The CyberWire Daily Briefing for 4.11.2013

Cyber Attacks, Threats, and Vulnerabilities

South Korea Ups Its Alert Status As It Accuses The North Of Last Month's Cyber Attacks (Fast Company) South Korea Ups Its Alert Status As It Accuses The North Of Last Month's Cyber Attack. A pair of Musadan missiles are reported to be in transit to the east coast, as North Korea watchers point to Monday, the anniversary of Kim Il Sung's birth, as being

North Korea possesses high cyber attack capabilities (Arirang News) The South Korean government concluded Wednesday that North Korea was behind last month's massive cyber attack that brought down the computer networks of major South Korean media and banks. General James Thurman, the Commander of the United

Cyber War Threatens Real-World Conflict In Korean Peninsula - And The North Might Be Winning (Huffington Post) There is already a war taking place on the Korean Peninsula: it's on the internet - and the North may be winning. Jarno Limnell, doctor in military science and director of cyber-security for Stonesoft, based in Finland, told the Huffington Post UK that a "cyber war arms race" is now in operation on the peninsula, and that it represents a new and dangerous frontier for both sides

Hayan Petroleum Company of Syria breached by Latin hack team (E Hacking News) The hacker group known as "LatinHackTeam" has breached website belong to one of the oil company of Syria - Hayan Petroleum

Rogue Twitter Account Used in Targeted Attacks Against Free Tibet Supporters (Threatpost) Attackers targeting Tibetan freedom supporters aren't holding back when it comes to using all avenues to infect activists with malware. In a relatively short amount of time, we've seen Tibetan nationals in China and in exile around the world targeted with spear phishing campaigns, watering hole attacks, hacks against Android mobile devices and now the latest vector: social media sites.

Targeted social media attacks said to be underreported (CSO) The latest targeted attack, on Chinese activists, shows how cybercriminals are broadening their tactics in going after individuals. Cybercriminals' use of Facebook, Twitter and other social media in targeting individuals with malware is an underreported problem that affects many organizations, says one security expert. Security company Cyber Squared reported this week how three Chinese political activists in and outside of the country were sent tweets from Twitter that contained links to two compromised websites. The sites, which included a Chinese language forum and a Tibet-related WordPress blog, loaded Adobe Flash exploits

ZeroAccess Bitcoin Botnet Shows No Signs Of Slowing: FortiGuard Labs Releases Quarterly Threat Landscape Report (Dark Reading) Report also reveals analysis of the South Korea cyberattacks and two new Android adware variants. Fortinet (NASDAQ: FTNT) − a world leader in high-performance network security – today announced the findings of its FortiGuard threat landscape research for the period of January 1 − March 31, 2013. FortiGuard Labs observed that the Bitcoin mining botnet, ZeroAccess, was the number one threat this quarter as reported by FortiGate devices worldwide. The report also reveals analysis of the South Korea cyberattacks and two new Android adware variants that have climbed the watch list in the last 90 days

Shylock bank Trojan upgraded with new capabilities, says Symantec (CSO) "All that glitters is not gold." The prodigious Shylock man-in-the-browser (MitB) banking Trojan is still being upgraded as part of a campaign to migrate from its traditional targets in UK financial services to foreign ones, Symantec has reported

Anatomy of an exploit - Linksys router remote password change hole (Naked Security) A security researcher from California has published a how-to guide detailing a number of exploits against various Linksys routers. Paul Ducklin looks at the ominous sounding "EA2700 Password Change Insufficient Authentication and CSRF Vulnerability"

Mali offers free .ML domains to anyone. What could POSSIBLY go wrong? (Naked Security) It's good news if you're a cybercriminal. But probably not something that's going to do much good for one of the world's poorest countries

Vulnerabilities in aircraft systems allow remote airplane hijacking, researcher says (CSO) Communication technologies like ADS-B and ACARS can be abused to remotely exploit vulnerabilities in aircraft systems, a researcher said. The lack of security in communication technologies used in the aviation industry makes it possible to remotely exploit vulnerabilities in critical on-board systems and attack aircraft in flight, according to research presented Wednesday at the Hack in the Box security conference in Amsterdam

Ransomware Delivers Images of Child Porn (eSecurity Planet) The malware demands that the victim pay a fine for viewing child pornography, and shows a series of images as proof of the alleged offense

Ransomware: The cybercrime money machine of 2013 (IT Proportal) Towards the end of last year, when the major security firms were compiling their customary run-downs of the biggest threats expected to emerge in 2013, ransomware figured prominently as an ominous one to watch. This breed of malicious software owes its name to the way in which it attacks a computer, quite literally holding it ransom by paralysing the device and demanding payment for it to be unlocked. By February this year, the experts prophecies began to be realised as a sophisticated and sprawling ransomware plot came to light, with Europol detaining a multi-national criminal gang in Spains Costa del Sol

Risks to retailers through point of sale systems (Net-Security) McAfee released a report on the growing risks the industry is facing with both legacy and newer point of sale systems (POS). The report discusses how the retailing industry's reliance on third parties for service and support is creating security vulnerability and privacy issues. Todays advanced security threats mean that a retailer needs to be more than just PCI DSS compliant in order to protect customer information beyond credit cardholder data

New spam attack investigated (New Zealand Herald) Telecom has launched an urgent investigation into another spam attack on some Yahoo! Xtra customers. The suspicious emails appeared to be from one of the user's contacts, but contained an embedded link to a potentially malicious website

Coinbase Admits Data Leak (eSecurity Planet) Some merchants' e-mails addresses were exposed -- and were used in a recent phishing attack

UK support organization hacked, data leaked (PHIprivacy) I became aware of a breach involving HPTH UK. The breach had been posted on Pastebin by @LulzSecWiki, who headlined it as HPTH UK Hospital Server Data Leak. @LulzSecWiki also tweeted a link to the data dump

Massive Google scam sent by email to Colombian domains (Internet Storm Center) This morning many users in my city woke up with supposedly good news from a resume they sent to google looking for open positions

The spammer who logged into my PC and installed Microsoft Office (Ars Technica) Spam text made a tempting offer—so I let the spammer take control of my PC. It all began with an annoying text message sent to an Ars reader. Accompanied by a Microsoft Office logo, the message came from a Yahoo e-mail address and read, "Hi, Do u want Microsoft Office 2010. I Can Remotely Install in a Computer." An offer I couldn't refuse. The recipient promptly answered "No!" and then got in touch with us. Saying the spam text reminded him of the "'your computer has a virus' scam," the reader noted that "this seems to be something that promises the same capabilities, control of your computer and a request for your credit card info. Has anyone else seen this proposal?" I hadn't seen this particular scam, so there was only one thing to do: take the scammer up on his offer and let him go to town on a spare copy of Windows

Hackers turn a Canon EOS camera into a remote surveillance tool (CSO) The Canon EOS 1D-X camera is not designed with security in mind, a researcher said. The high-end Canon EOS-1D X camera can be hacked for use as a remote surveillance tool, with images remotely downloaded, erased and uploaded, a researcher said during the Hack in the Box security conference in Amsterdam on Wednesday

Security Patches, Mitigations, and Software Updates

KB2823324 causing boot issues in Brazil and some other locales (Internet Storm Center) An article in Linha Defensiva (http://www.linhadefensiva.com/2013/04/brazilian-users-unable-to-boot-windows-after-botched-update/) reports that after applying the update machines were no longer able to boot. According to the article Microsoft has recognised that there is an issue with the Brazillian version of the OS, but the links in the article do point to other locales having a similar issues. I wasn't able to find any futher reference on the microsoft site, but in the mean time if you do approve this KB for deployment make sure you test it thouroughly prior to a production implementation

Cyber Trends

Three-Quarters Of British Employers Have No Enforceable Systems To Stop Employees Stealing Company Data (Dark Reading) Clear disconnect between perceived risk and actual behaviour, as one in five employees admit to accessing or stealing private company information while at work

Survey: Encryption Momentum Building - Health Data Breach Prevention Steps Highlighted (Healthcare Information Security) To prevent data breaches, healthcare organizations are taking a number of critical steps, including ramping up their use of encryption, the second annual Healthcare Information Security Today Survey shows. Preventing and detecting breaches is one of the top three information security priorities for this year, the survey confirms. And for now, organizations are more confident about their ability to counter external threats, such as hacker attacks, than they are about countering internal threats, such as staff members losing unencrypted devices

Cyber warfare is the new threat to the global order (Nation Multimedia) Startling new developments in the American national security doctrine have shaken the foundations of thinking about fear and safety in the world. Chiefs of intelligence agencies in the US have released a report claiming that cyber attacks and cyber espionage pose a greater danger than conventional terrorist groups like al-Qaeda. The speed with which Internet-based technology is evolving and the alacrity with which various state and non-state actors are trying to leverage it for their own self-interests is baffling even to an advanced Web-based great power like America, not to mention less technically adept nations

Bitcoin volatility caused by surge in demand, slow software (CSO) Interest in the virtual currency has caused strain on bitcoin exchanges. Bitcoin's roller-coaster price swings on Wednesday were caused by an influx of new buyers and software that couldn't keep up, according to the largest exchange, Mt. Gox

Bitcoin Suffers A Correction Amid Apparent DDOS Attacks On Some Exchanges (TechCrunch) Bitcoin is undergoing a classic correction after quintupling in price over the past 30 days. The currency, which was trading as high as $265 earlier today on Mt. Gox, plummeted and is now trading at around $150. We've reached out to one of the biggest exchanges, Mt. Gox, to see what happened. But another San Francisco-based exchange called TradeHill is saying that the crypto-currency is

Bitcoin is just the poster currency for a growing movement of alternative tender (Quartz) Like the trillion-dollar platinum coin several months ago, Bitcoin has jumped from a technical curiosity to "mainstream" financial news. It has become an object of economic escapism--but the kind you can't escape from. Whether it continues to grow as a phenomenon has yet to be seen, but the underlying curiosity tells us that there is growing skepticism about global financial systems' long-term viability, and a correlated grassroots interest in returning to smaller scale, offline, more locally-focused systems of exchange

Real money starts to pour into math-based currencies like bitcoin (Quartz) Chris Dixon, a partner at the venture capital firm Andreessen Horowitz, posted this brief observation on Tumblr the other day: "Three eras of currency - Commodity based, e.g. Gold, Politically based, e.g. Dollar, Math based, e.g. Bitcoin." Now Dixon's firm and several other well known investors are putting their own money--in this case, politically based US dollars--behind their conviction that the future of money is in "math-based" currencies like bitcoin

Gartner: Long hard climb to high level of cloud computing security (Network World) Gartner analyst Jay Heiser says Gartner clients often "disappointed" by what they see offered as security and reliability provisions in cloud contracts. It's still a long, hard climb to get to a high level of security in cloud computing, according to Gartner research vice president Jay Heiser, who said business and government organizations with sensitive data appear likely to hold back from cloud-based services until things improve

How To Bug Mitch McConnell's Office (InformationWeek) A report in Mother Jones this week cites a recording of Senate Minority Leader Mitch McConnell (R-Ky.) in his offices engaged in what he thought was a private conversation. Someone recorded the conversation and provided the recording to Mother Jones. Especially in the context of political figures our thinking about surveillance gets primitive…The term "bugging" in political context raises images of Watergate (for those of us old enough to remember it -- I'm 51 and remember it clearly), with burglars breaking into a building and physically messing with telecommunications equipment, not to mention big clunky tape recorders in the Oval Office. Nowadays you'd do it completely differently. How would you record someone's conversations clandestinely? You'd use the powerful and flexible world of malicious software. Every computer and mobile device in that office where Senator McConnell was speaking is a potential clandestine recording device

Marketplace

DOD requests $4.7 billion to help fund offensive cyber teams (Foreign Policy) "In addition, manpower at the National Security Agency continues to be funded to provide both cyber security and intelligence support to the USCYBERCOM teams." Continued investment in cyber is listed as one of the "Key Priorities" in the budget, along

Budgetary cost-cutting realigns military for cyberwar (Fox News) Michael A. Brown, the former director of cybersecurity coordination for the Department of Homeland Security (DHS), told FoxNews.com that budgetary issues are a serious concern for today's military. The armed forces are making strides to emphasize cyber

Cool Budget, Dude (Daily Beast) "Teams of cyber experts--including defensive, intelligence, and analytical--will defend the Nation, as well as DOD infrastructure, by conducting reconnaissance, surveillance, development, maintenance, and analysis." The budget also

Cybersecurity more of a priority in Obama budget (NBCNews.com) Intelligence officials said last month that cyber attacks and espionage have supplanted terrorism as the top security threat facing the United States, and military officials sounded the alarm as well. "Lock your doors," Air Force General Robert Kelher

2014 Budget Request: National Institute of Standards and Technology (NIST) (FierceGovernmentIT) Under President Obama's fiscal 2014 budget request, the National Institute of Standards and Technology would receive a total discretionary budget authority of $934 million, or 19.59 percent more than the current year amount under the continuing resolution when accounting for inflation

The president's 2014 budget request (FierceGovernmentIT) The Obama administration proposed spending approximately $82 billion on information technology in the coming fiscal year, it says in a section of the budget request it delivered to Congress on April 10

Chinese security concerns scares away investors (ZDNet) Recent reports that China is the source of numerous cyberattacks is scaring off foreign investors, according to officials. United States officials believe that China's credibility and attractiveness as a place to invest are being harmed by cybersecurity worries, as reported by Reuters. Robert Hormats, U.S. under secretary of state for economic growth, energy and the environment said on Tuesday at a U.S.-China Internet industry forum that the scale of hacking activity allegedly coming from China is not only breeding mistrust in the U.S. government, but is also causing businesses to reconsider investment opportunities

Northrop to assist Air Force with R&D for intelligence tools (Defense Systems) By Defense Systems Staff; Apr 11, 2013. A Northrop Grumman unit will furnish research and development services for intelligence tools used by the Air Force and other federal agencies under a $40.5 million contract, the Defense Department said April 9

FireEye Brings Global Momentum to Australia and New Zealand (PRWire) FireEye, Inc., the global leader in stopping advanced cyber attacks, has begun a rapid expansion in Australia and New Zealand (A/NZ). The company, which pioneered a method of detecting cybersecurity threats through its proprietary signature-less technology, has appointed Phil Vasic regional director for Australia and New Zealand

What Would Apple-Yahoo Deal Spell? (InformationWeek) Apple and Yahoo are in talks to see what new role Yahoo might play on iOS devices. If it happens, the deal could further sour Apple's relationship with Google

Report: Tom Wilburn Appointed Cisco Global Enterprise SVP, CTO (GovConWire) Tom Wilburn, who joined Cisco (NASDAQ: CSCO) in 2005, has been appointed to succeed John McCool as senior vice president and chief technology officer of the global enterprise segment. McCool is leaving the company the company after 17 years and helped grow its corporate mobile and networking equipment unit from $5 million to more than

Sujey Edward, Sheri Neely Named Salient VPs (GovConWire) Sujey Edward and Sheri Neely, respectively a former agile coach for federal agencies and a LIST Innovative Solutions veteran, have joined Salient Federal Solutions to serve as vice presidents. Edward will serve as VP of the company's agile center of excellence and Neely will lead the company's mission critical software development unit, Salient said Wednesday

Mark Hewitt Promoted to QNA EVP, Chief Strategy Officer (GovConWire) Mark Hewitt, former senior vice president for technology solutions strategy at QinetiQ North America, has been promoted to executive vice president and chief strategy officer. Hewitt will be responsible for developing strategies and will also oversee QNA's defense and commercial innovation programs, the company said Wednesday. He will also oversee the company's corporate development, strategic investments and

Jeremy Wensinger Joins USIS as Global Security, Solutions Head (GovConWire) Jeremy Wensinger, former chief operating officer of GTSI Corp., has joined US Investigations Services as president of the global security and solutions division. He will lead a team of 3,000 employees that support national security missions and work with government agencies to protect people, information, operating systems and other assets, USIS said Wednesday

Will Retirements Put Federal IT at Risk? - 20 percent of IT Security Workforce Could Retire in 3 Years (Government Information Security) Retaining qualified IT security talent remains a challenge for governments because often they can't compete with the higher salaries the private sector offers. Exasperating the situation for the federal government is that a sizeable percentage of its cybersecurity workforce is closing in on retirement age. A survey of some 22,000 federal government employees whose jobs include cybersecurity tasks reveals that the majority of them above age 40 are at least 10 years away from retirement eligibility, but nearly 12 percent could retire within one year, with almost 9 percent more eligible to retire within three years

Addressing the InfoSec Staffing Crisis - How Schools, Industry and Associations Can Help (Government Information Security) The IT security industry faces a major staffing crisis, according to the latest research. But what can schools, businesses and industry associations actually do to start addressing the problem? The new Global Information Security Workforce Study from (ISC), the information security certifications body, shows that a worldwide dearth of skilled IT security workers is now a staffing crisis that could cripple organizations' ability to respond to breaches and other security threats

Products, Services, and Solutions

Ecteon Achieves Certification As HIPAA Privacy And Security Experts (Dark Reading) Helps clients meet stepped-up federal compliance requirements

Rapid7 Updates Risk Assessment And Management Suite (Dark Reading) Updates Metasploit, Mobilisafe, and Nexpose. Rapid7, a leading provider of IT security risk management software and cloud solutions, today announced that it is further enhancing its risk assessment and management portfolio to enable organizations to gain greater insight into their asset and user-based risk. The update includes the launch of Metasploit 4.6, available immediately, and Mobilisafe for Office 365 and Nexpose 5.6, both of which will launch later in the month. The updates to Rapid7's portfolio give security professionals broader assessment capabilities to prioritize and manage risk across their organization's complete environment

StillSecure & Trivalent Group Expand Partnership To Include PCI Complete & HIPAA Essential (Dark Reading) Deal includes new suite of managed security services and compliance offerings to customers, including PCI Complete and HIPAA Essential

Facebook And Webroot Expand 'Always-On' Security To New Markets (Dark Reading) Global users will benefit from an in-Facebook implementation of Webroot's URL Classification Service

Trend Micro Expands Facebook Partnership Globally Providing Users Protection For Their Digital Lives (Dark Reading) Facebook users from around the world now have access to safer social networking in multiple languages

Bitdefender launches free mobile malware app (ARN) 'Antivirus Free' built with simple interface and for easy operation. Security software vendor, Bitdefender, has launched its 'Antivirus Free' app on the Google Android platform to combat the growth in mobile malware. The app promises a "fast and powerful antivirus solution that taps the latest in-the-Cloud scanning technology and prevents battery strain"

Aruba Networks unveils Workspace product that combines NAC, MDM, MAM (FierceMobileIT) Wi-Fi provider Aruba Networks unveiled on Wednesday its WorkSpace software that integrates network access control, mobile device management and mobile application management for enterprises struggling with the flood of devices entering their networks

Piston Ships OpenStack On A Stick 2.0 (InformationWeek) Piston releases 2.0 version of Enterprise OpenStack, a pre-configured cloud OS loaded on a memory device, ready for building private clouds

Technologies, Techniques, and Standards

How To Successfully Phish Your Own Firm (Dark Reading) CSOs share advice, war stories on internal simulated phishing attacks for user awareness training. Simulated phishing attacks are gradually becoming a more accepted method of schooling users on how to spot a phony email rigged with a malicious link or attachment, but staging fake phishing attacks can backfire if users are completely blindsided -- or become too comfortable with the controversial process

10 Key Compliance Pitfalls -- And How To Avoid Them (Dark Reading) A look at the most common mistakes in compliance initiatives, and what you can learn. Today, it's the rare business that doesn't have some regulation on its radar, whether it's because the business processes credit cards, handles personal client information, is publicly traded, handles medical information, operates on behalf of a national or regional government, or any other number of considerations

Taking Steps To Stop Software Sabotage (Dark Reading) Enterprise applications pose tempting targets to developers, IT admins and other insiders with the technical know-how to tamper with code. When most security pros think about application security, the first goal that usually comes to mind is finding and remediating flaws in development and production. But what if the bugs put in place are no accident? What if they're planted there on purpose by someone in the organization who knows where to hide them

Adapting to the post-Shamoon world (CSO) In part two of his commentary on the Shamoon virus attacks, IANS Phil Gardner taps the expertise of IANS faculty on how businesses should respond and prepare for future targeted, geopolitical cyberattacks. In my last column in CSO, we talked about how the Shamoon virus attack on Saudi oil firm Aramco signified the start of an insidious new wave of malware. Instead of quietly siphoning off data and intellectual property for financial gain, Shamoon and others like it aim to publicly cripple businesses in the name of geopolitical score-settling —an intent that makes them far more dangerous and difficult to thwart. The good news? More than 98 percent of businesses today, thankfully, do not fall within the crosshairs of these politically-motivated attackers. If you aren't charged with running the main economic engine of your country (a high-profile bank, utility, defense contractor, etc.), chances are these types of attacks are not targeting you

Global technology supply chain security standard released (Net-Security) The Open Group published of the Open Trusted Technology Provider Standard (O-TTPS), the first complete standard published by The Open Group Trusted Technology Forum (OTTF) and which will benefit global providers and acquirers of Commercial Off-the-Shelf (COTS) Information and Communication Technology (ICT) products. This open standard is the first of its kind to help organizations achieve Trusted Technology Provider status, assuring the integrity of COTS ICT products worldwide and safeguarding the global supply chain against the increased sophistication of Cybersecurity attacks

Securing The Cloud: Why You Need Cast-Iron Guarantees (Forbes) The Cloud Security Alliance is drawing up a new version of its Cloud Trust Protocol (CTP) that will create a clear set of transparent measures that can be applied to all CSPs. According to senior researcher, Alain Pannetrat, the CTP will allow

Mobile users must relearn security, Bitdefender argues as free Android security bows (CSO) The release of a free Android security application may simplify the protection of increasingly popular mobile devices, but user ignorance and the proliferation of malware-ridden honeytraps mean users must be targeted with focused education, a security expert has argued

Design and Innovation

The Software Revolution Behind LinkedIn's Gushing Profits (Wired Business) LinkedIn took a huge risk pausing all development for two months as it switched to a turbocharged new system known as "continuous deployment." The gamble paid off big: LinkedIn now releases new web and app features twice per day, compared

Google Wants To Operate .Search As A 'Dotless' Domain, Plans To Open .Cloud, .Blog And .App To Others (TechCrunch) If it gets it, Google wants to turn .search into a "dotless domain," the company told ICANN a few days ago. Last year, Google applied to manage the .app, .blog, .cloud and .search generic top-level domain (gTLD) names as part of a major expansion of the domain-name system. ICANN, which is managing this expansion, hasn't awarded any of the gTLDs yet, and the whole program

Cloud computing companies are preparing to dunk their servers in vats of oil (Quartz) By June or July of this year, according to Andy Price of Green Revolution Cooling, something strange will be announced by at least two of the companies that own the hundreds of thousands of computers that make the internet possible. In out-of-the-way locations, these companies--whose identities Price won't reveal but, he says, are on a par with Facebook, Amazon and AT&T--are doing bizarre things to their infrastructure. Specifically, to their servers, the high-powered PCs that store, retrieve and process all the data on the internet and comprise the physical structure of the "cloud"

Academia

8 MOOCs Transforming Education (InformationWeek) The early market for massively open online courses brings more approaches than you might realize. Take a look at 8 game changers

Legislation, Policy, and Regulation

Strategic Command Priorities Chart Way Forward (Department of Defense) Working largely through its subordinate command, U.S. Cyber Command, Stratcom is continuing its efforts to protect U.S. military access to and freedom of action in cyberspace, the general reported. Despite the myriad security challenges the United States

Pentagon Official Examines Law in Cyberspace Operations (Department of Defense) But he warned against overstating the militarization of the Internet, specifically that DOD or the National Security Agency has had a leading role in domestic cybersecurity

Reddit co-founder calls out Google, Twitter, Facebook over CISPA (CSO) A co-founder of social news site Reddit has publicly urged the heads of Twitter, Google and Facebook to support efforts to defeat a controversial cyber security bill currently under consideration in Congress

New cybersecurity bill clears House committee (CNN) They fear the National Security Agency and the military will have access to American's personal information. Rogers and Ruppersberger expect the full house will adopt the measure. Then it will be up to the Senate to pass its own version. If that

House Intelligence to markup CISPA with amendments (FierceGovernmentIT) The House Intelligence Committee will consider a number of amendments meant to address privacy criticism of the Cyber Intelligence Sharing and Protection Act when it meets to mark up the bill on April 10, its sponsors said during an April 8 press call

Information sharing to improve our cybersecurity (The Hill) A recent report issued by computer security firm Mandiant shined a bright light onto a dark truth we have known for years: The Chinese government is systematically and methodically stealing American intellectual property at a breathtaking pace and scope

Litigation, Investigation, and Law Enforcement

Army Judge Raises Burden in Private's Trial on Leaks (New York Times) The military prosecutors seeking to have Pfc. Bradley Manning convicted of violating the Espionage Act over his release of secret government files to WikiLeaks will face an additional burden at his court-martial under a ruling on

FairSearch: Google using Android to monopolize mobile marketplace, control consumer data (FierceMobileIT) Google (NASDAQ: GOOG) uses its Android operating system as a "Trojan Horse" to engage in anti-competitive behavior in the mobile marketplace, argued a complaint by FairSearch.org filed on Tuesday with the European Commission

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

Symposium on Cybersecurity & Information Assurance (Teaneck, New Jersey, USA, May 1, 2013) Fairleigh Dickinson University's Center for Cybersecurity and Information Assurance is pleased to announce its inaugural Symposium on Cybersecurity and Information Assurance to be held on May 1, 2013 in the Wilson Auditorium of the Metropolitan campus. This forum will gather top security professionals from government, industry, and academia to present the current state of cybersecurity affecting our daily lives. The symposium will raise the awareness of attendees about the cyber threats and some of the remedial measures. Among the various facets of this evolving area, focus will be on topics such as Survivability in Cyberspace, Security Pattern Usage in Software Development Lifecycle (SDLC), Network Security Service Implementation issues, and Thinking with a Security Mindset.

Hack in the Box 2013 (Amsterdam, the Netherlands, Apr 8 - 11, 2013) HITB2013AMS will feature cutting edge attack and defense research including the a presentation on the inner workings of the iOS 6.1 Evasi0n jailbreak presented by members of the world famous Evad3rs Team, a brand new kernel level exploit affecting all versions of Microsoft Windows up till Windows 8 and even a presentation on remotely hacking airplanes.

SANS Northern Virginia 2013 (Reston, Virginia, USA, Apr 8 - 13, 2013) This event features comprehensive hands-on technical training fand includes several courses that will prepare attendees for DoD 8570 and GIAC approved certification exams. Four of the courses can apply to a SANS Technology Institute's Master of Science Degree in Information Security Management or Master of Science Degree in Information Security Engineering.

INFILTRATE 2013 (Miami, Florida, USA, Apr 11 - 12, 2013) INFILTRATE is a deep technical conference that focuses entirely on offensive security issues. Researchers focused on the latest technical issues will demonstrate techniques that you cannot find elsewhere.

Software Engineering Institute Invitational Career Fair (Pittsburgh, Pennsylvania, USA, Apr 11 - 12, 2013) Attention software engineers and cyber security professionals, the Carnegie Mellon Software Engineering Institute needs your top notch skills to meet today's challenges. SEI staff will be interviewing on April 11 & 12 at their offices in Pittsburgh to fill immediate local positions. All candidates must be eligible to obtain a Security Clearance. Interviews are by appointment only. At the SEI you will have opportunities to make an impact on internet security and work with some of the most talented people in the field.

Information Tech Expo Series - Hawaii (Oahu, Hawaii, USA, Apr 12 - 19, 2013) This 6-series showcase will feature stops at 5 DoD locations and 1 Intel Center on the island of Oahu. Celebrating 20 years of these expos is a true testament to the government and military's readiness to learn from and work with industry partners. .

InfoSec World Conference & Expo 2013 (Orlando, Florida, USA, Apr 15 - 17, 2013) With the primary objective of providing top-notch education to all levels of information security and IT auditing professionals, InfoSec World delivers practical sessions that give you the tools to strengthen your security without restricting your business.

Cyber Guardian 2013 (Baltimore, Maryland, USA, Apr 15 - 20, 2013) Cyber Guardian is the SANS Institute's annual, interactive training session for cyber security professionals. All courses are associated with a GIAC Certification, and cover topics like intrusion detection, perimeter protection, hacker techniques, penetration testing, and advanced forensics. Cyber Guardian will feature the popular SANS NetWars Tournament on April 18-19, a hands-on, interactive training exercise.

A Dialogue on Cyber Warfare from Legal and Corporate Perspectives (New York, New York, USA, Apr 16, 2013) Conversation on Cyber Warfare and the LawThe Journal of Law & Cyber Warfare in partnership with the Columbia Society of International Law is honored to host this first cutting edge conference on the complex issues of cyber warfare.States are faced with the multi-faceted challenges of cyber warfare. No longer confined to the world of technology professionals and spies, these threats are a growing part of the daily lives of corporations and individuals. The constitution and legislation are both scarce and obsolete and the bench and the bar lack the resources and expertise to decide or advocate on these issues.

SANS 20 Critical Security Controls Briefing (Washington, DC, USA, Apr 18, 2013) The SANS Institute presents an Executive Briefing on the 20 Critical Security Controls.

Infosec Southwest 2013 (Austin, Texas, USA, Apr 19 - 21, 2013) InfoSec Southwest is intended to be a general security and hacking conference with no specific industry or topical focus. As such, nearly all topics (other than vendor pitches) are fair game and the attending audience is expected to span all demographics.

cybergamut Technical Tuesday: Secure VoIP & Messaging for Mobile Platforms (Laurel, Maryland, USA, Apr 23, 2013) Phil Zimmermann of Silent Circle will show you how to communicate securely without relying on PKI. cybergamut Technical Tuesday is for cyber professionals to exchange ideas and discuss technical issues of mutual interest.

Mobile Device Security for Defense and Government (Alexandria, Virginia, USA, Apr 23 - 24, 2013) This Defense Strategies Institute conference addresses the challenges of operating mobile devices in networks whose security is mission critical. The symposium's overall theme will focus on DOD's plan to maximize the potential uses of mobile devices. Within specific key areas: wireless infrastructure, mobile devices and mobile applications. The thought leadership and community goal of this event is to advance flexible and secure mobile devices to benefit the warfighter and keep pace with changing technology.

Infosecurity Europe (London, England, UK, Apr 23 - 25, 2013) Europe's number one Information Security event. Featuring over 350 exhibitors, the most diverse range of new products and services, an unrivalled education programme and over 12,000 visitors from every segment of the industry, it's the most important date in the calendar for Information Security professionals across Europe.

INSA Leadership Dinner Featuring Betty Sapp, Director, NRO (Reston, Virginia, USA, Apr 25, 2013) - This leadership dinner will feature a keynote address from Betty Sapp, Director of the National Reconnaissance Office highlighting her focus on innovation at the NRO and for the Intelligence Community. Registration will open on Thursday, March 14 and will close Thursday, April 18.

23rd Annual Government Procurement Conference (Washington, DC, USA, Apr 25, 2013) This unique one-day event attracts more than 3,000 participants representing government agencies, prime contractors and small businesses from around the country. Participating companies are able to network with procurement officials from federal, state and local government agencies under one roof.

cybergamut CompTIA Security+Certification Boot Camp Training Program (Baltimore, Maryland, USA, Apr 29 - May 2, 2013) Security+ certification training delivers a foundational proficiency in the network security arena. Security+ Certified Professionals are better able and positioned to support small and medium-sized organizations that are at increased risk of cyber crime and other forms of security-related threats. Security+ certified professionals may now apply the CompTIA Security+ certification towards the Microsoft MCSA and MCSE Security certifications.

TechExpo Cyber Security Hiring Event (Columbia, Maryland, USA, Apr 30, 2013) A hiring event for experienced cyber security professionals, with many leading companies in attendance and interviewing on-the-spot. Learn from the distinguished speakers' panel, details of which will be forthcoming on the event site. All job-seekers should be US citizens with cyber security or IT experience. A security clearance is not required, but preferred.