The CyberWire Daily Briefing for 3.7.2013

Cyber Attacks, Threats, and Vulnerabilities

India: Attacks on infrastructure came from China (ZDNet) The Indian government has singled out China as one of several nations identified to have been responsible for attempts to hack the country's cyber networks. Minister of State for Communications and IT Shri Milind Deora told India's house of representatives, Lok Sabha, that there had been attempts to hack the government's systems from "time to time". In a written reply to a series of pre-submitted questions posed the previous day by member of parliament Shri Jose K. Mani, Shri Deora said it was difficult, though, to attribute cyberattacks to a particular country."These attacks have been observed to be originating from a number of countries, including China," Deora said

'Time Bomb' Attack Out Of China Defused (Dark Reading) Targeted attack against Chinese and Japanese journalists used Mandiant's ATP1 report as a lure. Mandiant's in-depth report published last month on a prolific cyberespionage team tied to the Chinese military was, in turn, used as a lure in other targeted attacks -- by what appears to be different Chinese hacker groups

Every day 4,200 Chinese media censors take a break during the evening news (Quartz) Here's a tip for the 300 million users of China's Twitter-like microblogging site Sina Weibo: If you don't want to get censored, post your messages at around 7pm, Beijing-time

Bank DDoS Attacks Resume (Threatpost) A number of U.S. banks are dealing with online service disruptions as hacktivists reportedly have launched another round of distributed denial of service (DDoS) attacks against financial institutions. According to sitedown. co, customers for PNC Bank, Wells Fargo, Citibank, Bank of America and a number of other major banks have been reporting an inability to access their respective banking websites or online accounts."Earlier today, customers using certain Internet service providers were experienceing difficulties reaching PNC's sites," Marcey Zwiebel, VP and senior manager of external communications for PNC told Threatpost via email

Saudi Aramco, Saudi Arabia's national oil company, has had its Twitter hacked (Naked Security) Saudi Aramco, the national oil company of Saudi Arabia, has had its official Twitter account compromised by hackers. Not only have the hackers replaced Saudi Aramco's logo with a picture of the Heath Ledger's portrayal of "The Joker" from the film "The Dark Knight" Batman movie, but they have also tweeted a series of messages to the oil firm's 46,000 followers. Here, via the wonder of an animated GIF, I can show you what the tweets are saying in English:Here's a (Google-translated) example:Account has been compromised by Mister Rero for through a loophole of Alheczr discovery Joseph hacker to connect with JosephLast August, Saudi Aramco revealed that it had been hit by a malware attack that affected more than 30,000 of its computers

Following breaches, experts call for two-factor authentication on Twitter (CSO) While two-factor authentication is not a silver bullet, it is a necessary step toward better security, said one analyst

Devil targets banks in Google Play store (SC Magazine) Malware tailored to steal SMS verification tokens from major Australian and kiwi banks is circulating on Google's App store from fraudulent developer accounts. The bot could be purchased from underground websites and used to target the likes of the Commonwealth Bank, Westpac and NAB along with New Zealand organisations HSBC, Kiwibank and ANZ. Perkele, meaning devil in Finnish, was used in tandem with PC web application malware, Krebsonsecurrity reported

Malicious Java applet uses stolen certificate to run automatically (Help Net Security) A signed but malicious applet that will apparently fool even the latest Java 6 update has been discovered on a German online dictionary website infected by the g01pack exploit kit

BitInstant back online following breach, Bitcoin theft (Help Net Security) BitInstant, one of the online Bitcoin exchange services, has been down and unaccessible from Thursday evening to Monday due to a "sophisticated attack," which resulted in a loss of $12,480 in Bitcoins

Android Accounted For 79 percent Of All Mobile Malware In 2012, 96 percent In Q4 Alone, Says F-Secure (TechCrunch) Is it because Android is the most popular smartphone platform in the world right now, or is it because it's just fundamentally easier to attack? In any case, Google's mobile juggernaut Android continues to be the world's biggest magnet for mobile malware. According to a report out today from security specialists F-Secure, Android accounted for 79% of all malware in 2012, up from 66.7% in 2011 and

Google Android Gingerbread prevalence poses security risk to firms (V3.com) Fragmentation in the Google Android mobile ecosystem is leaving businesses at risk to cyber attacks, according to security firms Trend Micro and F-Secure…Trend Micro security director Rik Ferguson told V3 that the ongoing fragmentation and slow update cycle could have disastrous implications for businesses using Android devices. "The fragmented nature of the Android operating system version installed base is certainly a problem, although more so for enterprises than for individual end-users currently," Ferguson told V3

Security Risks of Telecommuting (infosec island) In today's work environment, costs are skyrocketing, but one way to reduce costs is to offer a telecommuting option for employees. While it may be easier for telecommuting employees to perform their work at home or in the field, the process doesnt happen without posing serious security risks. The number one issue is connecting from the home environment or the field environment to the office, but secure communications are often overlooked due to costs and complexity

SaaS integration challenges pose security risks (ZDNet) As small and midsize businesses (SMBs) leverage software-as-a-service (SaaS) to scale more quickly, they can end up with disparate applications that do not integrate. This gives rise to security issues as companies will bypass security protocols governing these software, and result in data residing in silos in different cloud services. The integration of Web-based applications used to provide customers more functionalities becomes complicated as SMBs migrate to a SaaS business model, explained Pavan Joshi, Web security solutions product manager at Akamai Asia-Pacific and Japan

Cybercriminals Predicted To Expand Use Of Browser Proxies (Dark Reading) A technique for controlling a compromised system's browser, widely used in Brazilian banking schemes, will likely become popular amongst global cybercriminals in the next few years, say security experts. The technique abuses a legitimate way to control where a browser sends its requests, known as proxy auto-configuration or PAC, to take over a victim's browser and send traffic--say, requests to a bank--to an attacker-controlled server instead. While the attackers still have to find a way to execute code on a victim's system, once that is done, they can set a proxy for the browser, capture selected traffic and re-route it invisibly."You can essentially have the end users interact with a shadow Internet, essentially an Internet experience that is designed by the bad guys," says Daniel Ingevaldson, chief technology officer for Easy Solutions, a fraud-prevention company that operates extensively in South America

Security Patches, Mitigations, and Software Updates

Oracle ships out-of-band Java fix, Apple follows suit (Naked Security) Oracle recently published an emergency update for Java, and Apple quickly followed suit for the version of Java it still officially supports. Paul Ducklin tries to guess where Oracle's Java patch cycle will end up

Wireshark Security Updates (Internet Storm Center) Wireshark released updates for version 1.6.14 and 1.8.6 to fix several vulnerabilities (multiple CVEs have been fixed). See the Wireshark announcements for the complete list of fixes

Apple Blocking Java Web plug-in (Internet Storm Center) Apple has released a security bulletin indicating they have updated the web plug-in blocking mechanism to disable versions of Java older than Java 6 update 41 and Java 7 update 15. Review the links below on how you might be affected

Cyber Trends

Bit9's Delicate Disclosure Dance A Sign Of The Times (Dark Reading) Bit9's sharing of some details on the attack that turned its whitelisting technology against some of its customers while trying to keep them safe from further danger represents a new challenge for security firms. Firsthand breach disclosure is gradually becoming a best practice for security firms as they are increasingly being targeted by the attackers that their products are trying to repel

Businesses Concerned About State-Sponsored Cyber Attacks (EWeek) In the wake of high-profile cyber-attacks directed against U.S. companies, a survey finds half of businesses believe their organization could be a target. Half of businesses say their organization is a potential target for state-sponsored cyber attacks, according to a survey of 205 attendees of the RSA 2013 security conference by information risk and security performance management solutions specialist nCircle. The survey also found just under half (48 percent) of respondents thought China had the most advanced capabilities for state-sponsored cyber-attacks, while a third (33 percent) of respondents said they believe the United States has the most advanced capabilities

FBI warns state hackers pose national security risk (v3) The FBI is stepping up its fight against cyber hackers due to the major risk the recent slew of attacks pose to the US. FBI director Rober Mueller claimed that industry and law enforcement must work together to combat the increased cyber threat posed by nation state hackers and criminals in a speech on Thursday."Network intrusions pose urgent threats to our national security and to our economy," Mueller said."If we are to confront these threats successfully, we must adopt a unified approach that promotes partnerships and intelligence sharing-in the same way we responded to terrorism after the 9/11 attacks."Mueller warned that US's existing initiatives, like the Domestic Security Alliance Council and InfraGard alliance are not strong enough to fully protect industry and the government from cyber attacks. The Domestic Security Alliance Council is an outreach programme that involves chief security officers from more than 200 companies connected to critical infrastructure sectors

Why Cybercrime Remains Big Business - And How To Stop It (Forbes) Cybercrime is big business. And it is growing in scope and impact. But what may not be obvious to the casual observer is that cybercrime is growing in its magnitude and sophistication because of two key factors: the consumerization of crimeware, and the adoption of time-tested business processes to enhance the profitability of crime syndicates worldwide

65 percent of firms in UK fear a cyber attack in 2013: survey (Canadian Underwriter) Sixty-five percent of polled organizations report being extremely concerned or concerned about a cyber attack in 2013, notes a new survey from the Business Continuity Institute (BCI) and the British Standards Institution (BSI)

New generation aircraft face increased cyber threat (Flightglobal) The latest generation in aircraft face a growing cyber threat, as they are increasingly connected to data networks and the internet. These aircraft, which include the Airbus A350 and Boeing 787, have more data uplinks and downlinks, and are often equipped with passenger wi-fi systems, that create possible opportunities for cyber terrorists, panellists say at International Air Transport Association's (IATA) AVSEC aviation security conference in New York today

Boeing 787s to create half a terabyte of data per flight, says Virgin Atlantic (Computer World) Virgin Atlantic is preparing for a significant increase in data as it embraces the internet of things, with a new fleet of highly connected planes each expected to create over half a terabyte of data per flight

99 percent of web apps vulnerable to attack (Help Net Security) A new Cenzic report demonstrates that the overwhelming presence of web application vulnerabilities remains a constant problem, with an astounding 99 percent of applications tested revealing security

Marketplace

[South Carolina's] DHEC Requests $1.5 Million for Cyber Security (WLTX) The state Department of Health and Environmental Control is looking to keep sensitive information at the agency safe. Director Catherine Templeton told a senate finance committee the department need $1.5 million for the task

As Pentagon Budget Cuts Hit, Firms Hold Off On Layoffs (USAToday.com) Despite predictions that sequestration-related defense cuts could result in 1 million layoffs, contractors have filed few notices of plant closings or mass layoffs, suggesting that any big impact on the economy from Pentagon downsizing is at least 60 to 90 days away

TIGTA: Delays hinder IRS ability to monitor employee computers for security (FierceGovernmentIT) Significant delays have hindered the Internal Revenue Service's ability to continuously monitor security settings on employee workstations and laptop computers, according to a report from the Treasury Inspector General for Tax Administration

NASA Kicking Off Potential $14B Enterprise-Wide IT Vehicle (GovConWire) National Aeronautics and Space Administration is set to put out a preliminary request for a potential $14 billion information technology acquisition contract focused on cloud-based computing services, hardware, storage systems and peripherals. The draft request for proposals for the seven-year Solutions for Enterprise-Wide Procurement V contract will be released this week, with the final RFP

National Security Agency to Receive High Performance Computing Support from BAE Systems Experts (Fort Mill Times) BAE Systems has been awarded a multi-year $127 million contract to provide infrastructure and software development support to the National Security Agency's (NSA) High Performance Computing Infrastructure Group

Fort Meade to Build New High-performance Computing Center (SIGNAL) Hensel Phelps Kiewit Joint Venture, Chantilly, Va., was awarded a $564,689,000 firm-fixed-price, incrementally-funded contract. This increment is worth $56 million. The award will provide for the design and construction of a high- performance computing center on Fort Meade, Md. Work will be performed in Fort Meade, with an estimated completion date of Sept. 1, 2015. The U.S. Army Corps of Engineers, Baltimore, Md., is the contracting activity

SAIC Helping Navy Run Anti-Terrorism Program Software (GovConWire) Science Applications International Corp. (NYSE: SAI) has won a potential $74,398,851 contract to help the U.S. Navy maintain software and equipment for anti-terrorism program systems. The company will receive an initial $3,655,433 increment at the time of award and a second $17,551,889. increment in April, the Defense Department said Tuesday. SAIC will receive the full contract

'Sandboxing' leader FireEye seen moving toward an IPO (Network World) Why is it a lot of security firms want to have sandboxing 'like FireEye'…The disclosure by Google three years ago about cyber-espionage in China was a

SC Magazine Names Mandiant the 2013 Professional Award Winner for Best Security Company (Business Wire) Mandiant, the leader in security incident response management, has been awarded the 2013 SC Award for exemplary professional leadership in information-technology (IT) security. The award was presented on

Procera Networks Inc. Stock Downgraded (The Street) Procera Networks (Nasdaq:PKT) has been downgraded by TheStreet Ratings from buy to hold. The company's strengths can be seen in multiple areas, such as its revenue growth, largely solid financial position with reasonable debt levels by most measures and expanding profit margins. However, as a counter to these strengths, we also find weaknesses including a generally disappointing performance in the stock itself, unimpressive growth in net income and disappointing return on equity

Microsoft Establishes Cybercrime Center to Combat Piracy, Malware (Fox Business) Microsoft Corp. (MSFT) is consolidating its digital crimes and software piracy teams into a single Cybercrime Center in an effort to confront new ploys by Web criminals with bolder initiatives of its own. Microsoft has been a target for Internet thieves for a generation

Hot security skills of 2013 (NetworkWorld) Most successful CSOs will tell you it was a unique mix of skills that propelled them to their current position. Technical background is important, certainly, but practice in the business and excellence in communication are paramount for any CSO truly worthy of a place in the C-suite. We don't expect that to change any time soon

Products, Services, and Solutions

SNARE SIEM Server Version 6.0 Includes a Comprehensive Query Builder And Modern Browser User Interface (Dark Reading) Allows for custom configuration of agent event log objective-setting and monitoring capabilities

DMS International Awarded ISO 27001 Information Security Certification (PR Newswire) DMS International today announced it has earned the prestigious ISO/IEC 27001-2005 Certificate of Registration for their Information Security Management Systems (ISMS). Qualifying against the ISO 27001 standard places DMS at the forefront in the provision of world-class Information Assurance services. This certification verifies DMS International's compliance with ISMS policies procedures and controls consistent with the requirements of the ISO standards

Static analysis tool for examining binaries (Help Net Security) GrammaTech announced a static-analysis tool for analyzing binary libraries and executables. CodeSonar for Binaries enables users to examine software for security vulnerabilities and malicious code

ATEN Introduces New Secure KVM Solutions Designed Specifically for the Intelligence IT Community (ATEN-USA) ATEN, a leading designer and manufacturer of advanced connectivity solutions, today announced the availability of secure KVM switches, designed specifically for the intelligence IT community. The CS1182 (two-port) and CS1184 (four-port) along with the CS1642-DoD (two-port) and CS1644-DoD (four-port) KVM switches provide secure and reliable access to government and military desktop computing environments

Technologies, Techniques, and Standards

An Auditor's Thoughts On Access Control (Dark Reading) Four key access control considerations an auditor will look for. Regardless of whether it's for PCI, HIPAA, SOX or GLBA, chances are high that if an auditor's bound for your organization your access control is about to go under the microscope. With so many compliance-driven mandates around separation of duties and user monitoring dependent on strong access control regimes, it's no wonder that this is one of the key areas that auditors will focus their efforts

The Great Lie Of Compliance (Dark Reading) If you believe you are fully compliant, then you are not. It happened again: I'm chatting with a gentleman at one of those business social events. He is senior management for a large organization. As we talk about the economy and business, he politely asks a few questions about what my team does to help companies

Tips For ID Theft Protection During Tax Season (Dark Reading) The threat of identity theft this tax season leaves consumers with more to worry about than whether or not a tax return is in the mail. Experian's ProtectMyID, a multilayered identity theft detection, protection and fraud resolution product, advises consumers to protect personal financial information found in tax returns. A thief may use sensitive information, such as a Social Security number, to claim a fraudulent tax refund, open fraudulent credit cards and commit other criminal acts that may take months, if not years, to correct

Anti-Virus Isn't Enough: 7 Steps to Discourage Hackers (eSecurity Planet) Anti-virus software is no longer a match for today's threats. Here's what your business needs to stay protected. When hackers broke in to the New York Times' network, evaded its anti-virus software and began plundering its computer systems, it highlighted a rather uncomfortable truth: Anti-virus software is

EBay develops 'miles per gallon' metric for data centers (IT World) There's a maxim in the data center business that you can't manage what you can't measure, and eBay has come up with the mother of all measurement systems for calculating data center efficiency

How to protect yourself from debit-card fraud (Naked Security) How's this for a phone call you don't want on a Sunday night: Visa's fraud unit, calling to ask whether you're aware that $1,371 has been wired from your bank account via Western Union. Unfortunately, it's far from a rare occurrence

At Pwn2Own, Browser Exploits Getting Harder, More Expensive to Find (Threatpost) The Pwn2Own contest has evolved in many ways over the years, from new rules to new targets to larger prizes, but perhaps the one thing that has changed the most is that the researchers who show up here every year hoping to go home with a bag full of money are having to spend more and more time finding and exploiting vulnerabilities in the browsers and plug-ins in play. The research team at VUPEN, which successfully compromised Internet Explorer 10 on Windows 8 spent several months finding the flaws they used and writing the expoits

Cyber security the best weapon remains good information security hygiene (Computer Weekly) IT professionals know that cyber security threats become more plentiful and sophisticated every year, and there is no reason for that trend to change. A recent report by the National Audit Office (NAO) said it would take the UK 20 years to develop the sophisticated skills needed to improve cyber security. But there is no need to despair with a calm head and using current IT capabilities properly, you can keep the risks to your organisation acceptably low and protect your most valuable information

Design and Innovation

A Startup for When the Startup Money Runs Out (Wired Business) Exitround is a San Francisco-based startup that helps other startups get bought up by the big names in Silicon Valley and beyond

Korean Startup Accelerator SparkLabs Hosts Its First Demo Day, Adds Tom Peters To Advisory Board (TechCrunch) Korean startup accelerator SparkLabs hosted its first Demo Day in Seoul today with five of the six companies in the inagural class it revealed back in November (one company, online gaming studio Merrywind, is developing a game that is currently in stealth mode, so it did not present today). SparkLabs also announced that it will expand into healthcare with its second round of startups, in addition

Japanese password protector floods screen with hoax cursors - Password peepers foiled by camouflaged cursor (The Register) apanese boffins have demonstrated a rather nifty way of preventing online password theft by screen capture and shoulder surfing flood the screen with a barrage of dummy cursors. Researchers at the government backed Japan Science and Technology (JST) Agency showed off the rather unusual approach to preventing fraud to local tech vid site DigInfoTV. The technique works by camouflaging the users cursor so anyone looking over their shoulder or remotely taking screen grabs of the page will not be able to detect which keys on the software keyboard are being chosen

Oz Senator says Google Glass could 'end privacy as we know it' (The Register) Australian Senator Cory Bernardi has declared Google Glass might just be the end of privacy as we know it, because Google could use the device to conduct enable mass surveillance. Bernardi is a Liberal Senator for South Australia. Australia's Liberals are the nation's dominant right wing party and claim kinship with the UK's Conservative Party and the USA's Republicans

Research and Development

Seven-Year Facebook Study Warns of 'Silent Listeners' (Threatpost) Facebook users are sharing less information publicly, yet continue to share countless bits of information with what one group of researchers has dubbed "silent listeners." The researchers, from Carnegie Mellon University, recently wrapped up the world's first multiyear, longitudinal privacy study of the site. The study relies on a slew of information harvested from Facebook users who were members of the school's network over the course of seven years

Groundbreaking Cyber Fast Track Research Program Ending (Threatpost) When Peiter Zatko, the security researcher and pioneering hacker known as Mudge, joined the federal government several years ago to help run a DARPA research program, some in the security industry wondered what effect someone with his background could have in an organization as famously change-resistant and slow as the Department of Defense. As it turns out, the Cyber Fast Track program he started has been a huge success and though the CFT is ending in less than a month, the program may well serve as a model for other agile research programs inside the U.S. government

Academia

Cyber security teams from across Northeast face off at UMaine this weekend (Bangor Daily News) The University of Maine will come under attack Friday, with only teams of computer science students left to defend it. Ten teams will compete in the three-day 2013 regional Northeast Collegiate Cyber Defense Competition at UMaine's Neville Hall. They will be tasked with defending against computer hacking attempts devised by national cybersecurity professionals, including some with military and corporate computing experience, according to George Markowsky, organizer of the event and associate director of the UMaine School of Computing and Information Science

New Cyber Security, Forensics Center Formed: Program Will Help Strengthen National Cyber Infrastructure (University of Massachusetts Lowell) In his recent State of the Union address to Congress, President Obama declared that America must face the rapidly growing threat from cyber-attacks, including to "our power grid, our financial institutions [and] our air-traffic control systems"…To help strengthen our country's cyber defenses and protect national security, jobs and privacy, the University merged its Center for Network and Information Security and Center for Cyber Forensics to form a new Center for Internet Security And Forensics Entrepreneurs (I-SAFE)

Legislation, Policy, and Regulation

Texas proposes one of nation's 'most sweeping' mobile privacy laws (Ars Technica) If signed into law, cops would finally need a warrant to get location data

Wolf Tells NASA To Cancel Chinese Visit to NASA Langley (Aviation Week) Rep. Frank Wolf (R-Va.), chairman of the House Appropriations subcommittee that funds NASA,, has demanded that the U.S. space agency revoke a reported invitation to Chinese officials for an Earth-observation coordination conference at Langley Research Center next week. In a March 4 letter to Administrator Charles Bolden, Wolf said he has learned that Chinese participants will be included in a meeting of the Committee on Earth Observation Satellites (CEOS) strategic implementation team at Langley March 12-14. Under a law drafted by Wolf, a frequent critic of Chinas human rights and intelligence practices, NASA or the White House science office must certify to Congress that there will be no national security threat from an upcoming Chinese visit at least 14 days before the event

Heads-Up - Cybersecurity directive faces uncertain fate in Parliament (EurActiv) EU attempts to introduce comprehensive new cybersecurity rules risk failure in the European Parliament, where senior administrators doubt the package will pass before the legislature's mandate expires, EurActiv has learned. In addition to the launch of its new over-arching Cybersecurity Strategy, the European Commission last month proposed a Directive with measures to ensure harmonised network and information security across the EU. The proposed legislation will oblige companies to be audited for preparedness and to notify national authorities of cyber incidents with a significant impact

Companies Want Lawsuit Shield to Share Cyber Threat Data (Bloomberg) A month after President Barack Obama issued an executive order on strengthening U.S. cybersecurity, companies want Congress to provide incentives for joining the federal push for sturdier computer defenses. Under Obamas Feb. 12 order, the U.S. is to develop voluntary cybersecurity standards for critical industries and speed up government sharing of threat information with the private sector. Companies such as Dow Chemical Co

U.S. lawmakers introduce electronic surveillance reform bill (Computer World) Three U.S. lawmakers have introduced a bill to provide more protection from government surveillance for people who store data in the cloud. The Online Communications and Geolocation Protection Act would require U.S. law enforcement agencies to get court-ordered warrants before intercepting or getting access to electronic communications and geolocation data. The bill, which would change the 1986 Electronic Communications Privacy Act (ECPA), was introduced Wednesday by Representatives Zoe Lofgren, a California Democrat, Ted Poe, a Texas Republican, and Suzan DelBene, a Washington Democrat

Indian Police Agency Launches Responsible Disclosure Program (Softpedia) The Cyber Defence Research Center(CDRC) of Indias Jharkhand Police has launched a responsible disclosure program to help ethical hackers submit the vulnerabilities they find to the affected vendors, E Hacking News reports. The program encourages all those who identify security issues on the websites or in the computer systems of Indian ministries, public or private organizations, or government departments to fill out a submission form with the required details. Our in house team has close relationships with the information security community and disclosure has been found to be a big issue amongst the ethical hacker community, the police agencys CDRC noted

Defense Science Board Warns Of 'Existential Cyber Attack' (Business Insider) When former Defense Secretary Leon Panetta warned of a cyber attack equivalent to Pearl Harbor, he appears to have understated the threat

OVERNIGHT TECH: Senate Homeland Security and Commerce panels to talk (The Hill) Top House Homeland Security Dems call for cyber information-sharing bill to be referred to panel: Top Democrats on the House Homeland Security Committee are calling for their GOP counterparts to ensure the Cyber Intelligence Sharing and Protection Act

'Common sense' says users should be able to unlock cell phones (InformationWeek) A number of United States senators are looking to overturn a ruling by the Library of Congress prohibiting users from unlocking their cell phones from their carrier even after their contract has expired

Litigation, Investigation, and Law Enforcement

LinkedIn Data Breach Lawsuit Dismissed (Threatpost) The professional networking site LinkedIn won a class-action lawsuit before it even went to trial after a judge this week dismissed claims from two premium users who maintained the company failed to provide the level of data security outlined in its privacy policy

Jeremy Hammond marks 1 year in prison without trial (Daily Dot) It's the first anniversary of the day Jeremy Hammond was arrested for the last time. Since his March 5, 2012 arrest, he's been in Federal custody, and currently resides in "The Hole"--solitary confinement at the Metropolitan Correctional Center in New York City. Hammond has yet to stand trial. If convicted, he could face anywhere from 35 years to life in prison, and it's still unclear whether the year he's spent in custody without trial will be subtracted from his total sentence. Long pre-trial custody is now the norm for high-profile leaks and hacks--WikiLeaks whistleblower Bradley Manning has been held for more than 1,000 days. Once the trial is over, there's no restriction on talking to the press, but prior to that time no competent attorney will allow a defendant to give interviews, lest it prejudice the trial. Hammond's alleged crimes center around the infamous Stratfor hack of December, 2011, in which the operations of a private global intelligence contractor were exposed for all to see

Attorney General: Aaron Swartz Case Was a Good Use of Prosecutorial Discretion (Wired) Attorney General Eric Holder on Wednesday said the suicide death of internet activist Aaron Swartz was a tragedy, but the hacking case against the 26-year-old was a good use of prosecutorial discretion. Holder, the nations top prosecutor, is the highest-ranking member of the President Barack Obama administration to defend the indictment and prosecution of the former director of Demand Progress, who committed suicide in January as his April trial approached. Holders comments come seven weeks after Massachusetts U.S. Attorney Carmen Ortiz, whose office was prosecuting Swartz, said the authorities actions were appropriate in bringing and handling this case

Feds Demand Dismissal of Dragnet-Surveillance Challenge (Wired) Citing week-old Supreme Court precedent, the President Barack Obama administration told a federal judge Wednesday that it should quash a federal lawsuit accusing the government of secretly siphoning Americans electronic communications to the National Security Agency without warrants. The San Francisco federal court legal filing was in response to U.S. District Judge Jeffrey Whites written question (. pdf) to the government asking what to make of the high courts Feb. 26 decision halting a legal challenge to a once-secret warrantless surveillance project that gobbles up Americans electronic communications a program that Congress eventually legalized in 2008 and again in 2012

Google and Spain wrestle over EU privacy law (EurActiv) Google did battle with Spain's data protection authority in Europe's highest court on Tuesday (26 February), in a case with global implications that poses one of the toughest questions of the Internet age: When is information really private? The issue before the European Court of Justice boils down to this: If a person fails to make social security payments and their house is auctioned as a result, do they have the right to force Google to delete such damaging information from search results? Behind that question lie complex arguments over freedom of information, the right to protect data, what it means to be a publisher and who ultimately polices the web

Google sees 30 percent rise in National Security Letters from FBI (FierceGovernmentIT) The number of National Security Letters that Google receives from the FBI seeking user data is growing significantly, according to the company's latest transparency report. In 2012, the search engine company saw a 30 percent spike in NSLs from the FBI

Government Google Data Requests: Scope Unclear (InformationWeek) Google has begun disclosing limited information about U.S. government investigations that demand consumer data and, usually, silence from those cooperating

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

TechMentor Orlando 2013 (Orland, Florida, USA, Mar 4 - 8, 2013) Celebrating 15 years of educational events for the IT community, TechMentor is returning to Orlando, Florida, March 4-8, for 5 days of information-packed sessions and workshops. Surrounded by your fellow IT professionals, you will receive immediately usable education that will keep you relevant in the workforce. TechMentor track topics include:Windows PowerShell and AutomationCisco and Networking Infrastructure Windows Server Management Windows Client Management Cloud and Virtualization Identity, Access Management and Security Performance Tuning and Troubleshooting Mobility and BYOD Messaging and Collaboration.

IHS CERAWeek 2013 (Houston, Texas, USA, Mar 4 - 8, 2013) IHS CERAWeek 2013 will offer new insight on the energy future -- and on the strategic and investment responses by producers, consumers and policy-makers. What are the changes ahead in the competitive landscape for oil, natural gas, coal, renewables, and nuclear power? How will the global unconventional oil and gas revolution change the game for all energy participants? What will be the fuel and technology choices of the future. Michael Hayden will deliver the keynote. While primarily concerned with the energy sector, the conference may also be of interest to the cyber security industry.

Business Insurance Risk Management Summit (New York City, New York, USA, Mar 5 - 6, 2013) The annual Risk Management Summit, now in it its fourth year, provides attendees with focused insight via specific, timely general sessions and strategic, thought-provoking discussions with peers and industry leaders.

CanSecWest 2013 (Vancouver, British Columbia, Canada, Mar 6 - 8, 2013) CanSecWest, the world's most advanced conference focusing on applied digital security, is about bringing the industry luminaries together in a relaxed environment which promotes collaboration and social networking. The conference lasts for three days and features a single track of thought provoking presentations, each prepared by an experienced professional and talented educator who is at the cutting edge of his or her field. We give preference to new and innovative material, highlighting important, emergent technologies, techniques, or best industry practices. It will feature a bigger, enhanced Pwn2own.

e-Crime Congress 2013 (London, England, Mar 12 - 13, 2013) The e-Crime Congress is designed to meet the needs of key stakeholders and decision makers who are responsible for designing and coordinating information security and risk management strategy, safeguarding digital assets and sensitive information, protecting customers, defending against internal or external threats and responding to incidents.

CTIN Digital Forensics Conference (Seattle, Washington, USA, Mar 13 - 15, 2013) Speakers include experts and published authors in the field of digital forensics and cybersecurity. Topics include; Mobile Device Forensics, Internet Forensics, Physical Memory Analysis, Open Source Tools, Data Carving, Registry Forensics, Placing the Suspect Behind the Keyboard, Triage and Live Forensics CDs, and more.

Google and University of Maryland Cybersecurity Seminar (College Park, Maryland, USA, Mar 14, 2013) Dr. Ari Juels, Chief Scientist of RSA, The Security Division of EMC, and Director of RSA Laboratories, will discuss "Aggregation and Distribution in Cloud Security." His talk will feature information on cloud computing and virtualization, a key supporting technology. Cloud computing offers flexibility and agility in the placement of resources. Certain risks, however, arise from cloud services' tendency to aggregate sensitive data and workloads. He will discuss side-channel attacks resulting from the co-location of disparate tenants' virtual machines (VMs) on hosts and the vulnerabilities posed by databases aggregating the authentication secrets, e.g., password hashes, of numerous users. Conversely, cloud computing offers new opportunities to distribute data. Dr. Juels will also describe a new, research-driven RSA product that splits sensitive data across systems or organizations, removing the single points of compromise that otherwise naturally arise in cloud services.

Department of Homeland Security 6th Annual Industry Day (Washington, DC, USA, Mar 18, 2013) The Department of Homeland Security (DHS) will be hosting its 6th Annual Industry Day to provide advanced acquisition planning information to industry. DHS Industry Day will consist of two sessions, the morning session will be procurement-centric with an emphasis on procurement issues, policies and programs. The afternoon session will be Chief Information Officer (CIO) IT-centric. Both sessions will provide acquisition information concerning specific program areas.

IT Security Entrepreneurs' Forum (ITSEF 2013) (Palo Alto, California, USA, Mar 19 - 20, 2013) Supported by the U.S. Department of Homeland Security, Office of Science and Technology, ITSEF 2013 aims to connect the ecosystem of the entrepreneur: industry, government, and academia. The conference will advance innovation, lead change and build trusted global collaboration models between the public and private sectors to defeat Cybersecurity threats.

The Future of Cyber Security 2013 (London, England, UK, Mar 21, 2013) Cyber Security and the Citizen 2013 is a one-day conference and exhibition for senior decision-makers of central and local government organisations, NGOs and major private sector enterprises.

SANS Cyber Threat Intelligence Summit (Washington, DC, USA, Mar 22, 2013) Conventional network defense tools such as intrusion detection systems and anti-virus focus on the vulnerability component of risk, and traditional incident response methodology presupposes a successful intrusio…Network defense techniques which leverage knowledge about these adversaries - known as cyber threat intelligence - can enable defenders to establish a state of information superiority which decreases the adversary's likelihood of success with each subsequent intrusion attempt…The goal of this summit will be to equip attendees with knowledge on the tools, methodologies and processes they need to move forward with cyber threat intelligence. The SANS What Works in Cyber Threat Intelligence Summit will bring attendees who are eager to hear this information and learn about tools, techniques, and solutions that can help address these needs.

AFCEA Belvoir Industry Days 2013 (National Harbor, Maryland, USA, Apr 2 - 3, 2013) The purpose of this event is to inform the IT community about the recent successes and the forward-thinking opportunities that the Department of Defense and the Department of the Army have developed.

CSO40 (Braselton, Georgia, USA, Apr 2 - 3, 2013) The CSO40 Security Confab + Awards will honor and share the critical viewpoints of today's leading CSOs, CISOs and security executives at the nation's leading CSO thought leadership conference.

Cloud Connect Silicon Valley (Santa Clara, California, USA, Apr 2 - 5, 2013) Cloud Connect returns to Silicon Valley, April 2-5, 2013, for four days of lectures, panels, tutorials and roundtable discussions on a comprehensive selection of cloud topics taught by leading industry experts.

An Evening in Cyberspace: Supporting Tomorrow's Cybersecurity Leaders (National Harbor, Maryland, USA, Apr 6, 2013) UMUC is pleased to present An Evening in Cyberspace: Supporting Tomorrow's Cybersecurity Leaders. Join us for this special black-tie event to support the next generation of cybersecurity students. The evening will feature a reception, dinner, keynote and entertainment.

Cyber 1.3 (, Jan 1, 1970) Maj. Gen. Suzanne Vautrinot, USAF, commander, 24th Air Force, and commander, Air Force Network Operations, will discuss the global strategic implications that relate to the cyber domain at the Space Foundation national conference Cyber 1.3, to be held Monday, April 8th, at The Broadmoor Hotel in Colorado Springs, Colorado. Cyber 1.3 is a full-day conference that takes place immediately before the official opening of the 29th National Space Symposium. The conference includes a networking breakfast, a luncheon and concludes with a networking reception, co-sponsored by General Dynamics Advanced Information Systems. Government Executive Media Group is a Cyber 1.3 media co-sponsor.

HITBSecConf2013 (Amsterdam, the Netherlands, Apr 8 - 11, 2013) HITB2013AMS will feature cutting edge attack and defense research including the a presentation on the inner workings of the iOS 6.1 Evasi0n jailbreak presented by members of the world famous Evad3rs Team, a brand new kernel level exploit affecting _all versions_ of Microsoft Windows up till Windows 8 and even a presentation on remotely hacking airplanes.

INFILTRATE 2013 (Miami, Florida, USA, Apr 11 - 12, 2013) INFILTRATE is a deep technical conference that focuses entirely on offensive security issues. Researchers focused on the latest technical issues will demonstrate techniques that you cannot find elsewhere.

Information Tech Expo Series - Hawaii (Oahu, Hawaii, USA, Apr 12 - 19, 2013) This 6-series showcase will feature stops at 5 DoD locations and 1 Intel Center on the island of Oahu. Celebrating 20 years of these expos is a true testament to the government and military's readiness to learn from and work with industry partners. .

InfoSec World Conference & Expo 2013 (Orlando, Florida, USA, Apr 15 - 17, 2013) With the primary objective of providing top-notch education to all levels of information security and IT auditing professionals, InfoSec World delivers practical sessions that give you the tools to strengthen your security without restricting your business.

Infosec Southwest 2013 (Austin, Texas, USA, Apr 19 - 21, 2013) InfoSec Southwest is intended to be a general security and hacking conference with no specific industry or topical focus. As such, nearly all topics (other than vendor pitches) are fair game and the attending audience is expected to span all demographics.

23rd Annual Government Procurement Conference (Washington, DC, USA, Apr 25, 2013) This unique one-day event attracts more than 3,000 participants representing government agencies, prime contractors and small businesses from around the country. Participating companies are able to network with procurement officials from federal, state and local government agencies under one roof.

Interop Las Vegas (Las Vegas, Nevada, USA, May 6 - 10, 2013) Attend Interop Las Vegas, May 6-10, and attend the most thorough training on Apple deployment at the NEW Mac & iOS IT Conference. Join us in Las Vegas for access to 125+ workshops and conference classes, 350+ exhibiting companies and the latest technology.

FOSE (Washington, DC, May 14 - 16, 2013) FOSE is the premier event for government technology professionals interested in innovative, effective tools and solutions allowing you and your agency or organization to advance your mission. From IT managers and buyers to CIOs and other technology management professionals, FOSE has the right products, people and solutions for you in one very accessible location.

Maryland/DC Celebration of International Trade (Linthicum, Maryland, USA, May 21, 2013) Join Maryland exporters and international business experts as they celebrate International Trade Week. Hosted by the Maryland/DC District Export Council this event is a content rich celebration of international trade. Participate in expert discussions lead by manufacturers, legal, financial, transportation and industry experts as well as government leaders in eight vertical tracks for a total of 24 highly interactive 90 minute sessions.

IEEE-Cyber 2013 (Nanjing, China, May 26 - 29, 2013) This conference will cover cyber physical systems, cyber control and automation, cyber robotics, and the Internet of things.

Cyber Security @ CeBIT (Sydney, New South Wales, Australia, May 28 - 30, 2013) The Cyber Security Conference will serve as a platform where all those involved in securing and governing ICT within an organisation can discuss the newest challenges and strategies. The event is a must-attend for CIOs, CSOs, CISOs, Chief Risk Officers, Heads of Governance and Compliance and IT Directors. It is predicted that security service spending in Asia-Pacific will reach $7 billion in 2015, so ensure that you are investing in the best technologies for your business by joining us at the Cyber Security Conference on 28 May 2013 and hearing from leading financial institutions, retailers, airlines, telecoms companies and government.

DGI Cyber Security Conference & Expo (Washington, DC, 2013, May 30, 2013) Data security threats continue to increase in number and sophistication. The growing use of collaborative technologies - from mobile devices and social media to virtualization and cloud computing - will continue to be one of the most significant factors impacting the security landscape. For these reasons, the federal government has increased efforts to minimize and prevent cyber security attacks, and will continue to place significant focus on securing the nation's cyber infrastructure.

Consumerization of IT in the Enterprise Conference and Expo (San Francisco, California, USA, Jun 2 - 4, 2013) From smartphones to mobile apps, social software and 4G networks, the wave of innovation in the consumer space is transforming the way companies do business, both inside and outside of the enterprise. Over two and a half action packed days, CITE 2013 will bring together IT and business executives, venture capitalists and other practitioners to showcase leading efforts and teach others how to make the most of this transformation.

CyCon 2013: 5th International Conference on Cyber Conflict (Tallinn, Estonia, Jun 4 - 7, 2013) CyCon 2013 is an annual NATO Cooperative Cyber Defence Centre of Excellence conference that is conducted with the technical cooperation of the IEEE Estonia Section. CyCon 2013 will focus on the technical, strategic and legal implications of using automatic methods in cyber conflicts. The conference will be organized along two tracks: a Strategic Track and a Technical Track. Legal aspects will be incorporated in these two tracks.

NSA SIGINT Development Conference 2013 (Fort Meade, Maryland, USA, Jun 4 - 5, 2013) The National Security Agency is responsible for providing foreign Signals Intelligence (SIGINT) to our nation's policy-makers and military forces. SIGINT plays a vital role in our national security by providing America's leaders with critical information they need to defend our country, save lives, and advance U.S. goals and alliances globally. The exposition will be unclassified and will consist of a one-day event as an adjunct to the SIGINT Conference. The conference sessions will be conducted in a classified area in close proximity to the exhibits.

U.S. Census IT Security Conference and Exposition (Suitland, Maryland, USA, Jun 5, 2013) The Census Bureau's Information Technology Security Office (ITSO) and the Census Bureau's Data Stewardship Office is putting together a series of workshops on 'Information Security' and 'protecting your information' to lead up to their Annual IT Security Awareness Conference. This specific workshop will take place on June 5, 2013 with a focus on Security Issues..

2013 Cybersecurity Innovation Expo (Baltimore, Maryland, USA, Jun 10 - 13, 2013) Do not miss the opportunity to participate in the 2013 Cyber Innovation Forum with active participation from National Institute of Standards and Technology (NIST), the National Security Agency (NSA), and the Department of Homeland Security (DHS). This four-day event will take place at the Baltimore Convention Center on Monday, June 10 - Thursday, June 13 with the exposition taking place June 11-12.

3rd annual Cyber Security Summit (, Jan 1, 1970) Over the last 2 years, the summit has gathered 150+ senior Defence, National Security and Industry executives to address current and emerging cyber threats to Australia's security. Now in its 3rd year, ADM Cyber Security aims at: reviewing solutions to the ever increasing level of attacks, whether real or potential, [and] equipping all stakeholders with a wide range of actionable strategies.

25th Annual FIRST Conference (Bangkok, Thailand, Jun 16 - 21, 2013) The annual FIRST conference provides a setting for conference participants to attend a wide range of presentations delivered by leading experts in both the CSIRT field and from the global security community.

SECRYPT 2013 (Reykjavik, Iceland, Jul 29 - 31, 2013) The 10th International Conference on Security and Cryptography (SECRYPT 2013) will take place from 29 to 31 July 2013 in Reykjavik, Iceland…The conference will focus on information systems and network security, including applications within the scope of knowledge society in general and information systems development in particular, especially in the context of e-business, internet and global enterprises. It will bring together researchers, mathematicians, engineers and practitioners interested in security aspects related to information and communication.

International Conference on Cyber Security (New York, New York, USA, Aug 5 - 8, 2013) The Federal Bureau of Investigation and Fordham University will host the fourth International Conference on Cyber Security (ICCS 2013) on August 5 - 8, 2013 in New York City. ICCS, the White Hat Summit, is an unparalleled opportunity for global leaders in cyber threat analysis, operations and law enforcement to coordinate their efforts to create a more secure world. With the number of cyber threats escalating worldwide, the need for comprehensive security analysis, assessment, and actions has never been greater. Join those working on the front-lines of secure cyber networks at ICCS for the opportunity to learn useful knowledge and share critical intelligence on issues shaping the future of cyber security.

3rd Annual Cyber Security Training Forum (Colorado Springs, Colorado, USA, Aug 6 - 7, 2013) The Information Systems Security Association (ISSA) - Colorado Springs Chapter and FBC, Inc. will once again host the 3rd Annual Cyber Security Training Forum (CSTF). Formerly known as the Cyber Security Training Conference, CSTF is set to convene from Tuesday August 6, 2013 to Wednesday, August 7, 2013 at the DoubleTree by Hilton, Colorado Springs, Colorado.CSTF 2013 will bring together cyber experts from the DoD, federal government, business, research, and academia to address: the latest DoD and government cyber policies, remediation strategies and best practices, the growing impact, and evolution, of cyber threats and how to continue to protect and defend the Global Information Grid (GIG), mobility strategies, cloud & virtualization advancements, and emerging technologies. This will be accomplished through a number of in-depth cyber sessions, hands on live demonstrations, the yearly cyber challenge and government and industry exhibits. Don't miss this educational, and cost effective, cyber event in Colorado Springs, CO..

First International Conference on Cyber-Physical Systems, Networks, and Applications (Taipei, Taiwan, Aug 19 - 20, 2013) CPSNA 2013 will focus on core challenges of cyber-physical systems. Given a tight integration of computation and the physical world, cyber-physical systems must compose robust systems, networks, and applications built upon predictable, analyzable, and certifiable models and abstractions. CPSNA 2013 will serve as a forum to discuss new ideas for such core challenges of cyber-physical systems.

TechCrunch Disrupt San Francisco (San Francisco, California, Sep 7 - 11, 2013) For the fourth year in a row, TechCrunch Disrupt will take over the San Francisco Design Center Concourse, and we're bringing the hottest startups and best minds in the industry with us. Block off September 7-11 on your calendar, because you're not going to want to miss Disrupt SF 2013. The Hackathon kicks everything off, followed by our main event, which starts every morning with panels of special speakers and guests, one-on-one chats featuring TechCrunch writers and editors, special guest speakers and judges, leading venture capitalists and fascinating entrepreneurs addressing the most important topics facing today's tech landscape. In the afternoons, the Startup Battlefield presentations begin, with the final presentations held on the last day of Disrupt.

15th Annual AT&T Cyber Security Conference (New York, New York, USA, Sep 10, 2013) The AT&T Cyber Security Conference is an annual day-long conference offered by the AT&T Chief Security Office. Combining the expertise of its security experts, the scale and reliability of its global IP network and the innovation of AT&T Labs, AT&T is giving businesses some of the most powerful weapons available today in their battle against cyber security attacks. The conference showcases AT&T's leadership in helping businesses, large and small, manage the increasingly complex and critically important security of their IT networks and assets.

CyberMaryland 2013 (Baltimore, Maryland, USA, Oct 8 - 9, 2013) Join cybersecurity leaders, luminaries and rising stars at CyberMaryland 2013. This two-day event at the epicenter of the nation's cybersecurity innovation and education, will create opportunities for networking and idea sharing amongst the many cyber leaders and professionals across the country, including: federal, state and local government agencies, academic institutions, cybersecurity entrepreneurs, and industry leaders of research and development. CyberMaryland 2013 will address the biggest challenges facing America, including future innovation to meet the security challenges facing our country; collaboration across industry, government and educational institutions; and the development of a generation of cyber-warriors. Surrounding all of these issues is a constantly evolving business framework to provide efficient and effective solutions in a time frame that anticipates and mitigates current and future threats.

International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery (Shanghai, China, Oct 10 - 12, 2013) International Conference on Cyber-enabled distributed computing and knowledge discovery -promotes research and development of the cyber-related technology. It is unique and significant that spans through cyber-enabled data mining and knowledge discovery, distributed and parallel computing, cyber security, cloud computing, pervasive computing, mobile computing, Internet, wireless networks, cognitive systems, cyber information process, information discovery, e-health via cyber network, e-science, web technology, and network performance and tools. The research and development in these areas have received extensive attention in both the academia and industry to provide ubiquitous services for users. Various hardware and software designs, algorithms, protocols, simulations, and test-bed, and implementations are developed for distributed computing in an interconnected and distributed network environment. The purpose of CyberC is to provide a forum for presentation and discussion of innovative ideas, research results, applications and experience from around the world as well as highlight activities in the related areas.

APPSEC USA (New York, New York, USA, Nov 18 - 21, 2013) Welcome to Appsec USA 2013, New York - a world class software security conference for developers, auditors, risk managers, and entrepreneurs, bringing you the world's top speakers, the most relevant security topics and an unbeatable atmosphere. Hosted by OWASP.

2013 ASE International Conference on Cyber Security (Orlando, Florida, USA, Dec 10 - 15, 2013) The annual ASE Cyber Security Conference is a leading international forum for cyber security researchers, practitioners, developers, and users to explore cutting-edge ideas and results, and to exchange techniques, tools, and experiences. The conference seeks submissions from academia, government, and industry presenting novel research on all practical and theoretical aspects of cyber security. The First ASE International Conference on Cyber Security provides a key forum for researchers and industry practitioners to exchange information regarding advancements in the state of art and practice of cyber security.