The CyberWire Daily Briefing for 12.5.2013

Washington, DC: the latest from the SINET Showcase

SINET: Startups Push IT Security's Envelope (Dark Reading) SINET conference flags 16 security startups to watch, but they are just the tip of the iceberg, experts say

Lookingglass Cyber Solutions to Present at 2013 SINET Showcase (4-Traders) Recognized by Security Innovation Network for Unique Contributions to Cybersecurity Industry

Nok Nok Labs Selected as SINET 16 Innovator to Present at 2013 SINET Showcase (Thomasnet) Nok Nok Labs, a company founded to transform online authentication for modern computing, today announced that it has been selected as a SINET 16 Innovator

PerspecSys CEO David Canellos Demonstrates How to Achieve Public Cloud Benefits with Private Cloud Security and Control at SINET Showcase 2013 (BusienssWire) While a new year is around the corner, some old problems remain when it comes to cloud adoption. Data security persists as a chief concern for most businesses and government entities — along with residency and privacy — prompting many to settle for hybrid or private cloud options

Cylance Selected as SINET 16 Innovator (SYS-CON) Cylance, Inc., a global provider of disruptive cybersecurity products and services that reinvent the way organizations prevent advanced threats, today announced that it has been selected as a SINET 16 Innovator

Damballa Selected as SINET 16 Innovator for Upcoming 2013 SINET Showcase (BusinessWire) Damballa, the experts in advanced threat protection, today announced that it will present its recently released Failsafe 5.2 technology during the SINET Showcase 2013 to be held December 4-5, 2013 at the National Press Club in Washington D.C. The Security Innovation Network™ (SINET) is an organization focused on advancing Cybersecurity innovation through public-private collaboration

Appthority Selected as SINET 16 Innovator to Present at 2013 SINET Showcase (PRNewswire) Appthority, the leader in App Risk Management, today announced that it has been selected as a SINET 16 Innovator. Appthority will present its innovative all-in-one App Risk Management service during the SINET Showcase 2013

Triumfant Selected as SINET 16 Innovator to Present at 2013 SINET Showcase (PRNewswire) Triumfant, Inc., creator of patented software that automatically discovers, analyzes and remediates advanced malware attacks on the endpoint, today announced that it has been selected as a SINET 16 Innovator

Agari Selected as SINET 16 Innovator to Present at 2013 SINET Showcase (MarketWired) Agari, the leading provider of a cloud-based email security solution that identifies and prevents phishing attacks and cyber fraud, today announced that it has been selected as a SINET 16 Innovator

ThreatMetrix Selected as SINET 16 Innovator to Present at 2013 SINET Showcase (PRWeb) ThreatMetrix™, the fastest-growing provider of integrated cybercrime prevention solutions, today announced that it has been selected as a Security Innovation Network™ (SINET) 16 Innovator

Mobile System 7 Selected as a 2013 SINET 16 Innovator (PRWeb) Mobile System 7, Inc., a leader in enterprise mobile security, today announced that it has been selected as a SINET 16 Innovator. The Security Innovation Network (SINET) advances cyber security innovation and enables collaboration between the public and private sectors to defeat global cyber threats

Bromium Selected as 2013 SINET 16 Innovator (Bromium) Security Innovation Network selects Bromium LAVA™ as one of the industry's 16 most innovative security products of 2013

Endgame Selected as 2013 SINET 16 Innovator (Endgame) Endgame was selected by The Security Innovation Network (SINET) as a top emerging technology company from a pool of 115 applicants and will present at the 2013 SINET Showcase in Washington, DC on December 5

PhishMe selected as one of the 2013 SINET 16 Innovators (PhishMe) PhishMe is excited to be named to the 2013 SINET 16 Innovators and to present at the 2013 SINET showcase in Washington DC

Pindrop Security Selected as SINET 16 Innovator to Present at 2013 SINET Showcase (Pindrop Security) Pindrop Security, the pioneer in phone fraud prevention and call center authentication for banks and enterprise call centers, and the Security Innovation Network™ (SINET), an organization focused on advancing Cybersecurity innovation through public-private collaboration, today announced that Pindrop Security has been selected as a SINET 16 Innovator. Pindrop will present its Phoneprinting™ technology during the SINET Showcase 2013 to be held December 4-5, 2013 at the National Press Club in Washington, DC

Sonatype Selected as SINET 16 Innovator to Present at 2013 SINET (Sonatype) Security Innovation Network Selects Top 16 Entrepreneurs from 115 Entries to Share Emerging Cybersecurity Solutions

About ZanttZ, Inc. (ZanttZ) ZanttZ's solutions will detect and mitigate the large number of new sophisticated attacks on enterprise and government networks; in particular, we are targeting Advanced Persistent Threats (APTs) that have proven extremely vexing for existing security solutions—many of them are not caught today despite organizations spending over $9B on overall network security

Cyber Attacks, Threats, and Vulnerabilities

Someone's Been Siphoning Data Through a Huge Security Hole in the Internet (Wired) Earlier this year, researchers say, someone mysteriously hijacked internet traffic headed to government agencies, corporate offices and other recipients in the U.S. and elsewhere and redirected it to Belarus and Iceland, before sending it on its way to its legitimate

Bypass of Internet Explorer Cross–Site Scripting Filter Possible (Threatpost) A weakness has been discovered in the reflective cross-site scripting filter present in Internet Explorer since IE 8 that could enable an attacker to trick the browser into executing malicious code as trusted. The problem going forward is twofold: everything occurring in the bypass method is accepted as part of the official HTML standard going back at least 15 years; and Microsoft said it will not work on a fix for the flaw

Commercial Windows–based compromised Web shells management application spotted in the wild (Webroot Threat Blog) For years, whenever I needed a fresh sample of pharmaceutical scams, I always sampled the Web sites of major educational institutions, where a thriving ecosystem relying on compromised Web shells, continues to enjoy the high page ranks of the affected Web sites for blackhat SEO (search engine optimization) purposes. How are cybercriminals managing these campaigns? What type of tools and tactics do they use? In a cybercrime ecosystem that has logically migrated to Web-based platforms for a variety of reasons over the last couple of years, there are still those who're keeping it old school, by releasing host-based DIY cybercrime-friendly

JPMorgan warns 465,000 card users on data loss after cyber attack (Reuters) JPMorgan Chase & Co is warning some 465,000 holders of prepaid cash cards issued by the bank that their personal information may have been accessed by hackers who attacked its network in July

RBS Admits Decades of Underinvestment After Latest IT Glitch (AFP via SecurityWeek) The head of Royal Bank of Scotland admitted on Tuesday that it had failed to invest in its IT systems "for decades", after a glitch left customers of the state-rescued lender unable to access cash for three hours

Spoofed MasterCard warning delivers malware (Help Net Security) A worrisome email notifying users that their MasterCard debit card has been blocked just when most of them are trying to do their holiday shopping has been landing in inboxes around the world, warns MXLab

Fake Amazon "Order Status" emails deliver malware (Help Net Security) It comes as no surprise that as holiday shoppers begin to flood the internet looking for deals, the bad guys will be right behind them hoping to swoop in on an unsuspecting victim. Fake invoice scams are year round, but they are so much more effective during that time of year that most everyone is actually expecting packages in the mail from their online purchases

Dexter and Project Hook Break the Bank (Arbor ASERT Threat Intelligence) An active Point of Sale (PoS) compromise campaign designed to steal credit and debit card data using the Dexter and Project Hook malware has been detected. Indicators of compromise will be provided for mitigation and detection purposes. Prior to the publication of this Threat Intelligence document, members of the FSISAC, major Credit Card vendors and law enforcement were notified

Facebook, Google, Twitter Users Among the Nearly 2 Million Accounts Hacked by Botnets (The Wire) Cyber security firm Trustwave announced on Tuesday that nearly 2 million online accounts have been hacked, compromising the privacy of user of Facebook, Yahoo, Google, Twitter, and payroll service company ADP in nearly 100 countries

Today's "massive" password breach: a Webroot perspective (Webroot Threat Blog) First, this is not a blog about a big corporate breach, or a massive new discovery. Rather, the researchers at Trustwave gained access to a botnet controller interface (the C&C element of a botnet) known as Pony and revealed the data within. Not surprisingly, as the vast majority of botnets target user credentials, this controller had a good deal of data related to passwords. While 2 million passwords might seem like a lot, it is really a drop in the bucket compared to many recent breaches. Think about Adobe who lost a minimum of 28 million, but is rumored to

Children's tablets vulnerable to hacking, experts warn (The Telegraph) Cyber security firm says children's tablets are insecure and put security at risk

Adobe and Java vulnerabilities leave Windows open for exploitation (CNET) Two-thirds of affected Windows systems are victims of malware that exploit Adobe Reader, Adobe Flash, and Java

The Dinosaur in the Room (Dark Reading) Support for Windows XP ends in April 2014; the implications extend beyond the workstation

Researchers demonstrate low-cost NFC eavesdropping device (FierceMobileIT) Near-field communication (NFC) aims to revolutionize mobile commerce, but just how close the technology is to becoming a widely adopted reality is unclear. Many questions remain around standards and security. Gartner for one noted that the technology has been slow to gain traction

Anatomy Of An Electronic Health Record Zero–Day (Dark Reading) How a dangerous security flaw discovered in one of the most pervasive electronic medical record platforms in the U.S. was found and quietly fixed

The HealthCare.gov rabbit hole: Where's the data going? (Info World) HealthCare.gov's front-end problems for users has led to back-end issues with insurers as well

DDoS Attacks originated from thousands of .EDU and .GOV WordPress Blogs (The Hacker News) In a recent cyber attack on a Forum site, thousands of outdated legitimate WordPress blogs were abused to perform DDOS attacks using previously known vulnerabilities. After analyzing the Log file from the victim's server, we have noticed many Wordpress CMS based educational (.EDU) and Government (.GOV) websites from where the attack was originated

Microsoft: Anonymous hacktivists DDoSed us? Really? (THe Register) So Anonymous, we didn't even register their, ahem, 'total domain takedown'

Syrian Electronic Army hacks Time over Person of the Year poll (SC Magazine) The Syrian Electronic Army (SEA) stamped its avian emblem on the Twitter account belonging to Time on Friday

Election Database Shielded After Cyber Attack in Honduras (Prensa Latina) David Matamoros, head of Honduran Election Supreme Court (TSE), said that his database was shielded after the cybernetic attack carried out on Monday against TSE and other 13 institutions of this country

Worksop: Cyber fraudsters swiped £250,000 from company account (Worksop Guardian) A business which lost almost £250,000 after a cyber attack is back from the brink of closure, potentially saving 100 jobs

Does Black Friday and Cyber Monday extend to the black market? (CSO) Research about the underground provides evidence and the specifics necessary for credible stories

Festive season security myth: "If there are no links in an email, it can't be a phish." (Naked Security) The festive season is a good time to make sure your friends and family haven't fallen in with falsehoods when it comes to computer security. Paul Ducklin examines an email with no clickable links that was nevertheless a classic phish

Online Christmas shoppers advised: Avoid WiFi, use SSL (GMA Network) Avoid online shopping via Wi-Fi and shop at sites with SSL if possible. These were the pieces of advice from security vendor Bitdefender, which said the holidays may bring an increase in online offers

Cyber Trends

How Mobile Security Lags BYOD (InformationWeek) IT is turbo charging BYOD efforts, but mobile security practices aren't keeping up with the growing risk in several critical areas

Booz Allen Says Cyber Attacks Are the "New Normal" for Financial Services Industry (Hispanic Business) Five years ago, questions directed at boards of directors and senior executives at financial services firms on the toughest risk management issues might have resulted in responses like "liquidity risk," "regulatory compliance," or "bad debt." Few, if any, would have mentioned cyber security. Today, the same question generates a much different answer

9 out of 10 consumers would rather companies didn't store their info (Help Net Security) In the wake of data scandals, consumer trust in data security has hit a ten year low, with over 1 in 10 suffering from a data loss, Fujitsu's data research report has revealed. Only 9% of consumers have any faith in organizations to protect their data, with nearly a third (29%) recording a decline in trust over the last year

2014 is the year of the internet of things—no, seriously, we mean it this time (Quartz) It's fair to say that more people have heard of the "internet of things" than have experienced it. There is breathless press coverage of the phenomenon

Can we predict the future of security? (CSO) Can we predict the future of security? Yes and no, says UK security futurist David Lacey, speaking at the first Australian CSO Perspectives Roadshow in Canberra

Who is practicing security best practice? (CSO) There is a term in the Information Security field that tries my patience in no uncertain terms. That term is, "best practice". People love to bandy this about in discussions about their security program, widget or what have you. But, who is actually practicing

Shadow IT is undermining your security (CSO) A new study from McAfee illustrates the ways shadow IT–employees going rogue and using unauthorized devices or apps–is affecting security

Marketplace

Huawei's UK–based cyber–security centre set to get British approval: Report (NDTV Gadgets) Britain will clear Chinese telecoms equipment firm Huawei to run a UK-based cyber security centre if it agrees to tighter rules to allay spying and hacking fears, a person familiar with the matter said on Wednesday

Huawei pours £10m into UK university research (TechWorld) University of Cambridge and University of Southampton set to get a funding boost from the Chinese firm

Despite U.S. fears of China spying and hacking, U.K. cuddles up to Huawei (ZDNet) British PM David Cameron was forced to defend the move, despite U.S. senators' belief that the Chinese networking giant is spying on the rest of the world

Internet Firms Step Up Efforts to Stop Spying (The New York Times) When Marissa Mayer, Yahoo's chief executive, recently announced the company's biggest security overhaul in more than a decade, she did not exactly receive a standing ovation

America Goes to War With Itself Over Data Security (Bloomberg BusinessWeek) I know a handful of well-connected, cynical security folks in Silicon Valley who continue to maintain pretty much the same take on Edward Snowden. They say they believe he was paid off by China or Russia to leak a series of security documents and change the tenor of U.S. political discourse

Do Antivirus Companies Whitelist NSA Malware? (InformationWeek) Microsoft, Symantec, and McAfee fail to respond to a transparency plea from leading privacy and security experts

Microsoft likens NSA snooping to hacking by the Chinese government (ComputerWorld) Microsoft has come out with the harshest criticism by any tech company of National Security Agency (NSA) snooping, and likened it to the kinds of hacking carried out by top teams of hackers backed by the Chinese government. Is the criticism real, or an attempt to divert attention from Microsoft's past cooperation with intelligence agencies

How Web mail providers leave door open for NSA surveillance (CNET) Protecting users' e-mail privacy from the National Security Agency and other intelligence services means using encryption. But with the exception of Google, few companies do everything they can

Palantir Seeks $9 Billion Valuation In New Round As CEO Alex Karp Nears Billionaire Mark (Forbes) With Twitter going public last month, investors may be looking for the next Silicon Valley company to assume the mantle of the region's next hot tech firm

A private Dell makes sense. Doesn't mean it'll work, though (Channel Register) Sound economics doesn't equal business nous

Procera wins orders at two LatAm fixed–line operators (Telecompaper) Global internet intelligence company Procera Networks has received first-time orders for its PacketLogic Intelligent Policy Enforcement (IPE) systems from two Tier 1 fixed line operators in Latin America, including one cable MSO and one DSL operator

Mark Gerencser Joins Board at Sotera Defense Solutions (GovConWire) Mark Gerencser, a former executive vice president at Booz Allen Hamilton (NYSE: BAH) and current chairman of PC services firm Cyberspa, has joined the board of directors at Sotera Defense Solutions

Amit Mital Appointed as Symantec's New Chief Technology Officer (Softpedia) Enlarge picture Former corporate vice president of Microsoft's Startup Business Group, Amit Mital, has been appointed as Symantec's new chief technology officer (CTO). Mital takes the place of Steve Trilling, who will take up an operational senior leadership role

Products, Services, and Solutions

Security gate for open doors (Help Net Security) Internet crime has evolved to a full blown cyber-war, using internet servers as virtual soldiers to take down critical network infrastructures, or to steal information. While most security products focus on backdoors and security holes, hackers "go in" like normal users. The reason is obvious: It's simple, and many systems are not protected adequately

Nessus Helps Harden FireEye Appliances (Satisnet) A new compliance plugin for FireEye appliances is now available for Nessus customers. This new functionality allows you to audit FireEye instances against best-practice hardening guidelines, ensuring that the security appliance and the data contained therein is secure

Is Docker the Future of Virtualization Security? (eSecurity Planet) Virtualization is now the norm in data centers around the world, and with it have come new security challenges. Most virtualization is deployed today with a traditional hypervisor virtual machine

Technologies, Techniques, and Standards

ENISA provides new guide for mitigating ICS attacks (Help Net Security) The EU's cyber security agency ENISA has provided a new manual for better mitigating attacks on Industrial Control Systems (ICS), supporting vital industrial processes primarily in the area of critical information infrastructure (such as the energy and chemical transportation industries) where sufficient knowledge is often lacking

Security certification training programs: How to choose the right one (SearchSecurity) What are the most reliable ways to determine whether a certification training organization is solid? Lots of people who fail a security certification test unfairly give the trainer a bad review, so it's hard to use reviews to know which trainers to choose. What's your advice

Understanding the PCI DSS prioritized approach to compliance (SearchSecurity) I read recently that a PCI DSS official recommended a "risk-based approach" to PCI that allows for partial compliance by meeting the compliance obligations in stages. Is there such a thing, and is it a practical way to achieve PCI compliance

Grasping the nuances of PCI certification levels for service providers (SearchSecurity) I have a PCI compliance question for you, specifically around the level of certification required in a certain scenario. If a service provider has a number of customers with each one handling fewer than 6 million transactions, but as a whole (customers combined) the service provider is handling more than 12 million transactions, should that service provider have Level 1 PCI certification

Passwords aren't going away any time soon (Help Net Security) Despite nearly weekly revelations of new password database breaches, a survey by Authentify suggests that passwords will remain the primary protection for online accounts

Here Are The 20 Worst Passwords You Can Use (Business Insider) Two recent events illustrate that most people do not protect their data very well online

Browser hygiene tips for making online shopping safer (Help Net Security) The fuller schedules and longer to-do lists of the holiday season often mean multi-tasking and stress. And busy, distracted people doing their holiday shopping online may be more susceptible to falling into malware traps that attempt to steal credit card info or banking passwords

Updated Standards Part 1 — ISO 27001 (Internet Storm Center) Information Security Management Systems was released in September and slipped into use relatively quietly. The standard replaces ISO27001:2005. Whilst the overall intent of the standard remains the same and when you peel back the changes, most of the old standard remains. There are however enough changes that may require some effort to address

Updated Standards Part 2 — PCI DSS/PA DSS (Internet Storm Center) Last week the PCI Security Standards Council released the next versions of the Payment Card Industry Data Security Standard (PCI DSS) and the Payment Application Data Security Standard (PA DSS), version v3.0. The standards are updated over a three year cycle and are valid from the date of release. The previous version can still be used for certifcation until 31 December 2014 giving companies plenty of time to adjust to the new requirements

Using The Human Perimeter To Detect Outside Attacks (Dark Reading) The right training and reporting mechanisms can make it possible to crowdsource human observation of suspicious emails and potential attacks for faster detection

Design and Innovation

Beep Beep! UK lays out plans to embrace driverless cars (TNW) The government has said that it wants the UK to be a hotbed of research into driverless cars, and has announced a prize fund of up to £10 million for a town or city to join Milton Keynes in becoming a test center for the new unmanned automotive technology

The UK is going to rewrite all the rules to allow driverless cars to thrive (Quartz) This morning, the British government announced an infrastructure plan that, somewhat optimistically, projects £375 billion ($612 billion) of spending by public and private entities over the next decade or so (the timeline is fairly vague)

Research and Development

DARPA's online games crowdsource software security (Defense Systems) Flaws in commercial software can cause serious problems if cyberattackers take advantage of them with their increasingly sophisticated bag of tricks

CWU math students calculate what no mathematician has before (Yakima Herald) Math students at Central Washington University say they've broken a 37-year-old world record for the largest weird number

Big Data Faces Big Challenges With Encryption (SecurityWeek) Data encryption is one the keys to data protection, but big data brings its own set of complications to cryptography

Academia

Hackers meet professor's challenge to pen test his online world (CSO) An NYU professor challenged a team of hackers to break into his online world. They did, but it wasnt easy or cheap

Legislation, Policy, and Regulation

Digital spy tech could face same regulation as weapons in international treaty (The Verge) A consortium of international governments are working on an update to a nearly 18-year-old agreement in order to limit the export of various electronics security technologies

U.S. and Allies Mull Export Licenses for Network Equipment and Software (Export Law Blog) We can only assume that exporters have been very bad this year because they may find a big lump of coal left in their export reform stocking by jolly old St. Nick or, perhaps more accurately, Good King Wassenaar

Belgian PM accuses US of violation of public firm's integrity (Voice of Russia) Earlier this autumn the NSA spy scandal broke out in Belgium. The German Der Spiegel reported a cyber attack against the Belgian telecommunication company Belgacom

Sweden's Intelligence Agency Spies on Russian Leaders, Hands Over Data to the NSA (Softpedia) The NSA doesn't work alone, that much has been clear over the past months with all the leaks getting published. Well, this time around, it seems that Sweden is the one that aided the NSA in its effort to get information on Russian leaders. The country's intelligence agency, the FRA, spied on Russian officials and shared the data with its American counterpart

U.S. spy agency gathers data on cellphone locations globally — report (Reuters) The National Security Agency gathers nearly 5 billion records a day on the location of mobile telephones worldwide, including those of some Americans, the Washington Post reported on Wednesday, citing sources including documents obtained by former NSA contractor Edward Snowden

NSA leaks: UK blocks crucial espionage talks between US and Europe (The Guardian) First talks to soothe transatlantic tensions to be restricted to data privacy and Prism programme after Britain and Sweden's veto

It's Becoming Clear That The NSA's Nightmare Has Just Begun (Business Insider) The National Security Agency and its allies face a long, painful drip of classified documents relating to their intelligence operations

Cameron Says China Should Be More Open About Cyber-spying, but Guardian Should be Less (InfoSec Magazine) In Beijing, UK Prime Minister David Cameron has challenged the Chinese Government to discuss its industrial-scale cyber-espionage, while in London the Guardian is under legal threat for disclosing GCHQ's own efforts in this area

China Restricts Banks' Use of Bitcoin (The New York Times) China moved on Thursday to restrict its banks from using Bitcoin as currency, citing concerns about money laundering and a threat to financial stability

Bitcoin $10,000? (Forbes) Not only is the cyber currency less secure than it has ever been, speculation coupled with Asia's entrance into the market just make bitcoin the "best investment" around for those who love huge spreads between bid and ask prices, and a whole lot of drama. Ladies and gentleman, we have a Bitcoin bubble

Poorer countries need privacy laws as they adopt new technologies (The Guardian) Unctad report says global shift towards cloud computing requires data protection laws to be put in place to ensure security

NSA sez NO to prez: Spooks ban Obama from using iPhones (The Register) Leader of the free world now chained to 'super-secure' BlackBerry One

Obama can't have an iPhone for 'security reasons'? Shenanigans declared. (Venture Beat) At a gathering to talk about his new health care legislation, President Barack Obama casually revealed to the crowd that he wasn't allowed to upgrade his smartphone to Apple's iPhone due to "security reasons"

Litigation, Investigation, and Law Enforcement

Edward Snowden stole up to 20,000 Aussie files (The Australian) MORE than 15,000 secret Australian intelligence reports may have been stolen by rogue US National Security Agency contractor Edward Snowden in what the Coalition government is now describing as the most damaging blow dealt to Australian intelligence in the nation's history

It's all about cryptography as Rusbridger faces parliament (The Conversation) Despite all the political blustering that has surrounded Guardian editor Alan Rusbridger's meeting with the House of Commons Home Affairs Committee this week, the real story in the Snowden affair is cryptography

When Edward Snowden came to India to learn 'hacking' (Financial Express) A thin, bespectacled man seemingly fastened to his chair. His eyes glued to his desktop, the only visible movement being of his fingers running through the keyboard, the only sound audible being the scrolling of the mouse. The man who never asked questions, is one part of the story of Edward Snowden. This is what trainers at Koenig Solutions LTD in West Delhi's Moti Nagar area remember of computer analyst-turned-whistleblower Edward Snowden

UK citizen sues Microsoft over Prism private data leak to NSA (ComputerWeekly) A British citizen's UK court action will test the legal right of Microsoft to disclose private data on UK citizens to the US electronic spying organisation, the National Security Agency

Police foil German bitcoin fraud (The Independent) Two hackers have been arrested accused of creating a fake £580,000 cache of the bitcoin internet currency in Germany

Alleged Anonymous Hacker Denied Bail by Singapore Court (AFP via Softpedia) Singaporean national James Raj Arokiasamy, accused of hacking into the website of a Singapore council, has been denied bail

How an undercover agent brought down a $50 million cybercrime ring (The Daily Dot) This week, a federal court trying David Camez for his role in an identity fraud syndicate known as Carder.su heard a sort of testimony that's bound to become more and more common. Former Secret Service and current Homeland Security agent Michael Adams, when called as a witness, laid out the details of a sprawling, four-and-a-half-year undercover operation that exposed the identities of the organization's key players

Million–dollar fine for sneaky Bitcoin botnet builders (Naked Security) New Jersey has slapped a million-dollar fine on an on-line gaming company that sneakily used its own anti-cheating software to mine Bitcoins on its customers' computers. The company is paying under protest, claiming a "deep misunderstanding of the nature of our business"

Tweeters to be offered legal tips to avoid lawsuits (Reuters) The government's chief legal adviser said on Wednesday he plans to offer guidelines to social media users to help them avoid breaking Britain's laws on contempt when posting comments about court cases

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

Operationalize Threat Intelligence (Webinar, Dec 4, 2013) Security teams are overloaded with threat feeds. It doesn't end with third party providers. It includes alerts, logs, and tips from their own security and IT solutions. We need help transforming this data into knowledge so we can act. Attendees will learn concepts and best practices that enable organizations to reduce, prioritize and operationalize threat intelligence.

Cloud Security Alliance Congress 2013 (Orlando, Florida, USA, Dec 4 - 5, 2013) The CSA Congress is the industry's premier gathering for IT security professionals and executives who must further educate themselves on the rapidly evolving subject of cloud security. In addition to offering best practices and practical solutions for remaining secure in the cloud, CSA Congress will focus on emerging areas of growth and concern in cloud security, including standardization, transparency of controls, mobile computing, Big Data in the cloud and innovation.

SINET Showcase: THE SINET 16 (Washington, DC, USA, Dec 4 - 5, 2013) The SINET Showcase is supported by the Department of Homeland Security, Science & Technology Directorate and provides a significant opportunity for industry's most innovative global entrepreneurs to present in front of 350 sophisticated investors, buyers and researchers from the commercial and government markets. If a company is selected as one of the SINET 16, it will not only be recognized at the event, but receive access to prospective investors and customers as well. Please note that the deadline to apply for the SINET 16 is August 15th.

Strengthening the NIST Cyber Framework Against Advanced Threats (Washington, DC, USA, Dec 5, 2013) NIST's Cybersecurity Framework has tremendous value for risk management and defines best practices to block known threats. This discussion will share intelligence about campaigns by sophisticated cyber threat actors that have targeted critical infrastructure companies and discuss how well the Framework stacks up against advanced and new, unknown threats.

The 8th International Conference for Internet Technology and Secured Transactions (London, England, UK, Dec 9 - 12, 2013) The 8th International Conference for Internet Technology and Secured Transactions (ICITST-2013) is an international refereed conference dedicated to the advancement of the theory and practical implementation of secured Internet transactions and to fostering discussions on information technology evolution.

World Congress on Internet Security (London, England, UK, Dec 9 - 12, 2013) The WorldCIS-2013 is an international forum dedicated to the advancement of the theory and practical implementation of security on the Internet and Computer Networks. The inability to properly secure the Internet, computer networks, protecting the Internet against emerging threats and vulnerabilities, and sustaining privacy and trust has been a key focus of research. The WorldCIS aims to provide a highly professional and comparative academic research forum that promotes collaborative excellence between academia and industry.

ACSAC 2013 (New Orleans, Louisiana, USA, Dec 9 - 13, 2013) The Annual Computer Security Applications Conference (ACSAC) is an internationally recognized forum where practitioners, researchers, and developers in information and system security meet to learn and to exchange practical ideas and experiences.

Cylance Talk: Risk Does Not Equal Threat (Arlington, Virginia, USA, Dec 10, 2013) Attacks, malware and careless users may trigger alarm bells, but that does not mean your business is in danger. Compliance and risk management requirements, while necessary, result in additional work, time delays and operational cost in prioritizing what's really important. Identifying the risks that are true threats to the organization is critical. Join Cylance's Chief Knowledge Officer, Dr. Shane Shook along with industry experts Bob Bigman (President of 2BSecure and former CSO for the CIA) and Ulf Lindqvist (Program Director at SRI International) for a rousing round-table discussion on how your organization can determine what is a real threat, and what is merely a risk.

cybergamut Tech Tuesday: Dumping in the Dark: Gaining Insight into your Memory Acquisition Tools and Techniques (Columbia, Maryland, USA, Dec 10, 2013) Digital forensic and incident response professionals unanimously agree on the vital importance of physical memory acquisition and analysis in investigations, whether they center around the reconstruction of user activity or the isolation of malicious code. Most computer incident response teams have preferred tools for such acquisition that are part of their standard operating procedures invoked during live response or evidence acquisition. We all use these tools, but how many of us can describe how they work? This talk takes a deeper look at the differences found in those memory image files tied directly to the specific tools and techniques used in the acquisition process.

2013 ASE International Conference on Cyber Security (Orlando, Florida, USA, Dec 10 - 15, 2013) The annual ASE Cyber Security Conference is a leading international forum for cyber security researchers, practitioners, developers, and users to explore cutting-edge ideas and results, and to exchange techniques, tools, and experiences. The conference seeks submissions from academia, government, and industry presenting novel research on all practical and theoretical aspects of cyber security. The First ASE International Conference on Cyber Security provides a key forum for researchers and industry practitioners to exchange information regarding advancements in the state of art and practice of cyber security.

ACG® New York Cyber Security Investor Conference (New York, New York, Dec 11, 2013) The ACG New York Cyber Security conference will feature experts in Cyber Security that will enable you to understand the opportunities for investment in a number of areas that constitutes Cyber Security. IT security spending will be $639 billion by 2023 — a tenfold increase.

Cyber Defense Initiative 2013 (Washington, DC, USA, Dec 12 - 19, 2013) NetWars Tournament runs over an intense two- to three-day period, at a conference or hosted onsite. Many enterprises, government agencies, and military bases are using NetWars OnSites to help identify skilled personnel and as part of extensive hands-on training.