Cyber Attacks, Threats, and Vulnerabilities
Syrian Electronic Army no longer just Twitter feed jackers…and that's bad news (The Register) Hackers now target VoIP apps, directories, spewing Trojans as they go - infosec bods. The Syrian Electronic Army is starting to pose a serious risk to enemies of the Assad regime in both Syria and further afield, according to security watchers. Reports that the SEA managed to take over three personal email accounts of White House employees remain unconfirmed. However, recent worrying attacks on VoIP apps Viber and Tango mean that officials and security researchers need to keep a closer eye on the group, argues anti-malware tools firm FireEye
Syrian Electronic Army Hacks Major Communications Websites (FireEye) Syrian Electronic Army (SEA) has recently compromised three widely-used online communications websites, each of which could have serious real-world consequences for Syria's political opposition
What is the Syrian Electronic Army? (Infosecurity Magazine) As the Syrian Electronic Army (SEA) continues its hacking spree across largely Western organizations, it is worth pausing to question: what is the SEA, how does it operate, and what are its motivations
[NSA] Press Statement on 30 July 2013 (NSA) As the IC and NSA have stated previously, the implication that NSA's collection is arbitrary and unconstrained is false. NSA's activities are focused and specifically deployed against - and only against - legitimate foreign intelligence targets in response to requirements that our leaders need for information necessary to protect our nation and its interest. Public release of this classified material about NSA collection systems, without context, does nothing more than jeopardize sources and methods, and further confuse a very important issue for the country. Although it is impossible to provide full details of classified programs and still have them remain effective, we offer the following points for clarification
Newly exposed NSA tool, XKeyscore, sees 'nearly everything we do online' (Naked Security) The only thing US surveillance needs to read the contents of your email, with no prior authorization whatsoever, is your email address. Are we sick of PRISM yet, or do we still have room for outrage
Snowden's XKeyscore revelations challenged (The Register) Job ads for latest NSA horror ran in 2010. Edward Snowden's latest revelations about NSA snooping, the Xkeyscore program, have quickly been called into question
What's XKEYSCORE? (The Week) If you regularly search LinkedIn profiles for national security information, you'll find hundreds of highly compensated individuals who worked for NSA and who list, as one of their skills, the fluency in XKEYSCORE. Glenn Greenwald's publication today of one of the training presentation PowerPoints is sufficient to give us all that skill. (Marc Ambinder: now proficient in advanced web and document production, French, and XKEYSCORE.) I quibble with the Guardian's description of the program as "TOP SECRET." The word is not secret; its association with the NSA is not secret; that the NSA collects bulk data on foreign targets is, well, probably classified, but at the SECRET level. Certainly, work product associated with XKEYSCORE is Top Secret with several added caveats. Just as the Guardian might be accused of over-hyping the clear and present danger associated with this particular program, critics will reflexively overstate the harm that its disclosure would reasonably produce
The NSA's Evil Google: XKeyscore Tool Enables Vast Warrantless Search of Online Communication and Activity (HotHardware) One of the contentious issues that's swirled around the NSA since whistleblower Edward Snowden began leaking information on the organization's capabilities is exactly what it can -- or can't -- do. Snowden has stated that as a contractor with Booz Allen Hamilton, "I, sitting at my desk, certainly had the authorities to wiretap anyone, from you, or your accountant, to a federal judge, to even the President if I had a personal email"
Xbox One Mag Hacked by Ecuadorian Cyber Army (eSecurity Planet) 2,035 users' full names, e-mail addresses and mailing addresses were published online
Vulnerabilities in D-Link network video recorders enable remote spying, researcher says (CSO) The vulnerabilities allow attackers to gain access to devices used to monitor surveillance cameras or provide remote access to stored data
ZeroAccess malware revisited—new version yet more devious (Naked Security) Guess what? The authors of the infamous ZeroAccess malware have pushed out another update, and this time they're using some interesting techniques to stay alive longer. James Wyke of SophosLabs explains
Malware using GoogleCode for distribution (zscaler ThreatLab Blog) Malware hosting sites rarely stay up for too long. After the first few instances are seen by security vendors, they are added to blacklists which, in turn, are fed into other blacklists throughout the industry. Malware writers are now turning to commercial file hosting sites to peddle their warez. If these legitimate file hosts are not scanning the content they are hosting, it may force network administrators to block the service altogether. The kicker is that this time we see that GoogleCode seems to have swallowed the bad pill
Got an account on a site like Github? Hackers may know your e–mail address (Ars Technica) If you have an account on Github, StackExchange, or any one of countless other sites, there's a good chance hackers can identify the e-mail address you used to register it. That's because Gravatar, a behind-the-scenes service that says it works with millions of sites, broadcasts the information using cryptography that in many cases is trivial to crack
RBN's Fake Account Suspended Notices (Danchev) In the last quarter of 2007, under the public pressure put on the Russian Business Network's malicious practices, the RBN started faking the removal of malicious domains from its network by placing fake account suspended notices, but continuing the malware and exploit serving campaigns on them. And since I constantly monitor RBN activity, in particular their relationship with the New Media Malware Gang and Storm Worm, a relationship that I've in fact established several times before, a recently assessed malicious domain further expands their underground ecosystem. Let the data speak for itself
New Warning on Citadel and Reveton Issued (Infosecurity Magazine) The FBI's Internet Crime Complaint Center (IC3) has issued a new warning on a Citadel and Reveton ransomware campaign. Reveton is the ransomware, and Citadel is the malware platform used to deliver it
Why Carberp, ZeuS, and Other Vintage Malware Have a Bigger Bite Than You Think (FireEye) As a sales engineer working at FireEye, I spend my days running production pilots with prospects, discussing advanced persistent threats (APTs), customer's security posture, and the current advanced threat. While the focus here at FireEye is all about detecting the zero-day or advanced targeted attacks, I'm constantly surprised by how much plain old "commodity malware" or "crimeware" I find in networks
Secrets of the Comfoo Masters (Dell SecureWorks) The details of organized cyber-espionage campaigns are becoming more public. So-called "Advanced Persistent Threat" (APT) attacks are common news as individuals and corporations discover the data on their hard drives is part of a country or competitor's "shopping list." The actors behind these attacks are generally well-equipped in terms of training, finances, and access to resources. The missions of APT threat actors are usually of strategic importance, and the actors exercise virtually unlimited patience in penetrating and persisting inside their specific target's network until they accomplish their goals
The Current State of the Blackhole Exploit Kit (TrendLabs Security Intelligence Blog) The Blackhole Exploit Kit is one of the most notorious exploit kits currently in circulation among the cybercriminal underground today. Thus, we continuously monitor for incidents and attacks involving the exploit kit itself
FireHost Report Suggests Commodity Cloud Providers Are Bolstering Botnet Agility (Dark Reading) Q2 2013 sees sharp increase in blended, automated attacks. Secure cloud hosting company, FireHost, has today announced its Q2 2013 Web application attack statistics, which form part of FireHost's quarterly Superfecta report. These statistics track the prevalence of four distinct types of cyberattacks that pose the most serious threat to businesses, comprising CSRF, XSS, SQL Injection and Directory Traversal. For additional information on FireHost's Q2 2013 Superfecta report, visit Booth #621 at BlackHat USA 2013 in Las Vegas
The DNS Infrastructure of the Money Mule Recruitment Ecosystem (Dancho Danchev) What's the most static element of the vibrant money mule recruitment ecosystem? It's the DNS infrastructure that the the cybercriminals behind the campaigns repeatedly use to push new scams
Carriers Should Ditch Femtocells Over Security Risks: Researchers (SecurityWeek) After demonstrating how easily rogue femtocells can be used to intercept voice calls and text messages, researchers from iSec Partners called on carriers to stop using the network devices altogether
Black Hat: Researchers Use iPhone Charger As Hacking Tool (SecurityWeek) At Black Hat USA Wednesday in Las Vegas, a trio of researchers from The Georgia Institute of Technology demonstrated how to abuse USB functionality of Apple iPhones to compromise the device. Using a Beagleboard, the researchers built a proof-of-concept malicious charger they refer to as Mactans
Buy an ad, own a browser botnet (Threatpost) Researchers have figured out how to leverage the reach of online advertising networks to distribute javascript of their choosing, creating the equivalent of a botnet of ad impressions capable of crashing underlying webservers or distributing malware on a massive scale for pennies on the dollar
Video: Hacking home automation systems (SC Magazine) In this video, David Bryan and Daniel Crowley, researchers at Trustwave's SpiderLabs, discuss their recent work with home automation systems with SC Magazine's executive editor, Dan Kaplan, at this year's Black Hat conference in Las Vegas. The major vulnerabilities found in the technology could allow attackers to take control things like door locks, thermostats, and garage doors in homes
Spy phones: How everyday hackers can turn your devices against you (VentureBeat) You downloaded an app from a third-party marketplace you don't trust. Sure, the app might function like it's supposed to, but it might have just turned your phone into a stealthy spy machine
Polish CERT Polska and NASK Pull the Plug On .pl TLD On Malicious Registrar, Domain Silver (CircleID) Today we publish an overview of domains registered through Domain Silver, Inc, a registrar operating in the .pl domain. This Registrar started operating in May 2012. Since that time, the CERT Polska team started to observe a large increase in the amount of malicious domains registered in .pl and to receive many complaints concerning domains registered through Domain Silver
Canonical reveals details of Ubuntu Forums hack (Help Net Security) Canonical has published a postmortem on the recent Ubuntu Forums hack and has shared a blow-by-blow account on how the attack was carried out. At 16:58 UTC on 14 July 2013, the attacker
Cyber Trends
Most health data breaches malicious, not accidental (FierceHealthIT) The number of health data breaches is growing with the push to electronic records, and increasingly thieves are targeting their attacks, according to data security firm ID Experts
The Most Capable Cyber Attackers Are Less Likely to Attack (SIGNAL Online) The most damaging cyber attacks possible are among the least likely to happen, because the powers capable of undertaking them are unlikely to launch them, according to an expert with the Office of the Director of National Intelligence (ODNI). Sean Kanuck, national intelligence officer for cyber issues at the National Intelligence Council, ODNI, told the audience at the second day of the AFCEA Global Intelligence Forum in the National Press Club in Washington, D.C., that cyber attack capability need not translate to immediate threat
Email from social media safest, financial services riskiest (CSO) Study finds one in seven emails from financial brands poses risks to consumers. Email from social media brands is some of the safest on the Internet, while electronic posts from financial services brands is some of the riskiest, says a report released this week by an email security provider
APWG Report: Phishing Attack Numbers Drop 20 Percent from Historical Highs (BusinessWire) Cybergangs alter infrastructure abuse techniques in shift to crimeware-based attacks. The APWG reports in its Q1 2013 Phishing Activity Trends Report that phishing attack frequency declined 20 percent from Q4 2012 to Q1 2013, due to a precipitous drop in virtual server phishing attacks. Statistics indicate that phishing levels are returning to the levels seen prior to the record-setting highs of 2012
Cyber attackers turning toward states (Statescoop) s the federal government improves its cyber defenses, nefarious actors are turning their attention toward state and local governments, said Center for Internet Security CEO William Pelgin
The dying art of computer viruses (Graham Cluely) I think the first time I ever heard someone talk seriously about computer viruses was in 1988
CIO concerns over security obstructing enterprise mobility (Help Net Security) Despite a clear understanding of the benefits and drivers from the end-user community, companies have not mobilized many applications - and a large percentage are delaying full deployment of enterprise apps on mobile devices due to concerns around cost, complexity and security
Marketplace
Is Huawei wiring Africa for surveillance? (Quartz) The Chinese telecoms firm is offering exceptionally competitive prices, generous financing, and running networks to win local governments' trust
Huawei technology and price advantages to outweigh US cyber concerns in long-term (Financial Times) Despite fresh allegations that Chinese telecom companies such as Huawei Technologies and ZTE pose a major cybersecurity threat to the US, market pressures may allow the companies to establish a strong presence in the world's largest economy over time. "Eventually the Chinese makers will be present in the US market," Chris Simkins, the CEO of Chain Security, who previously represented the Department of Justice (DoJ) on the Committee on Foreign Investment in the United States (CFIUS), told PaRR
Intelligence Agencies Banned Lenovo PCs After Chinese Acquisition (Dark Reading) U.S. feared use of PCs built by Lenovo posed security threat long before spying concerns over Huaweii and ZTE surfaced
PRISM: No Reason to Shy Away From U.S. Cloud Providers (BWW) PRISM has brought many European and Asian companies to believe that using a U.S.-based cloud services provider is insecure and will allow the U.S. Government to snoop on their data. As a result, some are predicting a slow-down in cloud adoption, specifically the uptake of cloud services based in the United States. Unfortunately, the victim in this scenario is the enterprise themselves, since many of the leading and most in-demand cloud SaaS offerings are based in North America. But with the proper security solutions in place, enterprises can confidently adopt cloud services based anywhere in the world while keeping their data resident and within their full control, thereby eliminating concerns about 3rd parties accessing their sensitive corporate information
Silicon Valley Could Become Collateral Damage In NSA Leaks (Forbes) Much of the reaction to recent revelations of NSA surveillance activity has focused on the privacy implications for U.S. and foreign citizens and possible ramifications for U.S. international relations and national security. Yet the disclosure of the PRISM program – which the NSA used to collect e-mails, social media content, and other Internet traffic – set off a firestorm that threatens to engulf Silicon Valley boardrooms as well. American tech companies face two significant challenges. First, they could soon be caught in a Catch-22 arising out of contradictory legal systems on either side of the Atlantic. Second, they face the prospect of a declining market share as portions of their customer base seek out providers deemed to be less exploitable by U.S. intelligence agencies
No, Edward Snowden's Leaks Weren't Due to Sequestration (Atlantic Wire) A small detail from a Washington Post interview with Edward Snowden's father has been seized upon by political observers today. Lon Snowden disputes his son's claim that he went to work for Booz Allen Hamilton in order to steal more documents. Instead, Lon blames a scarier opponent: government sequestration, which cost his son his prior contract position
DOE NNSA IARC Receives CNDSP Authorization (Herald Online) OnPoint Consulting, Inc., today announced that the Department of Energy's (DOE) National Nuclear Security Administration's (NNSA) Information Assurance Response Center (IARC) became only the second federal civilian, non-Department of Defense (DOD), provider to receive a Computer Network Defense Services Provider (CNDSP) authorization
KEYW Announces the Formation of Hexis Cyber Solutions, Inc. (Virtual-Strategy Magazine) Hexis Cyber Solutions comprises KEYW's "Project G" organization and Sensage, Inc., acquired by KEYW in October 2012. Chris Fedde has been named
Dr. Sameer Bhalotra, Former White House Cybersecurity Executive, Joins Invincea Board of Advisors (ProductivityApps) Distinguished Authority on Nation's Highest Priority Cybersecurity Initiatives Brings Public Sector and Critical Infrastructure Expertise to Recognized Endpoint Security Pioneer
Cyber Security Firm to Call Howard County Home (WBAL) AirPatrol Corporation announced Wednesday the company will expand and relocate its corporate headquarters to Howard County. The company said they chose the location after looking for a new home in both Maryland and Virginia
Siemens CEO goes quietly, but revenue's still lurching (FierceMedicalDevices) Despite reports he planned to kick, scream and break a thing or two, Siemens ($SI) CEO Peter Löscher has agreed to peacefully step down from the German giant, leaving CFO Joe Kaeser to clean up months of lagging sales and alarming stock performances
Dell Board Denies Michael Dell Buyout Vote Rule Change (CRN) The Dell (NSDQ:Dell) special committee overseeing the shareholder vote that will determine the fate of the computer maker shot down Michael Dell's proposal to raise his buyout offer by 10 cents contingent on a change in the way shareholder votes would be counted
Products, Services, and Solutions
Accuvant launches Threat Intelligence Briefing service (Help Net Security) Accuvant announced at Black Hat USA 2013 the availability of its new Threat Intelligence Briefing (TIB) service. Delivered by Accuvant LABS research experts, the service gives organizations
Validian 1st–To–Market With Major Cyber Security Breakthrough for Mobile Device Privacy (ITBusiness) Validian Corp. (OTCQB:VLDI), the first-to-market with the next generation of cyber security technology for the management and protection of digital information, data and assets, today announced a major cyber security breakthrough for protecting the storage, access and transfer of Digital Information on mobile devices
Rabid trolls prompt Twitter to promise 'Report Abuse' button on all messages (Naked Security) Following the savagery unleashed by trolls on a UK journalist who managed to get a woman's face onto a banknote, then further bomb threats to other female journalists, and the subsequent outrage and promised boycott of Twitter for making it so hard to report abuse, the platform didn't have much
Cylance PrivateDetect takes a unique approach to security (CSO) Stuart McClure, and the rest of the team at Cylance have been in the trenches of cyber security for years. They know what works, and they've been in a position
Introducing ThreatWatch: A New Way to Explore the Evolving World of Cyber Dangers (Defense One) Welcome to the World Wide Web of threats. Nextgov's new feature, ThreatWatch, is a regularly updated catalog of data breaches successfully striking every sector of the globe, as reported by journalists, researchers and the victims themselves
Android tablet gives rare glimpse at North Korean tech (NetworkWorld) Thanks to a tourist, a detailed look at one of North Korea's latest tablet computers is possible. An Android tablet brought back from North Korea by a tourist has provided a glimpse at some of the restrictions placed on IT users in the famously secretive country
Novell ZENworks Mobile Management 2.7 (SC Magazine) ZENworks Mobile Management from Novell allows for full control of a mobile device from both a security and policy perspective. With this product deployed, administrators can easily mange a device's security settings, such as requiring a PIN or password on the device, as well as device encryption and file-sharing requirements. Along with security settings, administrators can also pass down policy for specific or groups of devices that include browser access or use of device functions, such as the camera or Bluetooth connection
HackShield bags prevent physical and digital intrusion (Help Net Security) Das Keyboard launched highly secure, radio frequency blocking bags. Known as HackShield bags, the company's one-of-a-kind backpack and messenger bags empower professionals on-the-go with a new level of protection against physical and digital intrusion
Web application scanner and vulnerability assessment tool launched in beta (SC Magazine) A cloud-based web application security assessment tool has been launched by High-Tech Bridge
Kaspersky to end hosted services this month (SC Magazine) In an email to SC Magazine, Kaspersky confirmed its announcement from August 2012 that it was ceasing to sell Kaspersky Hosted Security (KHS), but that all existing customers would be fully supported through to August 2013
Facebook turns on secure browsing by default (ComputerWorld) Facebook turned on a key security feature by default on Wednesday that scrambles data sent by users to the company's servers, following similar moves in recent years by Web services such as Google and Twitter
SSH Communications Security Unveils General Availability Of SSH Risk Assessor Tool (Dark Reading) Free tool provides users with a clear report on risk and compliance exposures in Secure Shell environments. Black Hat USA Booth #437 -- SSH Communications Security, known the world over as the inventor of the ubiquitous Secure Shell and SFTP protocols, today announced the general availability of SSH Risk Assessor (SRA), a free tool that provides users with a clear report on risk and compliance exposures in Secure Shell environments. SRA is now available for download on SSH's website
Malware Beware: Introducing The Spyder Initiative (ThreatTrack) One of the biggest challenges cybersecurity professionals face these days is reducing the lag time from identification to remediation for malware that infects a corporate network. That's about to change. ThreatTrack Security will showcase the next big advance in security technology, The Spyder Initiative, at this week's Black Hat USA 2013 conference in Las Vegas. Through The Spyder Initiative, ThreatTrack Security will develop a new breed of cyber-defense solutions that will help users identify and eliminate any threat targeting their network, including APTs and Zero-day threats evading traditional signature-based detection
Technologies, Techniques, and Standards
How To: Setting Up Google's Two-Factor Authentication In Linux (Internet Storm Center) We can already use two-step authentication in GMail with the Google Authenticator Android app. The idea is creating a secret key shared between the service and the Android app, so every 30 seconds we get a randomly generated token on Android that must be provided to login in addition to the password. That token is only valid in that 30s time frame
IT system security authorization more dynamic than in past, says NIST official (FierceGovIT) Perceptions about the information technology security authorization process as being archaic and bureaucratic aren't keeping pace with a shift to a risk-based approach being fostered by the National Institute of Standards and Technology and the Defense Department, said Ron Ross, a NIST cybersecurity official
World War B: Surviving a Global Business Breach Event (SecurityWeek) Data breaches are not designed for your convenience. They don't stick to one state or one regulator. They don't even stick to one country. There are HR files from the US, customer files from Canada, and marketing campaigns full of personally identifiable information from the UK. One breach can trigger laws around the globe, each with different responses
5 ways to be invisible online (MarketWatch) The NSA is reportedly tracking your activities on the Internet. Online, everyone's an open book -- but now the National Security Agency is also keeping tabs on consumers' activities online. Users increasingly wear their hearts on their screens, but security experts say there are ways to minimize your Internet footprint
Hide and go seek, not hide and go tweak (THe Honeynet Project) On July 31, 2013, Jason Geffner of CrowdStrike will discuss a new tool called "Tortilla" that allows incident responders and computer security researchers to hide behind the ToR network as they poke and prod malicious software infrastructure. Were I there (hint, hint, to those who are ;) I would ask Jason this question: What things should I not do while using Tortilla, and why shouldn't I do them? I know Jason and respect his technical skills, but if he and CrowdStrike don't have a good answer, that will say a lot about our field's collective ability to reason about actions along the Active Response Continuum
Is social sign-on the next step for online security? (SC Magazine) Han van Meegeren was born at the end of the 19th Century in the Netherlands and went on to become one of the world's most prolific art forgers. A talented artist, the story goes that van Meegeren turned to fraud when he became frustrated by critics' failure to lavish praise on his own original works. He decided to use his undoubted technical skill as a painter to create a new work in the style of Vermeer and pass it off as a hitherto-undiscovered original
Inside the Black Hat 2013 Wi-Fi Network (eSecurity Planet) What does it take to provide connectivity to one of the most hostile network environments on Earth? In this exclusive, eSecurity Planet finds out
Design and Innovation
What IT security pros can learn from a Dyson vacuum cleaner! (IS Decisions) How can IT security professionals better succeed when engaging others on information security and awareness? Bruce Hallas is the creator and founder of The Analogies Project and the owner and principle consultant at Marmalade Box Ltd
Academia
UD offering credit monitoring following cyber breach (NewsWorks) University of Delaware is urging current and former employees to be on the lookout for information regarding the steps they need to take following a major cyber security breech earlier this month
Switch in college focus pays off for cybersecurity contest winner (Baltimore Sun) Anne Arundel student excels in Homeland Security-sponsored camp
Legislation, Policy, and Regulation
NSA Chief Speaks At Black Hat (NPR) After Bradley Manning and Edward Snowden and Congressional pushback, NSA Chief Gen. Keith Alexander speaks to Black Hat, a conference for security professionals.
The gusher of news on the NSA and surveillance keeps coming. This week, one of the keenest audiences is in Las Vegas: hackers and security geeks and execs. Lots of them. At the conferences called Black Hat and DEF CON, where hacker T-shirts say "Hack Naked" and "Stay Anonymous."
General Alexander heckled during Black Hat keynote address (CSO) General Keith Alexander, Director of the National Security Agency, kept a cool head as he was heckled by attendees during his keynote address at the Black Hat security conference in Las Vegas on Wednesday
NSA Director's Defense of PRISM, Surveillance Programs at Black Hat Draws Mixed Reviews (SecurityWeek) A year ago, NSA Director Gen. Keith Alexander spoke at the DefCon security conference and made a direct appeal for the hacker community to help secure the Web. Twelve months and several leaks of classified data later, the feds were discouraged from attending DefCon, and Alexander took the stage at Black Hat USA to defend his agency's electronic surveillance programs
NSA chief asks a skeptical crowd of hackers to help agency do its job (Washington Post) It doesn't get much stranger than this, even in Vegas. Gen. Keith B. Alexander, director of the National Security Agency, stood in front of a standing-room-only crowd Wednesday, selling the idea of government surveillance programs
NSA Chief Justifies US Spying To Black Hat Hackers And Security Professionals (Forbes) Speaking to an audience of hackers and security professionals at the annual Black Hat conference in Las Vegas, National Security Agency Director General Keith Alexander defended the PRISM program and the NSA's cache of phone metadata as necessary to protect the lives of American citizens and overseas allies. He also said that the programs are tightly monitored and that - in addition to technical tools that limit what analysts can access -- all analysts are audited to be sure they have justification for any data they access
NSA Director Heckled At Conference As He Asks For Security Community's Understanding (Forbes) When NSA Director Keith Alexander appeared at the Las Vegas security conference Black Hat Wednesday morning, he hoped to mend the NSA's reputation in the eyes of thousands of the conference's hackers and security professionals. It didn't go exactly as planned
Franken aims to reveal scope of NSA surveillance (The Hill) Sen. Al Franken (D-Minn.) plans to introduce legislation on Thursday that would force the National Security Agency to reveal how many people in the United States it has spied on
Senators push for changes in NSA data collection (CSO) Lawmakers focus on adding transparency to the agency's phone records collection program. Several U.S. senators will push for changes in the way the National Security Agency collects the telephone records of millions of U.S. residents, with lawmakers saying they will focus on making the NSA program more transparent to the public
Glenn Greenwald Gives Civil Libertarians Momentum Despite Canceled Hearing (PolicyMic) Guardian columnist Glenn Greenwald was set to testify on Capitol Hill Wednesday for a hearing on the National Security Agency's controversial surveillance program, first revealed to the public by whistleblower Edward Snowden. The informal hearing was put on hold after President Obama scheduled a meeting with the Democratic lawmakers involved
The Fourth Amendment under assault (FiercMobileIT) The Fourth Amendment, which guarantees the right of U.S. citizens against "unreasonable searches and seizures," is under assault from the courts, law enforcement and the intelligence community
NSA acknowledges its '3 hops' get millions of Americans' phone records, not just terrorists (Washington Post) President Barack Obama's national security team acknowledged for the first time Wednesday that, when investigating one suspected terrorist, it can read and store the phone records of millions of Americans
NSA Hype Machine (Foreign Policy) Is Edward Snowden exposing the NSA -- or just buying its sales pitch? Maybe Edward Snowden wasn't such a blowhard, after all. When the NSA leaker insisted that low-level employees like him could spy on just about anyone, administration officials and NSA supporters in Congress were quick to call him an embellisher, if not an outright liar. But a pair of classified disclosures on Wednesday -- one authorized by government officials, the other most certainly not -- lend some credence to Snowden's claims. They don't clearly demonstrate that Snowden was right, but they don't exactly rule out that an analyst could use the powerful tool to spy on Americans without proper authority
Surveillance, Legal Access Could Weaken Internet Infrastructure (Threatpost) The pervasive bulk surveillance performed by the NSA and other government agencies that's been revealed in recent weeks relies on court orders, as do other kinds of legal access operations, such as wiretapping or lawful intercepts. Those orders are shrouded in secrecy and the organizations that receive them often comply immediately without asking any questions, a response that can sometimes be a mistake
Debate Over Extent Of Government Data Reach Will Last Years, Say Privacy Experts (CRN) Businesses have the ability to push back on law enforcement's secret demands for large swaths of user data or risk opening costly weaknesses that could provide terrorists and other criminals a way to conduct serious damage, according to a group of expert panelists studying the issue of privacy and civil liberties
It's Culture, Not Technology, That Inhibits Cyber Information Sharing (SIGNAL Online) Resistance to change may prove to be the biggest impediment to information sharing among the cyber intelligence community. Both government and industry must break out of their existing paradigms to share cyber intelligence that may prove vital to national security
How did low-level employees access national secrets? (CBS News) "It frightened me when I was running counterintelligence because I predicted this kind of disaster," said Joel Brenner, who was the National Security Agency's
NIST cybersecurity framework bill voted out of Senate committee (FierceGovIT) The Senate Commerce, Science and Transportation Committee passed by voice vote July 31 a cybersecurity bill that would codify into law the private sector cybersecurity framework called for by President Obama
New [UAE] Cyber Crimes Legislation (Mondaq) The UAE has introduced new federal legislation directed towards combating increased cyber criminal activity experienced in the region. This article addresses specific issues which arise out of this new law and what impact those issues might have on the insurance cover available
Litigation, Investigation, and Law Enforcement
Is the Snowden case Manning, Part II? Not quite, experts say (CNN) Bradley Manning and Edward Snowden are two American men in their 20s. They're both fascinated by -- and adept at -- computer use and held jobs that gave them access to some of their country's most secret and sensitive intelligence
US military judge to hear arguments in Manning sentencing (Reuters) The trial of Bradley Manning, the U.S. soldier found guilty on 19 counts of handing over classified data to WikiLeaks
Edward Snowden Has Left the Airport (National Journal) The NSA leaker has reportedly been granted a one-year asylum in Russia
Intelligence Official Says No One Fired over Snowden (NewsMax) The deputy director of the U.S. National Security Agency said on Wednesday that no one had been fired and no one had offered to resign over former security contractor Edward Snowden's ability to take large amounts of classified data from agency computers
ODNI declassifies bulk metadata reports (FiercGovIT) The head of the intelligence community declassified Wednesday two redacted reports to Congress on bulk metadata collection and a primary court order for metadata collection under the Patriot Act
NASA Navigates Space Better than it Navigates the Cloud (Infosecurity Magazine) An audit of NASA's progress in adopting cloud-computing technologies has revealed that the space agency's current use of cloud falls short of expectations in IT governance and risk management
Malware alert while seeking child abuse images at work earns US man 5 years in jail (Naked Security) A five-year jail term has been handed to a US man found downloading and watching child abuse imagery at work. Authorities were apparently alerted to his activities when his company computer was hit by a malware attack
