Get threat intelligence on hackers and vulnerabilities FREE every day with the Recorded Future Cyber Daily. Sign up today.
March 14, 2016.
By The CyberWire Staff
As the US prepares (according to reports) an indictment against Iranian hackers allegedly responsible for pre-attack reconnaissance of the Rye, New York, flood-control dam, observers speculate about the purposes such indictments serve.
North Korea denounces South Korea's accusations of widespread DPRK cyber espionage as a "bullsh*t fabrication, showing either unexpected fluency in demotic American idioms or the work of creative translators.
ISIS continues to worry about recent security breaches, including but not limited to the USB drive with Caliphate HR information a disgruntled jihadist turned over to Sky News (and apparently to various Western intelligence services).
Hamas hacked the Israeli version of the Big Brother reality television show Friday, displaying images of Israeli actions with respect to Palestinian population, Hamas attacks, and pro-Hamas text.
A Google Project Zero researcher claims that, across the sector, cyber security firms are too retro, too 1990s, for the proper security of their own code.
In industry news, while corporate C-suites show a growing awareness and understanding of cyber risks, corporate counsels think their companies remain largely unprepared to handle the legal fallout of a cyber incident.
Cyber stocks rallied late last week, but tech industry layoffs and the imminent demise of Norse suggest that investors are taking a more critical and nuanced view of the sector.
President Obama appeared at SXSW last week to skeptical reviews as he tried to strike an irenic note while substantially backing his Justice Department on encryption. That Justice Department seems ready to clash with Facebook over Whatsapp encryption.
Today's issue includes events affecting Australia, Bangladesh, Belgium, Canada, France, Iran, Iraq, Israel, Democratic Peoples Republic of Korea, Republic of Korea, New Zealand, Syria, United Kingdom, United States.
2016 National Conference of Minority Cybersecurity Professionals(Washington, DC, March 23 - 24, 2016) The landmark ICMCP conference will elevate the national dialogue on the necessary measures needed to attract and develop minority cybersecurity practitioners to address the cross-industry cybersecurity skills shortage.
Women in Cybersecurity (WiCYS) 2016(Dallas, TX, March 31 - April 2, 2016) The 3rd annual conference brings together women (students, faculty, researchers, professionals) in cybersecurity from academia, research organizations and industry for the sharing of knowledge and experience, networking and mentoring.
Cyber Attacks, Threats, and Vulnerabilities
Who Took The Cookies From The Cookie Jar?(Dark Reading) The indictment of five Iranian hackers three years after the fact raises the question: Is naming them a worthwhile part of the threat defense lifecycle, or is it a meaningless distraction?
North Korea slams Seoul's cyber attack accusations(Economic Times) North Korea on Sunday blasted Seoul's accusation that Pyongyang had launched a series of cyber attacks targeting South Korean government officials, calling the allegation a "bullshit" fabrication
ISIS Activists Protest Breach Of Security(MEMRI) MEMRI's exclusive publication of the letter by Gazan ISIS fighter Abu 'Abdallah Al-Muhajir, in which he complained to ISIS leader Abu Bakr Al-Baghdadi about the cooperation between ISIS-Sinai and Hamas, caused a stir among the organization's operatives in Sinai and its supporters in Gaza
New ways to fingerprint Tor Browser users discovered(Help Net Security) Users who want to remain anonymous online often opt for using the Tor Browser, which hides their real IP address, but there are techniques that (more or less) malicious actors can used to identify them
ESET warns against wave of infected emails(Security Brief) Cyber security firm ESET is warning people against a wave of infected emails after discovering an unusual high record of a malicious downloader called Nemucod in several countries, including New Zealand and Australia
Hackers Target Anti-DDoS Firm Staminus(KrebsOnSecurity) Staminus Communications Inc., a California-based Internet hosting provider that specializes in protecting customers from massive “distributed denial of service” (DDoS) attacks aimed at knocking sites offline, has itself apparently been massively hacked
Salt Lake City Police, Airport Websites DDoSed Against Teenager Shooting(Hack Read) The attackers from New World Hackers group (NWH) claimed that they conducted a series of powerful “distributed denial of service” (DDoS) attacks on the official website of Salt Lake City police, the airport, First Utah Bank and Downtown Alliance last night to register their protest against police shooting in which a teenager (Abdi Mohamed) who fell into a coma after being shot multiple times during a fight in downtown Salt Lake City
Bangladesh bank says hackers tried to steal $951 million(Reuters) Bangladesh's central bank confirmed on Sunday that cyber criminals tried to withdraw $951 million from its U.S. bank account, as the country’s finance minister said he first got to know of one of the biggest bank heists in history through the media
Questions about BB fund heist(Daily Star) An obvious case of a targeted attack, using vulnerability exploit tactics, the 100 million dollar Bangladesh Bank heist will remain one of the most profiled cyber crime case studies throughout 2016
Report: Ambulances vulnerable to hacker(MedCityNews) One of the newest arenas for cybersecurity is connected vehicles, and few types of vehicles are more connected than ambulances. That means medical transport is a growing target for hackers
A Look at the Mandiant M-Trends 2016 Report(Internet Storm Center) Mandiant released their 2016 threat reports last month and highlighted some interesting trends: more breaches were made public and location and motive of attackers were more diversified
2016 Data Breaches Have Exposed 4.3 Million Records(24/7 Wall Street) The latest count from the Identity Theft Resource Center (ITRC) reports that there has been a total of 139 data breaches recorded through March 8, 2016, and that nearly 4.3 million records have been exposed since the beginning of the year
Two New Cybersecurity Reports Offer Legislative Opportunities and Data Breach Scenarios(Government Technology) This is a tale of two studies. The first report from the Governing Institute was sponsored by the National Cyber Security Alliance (NCSA) and AT&T, and covers the intriguing results of a state government legislative survey on cyber. The second reports offers a “Data Breach Digest” from Verizon which elaborates on 18 different data breach scenarios worth considering. Both reports are free and bring excellent recommendations and worthwhile opportunities
It's time to pump the brakes on IoT(CIO) A recent survey suggests consumers think smart homes are too expensive, too complex, and too insecure, and despite the hype that surrounds the Internet of Things (IoT) the technology is far from ready for the masses
Cyberwar, out of the shadows (Q&A)(CNET) Author Fred Kaplan details how the US has quietly amassed the power to hack the world but has failed to create a plan for deterring similar attacks on US soil
Security concerns limit business initiatives(Help Net Security) Though the C-suite recognizes the benefits of data security, organizations are still struggling to develop programs that effectively incorporate security strategies without detracting from other business initiatives, according to Dell
GCs Say Their Companies Still Aren’t Ready for a Cyber Attack(Corporate Counsel) Cyber security is the top risk facing companies, but a majority still aren’t prepared for the legal fallout from a cyber security incident, according to a survey of general counsel conducted by Consero Group in partnership with AegisAdvantage
2016 Innovation Awards: PivotPoint Risk Analytics(Business Insurance) Data breaches are among the top concerns for any organization these days, with incidents reaching near catastrophic levels as personal and private business information is stolen, warehoused, sold and distributed. Their effects are far-reaching and expensive
Cyber insurance insufficient to cover all hack damages(Health Data Management) Some type of cyber breach is nearly guaranteed to hit every health system in the country, and potential effects could include stolen patient data, disrupted operations, destruction of technology, stolen consumer information or exposure of corporate secrets, trade secrets and proprietary information
What is HIPAA Compliance? (Michael Peters) Confused about HIPAA and HIPAA Compliance? This article will explain HIPAA and the importance of complying with this complex federal law
Governance the often-missing piece of Information Security(IT Security) In the report, What does Information Security have in common with Eastern Air Lines Flight 401? – I posit that one byproduct of professionalizing Information Security will be elevating it to the board level where it belongs
After the Satoshi Roundtable, is there a way to bridge the bitcoin divide?(TechCrunch) A recent rift amongst the developers of Bitcoin, which originally started with a question over increasing the so-called block size (so that throughput of transactions can be increased), exposed deep divides about distributed governance; and has now ironically led to entrenched positions, flared tempers, public insults, accusations and disparaging remarks
Can we build quantum-resistant encryption?(GCN) The possibilities and problems of quantum computing have figured more in science fiction than they have in government security, but that is gradually starting to change
How to break the deadlock over data encryption(Washington Post) Since the 1990s, U.S. law enforcement has expressed concern about “going dark,” roughly defined as an inability to access encrypted communications or data even with a court order
At SXSW, Obama asks tech community to compromise on encryption(Christian Science Monitor Passcode) Speaking to a tech-savvy crowd at the South By Southwest festival in Texas this weekend, President Obama made his strongest statement yet in support of law enforcement access to consumer devices – but said that the debate should not be defined by extremes on either side
Obama: ‘We don’t want government to look into everyone’s phones willy-nilly’(TechCrunch) Encryption with a backdoor accessible to very few in important situations is what President Barack Obama says he suspects is the answer to the digital privacy versus security debate. That contradicts the position of many in the security industry who believe that would inevitability lead to abuses of such a backdoor
No, you backoff on backdoors or else(Errata Security) Speaking at #SXSW, President Obama threatened the tech community, telling us to backdoor our encryption ourselves or else congress will mandate a worse solution later
Techies to Washington: Anything You Can Do We Can Do Better(Wired) President Obama is kicking off the annual South by Southwest conference in Austin, Texas, today with a conversation on how technologists and government agencies can work together to solve some of the country’s toughest problems. His goal, it seems, is to cement his own legacy for embracing technology and set the stage for the next administration to continue that work
New Documents Solve a Few Mysteries in the Apple-FBI Saga(Wired) As the saga around the San Bernardino iPhone continues, new details are trickling out in court documents about the phone and the government’s investigation. Some of the details answer longstanding questions about the case while others raise more questions
For a complete running list of events, please visit the Event Tracker on the CyberWire website.
Newly Noted Events
4th Annual Cybersecurity Law Institute(Washington, DC, USA, May 25 - 26, 2016) At our 4th annual Institute, in the capital where cybersecurity regulations and enforcement decisions are made, you will be able to receive pragmatic advice from the most knowledgeable legal cybersecurity...
SANS 2016(Orlando, Florida, USA, March 12 - 19, 2016) It is time we unite, join forces, and show that if we work together, we can make a measurable difference in security. It is our pleasure to announce that SANS 2016 is back in Orlando, Florida March 12-21
Pwn2Own 2016(Vancouver, British Columbia, Canada, March 16 - 17, 2016) Since its inception in 2007, Pwn2Own has increased the challenge level at each new competition, and this year is no different. While the latest browsers from Google, Microsoft, and Apple are still targets,...
Insider Threat Symposium & Expo™(San Antonio, Texas, USA, March 17, 2016) The Insider Threat Symposium & Expo was created in the wake of the recent data breaches affecting the U.S. Government (WikiLeaks, NSA Breach), and the continued damaging and costly insider threat incidents...
ICCWS 2016(Boston, Massachusetts, USA, March 17 - 18, 2016) ICCWS 2016 will cover the complex but exciting aspects of international cyber warfare and security
CISO Summit France(Paris, France, March 22, 2016) A forum for innovative IT thought leaders across France. Despite economic instability in the euro zone amid an on-going global financial crisis, IT spending worldwide is expected to increase in the coming...
Risk Management Summit(New York, New York, USA, March 22 - 23, 2016) The Business Insurance Risk Management Summit is a unique two-day conference serving the information and networking needs of senior risk managers, benefits managers and related decision makers from the...
Artificial Intelligence and Autonomous Robotics(Clingendael, the Netherlands, March 23 - 24, 2016) Artificial Intelligence (AI) has been a feature of science fiction writing for almost a century, but it is only in more recent years that the prospect of truly autonomous robotics — even those that...
Commonwealth Cybersecurity Forum 2016(London, England, UK, March 23 - 24, 2016) The Commonwealth, built on consensus and mutual support, is an ideal platform to build international cooperation on various aspects of cybersecurity. CTO's Commonwealth Cybersecurity Forum brings together...
Black Hat Asia 2016(Singapore, March 29, 2016) Black Hat is returning to Asia again in 2016, and we have quite an event in store. Here the brightest professionals and researchers in the industry will come together for a total of four days — two...
SecureWorld Boston(Boston, Massachussetts, USA, March 29 - 30, 2016) Join your fellow security professionals for affordable, high-quality cybersecurity training and education. Earn 12-16 CPE credits through 60+ educational elements learning from nationally recognized industry...
Insider Threat Summit(Monterey, California, USA, March 29 - 30, 2016) The focus of the Insider Threat Summit is to discuss personnel security issues including cyber security challenges and capabilities, continuous evaluation of privileged identities and ethical physical...
TU-Automotive Cybersecurity USA 2016(Novi, Michigan, USA, March 29 - 30, 2016) TU-Automotive Cybersecurity dissects the real issues behind the headlines, helping you to apply technology and best practices to deliver robust security defenses and processes within a more secure ecosystem.
Insider Threat Program Development Training(Washington, DC, USA, March 29 - 30, 2016) Insider Threat Defense announced it will hold a training class on Insider Threat Program Development (National Insider Threat Policy-NISPOM Conforming Change 2) on March 29-30, 2016, in Washington, DC.
Women in Cyber Security 2016(Dallas, Texas, USA, March 31 - April 2, 2016) With support from National Science Foundation, Award #1303441 (Capacity Building in Cybersecurity: Broadening Participation of Women In Cybersecurity through the Women in Cybersecurity Conference and Professional...
SPONSOR & SUPPORT
Grow your brand and reach new customers.
Grow your brand and increase your customer base by educating our audience about your products, services, and events by advertising on The CyberWire. We’ve built trust with an influential (and often hard to reach) audience of CISOs, CSOs, and other senior execs in the security space, across a wide array of industry verticals. Learn more.
Be a part of the CyberWire story.
People ask us (a lot) how they can support what we do. We have our sponsorships and services, of course, but those are not always within every supporter's financial reach, or it might just not be the right time for you to do those things. That's why we launched our new Patreon site, where we've created a wider variety of support levels, each with some new benefits. Our patrons are important to our future, and we hope you'll consider becoming one. We invite you to become part of the CyberWire story. Become a patron today.