The CyberWire Daily Briefing 11.14.14

Cyber Attacks, Threats, and Vulnerabilities

ISIS Keeps Getting Better at Dodging U.S. Spies (Daily Beast) There's a reason ISIS leader Abu Bakr al Baghdadi has proven so hard to take out. He and his followers have become really good at keeping their communications covert

G20 Brisbane: Anonymous Galactic calls to hijack G20 hashtag in cyber attack (Brisbane Courier-Mail) Anonymous Galactic, a branch of the global hacktivist movement, called on its members to "hijack" the G20 hashtag on social media today, to bombard Twitter and Facebook with "negative comments"

Australia braces for G20 cyber attacks (Fox News) Australian defense officials are preparing for what could be a barrage of possible cyber attacks during the G20 leaders' summit this Saturday and Sunday in Brisbane

G20 Cyber Security Advice (Australian Signals Directorate) Targeting of high profile events such as the G20 by state-sponsored or other foreign adversaries, cyber criminals and issue-motivated groups is a real and persistent threat. The information contained on government systems, whether classified or unclassified, is of strategic interest to cyber adversaries. Information gathered through cyber espionage can be used to gain an economic, diplomatic or political advantage

U.S. Dept. of Transportation Website Hacked By Chinese Hacker (Hack Read) A Chinese hacker going with the handle of "M4ix#4s" from "1937 CN Team" has hacked and defaced the official website of Federal Transit Administration (FTA) of U.S. Department of Transportation

NOAA Blames China In Hack, Breaks Disclosure Rules (Dark Reading) The National Oceanic and Atmospheric Administration finally confirms that four websites were attacked and taken down in September, but details are sketchy and officials want answers

Tracking Activity in the Chinese Mobile Underground (TrendLabs Security Intelligence Blog) We first lifted the veil on activities in the Chinese cybercriminal underground in 2012. Since then, we have continually reported about notable changes or activity found in this black market

HSBC loses 2.7mn users' data in Turkey cyber attack (Gulf Times) HSBC Holdings' Turkish unit said it lost 2.7mn customers' bank data in a cyber-attack. The hack resulted in the theft of data on cards and related bank accounts, Europe's biggest lender said in an e-mailed statement. No other information was stolen, and the breach shouldn't result in financial risk for customers, London-based HSBC said

BASHLITE Affects Devices Running on BusyBox (TrendLabs Security Intelligence Blog) When news of the Shellshock vulnerability broke out at the end of September, we spotted several attacks that leveraged the said vulnerability, thus manifesting the prevalence or even evolution on how attackers used the exploit. For instance, attackers used Shellshock to target SMTP servers, launch botnet attacks, and even to download KAITEN source code among others

SChannel Update and Experimental Vulnerability Scanner (MS14-066) (Internet Storm Center) Just a quick update on the SChannel problem (MS14-066, CVE-2014-6321). So far, there is still no public available exploit for the vulnerability, and details are still sparse. But apparently, there is some progress in developing a working exploit. For example, this tweet by Dave Aitel

New Twist to the Telephone Tech Support Scam (FBI Cyber Division IC3) The IC3 has produced Scam Alerts in the past advising the public of an ongoing telephone scam in which callers purport to be an employee of a major software company. The callers have strong foreign accents. The callers report the user's computer is sending error messages and numerous viruses have been detected. The caller convinces the user to give them permission to run a program allowing the caller to gain remote access. The caller advises the virus can be removed for a fee

Network Hijackers Exploit Technical Loophole (KrebsOnSecurity) Spammers have been working methodically to hijack large chunks of Internet real estate by exploiting a technical and bureaucratic loophole in the way that various regions of the globe keep track of the world's Internet address ranges

DNS infrastructure is 'highly vulnerable' to attacks, warns Infonetics (FierceITSecurity) The domain name system (DNS) infrastructure is "highly vulnerable" to attacks, warns Infonetics Research

Dridex Banking Trojan: Worldwide Threat (BankInfoSecurity) Phishing campaign uses malware embedded in Word documents

Two Dudes Prove How Easy It Is to Hack ATMs for Free Cash (Wired) When a small-time Tennessee restaurateur named Khaled Abdel Fattah was running short of cash he went to an ATM machine. Actually, according to federal prosecutors, he went to a lot of them. Over 18 months, he visited a slew of small kiosk ATMs around Nashville and withdrew a total of more than $400,000 in 20-dollar bills. The only problem: It wasn't his money

Under Attack: Your Bank, Your Grid, Yourself (Bloomberg View) Years ago hackers planted malicious software on computer systems that control parts of the United States' critical infrastructure, including pieces of the electrical grid, gas and water systems. The malware, which the Department of Homeland Security warned about only last month, was dubbed BlackEnergy and traced back to the Russian government

A Recap of the JP Morgan Breach (Webroot Threat Blog) There is a clear trend that every year there are bigger targets compromised with increased frequency with more personal data being collected. The recent attack on JP Morgan Chase is especially alarming considering they are the largest US bank and hackers had gained access to numerous servers with administrative access for nearly a month before being detected

Internet Voting Hack Alters Pdf Ballots in Transmission (Threatpost) Threats to the integrity of Internet voting have been a major factor in keeping the practice to a bare minimum in the United States

How Obama Endangered Us All With Stuxnet (Daily Beast) The cybersabotage campaign on Iran's nuclear facilities didn't just damage centrifuges. It undermined digital security everywhere

Expired Antivirus Software No. 1 Cause Of Unprotected Windows 8 PCs (Dark Reading) New data from Microsoft shows that nearly 10% of Windows 8 users are running expired AV software on their systems, making them four times more likely to get infected

Superbugs: 10 software bugs that took way too long to meet their maker (ITWorld) All software has bugs, but even the most well known applications can have errors and vulnerabilities that somehow go undetected for years

Security Patches, Mitigations, and Software Updates

A Killer Combo: Critical Vulnerability and 'Godmode' Exploitation on CVE-2014-6332 (TrendLabs Security Intelligence Blog) Microsoft released 16 security updates during its Patch Tuesday release for November 2014, among which includes CVE-2014-6332, or the Windows OLE Automation Array Remote Code Execution Vulnerability (covered in MS14-064). We would like to bring attention to this particular vulnerability for the following reasons

Microsoft Considering Public-Key Pinning for Internet Explorer (Threatpost) Microsoft is considering adding public-key pinning — an important defense against man-in-the-middle attacks — to Internet Explorer

Cyber Trends

The future of war: expanding the Clausewitzian spectrum of conflict (Foreign Policy) The Pentagon's principal cyber advisor, Assistant Secretary of Defense Eric Rosenbach, said about cyber operations last month, "The place where I think it will be most helpful to senior policymakers is what I call in 'the space between'. What is the space between? … You have diplomacy, economic sanctions…and then you have military action. In between there's this space, right? In cyber, there are a lot of things that you can do in that space between that can help us accomplish the national interest"

'@War' details the unsettling implications of cyber warfare and espionage (Christian Science Monitor) Journalist Shane Harris considers the progress that corporations, governments, and individuals are making in their capacity to protect — or to sabotage — the Internet infrastructure

U.S. government networks vulnerable despite billons spent on protecting them (Homeland Security Newswire) Experts say that cybersecurity has leaped over terrorism as the top threat to U.S. security, and with the awareness of the threat comes funding better to secure government systems

Cyber-Security Risk to Boardroom Communications Rises (eWeek) A new report found that corporate boards continue to communicate through unsecure means, and have minimal measures in place to prevent a security breach

IoT vendors must shoulder security burden as hackers outpace users: ESET (CSO) Home and business users are likely to keep missing attacks on their increasing numbers of connected devices as hackers focus on new ways of exploiting the new 'Internet of Things' (IoT), an ESET security researcher has warned

27 Data Security Experts Reveal The #1 Information Security Issue Most Companies Face With Cloud Computing & Storage (Sys-Con Media) Cloud computing is quickly becoming a mainstay for many technology companies today because of its superior flexibility, accessibility, and capacity compared to traditional online computing and storage methods. But just like traditional storage and data sharing methods, cloud computing comes with its own set of data security issues

Indians fear cyber attacks could damage country's economy: Honeywell survey (Hellenic Shipping News) More than nine in ten (92 percent) of surveyed adults in India say they are fearful that cyber hackers are carrying out attacks on major industries and sectors of the economy in their countries, according to the results of a global study announced by Honeywell

Marketplace

Microsoft: Competing AV vendors need to remember who the bad guys are (IDG via CSO) AV vendors, in fierce competition for users, should remember that cooperation is key in fighting malware, a top Microsoft security official said Friday

Time To Turn The Tables On Attackers (Dark Reading) As a security industry, we need to arm business with innovative technologies that provide visibility, analysis, and action to prevent inevitable breaches from causing irreparable damage

Gemalto acquires Marquis ID Systems (Nasdaq) Gemalto (Euronext NL0000400653 - GTO), the world leader in digital security, today announces that it has acquired all of the outstanding shares of Marquis ID Systems (MIDS), a primary provider of fully integrated solutions and services for Drivers License and Identification in the United States

Symantec partner program continues to develop in wake of company split (TechTarget) Symantec's brand-new North American channel chief gives his views on the recent company changes as the vendor continues to roll out features of its overhauled partner program

One on One with FireEye's Dave DeWalt (InfoRiskToday) CEO Opens up on the future of threat protection

DHS seeks recommendations on biometric data storage, analysis (FierceHomelandSecurity) The Homeland Security Department is turning to industry to get information about advanced technologies and systems that can help improve the storage, matching capabilities and analysis of biometric data

Cybersecurity Veteran Takes Helm as Catbird CEO (MarketWatch) With an increased focus on the company's growth plans, Catbird announced today the promotion of David Keasey to CEO. Keasey formerly served as Executive Vice President of Sales and Business Development for Catbird, the leader in security policy automation and enforcement for private clouds and virtual infrastructure

Products, Services, and Solutions

Apple Pay: How Secure Is It? (eSecurity Planet) Apple Pay and other emerging mobile payment methods like Google Wallet possess potential security vulnerabilities, yet they are more secure than credit cards

Windows Phone Sandbox Holds Up at Mobile Pwn2Own (Threatpost) The Mobile Pwn2Own hacking contest ended today as did the PacSec Applied Security Conference in Tokyo with hackers unable to gain complete control over a Windows Phone and the latest version of the Android mobile OS

SilverSky Targeted Attack Protection Solution Blocks Rare 'Unicorn' Bug Unidentified Since 1995 (PRNewswire) SilverSky, the leading independent provider of cloud-based security software and managed services, today announced that its Targeted Attack Protection (TAP) solution, by design, proactively catches all exploits designed to target the recently disclosed "Unicorn" Internet Explorer bug (CVE-2014-6332)

BlackBerry, Samsung Join Forces on Mobile Security (Wall Street Journal) BlackBerry Ltd. and Samsung Electronics Co. agreed to sell each other's mobile-security technology in an effort to win more enterprise customers

Bitdefender launches free tool to help rid users of adware (TechDay) Antivirus software provider Bitdefender has today added a free Adware Removal Tool for PC to its technologies, providing an exclusive layer of protection against annoying apps, adware, toolbars and other browser add-ons

NSONE and Black Lotus Launch Natively DDoS-Protected Private DNS Networks (MyHostNews) NSONE, Inc, a leading DNS and traffic management provider to major Internet companies, and Black Lotus, the market leader in Distributed Denial of Service (DDoS) protection services, today announced the availability of natively DDoS-protected Private DNS Networks

Check Point Introduces Solution for Fast Detection of Malware (This Day Live) Check Point Software Technologies, a global player in internet solutions, has introduced new solution that will detect and prevent malware in a system at the fastest possible time. The solution, which tests for zero second protection, beat out major solutions from other solution providers in a recent benchmark testing of malware attacks on corporate networks

Red Tiger Security Launches Online Cyber Security Training for Industrial Control Systems, SCADA Systems, and National Critical Infrastructure (Virtual Strategy Magazine) Red Tiger Security now offers cyber security training online for securing our nation's most important and strategic computer systems called Industrial Control Systems (ICS). This 5-day training course was previously only available in person

Centripetal Networks Leverages Verisign's iDefense Security Intelligence Services for their RuleGate® Appliance (Broadway World) Centripetal Networks announces today that they have partnered with VeriSign, Inc. to integrate Verisign iDefense® Security Intelligence Services into their ultra-high-performance network appliance

RedSeal Unifies Physical and Cloud Security (MarketWired) Unified security architecture is capable of being mapped, tested and measured; enables more proactive threat prevention and auditable regulatory compliance

First Dynamic DDoS Mitigation Service Launched by ISP (PRNewswire) ISP Vibe Communications selects NSFOCUS to deliver DDoS protection as a service

IID and DomainTools Partner to Strengthen Each Other's Offerings (Marketwired) Knowledge and data exchange results in better cybersecurity for customers

EFF Releases Privacy-Oriented Secure Messaging Scorecard (CryptoCoinsNews) The Electronic Frontier Foundation (EFF) released its Secure Messaging Scorecard for secure private messaging, evaluating dozens of messaging technologies on a range of security best practices

Linux Security Distros Compared: Tails vs. Kali vs. Qubes (Lifehacker) If you're interested in security, you've probably already heard of security-focused Linux distros like Tails, Kali, and Qubes. They're really useful for browsing anonymously, penetration testing, and tightening down your system so it's secure from would-be hackers. Here are the strengths and weaknesses of all three

Technologies, Techniques, and Standards

Hacker Wars: Companies Fight Back With Counter-Intelligence (NBC News) One Monday last June, 16 workers logged into their computers at the defense contractor Exelis and found emails from a financial consultant who was advising them on a subsidiary's planned spinoff. The message, sent the day before, offered updates on how the deal would affect their stock options. A spreadsheet was attached, and anyone who clicked on it got a pop-up window with the company logo asking for their user name and password

APT: Don't Give Up On Prevention (InformationWeek) As businesses rely on more complex systems with more tools from different vendors, traditional security measures are becoming increasingly inadequate

How Can Organisations Deal Intelligently with Information Security Breaches? (CSO) Data breaches are happening more frequently, compromising larger volumes of data than ever before. We seem to hear about new data breaches every day. The number of compromised records grows, while organisations are subjected to larger financial penalties, stronger legislative and regulatory scrutiny, and tangible reputational damage. For organisations that suffer a breach, responding in an intelligent and confident manner is critical

Shared Responsibility Examples: Shellshock (Trend Micro: Simply Security) Shellshock (which entails a number of CVE's), is a bug that affects bash, a command line interpreter/shell. This bug was rated a 10/10 by the National Vulnerability Database, meaning that it could have a huge impact and is easily exploitable

Managing and communicating IT security risk: A look inside Booz Allen Hamilton, Part 2 (FierceCIO) In yesterday's edition of FierceCIO we published part one of our interview with Booz Allen Hamilton CIO Kevin Winter. Winter discussed the unique reporting relationship in which his boss is the firm's CISO. Today he discusses IT security budgets; communicating IT security to the board; career paths for CISOs; and advice on how to best acquire or develop a CIS

PCRE for malware audits (Internet Storm Center) When auditing a company for their malware defense savvy, you are likely used to be presented with colorful pie charts of all the malware that their Anti-Virus (AV) product of choice "successfully" intercepted. Odds are that your auditee can show statistics for the past five years, and related "trends" of doom and gloom

Two-factor authentication: Understanding the options (Naked Security) We've written and talked about two-factor authentication (2FA), also known as two-step verification (2SV), before

What We Mean by Maturity Models for Security (Dark Reading) The aim is to assess the current state of security against a backdrop of maturity and capability to translate actions into goals that even non-security people can grasp

The Security Apps You Need to Keep Your Phone Safe (PC Magazine) Your phone is the most personal device you own. Here's how to choose the right mobile security software to keep it protected from malware and other threats

Best practices for government agencies to secure IT infrastructure (Help Net Security) Many government agencies, departments, subcontractors, service providers, and organizations that operate IT systems on behalf of the government must ensure protection of their critical infrastructure and ensure data security and continuous systems operation

Christmas: A Real Blend of Security & Online Shopping (ClickSSL Blog) Christmas is coming! Are we enough secured against cyber culprits? If the answer is "NO", then this article will give you an insight of some essential security precautions. It will make your Christmas delight, but in a secure manner. As like previous Christmas seasons, customers will again rush to E-shopping or bricks and mortar stores, there would be a great lump of data and sales

Research and Development

DHS Drafts Blueprints for Self-Repairing Networks as Hacks Mount (Nextgov) The Department of Homeland Security is working with industry to automate cyber defenses inside the government, which will ensure operations continue during and after hack attacks, DHS officials said Wednesday

Facebook experiment points to data ethics hurdles in digital research (TechTarget) A controversial Facebook research study that came to light this year provides fodder for discussions on the ethical issues involved in digital experimentation efforts

The promise of technology transfer (FCW) Research wranglers at the Department of Homeland Security are rounding up the next herd of federal cybersecurity technologies, to set them free on the commercial range in hopes of establishing hardier breeds of gear and capabilities

Academia

University of Maryland hosts girls' cybersecurity career workshop (Diamondback) At about 10 a.m. Tuesday, a group of middle school girls wearing matching white T-shirts formed a line leading into the Samuel Riggs IV Alumni Center

Students Face Off at NYU-Poly Cyber Security Week (The Journal) Hackers unite! At CSAW that is. New York University Polytechnic's School of Engineering is hosting eight separate security events this week in the 11th annual Cyber Security Awareness Week Conference (CSAW). Hundreds of college and high school students will converge at the campus starting on Thursday to participate in competitions, keynote talks and other events to help them boost their skills and knowledge in cyber security

NSF Awards University Cyber Researchers Conference Grant (UA News) The National Science Foundation has awarded a group of university cyber researchers across the state a grant to develop an upcoming conference on ethics and digital forensics

'Think Before You Link' promotes student cyber safety (Washington Post) As elementary and secondary students spend more time online, a new free program will roll out Tuesday aimed at giving children, teachers and families the tools to help young digital users safely navigate the Internet

Legislation, Policy, and Regulation

US, China see little progress on cybersecurity (The Hill) The U.S. and China made little if any progress on cybersecurity when President Obama and Chinese President Xi Jinping met at this week's Asia-Pacific Economic Cooperation (APEC) summit in Beijing

The Axiom Report: Cybersecurity and Its Impact on China-U.S. Relations (International Policy Digest) The latest revelations surrounding the Chinese cyberespionage group Axiom have once more highlighted the increasing tensions between the United States and the People's Republic of China (PRC) in cyberspace

We must not allow the internet to be an ungoverned space: UK PM (ZDNet) United Kingdom Prime Minister David Cameron has told a joint sitting of the Australian parliament that businesses have a social responsibility to clamp down on extremist content on the internet

Keeping cybersecurity focused on critical infrastructure (EurActiv) There is an uneven landscape when it comes to cybersecurity readiness in Europe, writes Thomas Boué. To build a foundation for cyber protections, the European Union needs to start with the most critical infrastructure, he argues

NSA Surveillance Faces Senate Test (TechCrunch) The United States Senate could vote on the USA FREEDOM Act as soon as next week, pushing the surveillance reform bill ahead this year. That would buck prior conventional wisdom that the Act was not a legislative priority, likely ending up shelved until the next Congress. There is still some fight in this Congress after all

As It Stands, Feinstein Would Vote 'No' on Surveillance Reform (Foreign Policy) In its current form, Sen. Dianne Feinstein, the chairwoman of the Senate Intelligence Committee, would vote against major legislation to reform the National Security Agency's bulk metadata collection program, the California Democrat said Thursday

The Enemy Who Is Us: DoD Puts Contractors On Notice For Insider Threats (Dark Reading) New rule requires US government contractors to gather and report information on insider threat activity on classified networks

Retailers Demand Federal Cybersecurity Legislation, Financial Services Firms Fire Back (Tripwire: the State of Security) In a letter addressed to Congressional leaders of the U.S. Senate and the House of Representatives, dozens of retail groups across the United States demanded the implementation of federal data protection legislation that would establish clear guidelines for businesses in the event of a breach

[Letter from Retailers to Congressional Leaders] (NRF) The recent spate of news stories about data security incidents raises concerns for all American consumers and for the businesses with which they frequently interact

[Letter from Bankers to Congressional Leaders] (ABA) On November 6, 2014, a group of organizations representing elements of the retail industry wrote to you regarding recent breaches of consumer information. Their letter, unfortunately, is inaccurate and misleading, and recommends solutions that leave consumers vulnerable to enhanced risk of data breaches. The undersigned financial services organizations wish to set the record straight

FTC chair wants clearer disclosures to protect privacy (IDG via CSO) Online service providers need to do a better job telling users what information will be gathered about them and how it will be used, a top official at the U.S. Federal Trade Commission said Wednesday

Litigation, Investigation, and Law Enforcement

How a Russian Dark Web Drug Market Outlived the Silk Road (And Silk Road 2) (Wired) Silk Roads come and Silk Roads go. But after every law enforcement crackdown shakes the dark web, one Russian black market always seems to survive

Seizure of Silk Road 2.0, 400 other hidden sites nets $1 million in bitcoin (FierceITSecurity) About a year after the shutdown of popular deep web bazaar Silk Road, the copycat that took its place, Silk Road 2.0, was seized by authorities Nov. 5

This suspected cybercriminal may be buying coke with your online bank funds (IDG via CSO) This suspected cybercriminal may be buying coke with your online bank funds

Americans' Cellphones Targeted in Secret U.S. Spy Program (Wall Street Journal) The Justice Department is scooping up data from thousands of mobile phones through devices deployed on airplanes that mimic cellphone towers, a high-tech hunt for criminal suspects that is snagging a large number of innocent Americans

Most law enforcement pros use social media in investigations, but training and policies lacking (FierceHomelandSecurity) Facebook, YouTube and Twitter have been essential in investigating, solving and preventing crimes, but a new LexisNexis study shows that many law enforcement agencies lack formal policies, training or dedicated staff to use such social media tools

CDT Files Brief in Wyndham Supporting FTC Regulation of Data Security (Center for Democracy and Technology) On Wednesday, November 12th CDT, along with the Electronic Frontier Foundation, filed an amicus brief in the long-running FTC v. Wyndham litigation. Those who have followed the case and our coverage of it may remember that in April 2014, Judge Esther Salas of the Federal District Court of New Jersey ruled in favor of the FTC regarding its ability to regulate data security under the unfairness prong of the FTC Act. However, observing that this ruling involved a novel question of law, Judge Salas allowed Wyndham to appeal her ruling to the Third Circuit. It is in this appeal that we've filed our amicus supporting the FTC

Georgia man sentenced to nine years for stolen credit card data (IDG via CSO) A 28-year-old man was sentenced to more than nine years in prison Wednesday for buying stolen credit and debit card numbers from an underground online marketplace

Coca Cola sued by former employee over unencrypted laptop data theft (TechWorld) Guards best-kept secret in US but not 55 laptops

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Maintaining Robust Grid Cybersecurity in Expanding Smart Grid Markets (Washington, DC, USA, Nov 20, 2014) This roundtable will explore how cybersecurity has become an integral component, not just an afterthought, of the critical infrastructure and the energy industry

10th Annual Cyber and Information Security Research Conference (Oak Ridge, Tennessee, USA, Apr 7 - 9, 2015) Cyberspace is fundamental to our national prosperity, as it has become critical to commerce, research, education, and government. Realizing the benefits of this shared environment requires that we are able to properly balance the risks and rewards, understand and communicate threats to security and privacy, and rapidly adapt any resulting approach to a changing adversarial environment. The 10th Annual Cyber and Information Security Research Conference at Oak Ridge National Laboratory in Oak Ridge, Tennessee will bring together cyber security researchers, program managers, decision makers, security vendors, and practitioners to discuss many challenging tasks and novel solutions pertaining to cyber security

Australian Cyber Security Centre Conference (Canberra, Australia, Apr 22 - 23, 2015) The Australian Cyber Security Centre (ACSC) will be hosting its first cyber security conference in 2015. We are bringing leading cyber security experts from Australia and abroad to share their expertise. This will be your first chance to experience the unique collaboration of the ACSC. Over 700 attendees from the national and international ICT community are expected to attend

Upcoming Events

AVAR 2014 (, Jan 1, 1970) The 17th Association of anti-Virus Asia Researchers International Conference: Security Down Under. Topics will include case studies of targeted attacks, real-life attack demonstrations, web-inject attacks/code insertion attacks, man-in-the-browser attacks, targeted advanced persistent threats, dedicated advanced evasion techniques, and mitigations to all of these. The conference will also take up identification and investigation of targeted threats, how to spot targeted attacks in collections, COINTEL (counter intelligence) on determined adversaries (e.g, detecting the attacker, running honeypots, etc.), mobile malware, and security policies.

ZeroNights 2014 (Moscow, Russia, Nov 13 - 14, 2014) ZeroNights is an international conference dedicated to the practical side of information security. It will show new attack methods and threats, showcase new possibilities of attack and defense, and suggest out-of-the-box security solutions. ZeroNights gathers experts, infosecurity practitioners, analysts, and hackers from all over the world

Cyber Security Awareness Week Conference (New York, New York, USA, Nov 13 - 15, 2014) Get ready for CSAW: the largest student-run cyber security event in the nation, with a research conference that attracts some of the biggest names in the industry, and a career fair with an impressive list of corporate partners. It's a weekend of competitions, keynote talks and cyber security events, designed to prepare best-performing students with the skills and knowledge to shape the future of the industry

Ground Zero Summit, India (New Dehli, India, Nov 13 - 16, 2014) Ground Zero Summit (GOS) 2014 in its second year promises to be Asia's largest Information Security gathering and proposes to be the ultimate platform for showcasing researches and sharing knowledge in the field of cyber security. GOS rationale: The increasing volume and complexity of cyber threats - including phishing scams, data theft, and online vulnerabilities, demand that we remain vigilant about securing our systems and information. Enterprises and governments worldwide are grappling the grim reality of data and critical systems being exploited. This summits aims at addressing these new forms of cyber attack and formulate solutions

The Affect of Cybersecurity on Humans (Albuquerque, New Mexico, USA, Nov 14, 2014) Most people would agree that technology is fascinating and has changed our lives in countless ways. But but how is it affecting us as humans and what are the issues surrounding the rapid advance in technology, especially when it comes to cybersecurity?

Cyber Threats to Critical Infrastructure: A Discussion of Challenges, Responses and Next Steps (Herndon, Virginia, USA, Nov 18, 2014) The vulnerability of the nation's critical infrastructure to cyber attack or disruption, whether from nation-states, non-state actors, hackers or disgruntled insiders, is of increasing concern to both the government and the private sector. INSA's Homeland Security Intelligence Council and Cyber Council are bringing together a panel of nationally-recognized experts to respond to a fictional scenario involving a cyber attack on critical infrastructure in the energy sector

Deepsec 2014 (Vienna, Austria, Nov 18 - 21, 2014) DeepSec is an annual European two-day in-depth conference on computer, network, and application security. This is a non-product, non-vendor-biased conference event. Our aim is to present the best research and experience from the fields' leading experts.

BugCON (Mexico City, Mexico, Nov 19, 2014) BugCON Security Conference is hardcore technical conference focused on the technical side of the security. Running since 2008 BugCON is the oldest forum where researchers, students and professionals shows their latest research and projects

Navy Now Forum: Admiral Rogers (Washington, DC, USA, Nov 19, 2014) Leaders from the Navy will present new initiatives in-depth, providing the audience with a thorough knowledge of the Navy's future plans. During the luncheon, military personnel and industry leadership will provide feedback on these initiatives to help chart the Navy's direction. This luncheon will feature NSA Director Admiral Michael Rogers

International Cyber Warfare and Security Conference (Ankara, Turkey, Nov 19 - 20, 2014) In-depth discussions will cover: new emerging threats and challenges on cyber warfare, the policy of leading cyber nations in cyber warfare and security, legal aspects of cyber warfare, industrial perspective in cyber warfare and security, new trends, new developments, technologies and solutions, and the next generation of cyber attacks—mapping the future threat environment.

EDSC 2014 (Seattle, Washington, USA, Nov 20 - 21, 2014) EDSC is a security conference focusing on embedded systems, hardware, and anything behind the silicon curtain. Embedded testing is a rapidly expanding area of the security industry staying current is important for engineers, researchers, and testers alike. EDSC will bring the top thought leaders in the embedded security field together for two days to share knowledge, techniques, and research.

Cyber Security World Conference 2014 (New York, New York, USA, Nov 21, 2014) Welcome to Cyber Security World Conference 2014 where renowned information security authorities and innovative service providers will bring their latest thinking to hundreds of senior executives focused on protecting today's enterprises. Cyber security experts will discuss topics such as protecting individuals and companies against cyber-attacks, biometrics as the future of security, risks brought by mobile computing, and protecting corporate and national infrastructure against foreign attacks

Ethiopia Banking and ICT Summit (Addis Ababa, Ethiopia, Nov 21, 2014) he one day summit is designed to highlight the key Investment opportunities especially in the Banking & ICT Sectors. As an emerging economic capital for the region, Ethiopia is leading the way in industrial growth, international trade and global integration for sub-Saharan Africa as a whole.

BSidesVienna (Vienna, Austria, Nov 22, 2014) BSidesVienna will open it's doors again in 2014. Be part of it and stay tuned

BSidesToronto (Toronto, Ontario, Canada, Nov 22, 2014) This year the conference is bigger, better, faster and…well, still one day in length but, we have an awesome line up. And no I'm not just paying "lip service"

DefCamp5 (Bucharest, Romania, Nov 25 - 29, 2014) DefCamp is the most important conference on Hacking & Information Security in Central Eastern Europe. The goal is bringing hands-on talks about latest research and practices from the INFOSEC field, gathering under the same roof security specialists, entrepreneurs, academic, private and public sectors

Cybergamut Tech Tuesday: Receiver Operating Characteristic (ROC) statistics and their successful use in medical studies, Nigerian scams, and APT detection (Columbia, Maryland, USA, Dec 2, 2014) Receiver Operating Characteristic (ROC) statistics have been a practical tool in the field of clinical medicine for more than 50 years, an area where stakes can be very high and test results are understood to be inherently uncertain. ROC statistics and that half-century body of knowledge also usefully inform networked system security across a range of activities including system design, analytics tuning, and operational tactics. This discussion first introduces ROC statistics in the context of clinical medicine, uses those concepts to explain why you can shortly expect a very well written Nigerian scam email, and then examines how ROC statistics can be used for practical improvements to networked system defense against Advanced Persistent Threat activity

5th Annual Raytheon Cyber Security Summit: "The Unassailable Enterprise" (Reston, Virginia, USA, Dec 2 - 3, 2014) We invite commercial and government entities to attend the 5th Annual Cyber Security Summit where we will explore the "unassailable enterprise" in 2014 and beyond. We bring together some of the most acclaimed cyber security experts and thought leaders in the industry to explore all aspects of cyber security

Healthcare Cyber Security Summit 2014 (San Francisco, California, USA, Dec 3 - 10, 2014) SANS is teaming up with the National Health Information Sharing & Analysis Center (NH-ISAC) to offer the 2nd Annual Healthcare Cyber Security Summit

SINET 16 (Washington, DC, USA, Dec 3 - 4, 2014) Innovative solutions frequently come from new and emerging companies. Each year, SINET invites sixteen innovative Cybersecurity companies to present their technology solutions to a select audience of prominent builders, buyers, investors and researchers. Our goal is to provide entrepreneurs from around the world an opportunity to increase awareness of their Cybersecurity products and solutions to US Federal Governmental agencies and commercial enterprises, key investors and venture capitalists. Applications close August 29, 2014

SINET Showcase (, Jan 1, 1970) "Highlighting and Advancing Innovation." Showcase provides a platform to identify and highlight "best-of-class" security companies that are addressing industry and government's most pressing needs and requirements. The chosen SINET 16 Innovators present their technological solutions to representatives from the ecosystem of the entrepreneur: venture capital, investment banking, system integration, academia, science, legal, policy, private industry and executives from the Federal Government, including civilian, intelligence and military professionals. Showcase's objective is to increase awareness of innovative solutions that may lead to an investment in, or the purchase of, advanced technologies that will help secure our nation's critical infrastructure and command-and-control systems.

Tax Incentives for Cybersecurity Businesses (Elkridge, Maryland, USA, Dec 9, 2014) Learn the details and take the opportunity to ask questions of leading experts on how to apply for tax credits (including cyber, research, security clearance, and secured space tax credits) and get the latest details on the Maryland Small Business Financing Authority's newest program for small businesses looking for investment dollars

International Conference for Internet Technology and Secured Transactions 2014 (London, England, UK, Dec 8 - 10, 2014) The ICITST is an international refereed conference dedicated to the advancement of the theory and practical implementation of secured Internet transactions and to fostering discussions on information technology evolution

(ISC)² Security Congress EMEA (London, England, UK, Dec 8 - 10, 2014) Building on the experience of the US-based (ISC)² Security Congress, now in its fourth year, (ISC)² Security Congress EMEA will offer a complementary and unique opportunity within the Europe Middle East and Africa region to participate in a comprehensive education program — over five focused tracks — and to connect with fellow colleagues in their international professional community. The themes are: Governance, Risk & Compliance; Mobile Security; Human Factor; Architecture; Data Security

ACSAC 30: Annual Computer Security Applications Conference (New Orleans, Louisiana, USA, Dec 8 - 12, 2014) ACSAC is more than just high quality, peer-reviewed research (though our 2013 acceptance rate was barely 19%). Our comprehensive program also includes training, case studies, panels, workshops, posters, and works-in-progress. Our speakers, presenters and instructors are experts involved in applied security work and research. Collectively, we explore practical solutions for computer security challenges across all phases of the system life cycle. ACSAC highlights the overall threat landscape, latest hacks and exploits, and the best prevention and defense innovations

ICFPT 2014 (Shanghai, China, Dec 10 - 12, 2014) ICFPT is the premier conference in the Asia-Pacific region on field-programmable technologies including reconfigurable computing devices and systems containing such components. Field-programmable devices promise the flexibility of software with the performance of hardware