The CyberWire Daily Briefing for 4.4.2013

Cyber Attacks, Threats, and Vulnerabilities

Israelis spooked by threat of all-out cyber attack next week (Haaretz) Israelis spooked by threat of all-out cyber attack next week. Many Israelis have reported a virus being spread via Facebook, days before a major cyber offensive is expected to be launched on Israel by several hacker groups

Banking Trojan disguised as innocuous Word and WinHelp files (Help Net Security) Part of the job of a malware author is to constantly think up new ways of outsmarting researchers and bypassing automatic detection methods used by antivirus and other security software. These techniques are eventually recognized and incorporated into the defenses, but it's always interesting for malware analysts to unearth new ones. Panda Security malware researcher Bart Blaze has recently discovered a banking Trojan targeting Brazilian online banking users that employs a novel way to hide its real nature: its executables are delivered in the guise of .hlp (WinHelp) files

Sophos' flagship web security product open to attack (SC Magazine) A popular web security appliance suffers from a number of severe vulnerabilities that could provide hackers with a launching pad to fire attacks against a victim organization. The trio of flaws are present in the previous version of Web Protection Appliance, produced by security firm Sophos. The company since has acknowledged the bugs and released an update, with the final batch of customers receiving the new version on Monday, according to a Sophos advisory. There are no reports of exploits in the wild

Has your Hewlett-Packard ScanJet printer just tried to infect your PC with malware? (Naked Security) Beware! Cybercriminals have attempted to infect computers worldwide, disguising their attack as an email claiming to come from a scanner in your office

In wake of Bitcoin spike, Instawallet halts service and Mt. Gox 'eats' DDOS (Ars Technica) Instawallet will reimburse accounts with less than 50 BTC—good luck if you're over

Mt. Gox under largest DDoS attack as bitcoin price surges (ComputerWorld) The largest bitcoin exchange said Thursday it is fighting an intense distributed denial-of-service attack it believes is intended at manipulating the price of virtual currency, which has seen volatile price swings in the past few days. Mt. Gox, which is based in Tokyo, said the attacks have caused its worst trading lags ever and caused error pages to be displayed to traders, according to a post on Facebook. By its own calculation, 80 percent of the bitcoin trades in U.S. dollars are executed on Mt. Gox's trading platform and 70 percent of all trades in other currencies

Bitcoin storage service, Instawallet, suffers database attack (CSO) Instawallet, which stored a person's bitcoins, said it will refund some lower balances

ING internet banking in chaos after 'mysterious' withdrawals (Dutch News) Financial services group ING is grappling with a major internet banking breakdown which has led to thousands of people being unable to use their direct debit cards. In some cases, people have lost thousands of euros from their accounts because of the fault while others have thousands of euros too much, Nos television reported. Even account holders who are not allowed to overdraw have discovered their counts are deep in the red because of double bookings

Retailers call for more action on ING internet banking problems (Dutch News) The disruption to INGs internet banking system on Wednesday night may have dramatic consquences for shopkeepers, the Dutch retail association told BNR radio. Thousands of people were unable to use their ING accounts for several hours because they were wrongly overdrawn or unable to see their balances. The chaos forced ING to shut down its internet banking system for a time

The War Z Hacked (eSecurity Planet) Game and forum e-mail addresses and encrypted passwords were accessed. Game publisher OP Productions LLC recently announced that the forum and game databases for the online game The War Z had been breached, and the the game and forums have been taken down temporarily in response (h/t Softpedia)

University of Florida Warns over 14,000 Individuals of Possible Identity Theft (Softpedia) The University of Florida is notifying 14,339 patients of the UF & Shands Family Medicine at Main medical clinic that their details might have been sold to an identity theft ring by one of the clinics employees. We share our patients frustration regarding this situation and regret that it happened. We are committed to serving our patients and helping them get through any problems that arise stemming from this incident said Susan Blair, chief privacy officer for the University of Florida

Bank card-slurp nasty 'infects tills, ATMs', corrupt staff fingered (Bank card-slurp nasty 'infects tills, ATMs', corrupt staff fingered) Audacious crooks have infected hundreds of shopping tills and cash machines with malware to swipe sensitive debit and credit card data, we're told. Researchers at Russian security firm Group-IB said the software nasty is called Dump Memory Grabber, which targets computers running Microsoft Windows. It can swipe information about cards issued by US banks as well as Nordstrom-branded cards

OpFuelStrike: Royal Dutch Shell Company Hacked, Database Leaked by Brazil Electronic Army (The Hackers Post) The official website of Royal Dutch Shell Company hacked by the Brazil Electronic Army under the operation called #OpFuelStrike, The operation against Oli Companies. The hackers announced the hack and leaked database on twitter handle

Hackers dump details on new Secret Service director (Russia Today) Just one week after President Obama appointed Julia Pierson as the first female Secret Service director in the agencys 148-year history, a group of hackers claims to have leaked her personal information. Pierson was among the names listed by hackers behind the website Exposed. re, which advertised Secret Files pertaining to US Attorney General Eric Holder, former Republican presidential candidate Mitt Romney, Microsoft founder Bill Gates, former US president George W. Bush, actress Angelina Jolie and a slew of other celebrities and public figures

Cartel Watchdog Disappears From Social Media After Death Threats (Wired Danger Room) The Twitter and Facebook accounts for a popular crime watchdog in one of Mexico's most dangerous states has been abruptly taken down. The owner also has a $46,000 bounty on his head

Anonymous hits North Korea in giant cyber attack (SC Magazine) Hackers claiming links with Anonymous have hit a number of websites connected with North Korea in what it claims is a response to recent aggressive behaviour by the secretive state towards South Korea and the United States

60 Malicious Codes Found in March 20th Cyber Attack (Arirang) A total of 60 malicious codes have been found in the massive cyber attack that downed systems at South Korea's banks and broadcasters last month. Government authorities say some 48-thousand PCs, electronic devices and ATMs were affected by the attack and that the number of the malicious codes would likely rise. Authorities went on to say that most of the codes came through several countries including the U.S

The Nine-Day Cyber Attack That Broke the Internet (CNBC) It's been awhile since most of us complained about spam choking our inboxes. Like Gangnam Style and designer cupcakes, spam is played out. But the recent cyber attack on Spamhaus, a European anti-spam organization, returned spam to the tip of the tongue. Mostly,because it caused trouble for a lot of innocent bystanders, and it has those of us on cyber security's front lines toting up the lessons

Bahrain 'facing major Internet disruption' (Trade Arabia) Internet users in Bahrain are facing weeks of disruption following what experts are saying is the biggest cyber attack in history by saboteurs, a report said. Millions of people worldwide have already suffered days of slow speeds, according to the

Cyber attack a virtual whack-a mole (Herald Argus) Did you know that one of the largest cyber attacks in history occurred last week? Our super duper information highway experienced a traffic jam that affected millions of users and shut down countless servers. The cyber highway was so gnarled and tangled horns were blaring all around the globe. O.K. so there were no horns but if our computers had horns they would have been blasting forth with the frustrations of internet users from here to Timbuktu

The biggest Mac malware attack of all time - blogger names suspected mastermind (Naked Security) Award-winning security blogger Brian Krebs has shared details of his investigation into who might have been behind Flashback - which hit more than 600,000 Mac computers in early 2012

How Attackers Choose Which Vulnerabilities To Exploit (Dark Reading) A look at how the bad guys choose their attack methods -- and what you can do about it. It's an old but true adage: To protect yourself against a criminal, you have to think like a criminal. This certainly applies to IT security professionals working to keep their organizations' systems and data safe: To protect against a cyber attacker, you have to think like a cyber attacker

Security Patches, Mitigations, and Software Updates

Skype And Dropbox Fix Redirect Security Hole That Could've Hacked Your Facebook (TechCrunch) Nir Goldschlager just saved your identity. One of the world's top white hat security researchers, Goldschlager this week helped Skype and Dropbox fix a critical security flaw that could have let hackers take control of their users' Facebook accounts. Tomorrow Goldschlager will detail how he found the exploit, but he gave TechCrunch the early heads up. Here's how hackers exploit the hole

Security Advisories for Firefox (Mozilla) [Current summary of Firefox vulnerabilities and fixes.

Cyber Trends

Activists on Front Lines Bringing Computer Security to Oppressed People (Threatpost) Security-related policy or legislation is enacted and then enforced to protect corporate, government or military interests. Civil organizations are often left flailing in the wind, fending for themselves with fewer IT resources and experience than a Middle America mom-and-pop operation. Yet these non-governmental—and not-for-profit—organizations have tasked themselves with helping those targeted by lethal adversaries who aren't just after corporate secrets, but are out to deny people their freedom or, in some cases, their lives

Security professionals don't have secure mobile habits (Help Net Security) Security professionals have embraced BYOD and theyre taking anytime, anywhere access to some pretty interesting locations according a new survey by Ping Identity. Most also admit to employing poor password security practices. The survey, based on 198 responses from attendees at RSA Conference 2013, sought to discover how work habits are changing as a result of cloud and mobile enterprise trends

Cybercrime a growing concern for businesses, security spending up at 40 percent of UK firms (We Live Security) Fears of cybercrime have become a major concern for many businesses around the world, and the UK is no exception. A recent UK survey found security spending was on the rise at four out of ten firms. The task is also increasingly time-consuming, with IT staff claiming to spend nearly one day a week dealing with security issues

Carna Compromise Delivers Data, But Casts Suspicions (Dark Reading) An anonymous researcher who infected more than 420,000 systems with a program aimed at collecting data on the Internet has resurrected a debate over whether the compromise of systems can be justified in pursuit of a beneficials aims

Cyberattacks Abound Yet Companies Tell SEC Losses Are Few (Bloomberg) The 27 largest U.S. companies reporting cyber attacks say they sustained no major financial losses, exposing a disconnect with federal officials who say billions of dollars in corporate secrets are being stolen. MetLife Inc., Coca-Cola Co. (KO), and Honeywell International Inc. were among the 100 largest U.S. companies by revenue to disclose online attacks in recent filings with the Securities and Exchange Commission, according to data compiled by Bloomberg. Citigroup Inc. (C) reported "limited losses" while the others said there was no material impact

Internal Audit Teams Target IT Security in 2013 (Dark Reading) As internal audit teams juggle the entire stack of enterprise risk management concerns, IT security and data privacy will continue to grow in priority amid other concerns like competition and risk from financial markets. Two new reports over the last few weeks point to the growing concern for IT risk management among internal auditors and the increasing trend for internal audit teams to beef up their IT security acumen throughout the rest of 2013."There's a continuing emphasis around information security and how auditors help reduce that risk to a more nominal level," says Brian Christensen, executive vice president, global internal audit, at Protiviti. "Despite valiant efforts to get their hands around that, it remains an ever-growing challenge

Advanced Cyber Attacks Occur up to Once Every Three Minutes (MarketWatch) FireEye, Inc., the leader in stopping today's new breed of cyber attacks, today announced the release of its 2H 2012 Advanced Threat Report. The report shows that malware activity has become so pervasive that organizations experience a malicious email file attachment or Web link as well as malware communication that evades legacy defenses up to once every three minutes

Firms need to drill staff on data security (ihotdesk - IT News) The majority of firms are unable to respond adequately to cyber attacks, says a new report from Guidance Software. However, by regularly reviewing communication strategies and processes firms could increase their ability to bounce back from such an attack by as much as 70 per cent

Marketplace

Budget Constraints Forcing An Overhaul In Military Operations, Hagel Says (New York Times) Defense Secretary Chuck Hagel, facing inevitable steep cuts in military spending even as global threats remain high, said Wednesday that he is being forced to consider fundamental changes in how the Pentagon defends American interests and conducts its daily business

Turns out, there already is a cloud for spooks (IT World) The NSA is running an OpenStack cloud. A week and a half ago, a well-researched article in Federal Computer Weekly indicated that the CIA had asked Amazon for help building a private cloud. As it turns out, another spy agency, the National Security Agency, already has a private cloud, this one built on OpenStack

Huawei Says Security Concerns Will Hinder U.S. Growth, But It Still Expects Traction In Europe And Asia (TechCrunch) Huawei, the world's second largest telecom gear marker after Ericsson, said that its U.S. growth will be hindered this year by U.S. security concerns. But Bob Cai, the Chinese company's vice president in charge of wireless-network marketing, told the Wall Street Journal that Huawei still expects its key wireless-network business to gain ground in Europe and Asia. Huawei has been dealt

Should U.S. limit China-government influenced IT systems? (CSO) New federal restrictions now preclude four U.S. agencies from buying information-technology (IT) systems from manufacturers "owned, directed or subsidized by the People's Republic of China" due to national-security concerns. But is this a smart tactic? Stuck into the massive spending bill passed by Congress and signed by the President are two short paragraphs about these new IT-purchasing restrictions that have been placed on the Department of Commerce, Department of Justice, the National Aeronautics and Space Administration (NASA) and the National Science Foundation (NSF). These restrictions represent a U.S. backlash against what many believe to be evidence over the last decade of massive cyber-espionage and theft of intellectual property by China. It comes amid rising fears that IT equipment produced, assembled or manufactured by a company "owned, directed or subsidized by the People's Republic of China" could be used to somehow sabotage the U.S. But it remains to be seen if this will be a short-lived backlash brought by Congress or it becomes the foundation for U.S. policy moving forward

Accusing China a diversion of US cyber force (China Economic Net) Recently, the US has started a new round of hype of "Chinese hacker threat", not only accusing Chinese enterprises of stealing America's commercial secrets through the internet, but also pointing the blame directly at the Chinese government and its military. As we all know it, the US has a powerful internet industry and absolutely advantageous hardware equipment and technology. It can't be denied that the development of the internet has brought great convenience to the world. In recent years, however, the US has been making use of its advantages to strengthen its cyber prowess. What is absurd and ridiculous is that the US is using all kinds of excuses to draw China into the focus of criticism

Australian Victoria Police seeks self-imposed data logging and filter (ZDNet) Australia's Victoria Police has gone to market to find a service provider that will help it implement a data filter and retention scheme for its employees using the internet. Described as a "web content filtering solution", Victoria Police's request for tender seeks to retain an audit trail of its employees internet usage for a minimum of seven years. Victoria Police's specifications require audit reports to include a "complete audit of internet usage by a specific individual", with enough detail that it can use it "for use in criminal prosecution or disciplinary hearings

Cyber Liability Insurance at the State Government level (idexpertscorp) I read an interesting article recently on Cyber Insurance within the public sector titled "Are Governments Ready to be Buyers of Cybersecurity Insurance". There were two main points that stood out to me and a surprise as well. We know that the actual penetration of Cyber Insurance in the privacy sector is somewhere around the 20% mark and that it is lower in the government sector

Kaspersky Lab partners with INTERPOL to combat cyber crime and cyber threat (Global Post) Kaspersky Lab, a leading developer of secure content and threat management solutions and the INTERPOL Global Complex for Innovation (IGCI) Singapore have bonded together to combat cyber crime and cyber threat. This was according to Eugene Kaspersky, CEO and co-founder of Kaspersky Lab, who announced on Tuesday the meeting he had with Ronald Noble, INTERPOL Secretary General, and Noboru Nakatani, IGCI Executive Director that was held at Kaspersky Labs headquarters in Moscow recently."I am most pleased with the outcome of this meeting. I have been pushing for the creation of what I used to call an 'Internet-INTERPOL' for over a decade now, at last it has finally come to pass," Kaspersky said

Cara Beston and Becky Swain of PwC's Risk Assurance Practice Recognized with CloudNOW's Top 10 Women in Cloud Award (MarketWatch) PwC Risk Assurance Partner Cara Beston and Becky Swain, PwC Cloud Assurance Director, today received CloudNOW's "Top 10 Women in Cloud Award" for their exceptional contributions and thought leadership to the cloud community. CloudNOW, an executive consortium of the leading women in cloud computing, presented the award during UBM Tech's Cloud Connect in San Jose, California. In addition, Ms. Swain will be speaking at Cloud Connect on the new initiatives led by the Cloud Security Alliance, in collaboration with international standards development organizations, to establish new forms of assurance and reporting with the mission of helping to build out a disparately desired trusted cloud ecosystem

Roger Baker Appointed Chief Strategy Officer at Agilex (GovConWire) Roger Baker, chief information officer at the Department of Veterans Affairs from 2009 until 2013, has joined Chantilly, VaDepartment of Veterans Affairs.-based federal technology contractor Agilex Technologies as chief strategy officer. He will be responsible for helping grow the company's presence in the government market as Agilex aims to become a billion-dollar company

Robert Logan Named CIO for SAIC Natl Security, Health Spinoff (GovConWire) Robert Logan, director of engineering for information technology services at Science Applications International Corp. (NYSE: SAI), has been appointed chief information officer. The appointment is effective April 1 and Logan will also serve as CIO of the future independent national security, health and engineering business after SAIC separates into two companies, SAIC said Wednesday

Hacked? Mandiant's Cyberattack Detectives Want To Know All About It (Fast Company) When the New York Times discovered that their systems were being infiltrated by hackers in late 2012, one of the first phone calls they made was to a company named Mandiant. Founded in 2004 by Kevin Mandia, a former Air Force cybercrime forensic

BlackBerry Gets A Helping Hand From Canada, With A $256M Loan To Telefonica For BB Devices (TechCrunch) BlackBerry last week posted better than expected quarterly results, but it's not out of the woods yet. Now Canada is stepping in to help. Today, Export Development Canada, the Canadian export credit agency, announced that it has provided a €200 million ($256 million) working capital facility to Telefonica, one of the world's biggest mobile operators, to procure BlackBerry

Products, Services, and Solutions

Absolute Software and Samsung partner on KNOX (H-online) Device security and management company Absolute Software has announced that it is partnering with Samsung to bring tracking, remote wipe and management capabilities to Samsung's KNOX security framework. Samsung KNOX, which is based on SE Android, was unveiled in March as a solution to secure business data storage on Android-based mobile devices. KNOX is expected to be launched in the second quarter of this year and, with the addition of Absolute Software's Computrace technology, will also include cloud-based security and management, including the option of having the company's investigation team trace and recover stolen devices with the help of local law enforcement

People Power turns old iOS devices into surveillance equipment (CSO) People Power's free app turns your iOS devices into surveillance equipment. Fancy home surveillance systems may be out of your budget, but you can always turn that aging smartphone or tablet into a wireless security camera. A new iOS app, People Power's Presence, helps you turn unused iPhone, iPods, or iPads into a makeshift security system that you can monitor remotely. You install the free app on your old device and your current smartphone, create a Presence account, and point the cameras in the direction you want to keep an eye on

Rain Networks Signs Distributor Deal With Bitdefender for Enterprise Solutions (MarketWatch) The agreement supports Rain Networks' growth in the enterprise channel market, and increases the availability of Bitdefender enterprise solutions, particularly Cloud Security for Endpoints. Rain Networks will also support sales of Security for

Technologies, Techniques, and Standards

The HTTP 'Range' Header (Internet Storm Center) One of the topics we cover in our "Defending Web Applications" class is how to secure static files. For example, you are faced with multiple PDFs with confidential information, and you need to integrate authorization to read these PDFs into your web application. The standard solution involves two steps

An Inside look at avoiding cloud risks (Windowsecurity) At the speed at which companies and individuals are adopting multiple cloud platforms, the high level of risk is unavoidable. In this article we will cover recent events in the UK and Europe, which have exposed millions of users due to lack of planning and contingency. It is important to point out that I am in no way against cloud technologies, in actual fact I have been involved in building some of the largest platforms for over ten years

At RSA, specious arguments against security awareness (ComputerWorld) It takes two to tango, and at least two opinions to tangle. That's why the security awareness panel held during the recent RSA conference was so frustrating: There was a remarkable lack of diversity in opinion. I attended with hopes for a proper debate, but that would require intelligent dialogue from representatives on both sides of the issue at hand

In wake of gTLD security criticism, ICANN announces emergency back-up registry operators (ComputerWorld) The Internet Corporation for Assigned Names and Numbers (ICANN) has selected three emergency back-end registry operators to guarantee domain names within a new generic top-level domain (gTLD) will resolve in the event of a failure at a new TLD operator, it said on Tuesday. The China Internet Network Information Center (CNNIC), U.S. based Neustar and the U.K. based Nominet were selected, the ICANN said in a news release. Emergency back-end registry operators, or EBEROs, are activated if a registry operator fails to provide or is unable to sustain five critical registry functions temporarily, or in the case of transition from one registry operator to another, ICANN said

New robocall-killer technologies, designed to filter out unwanted automated calls, win FTC awards (Naked Security) The US Federal Trade Commission (FTC) on Tuesday crowned two winners in its Robocall Challenge contest. The winners will split a $50,000 prize. They're Aaron Foss, a software developer from Long Island, New York, and Serdar Danis, a computer engineer who declined to reveal his hometown

How Can You Protect Your Business From Cyber-Attacks? (Business 2 Community) Forty percent of all cyber-attacks target businesses with fewer than 500 employees, the article notes, with an average cost of $190,000 per attack, according to statistics from the Department of Homeland Security and antivirus software firm Symantec

Blocking zero-day application exploits (Help Net Security) But that can't be done with blacklisting solutions, as we have seen with the recent New York Times, Washington Post and Wall Street Journal breaches. Since most targeted attacks exploit zero-day vulnerabilities, an effective solution must be able to

Identifying And Remediating Security Vulnerabilities In The Cloud (Dark Reading) Another good starting point is the Security, Trust & Assurance Registry maintained by the Cloud Security Alliance. The registry provides a record of self-assessed security practices of IaaS, SaaS and PaaS vendors, and can give organizations a sense of

Design and Innovation

Cisco's Lew Tucker On The Internet Of Everything And The Tie To An App-Centric World (TechCrunch) Cisco's Lew Tucker stood onstage today at Cloud Connect and pitched the networking giant's "Internet of Everything," an app-centric world that will be worth $14.5 trillion over the next couple of years. Whereas the Internet of Things is all the objects in our world, Tucker says the IoE is the smart grids and, really, the entire supply chain and its transformation. Big

The Idiocy Of The Social Animal (TechCrunch) As we move closer to the launch of the (probably awful) Facebook phone, let's examine just what the social network and its ilk have created. Millions of us use these new tools to joke, flirt and share memories, but just as many of us use these tools much to our disadvantage. In some ways, however, that is making things better for all of us

Research and Development

Quantum cryptography: On wings of light (Eureka! Science News) Quantum physicists believe they can provide secret keys using quantum cryptography via satellite. Unlike communication based on classical bits, quantum cryptography employs the quantum states of single light quanta (photons) for the exchange of data

Academia

MIT to Improve Cyber Security to Protect Itself Against DDOS Attacks (Softpedia) After the recent distributed denial-of-service (DDOS) attacks, hacks, and the gunman hoax, the Massachusetts Institute of Technology (MIT) is determined to improve campus security, including the organizations cyber security. In a security memo published a couple of days ago, MIT reveals that it will implement a series of changes to its networks to ensure theyre better protected. One of the most important changes refers to strengthening network traffic policies by blocking all traffic that originates from outside of MIT

ISU to host high school cyber defense competition (WTHI TV) Teams of high school students will be defending computer networks against cyber-attacks as part of a competition hosted by Illinois State University

Secret e-mail searches on Harvard cheating scandal broader than initially described (Boston Globe) Top Harvard University administrators disclosed Tuesday that covert searches of e-mail accounts regarding a massive cheating scandal were more extensive than previously acknowledged, deepening a controversy that has caused a rift between faculty and the administration

Legislation, Policy, and Regulation

AGA Commends CFCT Commissioner Chilton's 'End User Bill of Rights' (AGA) The American Gas Association (AGA) commends U.S. Commodity Futures Trading Commissioner Bart Chiltons End User Bill of Rights. Americas natural gas utilities, along with other end user energy market participants, enter into both financial and physical commodity transactions that are being regulated by the Commodity Futures Trading Commissioner (CFTC) for the first time under the Dodd-Frank Act. AGA member companies are regulated entities and are committed to compliance with the CFTCs regulations

A Cyber-Survivable Military (The National Interest) A recent report by the Defense Science Board (DSB) proposes a comprehensive approach to improving the U.S. military's resiliency to cyber threats. Many of its recommendations would address the cyber espionage plaguing the Department of Defense every day. But the study also considered how technologically-savvy, well-resourced states, such as China or Russia, might use cyber weapons against the United States in a war

Simulated cyber attack to test the response of State (Irish Independent) The Government is planning to simulate a cyber attack on its computer systems to see how IT staff cope with an assault from hackers

Department of Homeland Security Monitors Peaceful Protests (JD Journal) The Partnership for Civil Justice Fund (PCJF) obtained government documents using the FOIA records request that show the Department of Homeland Security monitors peaceful, lawful protests on a daily basis as part of policy, according to PCJF. The documents show that the DHS "Threat Management Division" directed Regional Intelligence Analysts to issue a "Daily Intelligence Briefing" that involves reporting on "Peaceful Activist Demonstrations" as well as "Domestic Terrorist Activity."

Businesses, privacy activists wrestle over California privacy bill (CSO) For privacy advocates, bill a 'foundational step,' but the Chamber of Commerce says proposed law goes too far. Businesses and privacy advocates are squaring off over a proposed law that would make California the first state in the nation to give people the right to see all the information companies have on them and to find out who the data is shared with

California introduces 'right to know' data access bill, and why Silicon Valley will hate it (ZDNet) As California considers going above and beyond what the EU gives its citizens in data access request rights, technology and Web firms in Silicon Valley will likely fight any hopes of such rights hopping across the Atlantic. The European Union has long championed its citizens' right to submit a request to acquire the data a company holds on them in order to ensure that such data is up to date and correct. In recent years, one Austrian law student took this "habeas data" right to public light by demanding his Facebook data from the social network. Americans do not have this right -- and generally have almost zero legal protection from the state or federal government against data thefts, unauthorized disclosures and other privacy-related matters, unlike in the EU

NIST, NTIA seek feedback on voluntary cybersecurity incentives (FierceGovernmentIT) Under the cybersecurity executive order signed by President Obama in February, the National Institute of Standards and Technology is to develop within one year a framework for incorporating "consensus standards and industry best practices" for voluntary adoption by operators of critical infrastructure

Agencies should shield FOIA requestor names, says CUNY academic (FierceGovernmentIT) Federal agencies should treat the identities of Freedom of Information Act requesters with the same privacy protections as librarians extend to patrons, argues an City University of New York law school academic

NSA Chief Wants Companies to Share More Info With the Government (PolicyMic) Speaking at a conference at Georgia Tech, Director of the U.S. National Security Agency General Keith Alexander pressed Congress last week to pass legislation creating a more effective information-sharing regime between government and businesses to

CISPA Explainer #2: Who Can Information Be Shared With? (American Civil Liberties Union News and Information) In the latter scenario, companies even get to decide whether your information can be delivered to civilian agencies like the Departments of Homeland Security (DHS), Treasury, or Energy, or whether it can go to military ones like the National Security Agency

CISPA would let companies legally hack, says CDT (FierceGovernmentIT) Broadly-written provisions within the re-introduced Cyber Intelligence Sharing and Protection Act would place too much power within companies sharing cyber threat information with the government and within the federal government, privacy advocates from the Center for Democracy & Technology said during a April 3 press call

Litigation, Investigation, and Law Enforcement

Apple's iMessage Encryption "Impossible To Intercept" For Surveillance Purposes, Claims DEA Report (TechCrunch) Apple's iMessage text messaging replacement and chat service has frustrated U.S. federal agents looking to get access to suspect communications, a new report from CNET reveals. According to government documents obtained by the news source, iMessage and its encryption are not vulnerable to existing methods used by the DEA, meaning that in a recent February 2013 investigation in particular, it was

Report thumping Army for mobile cyber security efforts yanked off DoD website (CSO) A report from the Inspector General of the U.S Department of Defense that's critical of the way the Army has handled mobile-device security has been inexplicably yanked from the IG DoD public website but can still be found in the Google caching system

US Takes First Step to Implement Cyber Executive Order (Main Justice) With higher profiles come more money, but Bruce McConnell, senior counsel on cybersecurity at the Department of Homeland Security, suggested business leaders don't fully appreciate the gravity of the threat. "How do we tell CEOs how much to spend and

US patent office drops the bomb on Apple (FierceMobileIT) The U.S. Patent and Trademark Office has dropped a bomb on Apple's (NASDAQ: AAPL) efforts to sue its competitors. The USPTO issued a Final Office Action rejecting Apple's "bounce-back" patent claim, a major part of the lawsuit that netted Apple $1 billion from Samsung, until a federal judge threw out $450 million of that award. The judge called for a new trial on that portion because the jury had some math problems

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

SANS 20 Critical Security Controls Briefing (Washington, DC, USA, Apr 18, 2013) The SANS Institute presents an Executive Briefing on the 20 Critical Security Controls.

Thriving in the Post-Sequestration GovCon Era (McLean, Virginia, USA, May 14, 2013) The Potomac Officers Club is hosting a summit for GovCon executives and government leaders to collaborate and share ideas on how to navigate a new era involving sequestration. At least five speakers, each experts in the intersection between the public and private sector, will discuss what is to come after the automatic budget cuts known as sequestration dissipate. Confirmed speakers include: Frank Kendall (Defense Undersecretary for Acquisition, Technology and logistics), Robert Hale (Defense Department Comptroller), Jim McAleese (founder of McAleese & Associates), Pierre Chao (managing partner and co-founder of Renaissance Strategic Advisors), and Stephen Fuller (George Mason University professor and director at the Center for Regional Analysis).

CSO40 (Braselton, Georgia, USA, Apr 2 - 3, 2013) The CSO40 Security Confab + Awards will honor and share the critical viewpoints of today's leading CSOs, CISOs and security executives at the nation's leading CSO thought leadership conference.

Cloud Connect Silicon Valley (Santa Clara, California, USA, Apr 2 - 5, 2013) Cloud Connect returns to Silicon Valley, April 2-5, 2013, for four days of lectures, panels, tutorials and roundtable discussions on a comprehensive selection of cloud topics taught by leading industry experts.

An Evening in Cyberspace: Supporting Tomorrow's Cybersecurity Leaders (National Harbor, Maryland, USA, Apr 6, 2013) UMUC is pleased to present An Evening in Cyberspace: Supporting Tomorrow's Cybersecurity Leaders. Join us for this special black-tie event to support the next generation of cybersecurity students. The evening will feature a reception, dinner, keynote and entertainment.

Cyber 1.3 (, Jan 1, 1970) Maj. Gen. Suzanne Vautrinot, USAF, commander, 24th Air Force, and commander, Air Force Network Operations, will discuss the global strategic implications that relate to the cyber domain at the Space Foundation national conference Cyber 1.3, to be held Monday, April 8th, at The Broadmoor Hotel in Colorado Springs, Colorado. Cyber 1.3 is a full-day conference that takes place immediately before the official opening of the 29th National Space Symposium. The conference includes a networking breakfast, a luncheon and concludes with a networking reception, co-sponsored by General Dynamics Advanced Information Systems. Government Executive Media Group is a Cyber 1.3 media co-sponsor.

HITBSecConf2013 (Amsterdam, the Netherlands, Apr 8 - 11, 2013) HITB2013AMS will feature cutting edge attack and defense research including the a presentation on the inner workings of the iOS 6.1 Evasi0n jailbreak presented by members of the world famous Evad3rs Team, a brand new kernel level exploit affecting _all versions_ of Microsoft Windows up till Windows 8 and even a presentation on remotely hacking airplanes.

SANS Northern Virginia 2013 (Reston, Virginia, USA, Apr 8 - 13, 2013) This event features comprehensive hands-on technical training fand includes several courses that will prepare attendees for DoD 8570 and GIAC approved certification exams. Four of the courses can apply to a SANS Technology Institute's Master of Science Degree in Information Security Management or Master of Science Degree in Information Security Engineering.

INFILTRATE 2013 (Miami, Florida, USA, Apr 11 - 12, 2013) INFILTRATE is a deep technical conference that focuses entirely on offensive security issues. Researchers focused on the latest technical issues will demonstrate techniques that you cannot find elsewhere.

Software Engineering Institute Invitational Career Fair (Pittsburgh, Pennsylvania, USA, Apr 11 - 12, 2013) Attention software engineers and cyber security professionals, the Carnegie Mellon Software Engineering Institute needs your top notch skills to meet today's challenges. SEI staff will be interviewing on April 11 & 12 at their offices in Pittsburgh to fill immediate local positions. All candidates must be eligible to obtain a Security Clearance. Interviews are by appointment only. At the SEI you will have opportunities to make an impact on internet security and work with some of the most talented people in the field.

Information Tech Expo Series - Hawaii (Oahu, Hawaii, USA, Apr 12 - 19, 2013) This 6-series showcase will feature stops at 5 DoD locations and 1 Intel Center on the island of Oahu. Celebrating 20 years of these expos is a true testament to the government and military's readiness to learn from and work with industry partners. .

InfoSec World Conference & Expo 2013 (Orlando, Florida, USA, Apr 15 - 17, 2013) With the primary objective of providing top-notch education to all levels of information security and IT auditing professionals, InfoSec World delivers practical sessions that give you the tools to strengthen your security without restricting your business.

Cyber Guardian 2013 (Baltimore, Maryland, USA, Apr 15 - 20, 2013) Cyber Guardian is the SANS Institute's annual, interactive training session for cyber security professionals. All courses are associated with a GIAC Certification, and cover topics like intrusion detection, perimeter protection, hacker techniques, penetration testing, and advanced forensics. Cyber Guardian will feature the popular SANS NetWars Tournament on April 18-19, a hands-on, interactive training exercise.

A Dialogue on Cyber Warfare from Legal and Corporate Perspectives (New York, New York, USA, Apr 16, 2013) Conversation on Cyber Warfare and the LawThe Journal of Law & Cyber Warfare in partnership with the Columbia Society of International Law is honored to host this first cutting edge conference on the complex issues of cyber warfare.States are faced with the multi-faceted challenges of cyber warfare. No longer confined to the world of technology professionals and spies, these threats are a growing part of the daily lives of corporations and individuals. The constitution and legislation are both scarce and obsolete and the bench and the bar lack the resources and expertise to decide or advocate on these issues.

Infosec Southwest 2013 (Austin, Texas, USA, Apr 19 - 21, 2013) InfoSec Southwest is intended to be a general security and hacking conference with no specific industry or topical focus. As such, nearly all topics (other than vendor pitches) are fair game and the attending audience is expected to span all demographics.

Mobile Device Security for Defense and Government (Alexandria, Virginia, USA, Apr 23 - 24, 2013) This Defense Strategies Institute conference addresses the challenges of operating mobile devices in networks whose security is mission critical. The symposium's overall theme will focus on DOD's plan to maximize the potential uses of mobile devices. Within specific key areas: wireless infrastructure, mobile devices and mobile applications. The thought leadership and community goal of this event is to advance flexible and secure mobile devices to benefit the warfighter and keep pace with changing technology.

Infosecurity Europe (London, England, UK, Apr 23 - 25, 2013) Europe's number one Information Security event. Featuring over 350 exhibitors, the most diverse range of new products and services, an unrivalled education programme and over 12,000 visitors from every segment of the industry, it's the most important date in the calendar for Information Security professionals across Europe.

INSA Leadership Dinner Featuring Betty Sapp, Director, NRO (Reston, Virginia, USA, Apr 25, 2013) - This leadership dinner will feature a keynote address from Betty Sapp, Director of the National Reconnaissance Office highlighting her focus on innovation at the NRO and for the Intelligence Community. Registration will open on Thursday, March 14 and will close Thursday, April 18.

23rd Annual Government Procurement Conference (Washington, DC, USA, Apr 25, 2013) This unique one-day event attracts more than 3,000 participants representing government agencies, prime contractors and small businesses from around the country. Participating companies are able to network with procurement officials from federal, state and local government agencies under one roof.

TechExpo Cyber Security Hiring Event (Columbia, Maryland, USA, Apr 30, 2013) A hiring event for experienced cyber security professionals, with many leading companies in attendance and interviewing on-the-spot. Learn from the distinguished speakers' panel, details of which will be forthcoming on the event site. All job-seekers should be US citizens with cyber security or IT experience. A security clearance is not required, but preferred.