The CyberWire Daily Briefing for 1.16.2013

Cyber Attacks, Threats, and Vulnerabilities

China or Russia Could Be Behind This Global Online Espionage Operation (Mashable) Russia or China could be behind one of the largest and most complex cyber espionage campaigns ever revealed, according to cybersecurity experts contacted by Mashable. The operation, codenamed Red October, was uncovered yesterday by the Russian online security giant Kaspersky Lab. Unfortunately the evidence can't clearly show who is behind the attacks

Java exploit used in Red October cyberespionage attacks, researchers say (CSO) Seculert researchers identified a Java exploit and corresponding attack pages on Red October command and control servers. The hundreds of government, military and research organizations targeted in a large-scale cyberespionage operation dubbed Red October were not only attacked using malicious Excel and Word documents as previously believed, but also by using Web-based Java exploits, according to researchers from Israeli IT security firm Seculert

Researchers Trap Major Cyber Attack (Top News Arab Emirates) Researchers, Prof. Alan Woodward and colleagues, from the University of Surrey have this time discovered a major cyber-attack, a recent report has revealed. The finding is being claimed by an expert as extremely appreciable

Throwing cold water on 'Red October' (CSO Salted Hash) The infosec news machine is going nuts over the report Kaspersky Lab's Global Research & Analysis Team released yesterday on what it calls Red October -- a cyberespionage network that's been stealing confidential data from private industry and government and research organizations in Eastern Europe, former Soviet republics and Central Asian countries for the last five years

Android Botnet Infects 1M+ Phones in China (Threatpost) Up to a million Android users in China could be part of a large mobile botnet according to research unveiled by Kingsoft Security, a Hong Kong-based security company, this week

DDoS Attacks on Banks Could Continue in Perpetuity (Security Bistro) Another week, and yet another proclamation from the extremist group Izz ad-Din al-Qassam Cyber Fighters, who vow to continue their Distributed Denial of Service (DDoS) attacks on the websites of several financial organizations in protest of a controversial film. We have repeatedly stated that removal of the offensive video, INNOCENCE OF MUSLIMS, from YouTube is the simplest solution to stop the cyber-attacks You want to continue playing the game, yes? the group said in their latest Pastebin post

Cyber attack was not done by amateurs, says YOK head (Hurriyet Daily News) The hacker group RedHack is a professional organization that is skilled in its craft, Gokhan Cetinsaya, the head of Turkey's Higher Education Board (YOK), has said in commenting on a cyber attack on the body's website last week. "We are not talking

S. Korea says North behind cyber attack on newspaper (The Star Online) South Korean police on Wednesday said North Korea was behind a cyber-attack that paralysed operations at a major conservative newspaper last year. Police accused the North of hacking the news website and database of the JoongAng Ilbo and

Waledac botmasters use Virut malware to build a new botnet (Help Net Security) Despite having been swooped down on by security companies and law enforcement a couple of times, the botmasters of the Waledac (Kelihos) botnet refuse to give up and are using new variants to set up new versions of the original botnet

Automated YouTube account generator offered to cyber crooks (Help Net Security) You're a spammer / malware peddler / phisher, and want to register hundreds of bogus accounts on a popular online service such as YouTube in order to lead users to your wares. But, you don't want to create them manually yourself because that would take simply too much of your precious time - so what do you do? According to Dancho Danchev, there's an elegant solution out there, just waiting to be bought and implemented: a software tool that uses API keys offered by a CAPTCHA-solving services to automate the account registration process

The Death Of Java In The Enterprise? (Dark Reading) The continued waves of Java zero-days have security experts recommending that enterprises reevaluate how they use Java. An early January Java zero-day bombshell has been just the inauspicious start to 2013 that many security researchers needed to set off talks again about the future of Java as a software platform. It's a continuation of a drumbeat that started after last year's rash of zero-days and one that's now gained an officious band leader in the form of the Department of Homeland Security's Computer Emergency Readiness Team (CERT), which this week suggested users disable Java in Web browsers

Beware! Malicious Europcar invoice emails spread Trojan horse attack (Naked Security) Beware! Malicious Europcar invoice emails carry a Trojan horse. SophosLabs has intercepted many emails today, attempting to infect Windows computers via an email purporting to be an invoice from a car rental company

Serious flaw allows Cisco IP phones to be used for spying (Fierce CIO: TechWatch) Researchers have demonstrated how a serious vulnerability in the 7900 series of the Cisco (NASDAQ: CSCO) Unified IP Phones can be used to transform them into bugging devices in order to eavesdrop on private conversations

Microsoft now 'actively investigating' Surface jailbreak tool (Fierce CIO: TechWatch) Microsoft is now "actively investigating" the Jailbreak tool for Windows RT that surfaced last week, according to a report on The Register, and will take "appropriate action as necessary." Though no further details were provided, this is a departure from Microsoft's (NASDAQ: MSFT) earlier stance where it played down the issue as not being related to security. "We applaud the ingenuity of the folks who worked this out and the hard work they did to document it. We'll not guarantee these approaches will be there in future releases," said Microsoft at that time

New 'Bouncer List' Exploits Turn Phishing Into Clubbing (Dark Reading) Targeted email attacks mirror your favorite night club; if you're not on the list, you don't get in. In the old days, phishing worked like spam -- the more users it hit, the more successful it was considered to be. But a new attack concept uncovered this week turns fraudulent email attacks in the opposite direction

The SCADA Patch Problem (Dark Reading) Industrial control systems vendors are starting to patch security bugs, but actually installing the fixes can invite more trouble. If you think database patching is onerous and fraught with risk, try patching a SCADA system that's running a power plant. With post-Stuxnet paranoia pressuring major SCADA vendors like Siemens to regularly respond to vulnerability finds with software patches, utilities and other organizations running industrial control systems face some serious decisions over where and when to patch -- if at all

Security Patches, Mitigations, and Software Updates

Adobe Patches Four ColdFusion Flaws Exploited in Wild (Threatpost) Coldfusion patch Adobe delivered a security hotfix for its ColdFusion application server today, repairing a host of vulnerabilities being exploited in the wild. The company had recommended a series of mitigations in a Jan. 7 advisory as a stopgap until today's hotfix was released

Cisco introducing Cisco Security Notices 16 JAN 2013 (Internet Storm Center) Cisco has announced that as of 16 JAN 2013 they will begin releasing a new publication type. "Cisco Security Notices will document low- and medium-severity security vulnerabilities that directly involve Cisco products but do not warrant the visibility of a Cisco Security Advisory"

Cyber Trends

Vulnerability of oil and gas infrastructure drives security investments (Help Net Security) Security of critical facilities remains the topmost priority for the global oil and gas industry. Escalating demand for oil and gas, the construction of new facilities, and physical and cyber threats

4 Cyber Issues for Hospitals (Becker's Hospital Review) In recent years, many hospitals and health systems have been affected by a data breach. According to a study by the Ponemon Institute, 94 percent of organizations surveyed experienced at least one data breach in the previous two years. Forty-five percent of organizations experienced more than five data breaches in the past two years. Part of this increase is due to emerging technology. While innovative, they create new vulnerabilities and challenge the industry to create new security and privacy protocols. Unfortunately, the vulnerabilities revealed by new technology will continue to haunt organizations that have yet to evolve their policies and procedures. In addition, healthcare organizations stand to face cyber issues beyond emerging technology, according to the "2013 Cyber Security Forecast" by Kroll Advisory Solutions

Marketplace

NIH to get data chief (Fierce Big Data) The National Institutes of Health is looking to establish the position of associate director for data science to uncover the potential in vast stores of biomedical research data related to genomics, imaging and electronic health records. It would be a rare, high-ranking government position that would be tasked exclusively with managing a data-centric agency

Who's visiting Steven VanRoekel? (Fierce Government IT) We downloaded the spreadsheet of logged White House visitors covering the period of January through September 2012 and produced an interactive visualization out of the data. Note--the visualization requires Java; we withheld posting it online until Oracle released a patch for its zero day exploit. Go here to download it. Also, full interactivity requires going directly to the IBM Many Eyes website where we made the visualization

So you want to be a data scientist (Fierce Big Data) There's no question that the top requirement for companies looking to gain a competitive advantage using data and analytics is going to be the talent to run a data and analytics program. So says Jack Phillips, CEO of the International Institute for Analytics, in a recent CIO article. Over the last year, there have been a lot of discussions and forecasts for the data scientist job market, covering everything from defining the role of the data scientist, to where the jobs would be and how much they would pay

CACI CEO Dan Allen: Company Pursuing Cyber Growth on $900M Intel Hardware IDIQ (GovconExecutive) CACI International will compete to provide the U.S. Navy applications and hardware for battlespace awareness operations under a potential five-year, $899 million contract, the company said Monday. The Navy is also seeking to acquire tools for intelligence and information operations under the indefinite-delivery/indefinite-quantity contract (click here for GovCon Wire's coverage of the contract award)

Department of Commerce Implements MaaS360 for Mobile Device Management (IT News Online) Fiberlink, the leader in cloud-based solutions for secure mobile device management (MDM) and mobile application management (MAM), today announced that the National Oceanic and Atmospheric Administration (NOAA), a scientific agency within the Department of Commerce, has deployed MaaS360 to provide visibility and control over government-owned mobile devices. With a mission to understand and predict changes in climate, weather, oceans and coasts, NOAA is using MaaS360 to meet the unique demands of its growing mobile workforce while helping to lead the effort to expand mobility initiatives at other operational units within the Department of Commerce, including the National Institute of Standards and Technology (NIST) and the United States Census Bureau

Palantir co-founder suggests it's worth $7B-$8B (Silicon Valley Business Journal) Palantir Technologies Inc. co-founder Joe Lonsdale says his secretive data analytics startup for the US Army, government intelligence agencies and financial

How a leveraged buyout could actually turn Dell into the tech success story of the decade (Quartz) Tarkan Maner, Dell's vice president of cloud operations, is shouting into the phone at me: "Investors are giving us some runway. We've got about 12 to 18 months. But if I don't execute, your next interview will be with a different guy!" Eight months ago, Maner was CEO of Wyse, an obscure but highly profitable company that had been skulking in the shadows of better-known enterprise information technology companies

RSA betting its future on big data (CSO) "This is what makes security interesting going forward," says RSA Chief Technologist Sam Curry in discussing the outfit's new position paper ("Big Data Fuels Intelligence-Driven Security"), which lays the groundwork for integrating big-data analytics into security operations. Pressed to say exactly how RSA will pursue such a strategy, Curry would only acknowledge more on products and services will be forthcoming soon. He emphasizes: "We're making a bet as a company on this"

Facebook's Future Depends On Opening The Data Center (TechCrunch) Facebook is a data company. Today's news about its new search features proves it. So did last week's news about Facebook testing what it can charge people to send Mark Zuckerberg a message. And tomorrow at the Open Compute Summit, Facebook will again show why becoming the world's largest data broker depends on the success of its massive data-center buildout

Think tank presses Blue Coat over censorship concerns (CSO) Blue Coat, which makes software and appliances that monitor and restrict web traffic, has been criticized before. A Canadian think tank called on Tuesday for continued scrutiny of U.S. security vendor Blue Coat Systems after a new technical analysis showed wide use of its products in countries with human rights and censorship concerns. The Citizen Lab, based at the Munk School of Global Affairs at the University of Toronto, published a report that showed Blue Coat technology widely deployed at key choke points in telecommunication systems

BlackBerry gets vote of confidence from monitoring-software maker (CSO) There's good news for a change for BlackBerry maker Research in Motion, as monitoring-software vendor SpectorSoft today announced its first software support for BlackBerry in the enterprise

VMware Joins Govt Open Source Industry Group (The New New Internet) VMware has joined a non-profit institution that advocates for using open source software in government technology systems. The virtualization and cloud computing infrastructure provider, an EMC Corp. subsidiary, joins the Open Source Software Institute as a platinum member, the OSSI said

Nathaniel Fick, Former CNAS Chief, Heads Cyber Targeting Firm (Defense News) Endgame Systems is a secretive cyber company with an intriguing specialty. The firm's chief product, software called Bonesaw, is a "cyber targeting application" that tracks servers and routers worldwide, mapping the hardware attached to the Web. These are the access points through which the National Security Agency, Cyber Command and other U.S. agencies, could launch operations against adversaries and threats

HP Names Former VA Healthcare COO Laura Miller a Public Sector Principal (Govconwire) HP Enterprise Services (NYSE: HPQ) has appointed Laura Miller, a former chief operating officer for the Department of Veterans Affairs' healthcare system, to serve as healthcare client principal for the U.S. public sector

IBM Names Global Public Sector Head Anne Altman Federal Lead (Govconwire) IBM (NYSE: IBM) has appointed Anne Altman, formerly general manager for the global public sector, to serve as GM for the U.S. federal government business. According to Washington Technology, she assumed leadership of the global public sector in 2009. The company says she was for strategy, direction, development and sales for public sector clients worldwide

Lloyd Howell to Succeed Jimmy Henry as Booz Allen's Civilian Lead (Govconwire) Booz Allen Hamilton (NYSE: BAH) has appointed Executive Vice President Lloyd Howell to succeed the retiring Jimmy Henry as head of the company's civilian business, the Washington Business Journal reports. Henry is retiring from the company in April after a 26-year career there, where he also served on the board of directors

Damballa Appoints Jennifer Byrne Vice President of Global Alliances (Fort Mills Times) Damballa Inc., the recognized experts in advanced threat protection…"Our exceptional team, which drives our unique approach to cyber security

Products, Services, and Solutions

Is Dell looking to kill PCs with 'Project Ophelia'? (Ars Technica) Dell is reportedly investigating a move to take the company private in a leveraged buy-out to clear the decks for a radical repositioning of the company. And according to a report from Atlantic Media's Quartz, that includes relaunching Dell's desktop and mobile business around a brand-new product: a computing device the size of a thumb-drive that will sell for about $50

Facebook's Bold, Compelling and Scary Engine of Discovery: The Inside Story of Graph Search (Wired Business) With the social networking giant's newest feature, friends can type in any query and get real useful information–that Google can't touch

Facebook's Graph Search announcement - should you be cynical, cautious or excited? (Naked Security) Facebook's "big announcement" turns out to be Graph Search. Paul Ducklin looks at what it is, when you'll actually be able to use it, and what it means for privacy

6Scan launches free website vulnerability and malware scanning service (CSO) A commercial subscription adds automatic fixing, a Web application firewall and other features. 6Scan, a Web security startup based in Tel Aviv, Israel, launched a new service on Tuesday that can scan websites for security issues, like vulnerabilities and malware infections, and allows their owners to automatically fix the identified problems

Panda Cloud Antivirus wins the Best of 2012 Soft award from PC Magazine (Melodika.net) Panda Security's free solution, Panda Cloud Antivirus, has received the award for Best of 2012 Soft from PC Magazine/Russian Edition

High volume biometric fingerprint and iris identification (Help Net Security) Neurotechnology released MegaMatcher Accelerator 5.0, a multi-biometric software and hardware solution designed for large-scale projects that require high-volume, high-speed fingerprint and/or iris identification

Free virtual machine management tool (Help Net Security) vOPS Server Explorer is a suite of five free utilities for VM administrators. The included tools are: Storage Explorer - Storage performance and capacity views across datastores and VMs that

Wombat unveils social engineering security training module (Help Net Security) Wombat released its social engineering training module to defend against social engineering threats, including spear phishing and social media-based attacks. Commonly defined as the art of exploitiing

Google's Chrome 24 offers better offline support, faster JavaScript (Fierce CIO: TechWatch) Google (NASDAQ: GOOG) released the stable version of Chrome 24 late last week, with just a number of minor changes but big improvements in speed. According to Google, its own Octane JavaScript pegs Chrome 24 as the fastest Chrome release yet

Report: New '7W' Ivy Bridge chips from Intel partly a marketing ploy (Fierce CIO: TechWatch) New Ivy Bridge based processors unveiled by Intel at CES last week garnered headlines because of their low power consumption of just 7W. While the new chips are indeed more power efficient, the extent of the gains on the power savings front is apparently less than what Intel would like to have users think

SAP, Oracle smackdown gets real (Fierce Big Data) With a sarcastic wish for good luck tossed from Oracle (NASDAQ: ORCL) CEO Larry Ellison to SAP co-founder Hasso Plattner last year for the latter's declaration that his company planned to build an in-memory database to rival Oracle--and replace it internally--a juicy industry smackdown stirred. This week it got real

SAP Sweetens Hana Deal With Free Sybase Database (InformationWeek) Not everything demands in-memory performance, so SAP is bundling a conventional database for customers licensing SAP BusinessSuite to run on Hana

Does iOS look outdated? Reasons for and against (ZDNet) The iPhone was first released back in 2007, and the iOS operating system -- which was called "iPhone OS" back then -- hasn't changed much during that time

Fusion-io targets Facebook, Apple with pile-it-high, sell-it-cheap flash (ZDNet) The enterprise flash card designer has launched a stack-them-high and sell-them-cheap flash product designed for 'hyperscale' tech companies. Fusion-io has launched a NAND flash card family that takes its inspiration from the retail adage of 'stack them high, sell them cheap'. The range of PCIe-flash drives, named ioScale, can only be bought in batches of 100 or more and capacities vary, per drive, from 410GB up to 3.2TB

Commtouch's New Mobile Security For Android Combats Fast-Growing Number Of Mobile Threats (Dark Reading) Solution offers cloud-assisted antivirus and Web security services. Commtouch(R) (NASDAQ: CTCH), a leading provider of Internet security technology and cloud-based services, today announced general availability of its new Mobile Security for Android. It is the first-ever OEM solution that offers cloud-assisted antivirus and Web security services delivered through a single, easy to integrate client SDK for the popular mobile operating system

Technologies, Techniques, and Standards

10 Facts: Secure Java For Business Use (InformationWeek) Businesses that rely on Java must now take additional steps to keep employees safe. Here's where to start

Java security comes down to 'war of attrition' (IT World) Users and Oracle both need to do their part against a malware industrial complex that can quickly attack any security hole

Java is not JavaScript - tell your friends! (Naked Security) Some people are worried that turning off Java also turns off JavaScript. Despite their names, Java and JavaScript are completely different, and turning off Java will not turn off JavaScript

When Disabling IE6 (or Java, or whatever) is not an Option (Internet Storm Center) We're getting a whole lot of bad advice regarding the latest crop of vulnerabilities. Folks are saying things like "disable Java", or "Migrate away from IE6/7/8", or even "Migrate to IE10 or Firefox". While these will certainly mitigate the current vulnerability, it's often not a practical way to go. If you pick the right week, almost anything could be your target "disable that" component - everyone has a zero day at one time or another. Specific to this week's issues, there are lots of business applications that are tied to older browsers - I've got a number of clients who have business critical applications that are tied to a specific version of IE (often IE6), or to a specific, old version of Java. Or if you still have a few thousand XP workstations, you're going to top out at IE8

Compliance auditing: The first step to cyber security (Help Net Security) Assuring that your company complies with industry standards is imperative. Being compliant not only heightens your reputation and allows you to trade in some industries, it also gives your clients confidence

Gigabit Wi-Fi almost ready for prime time (Fierce CIO: TechWatch) Despite earlier reports that pegged the arrival of gigabit Wi-Fi technology to mid-2012, gigabit wireless transfers appear to finally be ready for prime time if one considers the range of products being demonstrated at CES 2013, which concluded last week. Next-gen wireless products that were showcased ranged from wireless video displays to docking stations, as well as high-speed wireless file transfer technology

Robocallers stand out in a troll through Chinese cell phone records (Ars Technica) How to tell the robots from the humans even if you can't hear the conversation? The availability of electronic records of communications, from the use of cellphones to chats in online games, has given social scientists new options for studying how humans interact. Communication patters, friendship networks, and the spread of ideas have all become accessible to large-scale analysis. Now, researchers have combed the records of 5.9 million Chinese cellphone users, trying to figure out the normal pattern of calls they make. And in the process, they've identified a few abnormal patterns, ones that probably aren't made by humans at all

Design and Innovation

Google Announces First Project Glass Hackathons In NYC And SF, Will Detail 'Mirror API' (TechCrunch) Over the last year, Google has slowly been unveiling its plans around Project Glass, the company's R&D program responsible for attempting to bring wearable computing to the mainstream. Complete with augmented reality and an integrated display, Google's "smart glasses" have had many geeks on pins and needles, especially as "Explorer" editions of the glasses have been expected to begin showing

5 Secrets To Zuckerberg's Success (InformationWeek) Mark Zuckerberg's Facebook adventure gets examined in a new book that doesn't shock, but serves as a social business primer

Research and Development

Does Facebook Praise Kill Self-Control? (Wired Business) One hateful Facebook comment might reduce you to tears, but a recent study found that the "likes" prompted by your status updates and photo posts might also have a negative impact, especially on your waistline and pocketbook

Why hackers should be afraid of how they write (Sydney Morning Herald) It's been used to question or confirm the authorship of Shakespeare's plays, Homer's Illiad and Odyssey and St Paul's letters for hundreds of years. Now the science of stylometry could be used in the fight against hackers, trolls and malware writers that wreak havoc on the web. At the same time, stylometry - the analysis of a person's unique writing style could also be used by employers to identify whistleblowers or whingers among their staff."Your writing style can give you away and on the internet anonymity is difficult to achieve," say the US researchers who have developed online tools to analyse writing

Academia

Troll alert: 600,000 kids to learn about cyber safety (Sydney Morning Herald) A new cyber safety program will teach Australian middle-school students about cyberbullying, keeping passwords private and the dangers of posting embarrassing photos and videos online. Developed by Life Education and McAfee, the module is aimed at students in years 3 and 4 and will be delivered in 3500 schools across the country from next month."We've taught our kids, generation after generation, about how to be streetwise and about stranger danger," Prime Minister Julia Gillard said at the Yates Primary School in Dundas Valley on Wednesday morning. "We now have to teach our kids about new dangers

University Course Will Teach Medical Device Security (Security Ledger) The University of Michigan will be among the first to offer graduate students the opportunity to study the security of advanced medical devices. The course, EECS 598-008 Medical Device Security will teach graduate students in UMichs Electrical Engineering and Computer Science program the engineering concepts and skills for creating more trustworthy software-based medical devices ranging from pacemakers to radiation planning software to mobile medical apps. It comes amid heightened scrutiny of the security of medical device hardware and software, as more devices connected to IP-based hospital networks and add wireless monitoring and management functionality.

MCCC Finalizes Transfer Agreements With 2 Schools (Monroe Evening News) An agreement with Eastern Michigan University will enable students to transfer up to 74 credits from MCCC's information assurance and security program

Utica College Cybersecurity Programs Earn Prestigious NSA Approval (The Herald) Utica College's cybersecurity and information assurance courses have been approved by the National Security Agency (NSA)

IBM, Universities Team Up To Build Data Scientists (InformationWeek) Big Blue program aims to prepare students for a workplace increasingly driven by data

Swartz Suicide Puts JSTOR Academic Database In Spotlight (InformationWeek) Death of internet activist Aaron Swartz renews push for online content and copyright debate

Legislation, Policy, and Regulation

Swartz suicide shines light on federal anti-hacking law (IT World) The suicide of Internet activist and pioneer Aaron Swartz has focused attention on what some activists say is the overzealous use of the federal Computer Fraud and Abuse Act anti-hacking statute

Congresswoman proposes amendment to computer fraud law honoring Aaron Swartz (Computer World) A draft bill to exclude terms of service violations from the Computer Fraud and Abuse Act (CFAA) is to be introduced in the U.S. House of Representatives. The proposed amendment to the anti-hacking law comes in the wake of the suicide on Friday by Internet activist and computer prodigy Aaron Swartz, who was charged with wire fraud, computer fraud and other crimes for allegedly accessing and downloading over 4 million articles from the JSTOR online database through the network of the Massachusetts Institute of Technology

Government and social media providers get together on cyber safety (ladoo) On 16 January 2013, the Prime Minister announced a new agreement with Facebook, Google, Microsoft, and Yahoo to handle complaints and antisocial behaviour on social media sites. The Protocol commits these organisations to:set out clear guidelines for acceptable use of social mediaundertake education and awareness about appropriate behaviour onlinehave a robust process in place for reviewing and acting on any complaintshave a single point of contact for governmentIt is an important step in encouraging online safety for the Australian community

DoD Looks to Expand Cyber, Maritime Partnerships in Europe (Defense News) The U.S. Defense Department is looking to broaden its defense cooperation in Western Europe by deepening its military-to-military engagements, especially in maritime and cyber security initiatives. U.S. Defense Secretary Leon Panetta, who is in the middle of a weeklong trip to four European capitals, called for greater cooperation in these and other areas during meetings with the defense ministers from Spain and Portugal

No extension for SIM re-registration: TRA (Emirates 24/7) Long queues at both teleco centres as deadline of January 16 kicks in. UAE's Telecommunications Regulatory Authority's (TRA) has ruled out granting any further extension for du and etisalat mobile subscribers under the 'My Number, My Identity' campaign

Why Aaron Swartz's Ideas Matter (Technology Review) The world lost a brilliant activist and a leading proponent of information freedom last week. Aaron Swartz, a precocious and uncompromising digital activist, tragically took his own life last Friday. He was just 26. Swartz clearly touched the lives of those who knew him well in unique and wonderful ways, and the tributes posted online are testament to a special human being. But those who never knew him were affected as well—through the technologies he developed, his contributions to projects such as Wikipedia and the Internet Archive, and his untiring efforts to create a new understanding of digital rights and ownership, most prominently by helping create the Creative Commons.

Litigation, Investigation, and Law Enforcement

Michael Jackson Hackers Sentenced (eSecurity Planet) James Marks and James McCormick received six-month suspended sentences, along with 100 hours of community service

AMD accuses former top employees of stealing over 100,000 documents (Ars Technica) Chip maker says the defendants gave trade secrets to their new employer, NVIDIA. AMD filed a complaint yesterday alleging that four of its former employees—one former vice-president and three former managers—transferred sensitive AMD documents before joining competing graphics chip maker NVIDIA and then violated a "no-solicitation of employees" promise. The company alleges that Robert Feldstein, Manoo Desai, Nicolas Kociuk collectively downloaded over 100,000 files onto external hard drives in the six months before leaving the company. All three and another manager, Richard Hagen, were accused of recruiting AMD employees after leaving for NVIDIA

Google ordered to identify bloggers (Sydney Morning Herald) A South Australian court has ordered internet giant Google to reveal to a businessman the identities of anonymous bloggers who he claims have defamed him. Shane Radbone, a former AFL footballer, and his wife Victoria Elise Radbone want to sue the bloggers for defamation and applied to the SA District Court in Adelaide for orders against Google. Master Mark Blumberg on Tuesday ordered Google to disclose to the Radbones, within 21 days, full particulars of "relevant evidentiary material" relating to the identity of the person or persons who registered five named blogs

Hackers Who Tangled With the Feds and Lost (PC Magazine) Over the weekend, an outpouring of grief made its way through the Web following the suicide of Internet activist Aaron Swartz. Described as a "Web genius" by luminary Lawrence Lessig, Swartz (right) was also known for helping to found the popular Internet discussion site, Reddit. Swartz's death came exactly two years after his arrest for allegedly downloading

White House Must Respond to Petition to Remove U.S. Attorney in Aaron Swartz Case (Wired) A whitehouse. gov petition demanding the President Barack Obama administration remove Massachusetts top federal prosecutor in the aftermath of the Aaron Swartz suicide has surpassed 25,000 signatures meaning the administration is obliged to enter the debate over whether authorities went too far in prosecuting the 26-year-old internet sensation. Swartz, the executive director of Demand Progress, who had written about his own depression, was found dead at his Brooklyn apartment Friday

The case against Aaron Swartz was like sending someone to jail for checking too many books out of the library (Quartz) I closed the doors on my first startup 12 years ago, throughly broke, depressed, and feeling the burden of losing hundreds of thousands of dollars of other people's money. I've written about my own struggle with suicide, a failed entrepreneur unsure how to face the world. I've never met Aaron Swartz, the co-founder of Reddit who took his own life last week, but he has made me cry and ache in recent days more than I care to admit

WBC Threatens to Picket Aaron Swartz Funerals, Anonymous Intervenes (Softpedia) Members of the controversial Westboro Baptist Church (WBC) have revealed their intentions to picket the funerals of Reddit co-founder Aaron Swartz. After hearing the news, Anonymous hackers launched a new operation. Lord willing, WBC to picket the funeral of cyber-criminal Aaron Swaryz at Central Avenue Synagogue on Tuesday, January 15,2013, when scheduled, WBC wrote in a news release

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

Cybergamut Technical Tuesday: Finding Splunk Before Splunk Finds You (Columbia, Maryland, USA, Jan 22, 2013) Rob Frazier of Whiteboard Federal Technologies will present his talk "Finding Splunk Before Splunk Finds You". Certification letters will be available for PMI PMP PDU' and CISSP CPEs as well as other technical credits as appropriate. The live event will be in Columbia, MD, and there will be a cybergamut node established in Omaha, Nebraska for this event.

TED X Baltimore: Baltimore Rewired (Baltimore, Maryland, USA, Jan 25, 2013) At our TEDxBaltimore event, TEDTalks video and live speakers will combine to spark deep discussion and connection in a small group. The TED Conference provides general guidance for the TEDx program, but individual TEDx events, including ours, are self-organized.

Data Privacy Day (Various locations, Jan 28, 2013) The National Cyber Security Alliance (NCSA), a non-profit public-private partnership focused on helping all digital citizens stay safer and more secure online, and official coordinator of Data Privacy Day (DPD), is collaborating with many educational institutions, corporations, government and non-profit organizations across the world to make Data Privacy Day on January 28th a success. Data Privacy Day is an international day of awareness to educate everyone to respect privacy and safeguard personal information.

tmforum Big Data Analytics Summit (Amsterdam, Netherlands, Jan 29 - 30, 2012) Bringing together leading service providers, market analysts and all of the big names in Big Data, this forward-looking, education-packed two-day Summit combines keynote perspectives, case studies, debates, panels, interactive sessions and networking opportunities that maximize every participant's opportunity to network and generate ideas that can be implemented immediately.

North American ICS & SCADA Summit (Lake Buena Vista, Florida, USA, Feb 6 - 15, 2013) The Summit brings together the program managers, control systems engineers, IT security professionals and critical infrastructure protection specialists from asset owning and operating organizations along with control systems and security vendors who have innovative solutions for improving security. Along with government and research leaders, they are coming together to learn and discuss the newest and most challenging cyber security risks to control systems and the most effective defenses.

ATMiA US Conference 2013 (Scottsdale, Arizona, US, Feb 19 - 21, 2013) A conference devoted to the design of ATMs, and the future of the ATM industry.

Cybergamut Technical Tuesday: Cloud Security (, Jan 1, 1970) Dr. Susie Cole of Exceptional Software Strategies will discuss cloud security..

#BSidesBOS (Cambridge, Massachusetts, USA, Feb 23, 2013) Each BSides is a community-driven framework for building events for and by information security community members. The goal is to expand the spectrum of conversation beyond the traditional confines of space and time. It creates opportunities for individuals to both present and participate in an intimate atmosphere that encourages collaboration. It is an intense event with discussions, demos, and interaction from participants. It is where conversations for the next-big-thing are happening..

RSA USA 2013 (San Francisco, California, USA, Feb 25 - Mar 1, 2013) RSA Conference continually evolves program offerings to meet the ever-changing needs of our delegates in the dynamic infosec industry.

Nullcon Goa 2013 (Bogmallo Beach Resort, Goa, India, Feb 26 - Mar 2, 2013) An international information security conference that will feature speakers and training. Topics include security and politics, vulnerability elimination, Android hacking, SCADA and smart grid penetration testing, and more.

TechMentor Orlando 2013 (Orland, Florida, USA, Mar 4 - 8, 2013) Celebrating 15 years of educational events for the IT community, TechMentor is returning to Orlando, Florida, March 4-8, for 5 days of information-packed sessions and workshops. Surrounded by your fellow IT professionals, you will receive immediately usable education that will keep you relevant in the workforce. TechMentor track topics include:Windows PowerShell and AutomationCisco and Networking Infrastructure Windows Server Management Windows Client Management Cloud and Virtualization Identity, Access Management and Security Performance Tuning and Troubleshooting Mobility and BYOD Messaging and Collaboration.

Business Insurance Risk Management Summit (New York City, New York, USA, Mar 5 - 6, 2013) The annual Risk Management Summit, now in it its fourth year, provides attendees with focused insight via specific, timely general sessions and strategic, thought-provoking discussions with peers and industry leaders.

e-Crime Congress 2013 (London, England, Mar 12 - 13, 2013) The e-Crime Congress is designed to meet the needs of key stakeholders and decision makers who are responsible for designing and coordinating information security and risk management strategy, safeguarding digital assets and sensitive information, protecting customers, defending against internal or external threats and responding to incidents.

CTIN Digital Forensics Conference (Seattle, Washington, USA, Mar 13 - 15, 2013) Speakers include experts and published authors in the field of digital forensics and cybersecurity. Topics include; Mobile Device Forensics, Internet Forensics, Physical Memory Analysis, Open Source Tools, Data Carving, Registry Forensics, Placing the Suspect Behind the Keyboard, Triage and Live Forensics CDs, and more.

IT Security Entrepreneurs' Forum (ITSEF 2013) (Palo Alto, California, USA, Mar 19 - 20, 2013) Supported by the U.S. Department of Homeland Security, Office of Science and Technology, ITSEF 2013 aims to connect the ecosystem of the entrepreneur: industry, government, and academia. The conference will advance innovation, lead change and build trusted global collaboration models between the public and private sectors to defeat Cybersecurity threats.

The Future of Cyber Security 2013 (London, England, UK, Mar 21, 2013) Cyber Security and the Citizen 2013 is a one-day conference and exhibition for senior decision-makers of central and local government organisations, NGOs and major private sector enterprises.

Cloud Connect Silicon Valley (Santa Clara, California, USA, Apr 2 - 5, 2013) Cloud Connect returns to Silicon Valley, April 2-5, 2013, for four days of lectures, panels, tutorials and roundtable discussions on a comprehensive selection of cloud topics taught by leading industry experts.

An Evening in Cyberspace: Supporting Tomorrow's Cybersecurity Leaders (National Harbor, Maryland, USA, Apr 6, 2013) UMUC is pleased to present An Evening in Cyberspace: Supporting Tomorrow's Cybersecurity Leaders. Join us for this special black-tie event to support the next generation of cybersecurity students. The evening will feature a reception, dinner, keynote and entertainment.

Cyber 1.3 (, Jan 1, 1970) Maj. Gen. Suzanne Vautrinot, USAF, commander, 24th Air Force, and commander, Air Force Network Operations, will discuss the global strategic implications that relate to the cyber domain at the Space Foundation national conference Cyber 1.3, to be held Monday, April 8th, at The Broadmoor Hotel in Colorado Springs, Colorado. Cyber 1.3 is a full-day conference that takes place immediately before the official opening of the 29th National Space Symposium. The conference includes a networking breakfast, a luncheon and concludes with a networking reception, co-sponsored by General Dynamics Advanced Information Systems. Government Executive Media Group is a Cyber 1.3 media co-sponsor.

InfoSec World Conference & Expo 2013 (Orlando, Florida, USA, Apr 15 - 17, 2013) With the primary objective of providing top-notch education to all levels of information security and IT auditing professionals, InfoSec World delivers practical sessions that give you the tools to strengthen your security without restricting your business.

Infosec Southwest 2013 (Austin, Texas, USA, Apr 19 - 21, 2013) InfoSec Southwest is intended to be a general security and hacking conference with no specific industry or topical focus. As such, nearly all topics (other than vendor pitches) are fair game and the attending audience is expected to span all demographics.

25th Annual FIRST Conference (Bangkok, Thailand, Jun 16 - 21, 2013) The annual FIRST conference provides a setting for conference participants to attend a wide range of presentations delivered by leading experts in both the CSIRT field and from the global security community.

SECRYPT 2013 (Reykjavik, Iceland, Jul 29 - 31, 2013) The 10th International Conference on Security and Cryptography (SECRYPT 2013) will take place from 29 to 31 July 2013 in Reykjavik, Iceland…The conference will focus on information systems and network security, including applications within the scope of knowledge society in general and information systems development in particular, especially in the context of e-business, internet and global enterprises. It will bring together researchers, mathematicians, engineers and practitioners interested in security aspects related to information and communication.