The CyberWire Daily Briefing for 2.14.2013

Cyber Attacks, Threats, and Vulnerabilities

Zero-day PDF exploit affects Adobe Reader 11 and earlier versions, researchers say (CSO) Adobe is investigating the report, but has yet to confirm that the exploit bypasses the sandbox protection in Adobe Reader 10 and 11

Anatomy of a targeted attack - SophosLabs lands in the middle of an Adobe 0-day 'malware experiment' (Naked Security) SophosLabs was contacted recently to help investigate malware from an unusual sort of targeted attack. What our researchers found was intriguing, to say the least, so we thought we'd share our discoveries with you

Adobe Reader zero-day exploit spotted in the wild (Help Net Security) Researchers form security firm FireEye have found in the wild a PDF file that exploits a new zero-day vulnerability in Adobe Reader. "Upon successful exploitation, it will drop two DLLs. The first DLL shows a fake error message and opens a decoy PDF

New iOS 6.1 Security Flaw Grants Limited Access To Phone App, Photos, Email, Messages, FaceTime (TechCrunch) With just a few quick steps, it's easy to open the phone app on any locked iPhone running iOS 6.1. From there a person has full access to the photo library, can edit contacts, send emails, text messages or even make a FaceTime call. It's so easy that it's downright silly

Malware attacks spike against Apple OS X users in China enclave (Ars Technica) The increase is further proof that users of any system are vulnerable to hacks. One of the pages displayed by a booby-trapped Word document that exploits a vulnerability Microsoft patched in 2009. Researchers are reporting a spike in hack attacks targeting Mac OS X systems for the purpose of surreptitiously monitoring users' e-mail and chat contacts and maintaining persistent control over their computers

Emergency Alert System devices vulnerable to hacker attacks, researchers say (CSO) Researchers from IOActive found critical vulnerabilities in products from one of the main EAS device vendors

Google Play Gives User Data to App Devs (Threatpost) Android application developer Dan Nolan claims that the Google Play store sends software developers the names, approximated locations, and email addresses of every individual that downloads one of their applications

Jawbone accounts compromised by hackers - personal info accessed, passwords disabled (Naked Security) Jawbone, makers of Bluetooth headsets, fitness bracelets, and neat Jambox portable speakers, has warned that hackers managed to break into its systems, and accessed the names, email addresses and encrypted passwords of users

Flickr bug made users' private photos public (Help Net Security) A glitch in the Flickr matrix has resulted in intimate photos of a number of its users being made available for everyone to see after their permissions turned from "private" to "public" without their

Hackers pollute legitimate JavaScript code to spread malware (Help Net Security) Most hackers have stopped creating malicious sites long ago and have reverted to hacking legitimate ones and booby-trapping them with exploit kits, malware or malicious scripts. After all, these sites

Cryptome site, Twitter and email account hacked again (Help Net Security) Cryptome, the well-known online repository of documents concerning cryptography, freedom of speech, spying, and surveillance, has been hacked again on Monday night, says the notice on the site's main

TDoS-as-a-service ads pop up on publicly accessible forums (Help Net Security) In the past, aspiring cybercriminals with no coding knowledge had to find a way into invite-only underground forums or had to spend hours in chat rooms to gain the trust of potential "colleagues" in

Botnets for rent, criminal services sold in the underground market (SecurityAffairs) Internet is becoming a mine for criminals that in easy way are able to access to any kind of resources to arrange a cyber attacks, a cyber espionage campaign or a complex banking fraud. What is very scaring is the simplicity with which it is possible to acquire any kind of criminal services in the underground and the creativity of cyber criminals that are able to offer model of sale efficient as cheap. In the past I proposed in different posts information related to the sales in the underground market, especially the Russian one that is considered the most active

Welcome to the Malware-Industrial Complex (Technology Review) The U.S. government is developing new computer weapons and driving a black market in "zero-day" bugs. The result could be a more dangerous Web for everyone. Governments, contractors, and researchers are developing cyber-weapons that could put businesses and ordinary Internet users at risk. Every summer, computer security experts get together in Las Vegas for Black Hat and DEFCON, conferences that have earned notoriety for presentations demonstrating critical security holes discovered in widely used software. But while the conferences continue to draw big crowds, regular attendees say the bugs unveiled haven't been quite so dramatic in recent years

Security Patches, Mitigations, and Software Updates

Apple Will Release Fix For iOS 6.1 Microsoft Exchange Bug (TechCrunch) Apple says it has identified a fix for a bug that causes excess activity on Microsoft Exchange accounts after users accept an exception to a recurring calendar event, and will make it available in an upcoming software update. The bug is troublesome enough that some corporate IT departments have blocked their own devices from their Exchange servers

Thanks, Adobe. Protection for critical zero-day exploit not on by default (Ars Technica) Reader protected view: Like car airbags that work only if owners flip a switch. The recently discovered zero-day attacks targeting critical vulnerabilities in Adobe's ubiquitous Reader application are able to bypass recently added security defenses unless end users manually make changes to default settings, company officials said

Ruby on Rails Patches DoS, Remote Execution Flaws (Threatpost) Web app framework Ruby on Rails patched two security flaws this week in the open source framework that could have led to denial of service attacks and remote execution vulnerabilities

Vulnerability Patched in Schneider Electric ICS Gear (Threatpost) The Industrial Control System CERT released an advisory this week warning of a vulnerability in a popular sensor monitoring system used in a number of critical industries, including energy, water and manufacturing

Cyber Trends

Low Merchant PCI Compliance Rates Blamed On Dated Technology (Dark Reading) PCI vendor calls for acquirer/ISO PCI program technology updates to meet merchant needs

Personal Reflections on Suits and Spooks DC 2013 (infosec island) Now that I've had a chance to decompress from and reflect upon the terrific Suits and Spooks DC conference last weekend, I want to share some surprising shifts in thinking that occurred for me during those two days. The speakers were all terrific, but some topics triggered a lot of passionate debate amongst the speakers and the attendees. You can get a sense of what transpired by reading the live Twitter stream from the event

Global malicious websites increase by 600 percent (Help Net Security) Year-over-year, the number of malicious web-based attacks increased by nearly 600 percent, according to Websense Security Labs. These attacks were staged predominantly on legitimate sites

People worry more about being phished at home than at work (Help Net Security) In a corporate world where workers are bombarded with an average of 6 phishing emails everyday and 60% of people fall for them, research released by PhishMe has found that people worry more about being

Do APTs present a credible threat to national security? (Help Net Security) A global cybersecurity survey of more than 1,500 security professionals found that more than one in five respondents said their enterprise has experienced an advanced persistent threat (APT) attack

Cybersecurity commonly seen as national security threat, says Rand (FierceGovernmentIT) Many Western countries, and the Russian Federation, have designated cybersecurity threats as a top priority risk against national security, says the Rand Corp

The growing BYOD problem (FierceMobileIT) Nearly three out of five enterprises believe that BYOD represents a growing problem for their organizations, according to a survey of 162 enterprises conducted by Osterman Research on behalf of Dell (NASDAQ: DELL). Yet, 82 percent of enterprises allow their employees to use personally owned mobile devices to access corporate systems like email, databases and applications, the survey found

Marketplace

Congress Out On A Limb To Avoid Ax (USA Today) A divided Congress will take next week off and then return to a familiar conflict: a looming, self-inflicted budget deadline that threatens economic stability with no path in sight for avoiding it

DOD Repeats Dire Warnings On Cuts (Stars and Stripes) For the second day in the row, Pentagon top brass intensified its warnings to lawmakers about sequestrations crippling effect on military readiness and its ability to respond to budding conflicts across the globe

House GOP: Pentagon Crying 'Wolf' On Sequester (Politico.com) The military's last-ditch push to stop sequestration is being met with increasing resistance on Capitol Hill, with even some of the Pentagons strongest supporters criticizing the latest public relations campaign as too little, too late

Rubio, Paul Reflect GOP Split On Defense Cuts (Washington Times) The two Republican rebuttals to the State of the Union address Tuesday night reinforced the GOP's commitment to cutting spending - but the dueling responses from Sens. Marco Rubio and Rand Paul also exposed a split in the party over how that philosophy applies to the defense budget

INSA: intelligence community CIOs see need for information technology enterprise (FierceGovernmentIT) Driven by budget pressures and mission requirements, including the need to more efficiently share information between agencies, there appears to be a "growing consensus" among the Intelligence Community's chief information officers that implementing an IC Information Technology Enterprise is the right thing to do, according to an Intelligence and National Security Alliance paper

Dell's Future: 3 Wild Cards CIOs Should Understand (InformationWeek) As Dell pursues going private, Microsoft's $2 billion stake isn't the only thing that should give enterprises pause

Dell employees grumble about buyout as stock options are drowned (Ars Technica) Many stock-owning employees will be left with less than they had hoped for. While Dell CEO Michael Dell and many at the top of the Dell executive ladder stand to make out well in a move to take the company private, some rank-and-file employees and mid-level executives are grumbling about how the deal affects them. That's because Dell, which has used stock options and restricted stock heavily as an incentive for employees in the past, is simply cancelling many of the stock options it has awarded to employees if the go-private deal is completed

Microsoft's Big Data Strategy: An Insider's View (InformationWeek) Microsoft executive Dave Campbell outlines plans for Hadoop, machine learning, high-performance computing and data and analytic offerings on Azure

Accenture To Update USDA Food Safety Data System (GovConWire) Accenture (NYSE: ACN) has won a $2 million contract from the U.S. Agriculture Department to help the department's Food Safety Inspection Service update a data tracking system first implemented in 2005. The company will work with FSIS to consolidate data from three legacy systems into an agency-wide enterprise system under the one-year award, Accenture said

Jim Chilton Named Boeing Defense Systems Head, Greg Hyslop Tech Research VP (GovConWire) Jim Chilton, Boeing's (NYSE: BA) former vice president and program manager for exploration launch systems, has been appointed vice president and general manager of strategic missile and defense systems. The 29-year company veteran will succeed Greg Hyslop, who will serve as VP and GM of research and technology, Boeing said Tuesday

Thales Communications…Moving On Up… (Satnews) Thales Communications, Inc. has appointed Aaron Brosnan as the company's new Vice President of Business Development. Mr. Brosnan is responsible for developing and executing the company's business development strategies and growing the company's core business, including its next generation communications products. Mr. Brosnan comes to Thales from SCI Technologies, Inc., a Sanmina-SCI company, where, as Vice President of Business Development, he was responsible for leading its new business initiatives in the areas of aviation communications systems and avionics products, ground tactical vehicular and command post communications systems, radiation detection systems, tethered fiber optic systems, and engineering services

Private equity players need a buyout boom this year so they don't have to return investor cash (Quartz) Still flush with cash from funds raised before the financial crisis, private equity firms are increasingly finding themselves in a pickle. They raised a whopping $702 billion from optimistic investors between 2006 and 2008, when PE firms and their investors were making big bucks off a leveraged buyout (LBO) boom

Marissa Mayer Hints That Yahoo Could Go Social (Wired Business) Yahoo's CEO says the company should make it easier for users to share and talk with one another

Another Blow For BlackBerry As New Zealand Cops Pick iOS Devices (TechCrunch) In another setback for BlackBerry's key government business, the New Zealand police force has chosen iOS devices over smartphones and tablets running BlackBerry. Kiwi cops will be kitted out with iOS devices after spending nearly a year testing iPhones and iPads against competing models running Android and BlackBerry operating systems

Products, Services, and Solutions

Symantec/VeriSign Expands Encryption Options For SSL Digital Certificates (Dark Reading) Elliptic Curve Cryptography (ECC) algorithm, Digital Signature Algorithm (DSA) both now options for SSL sites in addition to RSA encryption

Twitter Lurches Toward Social E-Commerce (Wired Business) You can now charge purchases to your American Express card by tweeting. But the process is #VeryComplicated

Zscaler delivers big visibility security analytics (Help Net Security) Zscaler unveiled new analytics technology that gives enterprise security professionals real-time visibility into all employee internet activity across web, cloud email, and mobile application platform

Samsung unveils new cloud displays (Help Net Security) Samsung announced its next-generation TC191W and TC241W thin-client and NC191 and NC241 zero-client cloud displays. The lines combine VDI and desktop virtualization for secure access to a business cloud

McAfee delivers unified rapid-response security management (Help Net Security) McAfee is raising the bar on intelligent threat identification, time to respond and robust, unified security management with the latest updates to its security management solutions delivering on its

Opportunistic scanning from cloud to endpoint (Help Net Security) iScan Online introduces opportunistic security scanning from the cloud to any device. They perform internal PAN, PCI and Vulnerability scanning without installing software or the need for additional

CA streamlines identity and access management (Help Net Security) CA announced its CA CloudMinder identity and access management (IAM) service solution. CA CloudMinder provides enterprise-grade IAM for both cloud-based or on-premise applications in a highly scalable

SmartShare: Free tool for secure social sharing (Help Net Security) Veracode released SmartShare, a free tool designed to offer developers, bloggers and marketers a more secure method of on-site bookmark sharing. With more online content being shared than ever before

CACI, AOptix to Deliver Mobile Biometric Devices to the Pentagon; Dan Allen Comments (ExecxutiveBiz) CACI International and technology innovation firm AOptix will work together on a Defense Department contract to develop smart mobile identity devices, according to a AOptix statement. The new platform was unveiled by the company in September during the Biometrics Consortium Conference and integrates biometrics, including iris, fingerprint, face and voice recognition with smartphone technology

Facebook Graph Search: One Group's Early Lessons (InformationWeek) Farm Sanctuary shares lessons learned during its first steps with Facebook's new search engine, including privacy considerations

Xerox Targets Cloud Document Security Worries (InformationWeek) Xerox, working with Cisco and McAfee, launches printers and apps designed to securely route documents to Dropbox, Google Apps and other cloud services

Salesforce.com Secrets: 8 Apps Help You Do More (InformationWeek) Is your Salesforce.com app mix keeping up with your company's business growth? One rapidly growing midsize company shares a look at its blend of turnkey and custom apps

Technologies, Techniques, and Standards

Cloud Security Measures Too Opaque For Customers (Dark Reading) With nearly half of IT managers avoiding cloud services over worries that their data will be leaked, it is time for cloud providers to become more transparent

Security Analytics and Big Data (Dark Reading) I get a flood of 'big data' announcements on how using big data clusters, to analyze the mountains of event data companies collect, will 'transform' security as we know it. I think this is wrong

Assessing Risk And Prioritizing Vulnerability Remediation (Dark Reading) Vulnerabilities crop up constantly in your IT environment. How do you choose which ones to tackle first? Here are some risk-based recommendations

Auditd is your friend (Internet Storm Center) Recently I've been working on several incidents that included attackers getting shell access to the compromised host and somehow elevating their privileges to root. Of course, once they have access to the box, one of the first things they want to do is to be able to establish that same level of access again. While there are many, many ways for an attacker to plant a backdoor that will allow him access to the server later, the easiest way is, of course, to create a new, privileged account that the attacker can use to access the server

What businesses can learn from the New York Times cyber-attack (CBS News) What businesses can learn from the New York Times cyber-attack. Flickr user alextorrenegra. (MoneyWatch) There's a war taking place in cyberspace. Every day, businesses around the world are the subject of attacks by criminal organizations, and possibly

NIST revises electronic authentication guideline, releases for public comment (FierceGovernmentIT) The National Institute of Standards and Technology has updated the registration and issuance processes section of its Electronic Authentication Guideline, according to a revised NIST draft. The document, which will supersede NIST Special Publication 800-63-1, provides technical guidelines for federal agencies implementing electronic authentication, and defines requirements for each of four levels of assurance in the areas of identity proofing, registration, tokens, management processes, and authentication protocols. Its recommendations cover remote authentication of users, such as employees, contractors or private individuals who interact with government IT systems over open networks

BYOD spurs need for enterprise app stores (FierceMobileIT) The BYOD trend is spurring the deployment of enterprise app stores as companies struggle to deal with the influx of personally owned devices, according to Gartner. One-quarter of enterprises will have enterprise app stores to manage corporate apps on PCs and mobile devices by 2017, the research firm predicts

Enterprises need to educate employees about BYOD risks (FierceMobileIT) BYOD continues to pose more and more support and security challenges for the enterprise. According to a recent survey conducted by Osterman Research on behalf of Dell (NASDAQ: DELL), three out of five enterprises believe that BYOD represents a growing problem

Design and Innovation

New 'FiberHouse' in Kansas City invites startups for a year, rent-free (Ars Technica) Famed early-stage investor Brad Feld, who bought house, holds new competition. The Kansas City Startup Village is aglow with the announcement that Brad Feld, an early-stage investor, has closed on a house in Kansas City, Kansas (KCK)—he's already dubbed it the "FiberHouse." Feld is also a co-founder of TechStars, a well-known startup accelerator based in Boulder, Colorado. "I'm not going to be living in it," he wrote on his blog on Wednesday. "Instead, I'm going to let entrepreneurs live / work in it. Rent free. As part of helping create the Kansas City startup community. And to learn about the dynamics of Google Fiber. And to have some fun"

Research and Development

Science Shows Dating Websites Aren't Better At Finding You Love (TechCrunch) I was really hoping this article would have ended differently. But after spending countless hours scanning tiny pixelated squares of people who were supposed to represent my mathematically determined soul mate, I found that online dating websites are modern-day versions of snake oil. I ended up back at bachelorhood after a long and expensive trek through computer-aided love services; I decided to

Ask Ars: Why spend time and money finding new prime numbers? (Ars Technica) That new 17-million digit Mersenne prime number might matter. Someday. Are we wasting computer power looking for new numbers with certain properties? OK, you've got us. The jig is up. There is no use for absurdly large prime numbers—yet (we'll explain that eventually). Slightly less ludicrous prime numbers do have a point, which we'll describe here

MIT's $1 million test to see if social media can make investors money (Quartz) MIT researchers are giving 10,000 Asian students $100 each to invest in the stock market, hoping to prove a theory that, under the right circumstances, social networks can improve financial decisions

Legislation, Policy, and Regulation

Hague spells out counterterrorism plan (Financial Times) William Hague will say on Thursday that Britain needs to develop justice and human rights partnerships with states in the Middle East and Africa so that the UK is better placed to provide them with intelligence to counterterrorist threats. The foreign secretary will use a speech in London to spell out how the UK wants to deepen intelligence co-operation with countries where jihadist threats to Britain are emerging. It is often hard for the UKs intelligence agencies to share information with the relevant governments because they have poor human rights records

Pentagon reveals new medal for drone operators, cyber attack troops (New York Daily News) Defense officials say the Pentagon is creating a new medal that can be awarded to troops who have a direct impact on combat operations, but do it from afar. The Associated Press has learned that the new Distinguished Warfare Medal will

Obama's executive order leaves more questions than answers (CSO) Alan Paller of the SANS Institute throws cold water on the notion that this executive order will change the state of cybersecurity for the better

Booz Allen Vice Chair Mike McConnell: Cyber Legislation Needed, Exec Order 'A Good Start' (ExecutiveBiz) The U.S. needs cybersecurity legislation to protect citizens and businesses from increasing rates of cyber attacks and exploitation, according to Booz Allen Hamilton Vice Chairman Mike McConnell

Obama Presses Cybersecurity Effort (Wall Street Journal) The Obama administration pressed ahead Wednesday with its campaign to bolster cybersecurity measures through an executive order while setting the stage for a new battle in Congress over how to ensure computer safeguards at companies that run the electric grid and other key infrastructure

US says America is losing cyber war to China; officials vow to find compromise on legislation (Washington Post) Declaring that America is losing an aggressive cyber-espionage campaign waged from China, administration officials and lawmakers on Wednesday agreed to push legislation that would make it easier for the government and industry to share information about who is getting hacked and what to do about it. They say this new partnership, codified by law and buoyed by President Barack Obamas new executive order, is critical to keeping countries like China, Russia and even Iran from rummaging in American computer networks and targeting proprietary data they can use to wreak havoc or compete against U.S. businesses

Feds roll out cyber plan as Hill vows legislation (Monterey County Herald) Declaring that America is losing an aggressive cyber-espionage campaign waged from China, administration officials and lawmakers on Wednesday agreed to push legislation that would make it easier for the government and industry to share information about who is getting hacked and what to do about it

Presidential Cybersecurity Executive Order Has Limited Reach (SIGNAL Magazine) One day after unveiling a long-awaited executive order concerning a wide-range of cybersecurity concerns, President Barack Obama's top cybersecurity advisers admit that the order only goes so far in dealing with pressing Internet security needs. They say that the order is only a "down payment" and no substitute for permanent congressional legislation on the matter

Full text Obama - Executive Order - Improving Critical Infrastructure Cybersecurity (White House) By the authority vested in me as President by the Constitution and the laws of the United States of America, it is hereby ordered as follows:Section 1. Policy. Repeated cyber intrusions into critical infrastructure demonstrate the need for improved cybersecurity

Cybersecurity Executive Order (Chemical Facility Security News) Well, President Obama finally signed the long promised Cybersecurity Executive Order. We dont have an EO number yet, that will come in the next day or two when the EO is published in the Federal Register. In any case, what is posted on the White House web site is certainly good enough for us to start seeing what practical effect this EO will have on cybersecurity

Cybersecurity Executive Order Short on Action, Long on Voluntary Initiatives (Threatpost) The executive order that President Barack Obama signed yesterday in advance of his State of the Union Address contains a lot of provisions for information sharing on attacks and threats on critical infrastructure, and also calls for the development of a framework to reduce cybersecurity risks in federal agencies and critical infrastructure. What the order does not include are any mandates, required changes or a plan for significant action. The most-discussed section of the executive order on cybersecurity is the one that directs the attorney general, secretary of the Department of Homeland Security and the Director of national Intelligence to establish an information-sharing program that will produce unclassified reports on "cyber threats to the U.S. homeland that identify a specific targeted entity." However, this is not the broad, two-way sharing of attack and threat data between the government and the private sector that some in the security community had been pushing for.

Financial industry welcomes Obama cybersecurity plans (Finextra) US President Barack Obama has signed a cybersecurity executive order designed to improve collaboration and information sharing between the government and critical infrastructure providers such as banks. Obama signed the 'improving critical infrastructure cybersecurity' order ahead of his State of the Union address this week, during which he warned that America's enemies are "seeking the ability to sabotage our power grid, our financial institutions and our air traffic control systems"."We cannot look back years from now and wonder why we did nothing in the face of real threats to our security and our economy," he told Congress, urging it to pass laws to back up his plans. In response, the House Intelligence Committee said it planned to revive its Cyber Intelligence Sharing and Protection Act (Cispa), which has been criticised in the past by privacy groups

New executive order launches far-reaching cyber security regulations process (Washington Examiner) The Cyber Security Framework will begin as a set of voluntary standards, but the order initiates a process that gives bureaucrats the opportunity to expand their power, because the Department of Homeland Security will "encourage" regulatory agencies to

White House Cybersecurity Executive Order: What It Means (InformationWeek) The White House late Tuesday issued a long-awaited executive order to bolster the nation's cyber defenses. But that order leaves some questions unanswered

Litigation, Investigation, and Law Enforcement

Lawyers Claim Number of Data Breach Victims Was Falsified by Ottawa (Oye Times) The group of people whose personal information was lost by the federal government are claiming that the actual number of victims are much more than claimed by Ottawa. It was officially announced by the Human Resources and Skills Development Canada last month that it has lost a flash drive from an office in Gatineau, Que., which enclosed personal information of more than half a million recipients of student loan

Dutch company hits Facebook with lawsuit over 'Like' button (IT Proportal) Facebook has been dragged into a new legal confrontation, this time over the use of the Like button, as well as a few other popular features. The social networking site was sued by Rembrandt Social Media - a patent-holding company working on behalf of the estate of Joannes Jozef Everardus van der Meer, a programmer from the Netherlands who died in 2004. The complainant claims that Facebooks overwhelming success is a direct product of many key features and technologies patented by Van der Meer and now owned by Rembrandt

Man Arrested in Relation to the Remote Control Virus (Symantec) Back in October 2012, we published a couple of blogs about Backdoor. Rabasheeta, a back door Trojan that was used to make numerous death threats from compromised computers, resulting in four wrongful arrests. The saga may have come to an end for the malware author who had been taunting the Japanese authorities for months

Japanese Police Determined to Enhance Anti-Cybercrime Capabilities (Softpedia) The recent case in which police has wrongfully arrested four men who were believed to have sent threatening messages on the Internet has made Japanese authorities realize the importance of proper cybercrime-fighting skills. To solve the case of the online threats which were actually made by a computer malware whose author was arrested recently various police organizations from all over Japan had to share virus-related information, Daily Yomiuri reports. This was the first time when law enforcement collaborated in such a manner

Reveton ransomware gang arrested by Spanish police (Naked Security) The Spanish police have arrested 11 individuals suspected of being members of the infamous Reveton ransomware gang

ATM skimming ring compromised over 6,000 bank accounts (Help Net Security) U.S. federal authorities have announced the filing of an indictment against two alleged leaders of an international scheme to steal customer bank account information using "skimming" technology that

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

ATMiA US Conference 2013 (Scottsdale, Arizona, US, Feb 19 - 21, 2013) A conference devoted to the design of ATMs, and the future of the ATM industry.

Cybergamut Technical Tuesday: Cloud Security (, Jan 1, 1970) Dr. Susie Cole of Exceptional Software Strategies will discuss cloud security..

#BSidesBOS (Cambridge, Massachusetts, USA, Feb 23, 2013) Each BSides is a community-driven framework for building events for and by information security community members. The goal is to expand the spectrum of conversation beyond the traditional confines of space and time. It creates opportunities for individuals to both present and participate in an intimate atmosphere that encourages collaboration. It is an intense event with discussions, demos, and interaction from participants. It is where conversations for the next-big-thing are happening..

RSA USA 2013 (San Francisco, California, USA, Feb 25 - Mar 1, 2013) RSA Conference continually evolves program offerings to meet the ever-changing needs of our delegates in the dynamic infosec industry.

Nullcon Goa 2013 (Bogmallo Beach Resort, Goa, India, Feb 26 - Mar 2, 2013) An international information security conference that will feature speakers and training. Topics include security and politics, vulnerability elimination, Android hacking, SCADA and smart grid penetration testing, and more.

NRO Winter Way Forward Conference (Chantilly, Virginia, USA, Feb 28, 2013) This annual event will provide an increased awareness, understanding and support among the IT workforce by focusing on the NRO IT Way-Forward in terms of the NRO IT Sub-Portfolio Roadmaps. Exhibitors will gain valuable networking time with conference attendees and all NRO personnel.

TechMentor Orlando 2013 (Orland, Florida, USA, Mar 4 - 8, 2013) Celebrating 15 years of educational events for the IT community, TechMentor is returning to Orlando, Florida, March 4-8, for 5 days of information-packed sessions and workshops. Surrounded by your fellow IT professionals, you will receive immediately usable education that will keep you relevant in the workforce. TechMentor track topics include:Windows PowerShell and AutomationCisco and Networking Infrastructure Windows Server Management Windows Client Management Cloud and Virtualization Identity, Access Management and Security Performance Tuning and Troubleshooting Mobility and BYOD Messaging and Collaboration.

Business Insurance Risk Management Summit (New York City, New York, USA, Mar 5 - 6, 2013) The annual Risk Management Summit, now in it its fourth year, provides attendees with focused insight via specific, timely general sessions and strategic, thought-provoking discussions with peers and industry leaders.

CanSecWest 2013 (Vancouver, British Columbia, Canada, Mar 6 - 8, 2013) CanSecWest, the world's most advanced conference focusing on applied digital security, is about bringing the industry luminaries together in a relaxed environment which promotes collaboration and social networking. The conference lasts for three days and features a single track of thought provoking presentations, each prepared by an experienced professional and talented educator who is at the cutting edge of his or her field. We give preference to new and innovative material, highlighting important, emergent technologies, techniques, or best industry practices. It will feature a bigger, enhanced Pwn2own.

e-Crime Congress 2013 (London, England, Mar 12 - 13, 2013) The e-Crime Congress is designed to meet the needs of key stakeholders and decision makers who are responsible for designing and coordinating information security and risk management strategy, safeguarding digital assets and sensitive information, protecting customers, defending against internal or external threats and responding to incidents.

CTIN Digital Forensics Conference (Seattle, Washington, USA, Mar 13 - 15, 2013) Speakers include experts and published authors in the field of digital forensics and cybersecurity. Topics include; Mobile Device Forensics, Internet Forensics, Physical Memory Analysis, Open Source Tools, Data Carving, Registry Forensics, Placing the Suspect Behind the Keyboard, Triage and Live Forensics CDs, and more.

IT Security Entrepreneurs' Forum (ITSEF 2013) (Palo Alto, California, USA, Mar 19 - 20, 2013) Supported by the U.S. Department of Homeland Security, Office of Science and Technology, ITSEF 2013 aims to connect the ecosystem of the entrepreneur: industry, government, and academia. The conference will advance innovation, lead change and build trusted global collaboration models between the public and private sectors to defeat Cybersecurity threats.

The Future of Cyber Security 2013 (London, England, UK, Mar 21, 2013) Cyber Security and the Citizen 2013 is a one-day conference and exhibition for senior decision-makers of central and local government organisations, NGOs and major private sector enterprises.

SANS Cyber Threat Intelligence Summit (Washington, DC, USA, Mar 22, 2013) Conventional network defense tools such as intrusion detection systems and anti-virus focus on the vulnerability component of risk, and traditional incident response methodology presupposes a successful intrusio…Network defense techniques which leverage knowledge about these adversaries - known as cyber threat intelligence - can enable defenders to establish a state of information superiority which decreases the adversary's likelihood of success with each subsequent intrusion attempt…The goal of this summit will be to equip attendees with knowledge on the tools, methodologies and processes they need to move forward with cyber threat intelligence. The SANS What Works in Cyber Threat Intelligence Summit will bring attendees who are eager to hear this information and learn about tools, techniques, and solutions that can help address these needs.

AFCEA Belvoir Industry Days 2013 (National Harbor, Maryland, USA, Apr 2 - 3, 2013) The purpose of this event is to inform the IT community about the recent successes and the forward-thinking opportunities that the Department of Defense and the Department of the Army have developed.

CSO40 (Braselton, Georgia, USA, Apr 2 - 3, 2013) The CSO40 Security Confab + Awards will honor and share the critical viewpoints of today's leading CSOs, CISOs and security executives at the nation's leading CSO thought leadership conference.

Cloud Connect Silicon Valley (Santa Clara, California, USA, Apr 2 - 5, 2013) Cloud Connect returns to Silicon Valley, April 2-5, 2013, for four days of lectures, panels, tutorials and roundtable discussions on a comprehensive selection of cloud topics taught by leading industry experts.

An Evening in Cyberspace: Supporting Tomorrow's Cybersecurity Leaders (National Harbor, Maryland, USA, Apr 6, 2013) UMUC is pleased to present An Evening in Cyberspace: Supporting Tomorrow's Cybersecurity Leaders. Join us for this special black-tie event to support the next generation of cybersecurity students. The evening will feature a reception, dinner, keynote and entertainment.

Cyber 1.3 (, Jan 1, 1970) Maj. Gen. Suzanne Vautrinot, USAF, commander, 24th Air Force, and commander, Air Force Network Operations, will discuss the global strategic implications that relate to the cyber domain at the Space Foundation national conference Cyber 1.3, to be held Monday, April 8th, at The Broadmoor Hotel in Colorado Springs, Colorado. Cyber 1.3 is a full-day conference that takes place immediately before the official opening of the 29th National Space Symposium. The conference includes a networking breakfast, a luncheon and concludes with a networking reception, co-sponsored by General Dynamics Advanced Information Systems. Government Executive Media Group is a Cyber 1.3 media co-sponsor.

INFILTRATE 2013 (Miami, Florida, USA, Apr 11 - 12, 2013) INFILTRATE is a deep technical conference that focuses entirely on offensive security issues. Researchers focused on the latest technical issues will demonstrate techniques that you cannot find elsewhere.

Information Tech Expo Series - Hawaii (Oahu, Hawaii, USA, Apr 12 - 19, 2013) This 6-series showcase will feature stops at 5 DoD locations and 1 Intel Center on the island of Oahu. Celebrating 20 years of these expos is a true testament to the government and military's readiness to learn from and work with industry partners. .

InfoSec World Conference & Expo 2013 (Orlando, Florida, USA, Apr 15 - 17, 2013) With the primary objective of providing top-notch education to all levels of information security and IT auditing professionals, InfoSec World delivers practical sessions that give you the tools to strengthen your security without restricting your business.

Infosec Southwest 2013 (Austin, Texas, USA, Apr 19 - 21, 2013) InfoSec Southwest is intended to be a general security and hacking conference with no specific industry or topical focus. As such, nearly all topics (other than vendor pitches) are fair game and the attending audience is expected to span all demographics.

23rd Annual Government Procurement Conference (Washington, DC, USA, Apr 25, 2013) This unique one-day event attracts more than 3,000 participants representing government agencies, prime contractors and small businesses from around the country. Participating companies are able to network with procurement officials from federal, state and local government agencies under one roof.

Interop Las Vegas (Las Vegas, Nevada, USA, May 6 - 10, 2013) Attend Interop Las Vegas, May 6-10, and attend the most thorough training on Apple deployment at the NEW Mac & iOS IT Conference. Join us in Las Vegas for access to 125+ workshops and conference classes, 350+ exhibiting companies and the latest technology.

Consumerization of IT in the Enterprise Conference and Expo (San Francisco, California, USA, Jun 2 - 4, 2013) From smartphones to mobile apps, social software and 4G networks, the wave of innovation in the consumer space is transforming the way companies do business, both inside and outside of the enterprise. Over two and a half action packed days, CITE 2013 will bring together IT and business executives, venture capitalists and other practitioners to showcase leading efforts and teach others how to make the most of this transformation.

25th Annual FIRST Conference (Bangkok, Thailand, Jun 16 - 21, 2013) The annual FIRST conference provides a setting for conference participants to attend a wide range of presentations delivered by leading experts in both the CSIRT field and from the global security community.

SECRYPT 2013 (Reykjavik, Iceland, Jul 29 - 31, 2013) The 10th International Conference on Security and Cryptography (SECRYPT 2013) will take place from 29 to 31 July 2013 in Reykjavik, Iceland…The conference will focus on information systems and network security, including applications within the scope of knowledge society in general and information systems development in particular, especially in the context of e-business, internet and global enterprises. It will bring together researchers, mathematicians, engineers and practitioners interested in security aspects related to information and communication.