cyber security team. Cyber security startups continue to surge, and the cyber labor shortage surges with them.
Today's issue includes events affecting Armenia, Australia, Azerbaijan, Canada, China, Iraq, Netherlands, Russia, Syria, United Kingdom, United States, and Yemen.
Dateline Washington, DC: Cyber Framework and Critical Infrastructure: A Look Back at Year One
Happy Birthday to NIST's Cybersecurity Framework(SIGNAL) The U.S. government-backed cybersecurity framework for the nation's federal agencies and critical infrastructure sector — released one year ago today — has received a general thumbs up of approval from industry experts
Intel panel poised to release new cyber bill(The Hill) The Senate Intelligence Committee is expected to introduce legislation next week that would help the public and private sectors share information about cyber threats, sources tell The Hill
Cyber Attacks, Threats, and Vulnerabilities
Emails reveal sensitive info left exposed after US pullout from Yemen(Fox News) Internal State Department emails reviewed by Fox News reveal that as security unraveled in Yemen, U.S. personnel were scrambling to finalize their exit plan and were so uncertain about what would happen that procedures for safeguarding sensitive information were bypassed — with permission from Washington
Superfish: A History Of Malware Complaints And International Surveillance(Forbes) Superfish, a little-known "visual search" and ad tech provider from Palo Alto whose CEO was once part of the surveillance industrial complex, is about to learn what it feels like to face the unwavering wrath of the privacy and security industries. Lenovo will take much of the blame for potentially placing users at risk by contracting Superfish to effectively carry out man-in-the-middle attacks on users to intercept their traffic just to get the firm's "visual" ads up during customers' web searches
How Lenovo's Superfish 'Malware' Works And What You Can Do To Kill It(Forbes) Lenovo might have made one of the biggest mistakes in its history. By pre-installing software called 'Superfish' to get ads on screens it's peeved the entire privacy community, which has been aghast this morning on Twitter. There are serious security concerns about Lenovo's move too as attackers could take Superfish and use it to ensnare some unwitting web users
See How This Android App Clones Contactless Credit Cards In Seconds(Forbes) Australian security researcher Peter Fillmore has a history of card cloning. In October last year, Fillmore showed how he could clone Visa and MasterCard payment cards with an Android app running on a Google Nexus 4. He successfully shopped with it, buying some beers in a Sydney pub and a Snickers bar from a supermarket
Hey, does anyone know if Dilbert has upset Kim Jong Un recently?(Graham Cluley) No, I'm not serious. I don't really think that North Korea has a grudge against Dilbert. But it's clear that someone isn't a fan of the long-running Scott Adams cartoon strip, whose website has recently suffered a DDoS (distributed denial-of-service) attack
Officials: Cyber heist didn't hit US(The Hill) No American banks were affected by a worldwide cyber ring that reportedly stole up to $1 billion from banks in 30 countries, U.S. officials and banking executives say
Microsoft Adds 4 Security Measures to Office 365(CMS Wire) Microsoft has added four security measures to Office 365 to help businesses keep their data secure. Two of the measures are focused on compliance and the other two offer better identity protection
Why Apple and Microsoft are Upset About Google's 'Project Zero'(TechVibes) It's called Project Zero. Sounds like a new sci-fi pic or a top secret government project, doesn't it? Nope, this Project Zero is a new initiative from Google, and rival companies Apple and Microsoft are wishing it would be kept as secretive as Area 51
Good tech, bad tech(Economist) Why people need to wise up about what smart criminals are working on
The BYOD ethos is a corporate cyber attack waiting to happen(Electroblog) BYOD workers may save companies a lot of money by reducing IT hardware expenditure, but it could cost corporations dear in cyber attacks. Most of us today are BYOD (Bring Your Own Device) workers. That is people who use their own computers and smart phones in the workplace. The problem is it raises a multitude of Internet security questions and potentially creates some serious risks
Are We Experiencing a Cybersecurity Bubble? Mach37 Head Weighs In(DCInno) In recent months — maybe more so than ever before in history — the prevalence and threat of cybercriminals has become apparent. Detrimental example after example has illustrated the growing need for top level cybersecurity professionals. As a result, cultivating this talent has become a major business avenue of interest. In Washington, D.C., the area's highly competitive cybersecurity ecosystem is causing a predatory skirmish between budding franchise giants and their startup counterparts
Fighting Fire With FireEye(Seeking Alpha) FEYE suffered a dramatic share price decline in 2014 due to irrational valuations and mismanaged expectations for revenue growth following the acquisition of Mandiant in 2014. The poor performance of shares in 2014 does not reflect solid full year 2014 results and execution by management. FEYE's leadership over competitors in advanced threat detection/prevention and incident response forensics is underestimated. The introduction of Fireeye as a Service, new product appliances/subscriptions, and infrastructure investments to expand internationally are potential catalysts for upside to conservative 2015 revenue/billings guidance. FEYE deserves a premium valuation for its leadership position in the fastest growing segments of the security industry
AT&T: Pay more if you don't want to share data for personalized ads(Help Net Security) If you are a customer of AT&T's GigaPower fiber-optic Internet access service and you don't want to see personalized ads based on your browsing history, searched terms and clicked links, you'll have to shell out nearly $30 more for the service than those who do
Technologies, Techniques, and Standards
TrueCrypt Audit Stirs Back to Life(Threatpost) The stagnant TrueCrypt audit stirred to life in the last 24 hours with the announcement that the second phase of the audit, tasked with examining the cryptography behind the open source disk encryption software, will begin shortly
6 steps for effective rights management(Help Net Security) Significant data breaches in both government and industry are in the headlines at an unrelenting pace. Some of these breaches are enormous in scale and impact, and all have the potential to damage consumer trust. Why are so many of these breaches disastrous?
Preventing indigestion from ingesting cyber data(Federal Times) Remember the last time that you went to an all-you-can-eat buffet and had a difficult time determining which food group to start with? (I often ask myself, should I start with a salad or head straight to the good stuff?) And do you remember that overstuffed feeling you had once you finished overeating and waddled your way out of the restaurant?
MSPs Can Help Thwart Shadow Cloud Threats(Midsize Insider) The use of unauthorized cloud applications, best known as the "shadow cloud," within in the workplace is a growing trend that most IT departments would like to see evaporate. Shadow cloud threats are an emerging risk to networks and data because they slip under the IT staff's radar; after all, IT can't put in security measures for applications they don't realize are being used
Threat Intelligence in an Active Cyber Defense (Part 1)(Recorded Future) Many organizations have bought into the idea of cyber threat intelligence but two questions tend to dominate the discussion: How do you use threat intelligence and when is an organization ready to use it? There are multiple answers to these questions but this two-part article offers an answer in the context of an active cyber defense
Design and Innovation
Darkleaks: An online black market for selling secrets(Help Net Security) Whistleblowers and those individuals that are simply out to make a buck out of any confidential and valuable information, can now offer it for sale on Darkleaks, a decentralized, anonymous black market on the Internet
Vladimir Putin's spy army targets Australia(The Australian) Russian President Vladimir Putin has increased Moscow's spy operations against Australia, boosting his country's espionage to levels not seen since the Cold War
Why The USA Hacks(Dark Reading) The U.S. government views cyberspace as just another theater of war akin to air, land and sea, and it operates in the domain for one basic reason: national defense
Net neutrality campaigning comes down to the wire(FierceCIO) With a week to go until the Federal Communications Commission votes on the issue of net neutrality, both sides in the debate are making their last minute pushes to influence commission members
For a complete running list of events, please visit the Event Tracker on the CyberWire website.
Newly Noted Events
Kansas City Secure World(Kansas City, Missouri, USA, April 1, 2015) Join your fellow security professional for affordable, high-quality cybersecurity training and education at a regional conference near you. Earn CPE credits while learning from nationally recognized industry...
Mid-Atlantic ISSA Security Conference 2015(Gaithersburg, Maryland, USA, April 15, 2015) Meeting at the NIST campus, this all-day event, jointly hosted by the ISSA Baltimore, DC, and Northern Virginia chapters, will have 3 concurrent tracks of security professionals discussing the current...
DEFCON | OWASP International Information Security Meet(Lucknow, India, February 22, 2015) Defcon | OWASP Lucknow International Information Security Meet is a combined meet of Defcon and OWASP Lucknow. Defcon Lucknow is a DEF CON registered convention for promoting, demonstrating & spreading...
10th Annual ICS Security Summit(Orlando, Florida, USA, February 22 - March 2, 2015) Attendees come to the Summit to learn and discuss the newest and most challenging cyber security risks to control systems and the most effective defenses. The Summit is designed so you leave with new tools...
Cybersecurity for a New America: Big Ideas and New Voices(Washington, DC, USA, February 23, 2015) In addition to featuring keynote remarks by Admiral Mike Rogers, Director of the National Security Agency, this event will convene experts and practitioners from the public and private sector, military,...
Workforce Development Forum — CyberWorks Information Session(Baltimore, Maryland, USA, February 24, 2015) Are you a technology company that would like to actively participate in growing the right candidates for your open IT and cybersecurity positions? Are you a job seeker interested in pursuing a career in...
Cybersecurity: You Don't Know What You Don't Know(Birmingham, Alabama, USA, February 24 - 25, 2015) What: Connected World Conference in partnership with University of Alabama at Birmingham's Center for Information Assurance and Joint Forensics Research (The Center) have teamed up to bring professionals...
The Future of Cybersecurity Innovation(Washington, DC, USA, February 26, 2015) The US intelligence community has ranked cyberattacks as the No. 1 threat to national security — more than terrorist groups or weapons of mass destruction. But the military's cyberwarriors fight...
2015 Cyber Risk Insights Conference — San Francisco(San Francisco, California, USA, March 3, 2015) Following on the success of the 2014 half-day cyber risk event, Advisen will present a full day of learning and networking for risk managers, CISOs, CROs, insurance brokers, insurance underwriters, reinsurers...
Cybergamut Technical Tuesday: Tor and the Deep Dark Web(Columbia, Maryland, Sioux Falls, March 3, 2015) This talk will explore the use of Tor and how it relates to garnering useful intelligence. Distinguishing attribution or valuable intelligence from limited event data is difficult. Leveraging external...
Boston SecureWorld(Boston, Massachusetts, USA, March 4 - 5, 2015) Join your fellow security professional for affordable, high-quality cybersecurity training and education at a regional conference near you. Earn CPE credits while learning from nationally recognized industry...
Mercury Proposers' Day Conference(IARPA1, Washington, DC, March 5, 2015) The Intelligence Advanced Research Projects Activity (IARPA) will host a Proposers' Day Conference for the Mercury Program on March 5, in anticipation of the release of a new solicitation in support of...
OISC: Ohio Information Security Conference(Dayton, Ohio, USA, March 11, 2015) Technology First invites you to participate in the 12th Annual Ohio Information Security Conference Wednesday, March 11, at the Sinclair Community College Ponitz Center in Dayton, Ohio. The conference...
RiSK Conference 2015(Lasko, Slovenia, March 11 - 12, 2015) In recent years RISK conference has become one of the leading events on computer security in the Adriatic region and is attended by engineering as well as executive staff of companies from the region.
B-Sides Vancouver(Vaqncouver, British Columbia, Canada, March 16 - 17, 2015) The third annual Security B-Sides Vancouver is an information security conference that will be held March 16th and 17th. We love to see brand new speakers, seasoned speakers, and everyone in between
Insider Threat 2015 Summit(Monterey, California, USA, March 16 - 17, 2015) The Insider Threat 2015 Summit is about bringing Government and Industry organizations and their cybersecurity leaders together in order to better understand the type of threats that may impact their infrastructure...
2015 North Dakota Cyber Security Conference(Fargo, North Dakota, USA, March 17, 2015) The North Dakota Cyber Security Conference brings together community members from academia, government and industry to share strategies, best practices and innovative solutions to address today's challenges...
Philadelphia SecureWorld(Philadelphia, Pennsylvania, USA, March 18 - 19, 2015) Join your fellow security professional for affordable, high-quality cybersecurity training and education at a regional conference near you. Earn CPE credits while learning from nationally recognized industry...
BSides Salt Lake City(Salt Lake City, Utah, USA, March 20 - 21, 2015) BSides is a community-driven framework for building events for and by information security community members. The goal is to expand the spectrum of conversation
CarolinaCon-11(Raleigh, North Carolina, USA, March 20 - 22, 2015) CarolinaCon-11 (also hereby referred to as "The Last CarolinaCon As We Know It") will occur on March 20th-22nd 2015 in Raleigh NC (USA). We are now officially accepting speaker/paper/demo submissions...
CyberTech Israel 2015(Tel Aviv, Israel, March 24 - 25, 2015) In the face of these enemies and threats, individuals, organizations and states are required to produce innovative, unique solutions that would improve the resistance and resilience of the sensitive systems...
2nd Annual ISSA COS Cyber Focus Day(Colorado Springs, Colorado, USA, March 25, 2015) Join us for the Information Systems Security Association (ISSA) — Colorado Springs Chapter — Cyber Focus Day set to take on Wednesday, March 25, 2015 at the University of Colorado Colorado...
CYBERWEST: the Southwest Cybersecurity Summit(Phoenix, Arizona, USA, March 25 - 26, 2015) The purpose of CYBERWEST is to bring together Government and businesses to: Exchange information and learn in areas of policy and strategy; technology and R&D; workforce training and education; and economic,...
Women in Cyber Security(Atlanta, Georgia, USA, March 27 - 28, 2015) Despite the growing demand and tremendous opportunities in the job market, cybersecurity remains an area where there is significant shortage of skilled professionals regionally, nationally and internationally.
Automotive Cyber Security Summit(Detroit, Michigan, USA, March 30 - April 1, 2015) The debut Automotive Cyber Security Summit will bring together CTOs, CSOs, Engineers and IT professionals from GM, KIA, Nissan, Bosch, Qualcomm and more for three days of case studies, workshops, panel...
Insider Threat Symposium & Expo(Laurel, Maryland, USA, March 31, 2015) The National Insider Threat Special Interest Group (NITSIG) announced that it will hold FREE 1 day Insider Threat Symposium & Expo (ITS&E) on March 31, 2015 in Laurel, Maryland. The symposium is exclusively...
SPONSOR & SUPPORT
Grow your brand and reach new customers.
Grow your brand and increase your customer base by educating our audience about your products, services, and events by advertising on The CyberWire. We’ve built trust with an influential (and often hard to reach) audience of CISOs, CSOs, and other senior execs in the security space, across a wide array of industry verticals. Learn more.
Be a part of the CyberWire story.
People ask us (a lot) how they can support what we do. We have our sponsorships and services, of course, but those are not always within every supporter's financial reach, or it might just not be the right time for you to do those things. That's why we launched our new Patreon site, where we've created a wider variety of support levels, each with some new benefits. Our patrons are important to our future, and we hope you'll consider becoming one. We invite you to become part of the CyberWire story. Become a patron today.