News about the Paris massacres continues to develop. Many outlets point to ISIS online video threats of similar attacks in Washington and elsewhere (but such threats, as disturbing and interesting as they may be, amount to chatter as opposed to actionable intelligence). Western leaders, US President Obama notably among them, point to a lack of specificity in the intelligence collected prior to the attacks. But those thought responsible for the murders were apparently for some time under scrutiny by European law enforcement authorities.
ISIS reacts with scorn to the Anonymous declaration of "total war," calling Anonymous "idiots." But the Caliphate does take the hacktivist collective seriously enough to offer advice on cyber security to its jihadist adherents. (ISIS is also, according to NBC News, operating a "Jihadist Help Desk," with advice on recruitment, messaging, etc.)
How the attackers organized themselves remains a matter of dispute. Early reports out of Belgium via the British press that the conspirators used PlayStation4 for their command-and-control appear discredited, and based on remarks offered by a Belgian official some days before the attack. Old assertions that the terrorists favor messaging app Telegram resurface, but today it's no longer clear how much they depended on any encrypted service.
Such uncertainty has not turned either side of the encryption debate from their familiar tropes, which show marked but unsurprising similarity to disputes over gun control: see-what-happens vs. crypto-doesn't-kill-people-do.
Governments work toward more intelligence sharing. So do enterprises, with increased attention and more funding for start-ups like TruSTAR.
Today's issue includes events affecting Australia, Belgium, Canada, China, France, Georgia, Greece, Iraq, Israel, Poland, Russia, Serbia, Syria, Ukraine, United Kingdom, United States.
ISIS Has Help Desk for Terrorists Staffed Around the Clock(NBC News) NBC News has learned that ISIS is using a web-savvy new tactic to expand its global operational footprint — a 24-hour Jihadi Help Desk to help its foot soldiers spread its message worldwide, recruit followers and launch more attacks on foreign soil
Obama: No 'specific' intel warning of Paris attacks(The Hill) The U.S. did not have any "specific" warning about Friday evening's terror attacks in Paris, President Obama said on Monday, raising questions about the ineffectiveness of global intelligence powers
What Role Did Encryption Play in Paris?(Lawfare) Glenn Greenwald has seen the big picture in Paris. With 129 people dead, terrorists still at large, and ISIS crowing over the carnage, Greenwald has jumped on the real problem: Someone, somewhere might think the Edward Snowden leaks had something to do with an attack to which our signals intelligence was blind
The Islamic State wants you to hate refugees(Washington Post) As the Syrian refugee crisis mutated from a regional problem to a global one, security concerns have increasingly been cited as a justification for keeping borders closed and refusing to resettle migrants
Russia–led cyber attack campaign shows the dark side of web analytics(First Post) FireEye has discovered a large-scale attack campaign collected extensive information from Internet. It has amassed vast amounts of information on web traffic and visitors to more than 100 websites — sites that the threat actors have selectively compromised to gain access to their collective audience
Smart TVs open hacker views into boardrooms, living rooms and bedrooms(FierceBigData) Researchers, including those at Tripwire and Avast, are warning that smart TVs could provide a way for hackers to infiltrate your home "all the way to your bank account." Avast researchers actually hacked a Vizio Smart TV last week to gain access to a home network and prove the point
Phishers are targeting millions of DHL customers(Help Net Security) As the end-of-the-year holidays are quickly approaching, people are starting to order more things (read: gifts for themselves and loved ones) online so that they can avoid the December rush and delivery problems
Automated Dynamic Firmware Analysis at Scale: A Case Study on Embedded Web Interfaces(arXiv e-prints) Embedded devices are becoming more widespread, interconnected, and web-enabled than ever. However, recent studies showed that these devices are far from being secure. Moreover, many embedded systems rely on web interfaces for user interaction or administration. Unfortunately, web security is known to be difficult, and therefore the web interfaces of embedded systems represent a considerable attack surface
How Chinese Tinder clone screws you(Larry Salibra) Update: Tantan CEO and Co-founder Yu Wang reached out to me via email to acknowledge these issues. Read his email and my response. TL;DR: Chinese Tinder clone Tantan is endangering young women and men by failing to use encryption and exposing private data like that made public in the Ashley Madison hack
Chipotle Serves Up Chips, Guac & HR Email(KrebsOnSecurity) The restaurant chain Chipotle Mexican Grill seems pretty good at churning out huge numbers of huge burritos, but the company may need to revisit some basic corporate cybersecurity concepts
Interview: Charting the cloud security landscape(ITProPortal) As more and more companies of all shapes and sizes embrace cloud computing, combined with the rising prominence of hackers and cyber attacks, the issue of cloud security has never been more serious
Businesses Need to be Better Prepared for Cyberattacks(Claims Journal) Results of a study on corporate confidence in responding to a data breach are in and of the 604 executives who responded, just 34 percent feel their company's data breach response plans are effective
Google to Warn Recipients of Unencrypted Gmail Messages(Threatpost) Google always seems to be busy fortifying Gmail — the latest steps by the company resolve to bolster message encryption and deter attackers from censoring or altering messages before they're delivered to users
Why Wickr is a fan of Turnbull(Australian Business Review) Wickr, the encrypted messaging app of choice for Malcolm Turnbull, knows almost nothing about its users. The only data it has access to is where they download the app from, which is how it knows that Australians are rushing to join the service
Barracuda launches NetxGen Firewall Desktop App(The Edge) Cloud-connected security and storage solutions provider Barracuda Networks Inc has launched its new Barracuda NextGen Firewall desktop appliances to provide affordable security and high bandwidth availability for cloud, SaaS, and other mission critical applications
Technologies, Techniques, and Standards
Don't Toy With The Dark Web, Harness It(Dark Reading) The Dark Web's sinister allure draws outsized attention, but time-strapped security teams would benefit from knowing what's already circulating in places they don't need Tor or I2P to find
Beyond CIP Compliance: Managing Cyber and Physical Security Risk(Transmission and Distribution) Although the Critical Infrastructure Protection standards have are improving the electric industry's defenses against damaging cyberattacks (in spite of what certain "experts" in this area continue to claim), they do not eliminate the risk of highly damaging or catastrophic cyberattack for electric utilities
How to hide your digital trail in plain sight(Christian Science Monitor Passcode) New York University's Finn Brunton and Helen Nissenbaum spoke with Passcode about their book, 'Obfuscation: A user's guide for privacy and protest
Privacy Best Practices for Developers(Infosecurity Magazine) The right to privacy is guaranteed by the US constitution, but a certain government contractor leaked information that made it clear that the government had its own version of privacy
French President Wants Defense, Intel Spending Boost(Aviation Week) French President Francois Hollande says he will extend a state of emergency to three months following the Nov. 13 terrorist attacks in Paris, and that France will review its military capabilities and increase funding for deployed troops and intelligence operations
After Paris attacks, intel agencies coming to French aid(C4ISR & Networks) It's safe to say that behind the scenes, as the French government mounts a response to the coordinated attacks across Paris on Nov. 13, U.S. intelligence agencies are assisting — including with geospatial intelligence capabilities and partnerships
Could US and Russia Enhance Intel Relationship?(Defense News) The head of the CIA is "determined" to keep conversations open between the intelligence communities of the United States and Russia and wants to see relations between the two nations "enhanced" to prevent future terrorist attacks, particularly from the Islamic State group, commonly known as ISIS or ISIL
Paris attacks may renew encryption debate(Salt Lake Tribune) The deadly attacks in Paris may soon reopen the debate over whether — and how — tech companies should let governments bypass the data scrambling that shields everyday commerce and daily digital life
After Paris, Encryption Will Be a Key Issue in the 2016 Race(Wired) When the Democratic presidential contenders gathered on the debate stage in Des Moines, Iowa, on Saturday, just hours after a series of terrorist attacks in Paris left at least 129 people dead, the candidates spent the early portion of their time on stage examining issues related to national security
The Email has Gone. But Who's it Gone to?(Willis Wire) We all know (or think we know) about the dangers of hitting the send button on emails, but now there's a new threat… No, the real point here lies buried in the UK Government's new Investigatory Powers Bill
Information Sharing Is Key To Avoiding A Cyberattack(TechCrunch) President Obama's recent extraction of a pledge from Chinese leader Xi Jinping that neither government would conduct or continue economic espionage in cyberspace, while important, still comes up far short of addressing the significant and growing global concerns about the potential for a 9/11-style cyberattack on critical financial sectors
Judge dismisses FTC security enforcement case against LabMD(FierceHealthIT) The Federal Trade Commission's data security enforcement case against Atlanta-based cancer screening laboratory LabMD following an alleged 2008 data breach was dismissed Friday by an administrative law judge who said that the agency failed to prove the breach harmed, or could potentially harm, consumers
The mafia of the digital age(IOL Beta) Through the dark world of cybercrime, its tentacles spread everywhere: stock manipulation, money laundering, gambling and more
UK's NCA Shares Threat Data with 50 Web Hosters(Infosecurity Magazine) The UK's National Crime Agency is claiming a new threat information sharing initiative has already helped web hosters reduce the threat to their servers by 12%, potentially saving them millions
Global Government Requests Report(Facebook) Today we are releasing our Global Government Requests Report as part of a broader effort to reform government surveillance in countries around the world by providing more transparency
Cybersecurity, the SEC and Compliance(New York, New York, USA, November 18, 2015) The recent SEC CyberSecurity Examination Initiative focuses on information safeguards for financial services organizations. Are you prepared? Please join us for a panel discussion on what cybersecurity...
CyberCon 2015(Pentagon City, Virginia, USA, November 18, 2015) CyberCon 2015 is the forum for dialogue on strategy and innovation to secure federal and defense networks, as well as private sector networks that hold their sensitive data
Internet-of-Things World Forum 2015(London, England, UK, November 18 - 19, 2015) This conference features speakers from leading IoT companies and their customers. Learn how the Internet-of-Things is creating new markets for products, services, and solutions
2015 U.S. Cyber Crime Conference(National Harbor, Maryland, USA, November 14, 2015) The 2015 U.S. Cyber Crime Conference (Formerly the DoD Cyber Crime Conference) has brought world-class forensics and incident response training combined with outstanding community networking for over 15...
CyberPoint 2nd Annual Women in Cyber Security Reception(Baltimore, Maryland, USA, November 19, 2015) CyberPoint International announces its 2nd Annual Women in Cyber Security Reception to be held on November 19, 2015. Bringing together women from across the region and all different points on the career...
Pen Test Hackfest Summit & Training(Alexandria, Virgina, USA, November 16 - 23, 2015) SANS Pen Test Hackfest Training Event and Summit is coming back to Washington DC, bigger and better than ever! The Hackfest is an ideal way to learn offensive techniques so you can better defend your environment.
Energy Tech 2015(Cleveland, Ohio, USA, November 30 - December 2, 2015) Now in its 5th year, EnergyTech 2015 seeks the convergence of the best minds in policy, systems engineering and applied technology to address some of the critical issues of our time. In addition to its...
IoT Security Foundation Conference(London, England, UK, December 1, 2015) The is the first official conference of IoTSF. It follows on from the IoT Security Summit earlier in the year, maintaining the momentum of the theme. Delegates can expect a similar level of quality of...
Public Sector Cybersecurity Summit 2015(Reston, Virginia, USA, December 1 - 2, 2015) The Raytheon|Websense 6th Annual Public Sector Cybersecurity Summit is a unique opportunity to learn about the state of cybersecurity and how to prepare for future threats from many thought provoking government...
Enterprise Security and Risk Management(London, England, UK, December 2, 2015) Whitehall Media's 4th ESRM conference will bring together hundreds of leading InfoSec, cyber security and risk management professionals to discuss the latest industry developments and identify the most...
Cargo Logistics America(San Diego, California, USA, December 2 - 3, 2015) Cargo Logistics America (CLA) connects freight owners with freight movers, fostering multimodal synergy between diverse stakeholders in import, export and domestic supply chains. This year's conference...
NG Security Summit US(Austin, Texas, USA, December 2 - 4, 2015) The NG Security Summit US will bring together 65 senior decision makers and business leaders from across the region. The event aims to solve key business challenges. In particular, the ability to network...
Program on Cyber Security Studies (PCSS)(Garmisch-Partenkirchen, Germany, December 2 - 17, 2015) The Marshall Center has developed a comprehensive program to explore the increasing domestic, international and transnational challenges in cyber security. Our goal is to provide a comprehensive, policy-focused,...
Cloud Security Alliance Summit Los Angeles 2015(Los Angeles, California, USA, December 3, 2015) The full day Cloud Security Alliance LA Summit is a standalone event in the greater Los Angeles area. Hosted by the CSA LA/SoCal chapter, some 200 well-qualified attendees are expected. The theme is "Enterprise...
2015 Cyber Security Exchange(Orlando, Florida, USA, December 6 - 8, 2015) This dynamic, three-day event will provide Cyber Security executives with valuable insights to reach their full potential by exploring security leadership strategies, heightened data privacy concerns,...
Disrupt London 2015(London, England, UK, December 7 - 8, 2015) TechCrunch Disrupt is one of the most anticipated technology conferences of the year. Join us at this iconic startup and thought leadership event in London on December 7 and 8. What happens at Disrupt?...
Passwords 2015(University of Cambridge, England, UK, December 7 - 9, 2015) More than half a billion user passwords have been compromised over the last five years, including breaches at internet companies such as Target, Adobe, Heartland, Forbes, LinkedIn, Yahoo, and LivingSocial.
ACSAC (Annual Computer Security Applications Conference)(Los Angeles, California, USA, December 7 - 11, 2015) ACSAC is one of the most important cyber security conferences in the world, and the oldest information security conference held annually. Researchers, government representatives, academia and security...
NSA RCTCON(Fort Meade, Maryland, USA, December 9, 2015) The NSA RCTCON industry exposition will be attended by 250-300 IC (Intelligence Community) cyber personnel working on solutions to the current cyber threats that face the U.S
SANS Institute: Information Security Training(Las Vegas, Nevada, USA, September 12 - 21, 2015) Information security training in Las Vegas from SANS Institute, the global leader in information security training. At SANS Network Security 2015, SANS offers more than 40 hands-on, immersion-style security...
cyberSecure (New York, New York, USA, December 15 - 16, 2015) Today's business leaders recognize that a multi-disciplinary approach is critical to protecting the bottom line. What's too often missed is a vision that incorporates best practices that allow you add...
SPONSOR & SUPPORT
Grow your brand and reach new customers.
Grow your brand and increase your customer base by educating our audience about your products, services, and events by advertising on The CyberWire. We’ve built trust with an influential (and often hard to reach) audience of CISOs, CSOs, and other senior execs in the security space, across a wide array of industry verticals. Learn more.
Be a part of the CyberWire story.
People ask us (a lot) how they can support what we do. We have our sponsorships and services, of course, but those are not always within every supporter's financial reach, or it might just not be the right time for you to do those things. That's why we launched our new Patreon site, where we've created a wider variety of support levels, each with some new benefits. Our patrons are important to our future, and we hope you'll consider becoming one. We invite you to become part of the CyberWire story. Become a patron today.