The CyberWire Daily Briefing for 8.5.2013

New York: the latest from SINET's Innovation Summit

LOGIIC — Linking the Oil and Gas Industry to Improve Cyber Security (DHS S&T) The LOGIIC (Linking the Oil and Gas Industry to Improve Cybersecurity) program is an ongoing collaboration of oil and natural gas companies and the U.S. Department of Homeland Security, Science and Technology Directorate. LOGIIC was formed in 2004 to facilitate cooperative research, development, testing, and evaluation procedures to improve cybersecurity in petroleum industry digital control systems. The program undertakes collaborative research and development projects to improve the level of cybersecurity in critical systems of interest to the oil and natural gas sector. The program objective is to promote the interests of the sector while maintaining impartiality, the independence of the participants, and vendor neutrality. After a successful first project, the LOGIIC consortium was formally established as a collaboration between DHS, the Automation Federation, and five of the major oil and gas companies

Security and Software Engineering Research Center (SERC) The mission of the Security and Software Engineering Research Center is to conduct a program of applied and basic research on software security, system security, and software engineering problems in order to enable technology gains in member organizations

About TCIPG: Trustworthy Cyber Infrastructure for the Power Grid (TCIPG) Researchers from the University of Illinois at Urbana-Champaign, Dartmouth College, Cornell University, the University of California at Davis, and Washington State University are together addressing the challenge of how to protect the nation's power grid by significantly improving the way the power grid infrastructure is built, making it more secure, reliable, and safe. This Department of Energy-funded project, with support from the Department of Homeland Security, recognizes that today's quality of life depends on the continuous functioning of the nation's electric power infrastructure, which in turn depends on the health of an underlying computing and communication network infrastructure that is at serious risk from both malicious cyber attacks and accidental failures. These risks may come from cyber hackers who gain access to control networks or create denial of service attacks on the networks themselves, or from accidental causes, such as natural disasters or operator errors

Written testimony of S&T Under Secretary Dr. Tara O'Toole for a Senate Committee on Homeland Security and Governmental Affairs hearing titled "The Department of Homeland Security at 10 Years: Harnessing Science and Technology to Protect National Security and Enhance Government Efficiency" (Department of Homeland Security) My testimony will describe why the development and adoption of new technologies are critical to meeting current and future demands of homeland security missions; how S&T knowledge products, technical analysis, laboratories, and university-based Centers of Excellence contribute to the effectiveness and efficiency of DHS operations; and how S&T is improving the capabilities and safety of first responders

Chinese Hacking Team Caught Taking Over Decoy Water Plant (Technology Review) A hacking group accused of being operated by the Chinese army now seems to be going after industrial control systems. Although security vulnerabilities in industrial systems have been well documented, evidence that people are actively trying to exploit them has been scarce. A Chinese hacking group accused this February of being tied to the Chinese army was caught last December infiltrating a decoy water control system for a U.S. municipality, a researcher revealed on Wednesday

Cyber Attacks, Threats, and Vulnerabilities

Indira Gandhi International Airport, Indian Customs Website Hacked by Pakistani Hacker (Hack Read) A Pakistani hacker going with the handle of Hasnain Haxor has hacked and defaced the official website of Indian Customs at Indira Gandhi Int Airport Mumbai, India and a website of Tamilnadu State Agricultural Marketing Board . Hacker managed to root the whole server with 800+ Indian sites on along with Indian Customs site which is a very high profile one that contains sensitive information on its server

Intercepted al Qaeda message led to shuttering embassies, consulates (CNN) An intercepted message among senior al Qaeda operatives in the last several days raised alarm bells that led to the closing of embassies and consulates Sunday across the Middle East and North Africa, CNN has learned

Thailand's Police Nursing College Website Hacked, Login Details Leaked by Pak Cyber Eaglez (Hack Read) A Pakistani hacker going with the handle of Sizzling Soul from Pak Cyber Eaglez has hacked in to the official website of Thai Police Nursing College, as a result the site has been defaced, database along with login details of site's admin and 64 college's staff have been leaked online. The reason for targeting Thai website remains unknown as the deface page only contains a note, claiming that site has been

Feds are Suspects in New Malware That Attacks Tor Anonymity (Wired) Security researchers tonight are poring over a piece of malicious software that takes advantage of a Firefox security vulnerability to identify some users of the privacy-protecting Tor anonymity network

Firefox Zero-Day Used in Child Porn Hunt? (Krebs on Security) A claimed zero-day vulnerability in Firefox 17 has some users of the latest Mozilla Firefox browser (Firefox 22) shrugging their shoulders. Indeed, for now it

Child porn bust takes half of Tor's hidden sites offline (The Verge) A man in Ireland believed to be behind Freedom Hosting, the biggest service provider for sites on the encrypted Tor network, is awaiting extradition on child pornography charges, reports The Independent. Denied bail until there is a ruling on the extradition request, Eric Eoin Marques has been described by an FBI special agent as "the largest facilitator of child porn on the planet," and faces up to 30 years in prison if tried in the US

Hidden Services, Current Events, and Freedom Hosting (Tor) Around midnight on August 4th we were notified by a few people that a large number of hidden service addresses have disappeared from the Tor Network. There are a variety of rumors about a hosting company for hidden services: that it is suddenly offline, has been breached, or attackers have placed a javascript exploit on their web site

Android one-click Google authentication method puts users, businesses at risk (CSO) A researcher has released a proof-of-concept Android app that can steal 'weblogin' authentication tokens for Google accounts

Google Warns: Don't Insert Pages Into Users' Browser History (Search Engine Watch) Google has warned webmasters many times about the dangers of using manipulative or deceptive behavior. Now Google has issued a special warning regarding a practice where a website inserts new pages into a user's browsing history

Beijing hacking combine exposed (USA Today) A Beijing-based hacking combine that has broken into hundreds of company networks — and continues to do so with near impunity — may have a tougher go of it from here on out. That's because here at the Black Hat Conference researchers from DellSecureWorks disclosed evidence that helps fingerprint the handy work of one of the top two cyber espionage gangs operating out of China

New 'Hacked shells as a service' empowers cybercriminals with access to high page rank-ed Web sites (Webroot Threat Blog) Whether it's abusing the 'Long Tail' of the Web by systematically and efficiently exploiting tens of thousands of legitimate Web sites, or the quest to compromise few, but high-trafficked, high page rank empowered Web sites, compromised shell accounts are an inseparable part of the cybercrime ecosystem

Fake 'iPhone Picture Snapshot Message' themed emails lead to malware (Webroot Threat Blog) We've just intercepted a currently circulating malicious spam campaign that's attempting to trick iPhone owners into thinking that they've received a 'picture snapshot message'. Once users execute the malicious attachment, their PCs automatically join the botnet operated by the cybercriminal/gang of cybercriminals, whose activities we've been closely monitoring over the last couple of months

Earn £8,000 a MONTH with bogus apps from Russian malware factories (The Register) DIY SMS-scam kits anyone can use - even your grandparents! Just 10 professionally run malware-making workshops in Russia are responsible for 30 per cent of the Trojans, spyware and other nasties infecting smartphones globally. That's according to a study by mobile security outfit Lookout

Millions of Kwikset Smartkey Locks Vulnerable to Hacking, Say Researchers (Wired) Millions of Kwikset smartkey locks used to secure residences can easily be thwarted with a screwdriver or wire, despite the company's claims that special features of the lock prevent anything other than a key from being inserted in the lock

NSA's XKeyscore is a global dragnet for vulnerable systems (Naked Security) XKeyscore doesn't just turn somebody's internet life inside out. It's also a bloodhound for sniffing out vulnerable system

Rodecap — a New Spam Bot in Town (Infosecurity Magazine) Just over a week ago Symantec published a note on a new spam bot that it was and is currently investigating. A Swiss researcher, however, was already on it, having trapped the first instance in his sandnet two days earlier

Colin Powell's Emails Tapped by Hacker (Infosecurity Magazine) The hacker known as Guccifer, who makes a habit of hacking the rich and powerful – the 'Illuminati' in his own terms – has struck again, this time forcing former US Secretary of State Colin Powell to deny an affair

DDoS myths and misconceptions (FierceCIO: TechWatch) In our Internet-connected age, DDoS attacks are a perennial problem that regularly make it into the news. In an attempt to better understand this topic, we posed a number of questions to Dan Holden, director of security research for Arbor Networks

Major malware businesses discovered in Russia act like Silicon Valley startups (VentureBeat) Lookout Mobile has found 10 Russian companies running what could be the most mature mobile malware businesses yet — and they operate just like a Silicon Valley startup

Picking up the SLAAC with Sudden Six (Neohapsis Labs) The people that run The Internet have been clamoring for years for increased adoption of IPv6, the next generation Internet Protocol. Modern operating systems, such as Windows 8 and Mac OS X, come out of the box ready and willing to use IPv6, but most networks still have only IPv4. This is a problem because the administrators of those networks may not be expecting any IPv6 activity and only have IPv4 monitoring and defenses in place

Banks' Improved Security Defenses Disarm Cyber Attackers (American Banker) The latest cyberattacks launched by the Al Qassam Cyber Fighters — the group that has taken credit for most of the devastating distributed-denial-of-service attacks on banks that began last fall — have been for the most part deflected by banks this time around. This fourth round of attacks, threatened by the Al Qassam hacktivist group on Pastebin July 23 ("Well, misters! The break's over and it's now time to pay off," the group wrote), are said to have targeted four banks, including Regions Bank and JPMorgan Chase

Privacy Hamstrings Protection of White House Staff Gmail (Nextgov) The recent hijacking of White House employees' personal email accounts underscores the difficulty guarding national security when private lives and government roles intersect

Security Patches, Mitigations, and Software Updates

Twitter introduces 'in–tweet' abuse button after complaints (ComputerWorld) U.K. police are investigating eight allegations of abuse made via Twitter

Cyber Trends

There's a tide of unstructured data coming — start swimming (The Register) Whether you prefer to define the known size of our planet's total digital universe in petabytes or even zettabytes, we can all agree the collective weight of data production is spiralling ever upwards

The App Economy: A Ticking Cybersecurity Timebomb (Forbes) In the last 5 years we have seen the quick rise of the App Economy, which spans mobile apps downloaded on smartphones/tablets and web apps used directly on browsers. Annual revenues in the mobile based App Economy are estimated at $72 billion today and are expected to double to $151 billion by 2017. The web based App Economy is far bigger. This App Economy has permeated our everyday lives and has changed the way we interact with each other, purchase virtual goods, order physical retail goods and entertain ourselves. Netflix, Twitter, Zynga, Facebook etc. are only a few of well-known companies behind this wave. The App Economy is also a great equalizer. Hundreds of other startups like Uber, WhatsApp, Fab, Instagram (acquired by Facebook) and Square are equally important to our everyday lives. New distribution channels and new cloud infrastructure technologies enable even smaller startups with a handful of employees and little funding to reach millions of users in a few months and effectively compete with bigger established players like Google, Electronic Arts and HBO. Unfortunately, security is an afterthought to many of these smaller startups, which are focused on product innovation and user acquisition

We Need a Dialogue on Cyber Security (Radio World) Like it or not, cyber security will continue to be a fact of life for broadcasters and ... The Department of Homeland Security, along with the Department of Energy

'Inadequate' security concerns for cloud service buyers (iTWire) "The Cloud Security Alliance (CSA), for example, has a Cloud Controls Matrix in the form of a spreadsheet containing control objectives deemed by participants

SaaS providers must be more transparent about security (Computer Business Review) The Cloud Security Alliance (CSA) has a cloud controls matrix in the form of a spreadsheet containing control objectives deemed by participants in the CSA to be

Here's how much data Google & Facebook have stored about you (VentureBeat) Online privacy is an oxymoron these days. If you are connected to a network, chances are that someone, somewhere has the capability to keep track of you

Marketplace

Working as an ethical hacker (Help Net Security) The term "ethical hacker" as it used today is, if you ask me, somewhat imprecise. After all, a hacker in it for the money could be said to follow his or her own moral compass on what is right and what is wrong - the only difference is that those ethics aren't compatible with those held by most people

If governments ban China-based Lenovo, should companies? (CSO) U.S., several other countries have banned computers from Lenovo after finding backdoors in hardware in firmware, report says

NSA revelations could hurt collaboration with 'betrayed' hackers (Chicago Tribune) The U.S. government's efforts to recruit talented hackers could suffer from the recent revelations about its vast domestic surveillance programs, as many private researchers express disillusionment with the National Security Agency. Though hackers tend to be anti-establishment by nature, the NSA and other intelligence agencies had made major inroads in recent years in hiring some of the best and brightest, and paying for information on software flaws that help them gain access to target computers and phones

IDRBT sets up centre for information assurance (Business Standard) Reserve Bank of India (RBI) governor D Subbarao today launched Centre for Information Assurance and Management at the Institute for Development and

Michael Dell Sweetens Buyout Bid (InformationWeek) Dell CEO and partners raise their bid to take the company private. In exchange, they've secured a change in the voting rules and increased their likelihood of sealing the deal

Booz Allen Hamilton Wins Major Integrated Cyber Operations Pillar Contract to Support C4ISR, Cybersecurity Programs (BusinessWire) Booz Allen Hamilton today announced it has now won four of the Full and Open Pillar contracts involving a range of full system lifecycle support activities for the Space and Naval Warfare Systems Center Atlantic (SCC Atlantic). Most recently, the firm won a contract with a total ceiling of nearly $900 million to support the integrated cybersecurity and Command, Control, Communications, Computers, Intelligence, Surveillance, Reconnaissance (C4ISR) operations of the Space and Naval Warfare Systems Center Atlantic (SCC Atlantic). The competitive ID/IQ contract has an initial one-year period of performance, with four, one-year options that could extend the work through July 2018. SSC Atlantic, an engineering command within the U.S. Navy, delivers adaptive and secure solutions to many naval, joint and national agencies. Under the terms of the MAC, Booz Allen will support a broad array of cybersecurity, information assurance and information operations projects for the Navy, Marine Corps, and other components of the Department of Defense

How To Hire A Spy. Meet the Man Who Offered Edward Snowden A Job (LinkedIn) Now he is out of his Moscow airport hideaway, protected by a year-long political asylum, Edward Snowden, the contractor accused by America of spying, will have no problem finding work. He has already been offered a job by VKontakte, Russia's most popular social networking site

Huawei Lashes Out at ex-CIA Chief Over Spying Claims (SecurityWeek) Chinese telecoms giant Huawei has hit back at allegations by a former CIA chief that the company spies for Beijing, labeling them "defamatory" and "baseless". Michael Hayden, who headed the Central Intelligence Agency in 2006-09, was quoted two weeks ago as saying China was engaged in unrestricted espionage against the West and that Huawei would have shared information with state agencies

Cisco Systems, Inc. (CSCO), Sourcefire, Inc. (FIRE), Radware Ltd. (RDWR): Tech Giant Bulking Up For Cyber War (Insider Monkey) Cisco Systems, Inc. (NASDAQ:CSCO) just announced plans to buy Sourcefire, Inc. (NASDAQ:FIRE) for $2.7 billion. The move helps bulk the networking giant up in an area where it had started to fall behind. Are Radware Ltd. (NASDAQ:RDWR) and Fortinet Inc (NASDAQ:FTNT) the next targets

Cyber security company FireEye files for a $175 million IPO (NASDAQ) FireEye, which provides malware protection software to enterprises, filed on Friday with the SEC to raise up to $175 million in an initial public offering

AirPatrol Corporation Relocates Corporate Headquarters To Howard County, Maryland (Area Development) An innovator in cyber security, providing location-based mobile and wireless enterprise solutions to both private businesses and government agencies, AirPatrol Corporation, plans to relocate and expand its corporate headquarters to that St. John Properties' Maple Lawn Corporate Center park in Howard County, Maryland

Trend Micro Launches New Intern Program, Offers Cyber Security Scholarships, Performance Incentives (PRNewswire) Trend Micro Incorporated (TYO: 4704; TSE: 4704), a global leader in security software and solutions, announced a new global internship program today. Inspired by CEO Eva Chen, the initiative will offer a behind the scenes look at a global pioneer in security and privacy technology. These interns – known as, "TrendTerns" – will also have the opportunity to earn academic scholarships and other performance incentives while gaining real-world experience

Products, Services, and Solutions

Researchers Develop DIY System to Detect Malware on Mobile Phones (Wired) Researchers have developed a do-it-yourself system for detecting malware on mobile phones using a femtocell that allows users to monitor their own mobile traffic

The InsideIQ™ Building Automation Alliance Partners with Cylance, Inc. to Promote ICS Security Services for Buildings (PR Newswire) The InsideIQ Building Automation Alliance, an international alliance of independent building automation contractors, has partnered with cybersecurity provider Cylance, Inc. in order for member firms to offer high level building automation system (BAS) security practices, training and certification for their customers. By joining forces with Cylance, a global leader in cybersecurity technology and services, InsideIQ member firms can provide customers using industrial control systems (ICS) and BASs with security assessments, incident response, best practices in cybersecurity services and on-site training

Self-encrypted 2.5" SATA SSD from Microsemi (Help Net Security) Microsemi announced a secure, half-terabyte SSD for mobile video surveillance operations, SANs and other high capacity storage applications requiring superior real-time data protection

Technologies, Techniques, and Standards

Cutting Through The Mystique Of Testing The Mainframe (Dark Reading) Mainframes are not enterprise dinosaurs—they're modern systems running mission critical data that must be scrutinized as much as any other part of the IT infrastructure. Las Vegas – While most IT security teams tend to lump mainframe systems into the category of legacy systems unnecessary or impossible to scrutinize during regular audits, that couldn't be farther from the truth, says a researcher at Black Hat USA who this week released a number of free tools meant to help bridge the understanding gap between mainframe experts and security professionals

Federal, state, city officials practice mock cyber attack (KHON2) "It's important to learn about computer security and to see what could happen so quickly I think people don't realize what computer security is about," U.S. Pacific

AhnLab Receives High Scores in NSS Labs' Breach Detection System Product Analysis (Consumer Electronics Net) AhnLab, a leading provider of information security products and services for enterprise and government organizations, today announced that the AhnLab Malware Defense System (MDS) appliance has scored in the 90 percentile and above, in all major facets, of the July "Breach Detection System Product Analysis" report conducted by NSS Labs

Understanding incident response: 5 tips to make IR work for you (CSO) Incident response is a plan that evolves over time to keep your organization best prepared against likely threats. CSO talked to industry experts at Black Hat about the ups and downs of IR, and how to develop a plan that's right for you

Research and Development

Think twice about that burner: your phone's signal has a unique digital fingerprint (The Verge) Researchers at the Dresden University of Technology have developed a surprisingly reliable tracking method that can remotely identify individual GSM phones based on unique characteristics in their radio signals, even if the phone's identification codes or SIM cards have been swapped. In lab tests using "real-world conditions," the researchers were able to identify 13 different mobile phones 97.62% of the time. That's an impressive initial result, and the team behind the work says that it's just the first step in this type of remote mobile forensics

Hacking tool analyses Twitter to make phishing emails more realistic (Information Age) Ethical hackers from SpiderLabs use natural language processing to help impersonate individuals in phishing attacks

Legislation, Policy, and Regulation

Not even Congress knows how the NSA works (The Verge) While the president and the intelligence community cling to "Congressional oversight" as a justficiation for the pervasive intelligence-gathering programs in place within the US, members of Congress theselves are saying that they don't have the information they need to exercise real authority over the NSA. A recent report in The Guardian quotes two House members, Morgan Griffith (R-VA) and Alan Grayson (D-FL), who have both requested information about the agency and its programs from the House Intelligence Committee, only to be rebuffed

Graham says NSA proving its worth (Politico) Lindsey Graham expressed support on Sunday for the National Security Agency and its programs and their contribution to the intelligence gathered on the

Lawmakers deny being stonewalled on National Security Agency information (The Hill) Senior members of Congress denied a report on Sunday that the National Security Agency (NSA) is refusing to turn over basic information about its operations to lawmakers. Speaking on Sunday talk shows, Sen. Saxby Chambliss (R-Ga.) and Reps. Peter King (R-N.Y.) and Dutch Ruppersberger (D-Md.) argued that the NSA has been responsive to congressional requests for information

Amash: Snowden a whistle-blower, 'old us what we need to know' (Fox News) Rep. Justin Amash said Sunday that Edward Snowden is a whistle-blower — adding to the debate about whether the American should be considered a traitor for leaking National Security Agency secrets while working as a federal contractor. Amash, R-Mich., acknowledged that Congress was aware that U.S. intelligence agents could gather information on Americans under the post-9/11 Patriot Act but not to the extent Snowden revealed this spring

Intelligence director James Clapper should resign for 'lying to Congress,' say lawmakers (The Verge) Shortly after an attempt to curtail the NSA's surveillance capabilities failed narrowly in Congress, two of the measure's co-sponsors have said that Director of National Intelligence James Clapper should still be held accountable for giving false testimony. "[Clapper] was here in March and unambiguously lied to Congress," Rep. Thomas Massie (R-KY) told Democracy Now. "And I believe he was under oath. And it really sets a bad precedent for the whole organization to let him keep his post. I think he should be relieved of his post for lying to Congress." Rep. John Conyers (D-MI) said that he "completely" agreed. "We're now at the point of having a more honest disclosure of what's going on in our intelligence community, which we now find was very deliberately ignoring parts of the law that they knew perfectly well they were violating," he said

Damaged Goods (Slate) How the NSA traveled down a slippery slope—and how it can regain Americans' trust. "When you see something that is technically sweet, you go ahead and do it, and you argue about what to do about it after you've had your technical success." –J. Robert Oppenheimer. The father of the atomic bomb made this observation in 1951 while testifying before a panel that wound up revoking his security clearance as a result of reports that he'd opposed going ahead with the much more powerful hydrogen bomb. He was explaining to the panel why he'd initially supported the H-bomb project—it was so "technically sweet" that "the moral and ethical and political issues" dropped by the wayside

True national security needs true oversight (Columbus Ledger-Enquirer) Jim Sensenbrenner, R-Wis., author of the Patriot Act. He told National Security Agency officials at a House Judiciary Committee meeting last month that "unless

Other Agencies Clamor for Data NSA Compiles (New York Times) The National Security Agency's dominant role as the nation's spy warehouse has spurred frequent tensions and turf fights with other federal

Why Wasn't the NSA Prepared? (The Atlantic) But General Alexander also heads Cyber Command, the new 4000-strong military force responsible for protecting military networks, and attacking the networks

King George's Revenge: Is Britain Using Our Tax Money to Spy on Us? (Government Executive) Weeks ago, I worried that surveillance officials in allied countries might conspire with one another to spy on one another's citizens. The NSA is restricted in the spying it can do on Americans. But it can spy on the British all it wants. And there's no law that prevents the Brits from spying on Americans. What if spy agencies in the U.S., Britain, New Zealand, Canada, and Australia were all in cahoots? Today there is even greater reason to be worried about that possibility

Verizon, BT, and Vodafone reportedly assisted UK's massive Tempora spying effort (The Verge) In June, The Guardian reported that Tempora — the surveillance program that is essentially the UK's version of PRISM — was tapping into undersea fiber-optic lines to access massive amounts of emails, social-media posts, video chats, and other online data. On Friday, the German newspaper Süddeutsche published a new story that claims Britain's Government Communications Headquarters (GCHQ) executed the spying program with the help of Verizon, BT, and Vodafone. In the process, these telecommunications companies and others have reportedly given the UK intelligence agency unrestricted access to the data that passes through their fiber-optic cables

Germany ends information sharing pact with Britain, United States (CNN) Germany has canceled a decades-old agreement on information-sharing with Britain and the United States, in the wake of controversy sparked by American leaker Edward Snowden's disclosures about mass surveillance programs

Filters 'not a silver bullet' that will stop perverts, warns Interpol chief (The Independent) An Irish policeman who heads up Interpol's fight against paedophiles and child traffickers has backed the Government's decision not to block online pornography in homes

Jimbo Wales: ISP smut blocking systems simply 'ridiculous' (The Register) Wikipedia man labels filters 'technologically incompetent'. Wikipedia founder Jimmy Wales has attacked "absolutely ridiculous" network-level porn-blocking systems that are being introduced by the UK's biggest telcos over the course of the next few months

Litigation, Investigation, and Law Enforcement

Cybercriminals are doing a better job than the companies they target (Help Net Security) What can you learn from reading the exploits of the most successful hacking ring ever brought to justice? Recently, the US Attorney's Office in NJ unsealed their indictment against a mostly Russian—one American co-conspirator was also named—gang of cybercriminals who are alleged to have snatched over 160 million credit card numbers resulting in more than $300 million in losses over seven years.

US federal agencies want NSA data to help nab copyright violators (Quartz) The primary defense of the necessity of the US National Security Agency's broad spying powers—including, apparently, recording pretty much everything anyone anywhere is doing on the internet—is that its activities are necessary to protect against terrorists and violent criminals. But a report published Saturday in the New York Times indicates that federal agencies with far more mundane mandates are unable to resist the lure of the NSA's vast trove of data

Former spy: U.S. gains with Snowden in Russia (CNN) It was with a heavy heart that I heard Edward Snowden has been granted, and apparently accepted, temporary asylum in Russia for one year. Short of locking him naked in solitary confinement as an example to other leakers, as was done to Bradley Manning, Russia is exactly where the American intelligence community wants Snowden

Lynne Curry: Snowden, the NSA, you and your company (Anchorage Daily News) From the outside, the national Snowden-National Security Agency story seems far from your reality and your employer's decision-making. But is it? Edward Snowden, the 29-year-old defense contractor, Booz Allen Hamilton employee and source behind the biggest intelligence leak in the NSA's history, ranks as one of America's most notable whistleblowers

Data thieves have ways and means to elude justice (Wilkes Barre Times-Leader) Four days later, the company hired respected forensics firm Mandiant to conduct an investigation. Police in Maryland Heights, Mo., where Schnuck Markets Inc

Latvia blocking extradition of Gozi writer thanks to "disproportionate" US sentencing (Naked Security) One of three men indicted in the US earlier this year in connection with the Gozi banking trojan remains in his native Latvia, after courts there twice blocked US requests for extradition

Grand Jury Probes Firm That Cleared Snowden (Wall Street Journal) A federal grand jury is investigating whether the company that conducted the last security background check on National Security Agency

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

Security in Government (SIG) (Canberra, Australia, Aug 12 - 14, 2013) The 25th annual Security in Government (SIG) conference is to be held from 12-14 August 2013 at the National Convention Centre in Canberra. Assistant Director for the National Security Resilience Policy Division in the Attorney General's Department, Robyn Devin said the SIG conference attracted protective security professionals from both the public and private sector.

2013 Cyber Security Division Transition to Practice (TTP) Technology Demonstration for Investors, Integrators, and IT Companies (I3) — West (San Jose, California, USA, Aug 22, 2013) This event will feature eight innovative cybersecurity technologies that have been developed at the Department of Energy National Laboratories and have the potential to strengthen and organization's cybersecurity posture. During this event cybersecurity professionals and technology investors from private industry will learn about these new technologies through presentations, demonstrations, and discussions with the research teams that produced these technologies. In addition, attendees will have an opportunity to schedule a private one-on-one discussion with the Researcher to discuss opportunities for commercializing the technologies and areas of interest to drive further cybersecurity research. Registration closes August 12.

International Conference on Cyber Security (New York, New York, USA, Aug 5 - 8, 2013) The Federal Bureau of Investigation and Fordham University will host the fourth International Conference on Cyber Security (ICCS 2013) on August 5 - 8, 2013 in New York City. ICCS, the White Hat Summit, is an unparalleled opportunity for global leaders in cyber threat analysis, operations and law enforcement to coordinate their efforts to create a more secure world. With the number of cyber threats escalating worldwide, the need for comprehensive security analysis, assessment, and actions has never been greater. Join those working on the front-lines of secure cyber networks at ICCS for the opportunity to learn useful knowledge and share critical intelligence on issues shaping the future of cyber security.

SINET Innovation Summit (New York, New York, USA, Aug 6, 2013) The purpose of the Innovation Summit is to reinvigorate public private partnership efforts and increase relationships between industry, government and academia that fosters sharing of information and collaboration on mutual Cybersecurity research projects.

3rd Annual Cyber Security Training Forum (Colorado Springs, Colorado, USA, Aug 6 - 7, 2013) The Information Systems Security Association (ISSA) - Colorado Springs Chapter and FBC, Inc. will once again host the 3rd Annual Cyber Security Training Forum (CSTF). Formerly known as the Cyber Security Training Conference, CSTF is set to convene from Tuesday August 6, 2013 to Wednesday, August 7, 2013 at the DoubleTree by Hilton, Colorado Springs, Colorado.CSTF 2013 will bring together cyber experts from the DoD, federal government, business, research, and academia to address: the latest DoD and government cyber policies, remediation strategies and best practices, the growing impact, and evolution, of cyber threats and how to continue to protect and defend the Global Information Grid (GIG), mobility strategies, cloud & virtualization advancements, and emerging technologies. This will be accomplished through a number of in-depth cyber sessions, hands on live demonstrations, the yearly cyber challenge and government and industry exhibits. Don't miss this educational, and cost effective, cyber event in Colorado Springs, CO..

AFCEA Tinker AFB Information Technology & Cyber Security Expo (Oklahoma City, Oklahoma, USA, Aug 8, 2013) Commercial vendors are invited to Tinker Air Force Base on Thursday, August 8th to exchange information and provide products demonstrations to the military and civilian personnel on base. IT and Information Assurance professionals from Tinker AFB are looking forward learning about the latest cyber security trends and best practices, networking with peers, and sharing remediation strategies.

AIAA Aviation 2013 (Los Angeles, California, USA, Aug 12 - 14, 2013) Leading cybersecurity experts will speak at AIAA AVIATION 2013, being held August 12-14 at the Hyatt Regency Century Plaza, Los Angeles, Calif. Hosted by the American Institute of Aeronautics and Astronautics, the conference will address the risk of the evolving cyber threats to the world's $2.2 trillion commercial aviation enterprise.

A Cloud Computing Introduction for Manager (Columbia, Maryland, Sioux Falls, Aug 13, 2013) Cloud computing is becoming popular. More and more Technical Managers and Project Managers will be interacting with cloud computing, either developing clouds, using clouds, or selecting among cloud and non-cloud alternatives to accomplish their projects. This talk provides a brief and basic introduction to cloud computing, what managers need to know about cloud computing, what are some of the myths, and what they need to ask about cloud computing from service providers. The presentation will include selected questions specific to managers associated with government projects and security risks of cloud computing. This non-technical presentation will help managers understand cloud basics and how to ask better questions when a cloud becomes part of your project. Dr. Patrick Allen of Johns Hopkins University Applied Physics Lab will be the presenter.

Resilience Week 201 (San Francisco, California, USA, Aug 13 - 15, 2013) 2013 Resilience Week brings together colleagues across government, academia and industry to facilitate an exchange of ideas dedicated to promising research in resilient systems that will protect cyber-physical infrastructures from unexpected and malicious threats - securing our way of life. Four different symposia will be offered: Resilient Control Systems, Resilient Cyber Systems, Resilient Cognitive Systems, and Resilient Communication Systems. Keynotes will be provided by numerous leading subject matter experts - from agencies including: NSA, DARPA, Sandia National Laboratory, and Office of the Assistant Secretary of Defense for Research and Engineering.

Kirtland AFB/Sandia/DOE Cyber Security Seminar & IT Expo (Albuquerque, New Mexico, USA, Aug 15, 2013) This expo is designed to stimulate exchanges of information between industry partners and Kirtland AFB Information Management Officers', Information Technology personnel, Contracting Officers' as well as end-users, developers, scientists, researchers and project managers in the areas of cyber security and information technology.

National SCADA Conference (Melbourne, Victoria, Australia, Aug 15 - 16, 2013) The 12th Annual National SCADA Conference, Australia's largest and longest running SCADA conference, will bring together many of the luminaries of the Australian and International SCADA community to evaluate and find solutions for the increasing demands of the SCADA environment. The theme for 2013 will be delivering intelligence and improved performance to SCADA networks. The SCADA conference program will deliver fantastic first-hand knowledge from leading international and local SCADA experts with a great mix of burning SCADA issues, case studies, security and real world implementations together with practical advice. The networking opportunities provided coupled with the largest SCADA exhibition in the Southern Hemisphere ensure the National SCADA Conference is a must attend event for Australia's and New Zealand's SCADA Communit.

First International Conference on Cyber-Physical Systems, Networks, and Application (Taipei, Taiwan, Aug 19 - 20, 2013) CPSNA 2013 will focus on core challenges of cyber-physical systems. Given a tight integration of computation and the physical world, cyber-physical systems must compose robust systems, networks, and applications built upon predictable, analyzable, and certifiable models and abstractions. CPSNA 2013 will serve as a forum to discuss new ideas for such core challenges of cyber-physical systems.

SANS Thailand 201 (Bangkok, Thailand, Aug 19 - 31, 2013) SANS hands-on advanced Information Security training is coming to Thailand this August! SANS is bringing our Web App Penetration Testing course to the Crowne Plaza Bangkok Lumpini Park in Bangkok, Thailand.

Defense Logistics Agency Tech Expo (Fort Belvoir, Virginia, USA, Aug 20, 2013) Industry exhibitors are invited to showcase and discuss the latest information services and technology to the personnel at the McNamara HQ Complex.

Human Cyber Forensics Forum (Washington, DC, USA, Aug 21, 2013) This forum brings together subject matter experts to discover and share new means of recognizing the human indicators related to cyber intrusions, and the evolution of these human indicators in the coming decades.