The CyberWire Daily Briefing for 5.20.2013

Cyber Attacks, Threats, and Vulnerabilities

Cyber attack: Saudi reports attacks on government websites (Economic Times) Several government Internet sites have come under "coordinated and simultaneous" cyber attack, an information security spokesman in the oil-rich kingdom reported on Friday. The spokesman said among them was the interior ministry website

Middle East in spotlight amid escalating cyber attacks (Al Arabiya) The Middle East has become a hotspot for cyber attacks, experts warn, amid an escalation of computer-led warfare across the globe. Dmitri Alperovitch, co-founder of Crowdstrike, a security technology specialist firm, told last week's Reuters Cybersecurity Summit in Washington that he is most concerned about cyber attacks linked to Iran, particularly if there is a spike in tensions in the Middle East

OPpetrol – Anonymous planning to strike Kuwait (248 AM) The hacker group Anonymous released a video a few days back stating they were planning to attack a number of countries including Kuwait on June 20th. Why? Because oil is sold with the dollar and Saudi Arabia has betrayed Muslims with their cooperation. No idea what their strike would encompass but most likely theyll be bringing down all the oil related websites. Check out the video they released above

OpPetrol - It's Not About the Oil (Caffeine Security) I've posted a new Threat Watch bulletin for OpPetrol - a multi-target operation being run by Anonymous.Updates to the bulletin can be read here.Below is the bulletin posted in its entirety.INTEL BRIEFFirst Release: 19MAY2013Updated: 19MAY2013Subject: Anonymous "OpPetrol"Target: United States, Canada, United Kingdom, Israel, Saudi Arabia (only Government), China, Italy, France, Germany, Kuwait (only government) and Qatar (only government)Specific named targets:Saudi Arabia government emails

Financial Times Suffers Cyber Attack (Fox Business) Pearson's (PSO) Financial Times reported Friday that several of its blogs and social media accounts were "compromised by hackers." The announcement, initially made through the U.K.-based business publication's Twitter account, was also confirmed by

Who Is Syrian Electronic Army: 9 Facts (InformationWeek) Beware patriotic Syrian hackers holding a media grudge. That's one takeaway from the ongoing exploits of the Syrian Electronic Army, a self-described group of grassroots Syrian hackers who support Syrian President Bashar al-Assad

Hackers using DDoS to TangoDown The New York Times website (Hackers News Bulletin) According to a post of nytimes.com they are the latest victim of Hackers because The New York Times Company was a victim of online attacks earlier this week that slowed down The New York Times Web site and limited access to articles and other types of content. Nytimes.com was unable to trace the hacker but they confirmed about this DDoS Attack.According to Danielle Rhoades Ha, a company spokeswoman, the Web site became unavailable to a small number of users after a denial-of-service attack

Chinese Hackers Resume Attacks on U.S. Targets (New York Times) Three months after hackers working for a cyberunit of Chinas Peoples Liberation Army went silent amid evidence that they had stolen data from scores of American companies and government agencies, they appear to have resumed their attacks using different techniques, according to computer industry security experts and American officials.The Obama administration had bet that naming and shaming the groups, first in industry reports and then in the Pentagons own detailed survey of Chinese military

Chinese cyber crime: More crooks than patriots (Financial Times) On a muggy spring night five years ago in the southern Chinese city of Shenzhen, six young men were slowly getting drunk. "We'd all had a few beers when someone first mentioned Foxconn," one of them recalls. "But we immediately saw that it was a great idea"

Letters: Security in self-sufficiency (Business-Standard) Both the editorial "The foreign spine" and Ajit Balakrishnan's article "As bytes replace guns" (May 15) highlight the encompassing and critical nature of the internet and cyber security. Over 60 per cent of our telecommunication hardware is imported, mostly from Chinese telecom equipment manufacturers. Chinese communications technology giant Huawei is under increasing scrutiny across the world for its close links with the Chinese government.Ren Zhengfei, a former technologist in the People's Liberation Army

Pakistan hit hard by targeted cyber attack out of India (The Nation) A new campaign by a family of information-stealing malware, which appears to originate out of India, has been hittingPakistanhard over the last few months, according to American researchers. Citing researchers at Eset, Dark Reading, a comprehensive news

Norman Shark Cyber Research Report Uncovers First Large Cyber Espionage Activity Emanating From India (Wall Street Journal) Norman Shark, the global security leader in malware analysis solutions for enterprises, service providers and government, today released a report detailing a large and sophisticated cyber-attack infrastructure that appears to have originated from India. The attacks, conducted by private threat actors over a period of three years and still ongoing, showed no evidence of state-sponsorship but the primary purpose of the global command-and-control network appears to be intelligence gathering from a combination of national security targets and private sector companies

Targeted data stealing attacks using fake attachments (Help Net Security) ESET has uncovered and analyzed a targeted campaign that tries to steal sensitive information from different organizations, particularly in Pakistan (with limited spread around the world)

Heads-Up - Anonymous will Launch Cyber Attack on Belgium Govt. against Censorship (Hackers News Bulletin) According to Various news sources on the web we came to know that Anonymous Belgium going to launch a Cyber Attack on the Belgium Government next month on June 15.This is because of Belgian government is actively blocking internet sites on the Web, without even a trace of transparency.As if the Belgian government didn't have enough people against its very existence, yesterday a site claiming to be linked to Anonymous, censorthis.be sent out a mass email declaring cyber war on the Belgian

South African Police Service website breached by #Anonymous (E Hacking News) The official website of South African Police Service has been breached by the Anonymous hacktivist with online name "DomainerAnon". "This action is to serve as a reminder to the government regarding the murders of 34 protesting miners outside the Marikana platinum mine by police. "Hacker stated as reason for the attack."To date no officers have been brought to justice... This situation will NOT be tolerated. #OpMarikanaMiners" The hacker provided a link to the database dump

Various Govt. Websites from China, Israel and Argentina taken down by TeamHackerArgentino (Hackers News Bulletin) Latest tweet says that the Israel Ministry of Foreign Affairs Website (israel-mfa.gov.il) has been taken down by the hacker group of Argentina @HackerArgentino.Yesterday also we reported that various govt. sites from China and Argentina were hacked and defaced with the page ending with (/Tobitow.html) along with more than 25 websites.Yesterday we had some chat with the group, they told us that they just want to ruined the system of Govt. and they dont have any other reason behind this

Yahoo Japan says 22 million user IDs may have been stolen (CSO) Yahoo Japan, the country's largest Web portal, said up to 22 million user IDs may have been leaked during a hack that was discovered last week. The company emphasized that the IDs are already public information, and no passwords or other private data were affected. Yahoo Japan IDs are used along with password to log in to the site, and are often displayed when users leave comments or use its shopping or auction services

Cyber attack: RPG group says user identities safe (The Economic Times) The RPG group will take up the case of the cyber fraud in which the company's account was hacked into and Rs 2.4 crore siphoned off on May 11 with Yes Bank on Monday

LSU Health Acknowledges Data Breach (eSecurity Planet) LSU Health Shreveport recently began notifying patients that a processing error at Siemens Healthcare, which prints and mails doctors' bills on behalf of LSU Health, resulted in the exposure of 8,330 patients' personal information

Mopar Parts Hacked, Account Data Leaked By @Ag3nt47 (Cyberwarnews) A hacker using the handle @Ag3nt47 has just announced a hack on one of the worlds most well known Automotive parts suppliers for Chrysler, jeep, dodge and othersThe leak is from the Official site of the mopar parts which supplies replacement and additional genuine parts for Chrysler, jeep, dodge and others is one of the North Americas largest car communities.The announcement for the leak came from twitter just a short time ago and has been posted to pastebin

Imperial College London Hacked & Accounts Leaked by @1923Turkz (Cyberwarnews) Today @1923Turkz has been very active announcing breaches along side a heap of defacements with one of the most recent breaches being a united kingdom based collage.The College is Imperial College London (http://www3.imperial.ac.uk/) and its main site has been breached leaving administrator and staff accounts and information being leaked to anonpaste.me.The breach announcement comes from the official account of 1923Turkz who has a long history of defacing websites and has well over 230K archives

Lomonosov, Moscow State University Hacked Accounts Leaked by @1923Turkz (Cyberwarnews) Hackers using the handle 1923Turkz have breached the Lomonosov, Moscow State University leaving user accounts leaked online.The University is one of Moscow main university which has been around for 258 years now and has under gone many name changes over this time.The hackers 1923Turkz who have over 200,000 defacement archives on the popular defacement archive website Zone-h announced the leak a short time ago via their twitter account

Globo.com redirecting users to Spam ads (sucuri) Globo.com, one of the largest Brazilian web portals (ranked #107 on Alexa and #6 for Brazilian traffic) appears to be compromised and all visits to it are being redirected to a sub page inside pagesinxt.com. If you go to g1.globo.com (or any other of their sub domains), you will end up on a page full of ads about Hosting, Internet and fake email products:That redirection has been going for a few hours at least and we detected it for the first time around 8am EST and it is still live four hours

North Korean cyber-rattling (The Economist) Prominent web security analysts such as Rob Rachwald of FireEye, an American firm, agree that the tools used in a recent cyber-attack on South Korea could

Large Attacks Hide More Subtle Threats In DDoS Data (Dark Reading) While distributed denial-of-service attacks topping 100Gbps garner the headlines, they are not the threat that should worry most companies. In March, the massive avalanche of data that crashed down on Spamhaus, the maintainer of a number of spam blacklists, made headlines as the largest distributed denial-of-service attack witnessed to date

Ransomware adds password stealing to its arsenal (Help Net Security) Slowly but surely, more and more users are becoming acquainted with the existence of ransomware and when faced with one, they opt not to pay the requested "fine" and instead seek help for disinfecting

New Mac spyware signed with legitimate Apple Developer ID (Help Net Security) A new piece of malware designed to spy on Mac users has been unearthed by security researcher and hacker Jacob Appelbaum at the Oslo Freedom Conference held this week in Norway

Fraudsters mining data left on recycled and stolen UK mobiles (Mobile News) Recycled and stolen handsets from the UK still containing their former owners' personal data are being sold on to foreign criminals looking to commit fraud with the information

Fake Walmart Notice Shipped with Blackhole Exploit Kit (Trend Micro) The BlackHole Exploit Kit (BHEK) spam run has already assumed various disguises for the past months. It has taken the form of very convincing but fake bank notice, cable provider email update, social networking email, and courier notification among others. Lately, we have seen a slew of spam that crafted as an email notice from the popular store Walmart. However, this spam run offers something different

Commercial 'form grabbing' rootkit spotted in the wild (Webroot Threat Blog) Trust is vital. It's also the cornerstone for the growth of E-commerce in general, largely thanks to the mass acceptable of a trusted model for processing financial data and personally identifiable information. For years, the acceptance and mass implementation of PKI (Public Key Infrastructure) has been a driving force that resulted in a pseudo-secure B2C, B2B, and B2G electronic marketplace, connecting the world's economies in a 24/7/365 operating global ecosystem

DIY malware cryptor as a Web service spotted in the wild - part two (Webroot Threat Blog) With more Web-based DIY malware crypters continuing to pop up online, both novice and experienced cybercriminals can easily obfuscate any malicious sample into an undetected -- through signatures based scanning not behavioral detection -- piece of malware, successfully bypassing perimeter based defenses currently in place

Hire DDoS attack service 'legal' and connected to FBI (ZDNet) A website that can be described as "DDoS for hire" is perfectly legitimate, according to the owner. Considering the FBI secretly monitoring the site's customers through a backdoor, is that the end of the story? Ragebooter.net is one of many sites that accepts payment -- through PayPal -- in order to flood sites with junk traffic; overloading servers and denying others access

Number of Hacked Akron Taxpayers Grows to 25K (fox8.com) Akron officials are warning residents to closely monitor their personal information after a cyber-attack against networks across the country, including the City of Akron. Friday afternoon, city officials estimated that the information of

gov.im cyber attack is still being probed (Isle of Man Today) The source of a malicious cyber attack on the Manx government's website is still unknown - and a criminal investigation is on-going. Further details about last month's distributed denial of service attack on the www.gov.im website were revealed in the

A look into the EC Council hack (Help Net Security) EC Council was reported to have been compromised by a hacker called Godzilla. Based on published materials it seems that the hacker got access to training course material of several certification

How do you stop a $45M ATM heist? (ATM Marketplace) As more details of the $45 million international ATM heist begin to surface, ATM operators and their financial institution partners are learning more about the importance of third-party vendor management practices and fraud prevention strategies. With millions of prepaid cards issued worldwide and consumer demand for the cards reaching all-time highs, it's clear that regardless of their format debit, credit or prepaid all cards have become extremely valuable to crooks.What makes this heist

Cyber Trends

Cyber experts fear escalation of attacks (CRN Australia) Cyber espionage is already "the greatest transfer of wealth in history," National Security Agency Director Keith Alexander, the top U.S. general in charge of cybersecurity, told the Reuters Cybersecurity Summit in Washington this week. "Disruptive and

Should we be worried about cyberterrorism? Without a doubt (Daily Inter Lake) According to this story by Shaun Waterman, the Department of Homeland Security had sent a bulletin to "the private sector" (probably banks and major corporations) about the threatened attack against high-profile targets such as government agencies and

Keep Cyberwar Narrow (The National Interest Online) In common parlance, people conflate "cyberspace" with the "Internet," and "cyber attack" with "cyber exploitation" or "denial of service disruption." This is, in part, due to a conflation of information and communication technologies (ICT) that are

Despite BYOD security worries, SMBs are slow to deploy MDM, survey finds (FierceMobileIT) While 61 percent of small and medium-sized businesses have implemented a BYOD policy, only 37 percent are managing or plan to manage those devices using a mobile device management product, according to a survey of 991 SMB IT professionals conducted by Spiceworks and sponsored by MDM firm Fiberlink

Marketplace

Apple iOS Devices Approved for Use on Military Networks (PC Magazine) "All of these pieces must be in place to allow the secure use of commercial mobile devices on department networks," Mark Orndorff, DISA Information Assurance Executive & Program Executive Officer for Mission Assurance and Network Ops, said in the

Officials Approve Guide for Government-issued iOS 6 Devices (Department of Defense) The security technical implementation guide for mobile devices using Apple's iOS6 operating system has been approved, Defense Information Systems Agency officials announced. Approval of the guide, known as a "STIG

FBI Faces Furloughs in 2014 (Government Executive) The FBI will furlough agents and employees in fiscal 2014, should sequestration cuts continue as scheduled. FBI Director Robert Mueller told the Senate Appropriations subcommittee that oversees the Justice Department the FBI would have no choice but to force unpaid leave, thereby putting the country at risk

US insurance industry may benefit from new Internet monitoring system (Live Insurance) Cyber security has become a very big deal for the U.S. government. Federal officials often highlight the risks that exist in the digital world, expressing their concerns that hackers and malicious parties could do irreparable damage to the country in a variety of ways. While these threats can often be over-politicized, the insurance industry is well aware of the risks they represent and has also been working to draw more attention to these risks in recent years

Keyboard wars: US turns to rookies as cyber threats worsen (Port Macquarie News) Internships start as young as 16 at companies such as Northrop Grumman, which reserves 20 spots for participants in the contest. ''We're the largest provider of cyber security solutions to the federal government, so we know that we've got

Twitter to buy data analytics startup Lucky Sort (FierceCMO) Twitter's acquisition of data startup Lucky Sort could make the social network more attractive to advertisers by giving deeper insights into user tweets and where to place ads. Financial terms of the deal were not disclosed

Tumblr deal is Marissa Mayer's first real attempt to make Yahoo hip again (Quartz) Yahoo CEO Marissa Mayer has made her first major move to try to make Yahoo cool again. The Wall Street Journal reports that (paywall) Yahoo's board today approved a $1.1 billion deal to acquire blogging site Tumblr. The deal, first reported by AllThingsD, is meant to attract younger users who see Yahoo as largely irrelevant

Guidance Software signs StarLink as Master Distributor in Middle East (AME Info) Guidance Software is recognized globally as a leader in digital forensics, cyber security, and e-discovery solutions. StarLink will sell, install and

Products, Services, and Solutions

Bitcoin ATM Robocoin Makes Money Laundering Easy (IEEE Spectrum) For four blissful years, the exchanges that trade in bitcoin operated within a cloud of legal uncertainty, awaiting the day when the regulatory beast would awaken to its new opponent. Now, that day has come. This week, the Department of Homeland Security took a quick and hard strike at MT Gox, the largest online exchange, serving its payment processor Dwolla with a warrant (later obtained by ars technica) to seize the MT Gox account. Dwolla is one of the preferred ways of getting government currencies in and out of MT Gox and the news caused temporary tremors throughout the Bitcoin community. Trading volume spiked and the exchange rate bobbled down to $106 before climbing back up

What Sets The Google Cloud Platform Apart From The Rest (TechCrunch) There is a misperception about the new Google Cloud Platform that the company put into general availability last week at Google I/O. It's not a brand new platform. It's what Google has used for years. It is Google's foundation. It is what makes Google, Google. And now it's open for the first time to developers and businesses

Barracuda updates web application firewall (Help Net Security) Barracuda Networks announced Barracuda Web Application Firewall 7.8, specifically aimed at reducing the impact of automated attack attempts from botnets. Automated botnet attacks recently have gain

Vir2us' iPac3 Looks to Disrupt Computer Services Market in U.S. and EU (SF Gate) Vir2us (pronounced virtuous) today announced the release of the third in a series of products in the company's Genesis Systems product line that puts an end to the need for tedious and lengthy computer repair processes. Current computer repair methods often don't fix computer users' problems because of their inability to identify millions of unknown and embedded viruses and malware, as well as their inability to fix intermittent hardware issues

Google App Engine upgrade could kill smaller hosting companies (FierceCIO: TechWatch) Among other services and tweaks, Google will be expanding its Google App Engine to support applications written in the PHP scripting language. This was unveiled at the company's Google I/O conference this week at a developer session on the Google Cloud Platform. A highly popular language, PHP is also the language used to host blogging platforms such as WordPress and Drupal

Google+ aims to level playing field with Facebook, Twitter (FierceCMO) Google+ has never really gained much traction with users. "Try as the company might to design a place online that's sort of like Facebook and yet distinctly not Facebook, and doesn't come with the character count limitations of Twitter, it all came too little too late," wrote PC Magazine's Damon Poeter

Pinterest adds improved mobile search functionality, notifications and mentions (FierceCMO) Pinterest, working hard to make its platform more mobile-friendly to its users, released a slew of updates for iOS and Android including better search functionality, push notifications and more mention capabilities

Technologies, Techniques, and Standards

Seven Ways Banks Can Leverage a 'Security Data Scientist' (BankTech) Security executives are stepping in line and forming their own strategies, approaches, and use cases to achieve that new competitive edge. CISOs are conquering this frontier by reducing risk and fraud, whether it stems from cyber data loss or questionable customer transactions.In general, businesses have made progress in laying the foundations for the required technical data-mart infrastructure and the organization structure to support big data security initiatives. And yet, there is much work

A New Approach for Blocking Zero-Day Threats (TechNewsWorld) It's a neverending chess game between writers of malicious code and security professionals regarding zero-day threats. Blacklisting and sandboxing are common defenses but hackers can find away around those protections. However, a new technique called stateful application control can stop bad code in its tracks before software vulnerabilities can be exploited

How a best practices registry could make cloud safer (USA Today) For several years, it has seemed as though computers have played a role in virtually every part of our lives. However, we stand upon the precipice of a truly profound explosion in the growth of computing. From iPhones to tablets to self-driving cars (!) to the electrical grid, conservative projections peg the number of Internet-connected devices to rise from 8 billion today to over 100 billion by 2020

Smartphone Theft: What Is Best Defense? (InformationWeek) The latest smartphones might feature screens with unparalleled colors and clarity, cutting-edge cameras, and the ability to run a bewildering array of apps. But why don't they build in better loss prevention? That's the gist of a plea issued this week by New York attorney general Eric T. Schneiderman, who's written to the CEOs of Apple, Google, Microsoft and Samsung, urging them to "help crack down on cell phone theft" by making it more difficult for thieves to wipe stolen devices' memory and resell the devices

Citi removes forex traders from Bloomberg internal chat groups (Financial Times) Citigroup is stopping traders in its foreign exchange division from using internal chat groups on their Bloomberg terminals, in the latest sign of concern by banks over online security issues. Bloomberg has come under fire over the past week from some of its largest clients over concerns that its journalists accessed private details regarding how they used its powerful financial data terminals. Citi said the decision to close the Bloomberg chat rooms had been taken before the recent complaints were made. "This move has been in the works for some time and is unrelated to recent issues," the US bank said

Design and Innovation

Android's Design Principles And The Calculus Of The Human Pleasure Response (TechCrunch) Android UX and interaction design leads Helena Roeber and Rachel Garb gave a talk at Google I/O this year about the Android Design Principles (ADP) they helped create and introduced back in 2012 with the launch of Android 4.0 Ice Cream Sandwich. The ADP foll three simple principles, essentially "enchat, simplify and amaze," but there's much more to those principles that that relatively slippery

Bitcoin's creator is Japanese mathematician Shinichi Mochizuki, says hypertext inventor (Quartz) Ted Nelson, the American academic who in 1963 coined the term hypertext, and is therefore viewed as one of the World Wide Web's founding fathers, just released a 12-minute video with a big reveal at the end: The inventor of bitcoin, says Nelson, is probably Japanese mathematician Shinichi Mochizuki

Research and Development

The Future Of Web Authentication (Dark Reading) After years of relying on passwords, technology vendors — and enterprises — are ready for new methods of proving user identity. It may have been drawn two decades ago, but the old New Yorker cartoon still rings true: "On the Internet, nobody knows you're a dog"

Academia

Espionage and sabotage in the virtual world (Financial Times) The growing threat of cyber attacks has captured the attention of governments and boardrooms worldwide. They have a shared interest in tackling the myriad established and nascent online threats. These range from espionage - the theft of intellectual property through spyware - to sabotage, through the import of malware to their systems

Top student tech experts at Worcester Prep finish in top 10 in national competition (Cape Gazette) Students from Worcester Preparatory School's Upper and Middle School tech teams participated in Toaster Wars, an online Capture the Flag Competition hosted by Carnegie Mellon and sponsored by leading technology corporations and the National Security Agency. The competition, which took place from April 26 to May 6, was open to middle school and high school students from the United States, but the difficulty is targeted at students in upper levels of high school and runs the gamut from low-level cryptology to AP Computer Science problems

Legislation, Policy, and Regulation

EU invites NATO to boost cyber alliance (Hurriyet Daily News) The European Union's top justice official invited NATO on May 18 to work more closely with the EU to combat cyber-crime and create a safe Internet environment where citizens' rights and personal data are protected

Digital Conflict - The imperative of cyber force leadership (Defense Systems) Last month, the Pell Center for International Relations and Public Policy at Salve Regina University, Newport, RI, released the results of a study that raised the eyebrows of senior individuals in the U.S. military and government. The study, entitled, One Leader at a Time: The Failure to Educate Future Leaders for an Age of Persistent Cyber Threat, says it all

Experts ding DHS vulnerability sharing plan as too limited (CSO) Without universally availability, plan could miss smaller businesses hackers could use as an entry point to critical infrastructure companies. The Department of Homeland Security's plan to selectively share information on zero-day vulnerabilities is too restrictive and should be opened up to more companies, experts say. DHS Secretary Janet Napolitano told Reuters this week that the agency would discreetly share classified information on software vulnerabilities that are unknown to the application developer

New approach required to counter rise of cybercrime, Dubai forum hears (The National) The UAE needs to develop new and more integrated laws to deter potential cybercriminals, a leading expert has warned. The rapid growth of computer technology used by individuals, businesses and the Government that is helping to power the economy is also attracting opportunistic criminals

Defense Department Infrastructure Still Vulnerable to Cyber-Attacks, Critics Say (National Defense) The Defense Department knows how to fight a kinetic war with bullets, bombs and boots on the ground, but it is still figuring out what a cyberwar would look like and how it would be fought

How the FBI's online wiretapping plan could get your computer hacked (Washington Post) According to Matt Blaze, a computer science professor at the University of Pennsylvania and another paper co-author, the current debate over online wiretapping echos the debate over cryptography in the 1990

Tri-service commands for space, cyber warfare (The Times of India) The armed forces are now finalizing the plan for creation of three new tri-Service commands to handle space, cyber and special forces, which will be "critical" in deploying capabilities for conventional as well asymmetric warfare in a unified manner

Litigation, Investigation, and Law Enforcement

Alleged Vatican Hackers Arrested (eSecurity Planet) Four people ranging in age from 20 to 43 have been placed under house arrest. Italian police today arrested four people suspected of involvement in cyber attacks on the Vatican and the Italian parliament. According to AFP, the four have been placed under house arrested

Telstra probed over privacy blunder (Sydney Morning Herald) The federal privacy commissioner has launched an investigation into a Telstra data breach which saw thousands of customer names, telephone numbers and home and business addresses show up in a Google search.Federal privacy commissioner, Timothy Pilgrim, said on Monday that Telstra had briefed him about the incident and advised that its customers' information, contained within Excel spreadsheets, was no longer online."Telstra is currently investigating the incident and have started to contact

U.K. hacker sentencing highlights U.S. overreach (Salon) Hacktivist Jeremy Hammond has already spent 14 months in pretrial detention at federal prison in New York. He awaits trial for his alleged involvement in the famed LulzSec Stratfor hack and faces up to 42 years in prison. Meanwhile, across the Atlantic, sentencing of admitted LulzSec hackers in Britain highlights the severity of the U.S. approach to hacktivism. Three young men in the U.K. pled guilty to activity attributed to the Anonymous offshoot; their charges mirror those facing Hammond

Doncaster 'cyber-attack' man jailed (The Star) The Doncaster ex-soldier who commanded a group of young computer hackers when they launched sophisticated cyber attacks on major global institutions has been jailed. Ryan Ackroyd, aged 26, masterminded the cyber attack operation from the bedroom

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

CEIC 2013 (Orlando, Florida, USA, May 19 - 22, 2013) The largest digital-investigations conference of its kind and the only one to offer hands-on lab sessions for practical skills development. CEIC offers relevant and practical information from expert speakers. It will be of interest to anyone interested in cyber forensics and e-discovery. Former Director of Central Intelligence Michael Hayden will deliver the keynote.

IEEE Symposium on Security and Privacy (San Francisco, California, USA, May 19 - 22, 2013) Since 1980, the IEEE Symposium on Security and Privacy has been the premier forum for the presentation of developments in computer security and electronic privacy, and for bringing together researchers and practitioners in the field. Papers offer novel research contributions in any aspect of computer security or electronic privacy. Papers may represent advances in the theory, design, implementation, analysis, or empirical evaluation of secure systems, either for general use or for specific application domains. (Co-located with the IWCC and Web 2.0 Security and Privacy.)

U.S. Department of State Mobile Computing Forum (Washington, DC, USA, May 23, 2013) The U.S. Department of State's Bureau of Information Resource Management will host an educational forum and IT Expo, themed "Mobile Computing," reflecting their mission to empower diplomacy, consular services and development, by providing access to information and technology solutions anytime and anywhere. The U.S. Department of State has over 69,000 users worldwide at 285 posts with approximately 40,000 remote access users! Small businesses and prime contractors with products and services in Mobile Computing are invited to share information about their companies.

International Workshop on Cyber Crime (IWCC) (San Francisco, California, USA, May 24, 2013) The aim of this workshop is to bring together the research accomplishments provided by the researchers from academia and the industry. The other goal is to show the latest research results in the field of digital forensics and to present the development of tools and techniques which assist the investigation process of potentially illegal cyber activity. We encourage prospective authors to submit related distinguished research papers on the subject of both: theoretical approaches and practical case reviews. (Co-located with the IEEE Symposium on Security and Privacy.)

Web 2.0 Security and Privacy (San Francisco, California, USA, May 24, 2013) The goal of this one-day workshop is to bring together researchers and practitioners from academia and industry to focus on understanding Web 2.0 security and privacy issues, and to establish new collaborations in these areas. (Co-located with the IEEE Symposium on Security and Privacy.)

Maryland/DC Celebration of International Trade (Linthicum, Maryland, USA, May 21, 2013) Join Maryland exporters and international business experts as they celebrate International Trade Week. Hosted by the Maryland/DC District Export Council this event is a content rich celebration of international trade. Participate in expert discussions lead by manufacturers, legal, financial, transportation and industry experts as well as government leaders in eight vertical tracks for a total of 24 highly interactive 90 minute sessions.

IEEE-Cyber 2013 (Nanjing, China, May 26 - 29, 2013) This conference will cover cyber physical systems, cyber control and automation, cyber robotics, and the Internet of things.

Cyber Security @ CeBIT (Sydney, New South Wales, Australia, May 28 - 30, 2013) The Cyber Security Conference will serve as a platform where all those involved in securing and governing ICT within an organisation can discuss the newest challenges and strategies. The event is a must-attend for CIOs, CSOs, CISOs, Chief Risk Officers, Heads of Governance and Compliance and IT Directors. It is predicted that security service spending in Asia-Pacific will reach $7 billion in 2015, so ensure that you are investing in the best technologies for your business by joining us at the Cyber Security Conference on 28 May 2013 and hearing from leading financial institutions, retailers, airlines, telecoms companies and government.

Private Sector Crossovers: Protecting People, Property and Information (, Jan 1, 1970) With its annual cyber conference on May 29, the Howard County Chamber of Commerce and its GovConnects initiative will offer expert speakers on cyber security and efforts to protect government agencies and private industry. There will be opportunities for informal networking and formal, targeted match-ups for businesses interested in making connections with government contractors and agencies.

Cyber Security for the Chemical Industry (Franfurt, Hessen, Germany, May 29 - 30, 2013) It is becoming increasingly more important than ever to be aware of the latest cyber threats, and equipped to protect your company from them. In addition to physical security, these industries are faced with the ever-increasing risk of cyber attacks to their DCS and SCADA infrastructure networks as well as their R&D networks. These attacks can have a costly affect not only on profits, but also corporate reputation.

DGI Cyber Security Conference & Expo (Washington, DC, 2013, May 30, 2013) Data security threats continue to increase in number and sophistication. The growing use of collaborative technologies - from mobile devices and social media to virtualization and cloud computing - will continue to be one of the most significant factors impacting the security landscape. For these reasons, the federal government has increased efforts to minimize and prevent cyber security attacks, and will continue to place significant focus on securing the nation's cyber infrastructure.

Recent Advances in Reverse Engineering (RARE) (San Francisco, California, USA, Jun 1 - 2, 2013) The goal of the rare conference is to provide a venue where people interested in the analysis of binary programs can speak to one another directly, and to form a common language outside of their respective hyper-specialized, individual niches.

2013 St. Louis CISO Summit (, Jan 1, 1970) Be on the forefront of a new global initiative where today's world-class leaders in information security will gather to navigate through international waters. Join these leaders as they follow the wind of change that is sweeping through the IS community motivating today's information guardians to develop a new way of thinking to ensure success in protecting their respective organizations.

Consumerization of IT in the Enterprise Conference and Expo (San Francisco, California, USA, Jun 2 - 4, 2013) From smartphones to mobile apps, social software and 4G networks, the wave of innovation in the consumer space is transforming the way companies do business, both inside and outside of the enterprise. Over two and a half action packed days, CITE 2013 will bring together IT and business executives, venture capitalists and other practitioners to showcase leading efforts and teach others how to make the most of this transformation.

Pen Test Berlin 2013 (Berlin, Germany, Jun 3 - 9, 2013) SANS Pen Test Berlin 2013 takes place from June 3rd to June 8th in the Radisson Blu Hotel on the bank of Berlin's River Spree. SANS will offer penetration testing courses as well as a series of presentations and social events. The training offers the opportunity to participate in NetWars.

CyCon 2013: 5th International Conference on Cyber Conflict (Tallinn, Estonia, Jun 4 - 7, 2013) CyCon 2013 is an annual NATO Cooperative Cyber Defence Centre of Excellence conference that is conducted with the technical cooperation of the IEEE Estonia Section. CyCon 2013 will focus on the technical, strategic and legal implications of using automatic methods in cyber conflicts. The conference will be organized along two tracks: a Strategic Track and a Technical Track. Legal aspects will be incorporated in these two tracks.

NSA SIGINT Development Conference 2013 (Fort Meade, Maryland, USA, Jun 4 - 5, 2013) The National Security Agency is responsible for providing foreign Signals Intelligence (SIGINT) to our nation's policy-makers and military forces. SIGINT plays a vital role in our national security by providing America's leaders with critical information they need to defend our country, save lives, and advance U.S. goals and alliances globally. The exposition will be unclassified and will consist of a one-day event as an adjunct to the SIGINT Conference. The conference sessions will be conducted in a classified area in close proximity to the exhibits.

U.S. Census IT Security Conference and Exposition (Suitland, Maryland, USA, Jun 5, 2013) The Census Bureau's Information Technology Security Office (ITSO) and the Census Bureau's Data Stewardship Office is putting together a series of workshops on 'Information Security' and 'protecting your information' to lead up to their Annual IT Security Awareness Conference. This specific workshop will take place on June 5, 2013 with a focus on Security Issues..

RSA Conference Asia Pacific 2013 (Singapore, Jun 5 - 6, 2013) Join your fellow information security professionals at the inaugural RSA Conference Asia Pacific, where we'll be discussing security issues from both a global and Asia Pacific perspective. Delegates will be able to attend keynote sessions presented by leading information security industry experts and guest speakers, and choose from approximately 50 sessions.

29th Annual INSA William Oliver Baker Award Dinner (Washington, DC, USA, Jun 7, 2013) his year's awardee is General Michael V. Hayden, former Director of the Central Intelligence Agency and the National Security Agency. Registration is now open and tables are available for purchase.

2013 Cybersecurity Innovation Expo (Baltimore, Maryland, USA, Jun 10 - 13, 2013) Do not miss the opportunity to participate in the 2013 Cyber Innovation Forum with active participation from National Institute of Standards and Technology (NIST), the National Security Agency (NSA), and the Department of Homeland Security (DHS). This four-day event will take place at the Baltimore Convention Center on Monday, June 10 - Thursday, June 13 with the exposition taking place June 11-12.

3rd annual Cyber Security Summit (, Jan 1, 1970) Over the last 2 years, the summit has gathered 150+ senior Defence, National Security and Industry executives to address current and emerging cyber threats to Australia's security. Now in its 3rd year, ADM Cyber Security aims at: reviewing solutions to the ever increasing level of attacks, whether real or potential, [and] equipping all stakeholders with a wide range of actionable strategies.

NovaSec! (McLean, Virginia, USA, Jun 13, 2013) NovaSec! is Northern Virginia's largest Cybersecurity and physical security networking event of the year. We are bringing together security professionals from commercial and government organizations with members of local Northern Virginia businesses and associations to allow participants to meet, interact on key issues and provide a unified forum to network with likeminded individual.

Suits and Spooks La Jolla 2013 (LaJolla, California, USA, Jun 15 - 16, 2013) Exploring Cyber Warfighting and Threat Mitigation for Corporations and Governments. The original concept for this event was to look at what special operations forces and corporate CERTs or SOCs have in common…it readily became apparent that two broad areas kept coming up: threat mitigation through intelligence and active defense (a.k.a. offense as defense). San Diego is a wonderful location for exploring this theme thanks to its military and high technology industries. The FBI, NCIS, DOD, academia and some cutting edge INFOSEC startups will be represented.

25th Annual FIRST Conference (Bangkok, Thailand, Jun 16 - 21, 2013) The annual FIRST conference provides a setting for conference participants to attend a wide range of presentations delivered by leading experts in both the CSIRT field and from the global security community.

Hack in Paris (Paris, France, Jun 17 - 21, 2013) This five day event will examine forensics, malware analysis, and corporate hacking techniques, and what could be better, it is held at the Euro Disney conference center outside of Paris. It has attracted a stellar lineup of speakers and promises to be a very technical event with heavy emphasis on training. This is its second year.

2013 ICAM Information Day and Expo (Washington, DC, USA, Jun 18, 2013) This day provides a forum for the Identity, Credential and Access Management (ICAM) community to get first-hand information on current identity management and related technologies.

Buzzword Forensics: Mobile is the Future…and the Future is Now (Laurel, Maryland, Sioux Falls, Jun 18, 2013) Digital forensics is evolving, as all forensic sciences must evolve. With the explosive growth of the Internet as context, the discipline of digital forensics has evolved significantly since the last millennium. In today's talk we briefly explore this evolution from the Paleolithic last millennium to our present, and increasingly mobile ecosphere. Mobile device forensics has something old and something new. Open source and commercial tools have had spotty records over the years with respect to mobile device forensics. We will explore some of the similarities and look explicitly at some of the major differences between classic computer forensics and mobile device forensics, using demos of Android forensics as an exemplar. Al Holt, adjunct professor at Towson University, will be the presenter.

NASA National Capital Region Industry Days (Washington, DC, USA, Jun 25 - 27, 2013) This dedicated Information Technology Expo - sponsored by the Office of the Chief Information Officer - will serve as a focal point for NASA personnel to learn about the latest products and advances in the marketplace.

AFCEA International Cyber Symposium 2013 (Baltimore, Maryland, USA, Jun 25 - 27, 2013) Cyber threats and challenges grow every day. Successfully defending our networks requires a team approach. With this in mind, the Cyber symposium will engage the key players, including the U. S. Government, the International Community, Industry and Academia, to discuss the development of robust cyberspace capabilities and partnerships. The AFCEA International Cyber Symposium 2013 focuses on the critical missions of U.S. Cyber Command and the interface with Army Cyber Command, Marine Corps Forces Cyber Command, 10th U.S. Fleet Cyber Command, 24th Air Force Cyber, Department of Homeland Security, U.S. Coast Guard, DoD-CIO, National Security Agency (NSA), Defense Information Systems Agency (DISA), Defense Advanced Research Projects Agency (DARPA), Academia, Industry partners. The operational theme " Defining Full Spectrum Global Cyberspace Operations" will explore the operational security of DoD and Industry Networks, Cyber Operations with Joint and Coalition partners, and discuss the training and development of the cyber workforce.

ShakaCon (Honolulu, Hawaii, USA, Jun 25 - 28, 2013) This is the fifth year this "laid back security conference in paradise" is being held. Some solid presentations and training on malware analysis and penetration testing. After all, what could be better than "sun, surf, and C Shells?" There are intensive training classes on hacking mobile apps and even lock picking (the set of tools is included in the class registration).

American Technology Awards Technology and Government Dinner (Washington, DC, USA, Jun 30, 2013) TechAmerica Foundation hosts its Eleventh Annual Technology and Government Dinner at the Ronald Reagan Building in Washington DC. The dinner continues to serve as the premier Washington, DC technology networking event bringing hundreds of tech industry, congressional, and government leaders together at one venue to celebrate the partnership between industry and government.