The CyberWire Daily Briefing 12.15.14

Cyber Attacks, Threats, and Vulnerabilities

Hackers Hack into Serbia's State Network and IDs of all Serbians (Tech Worm) It seems that identities of almost all Serbians are at the risk of their personal information being leaked or used for malicious intent as a result of a hack on Serbian State's network. Five hackers have claimed that they hacked in the internet backbone of the Serbian Identity system and stolen ID numbers of almost all citizens of Serbia. Though the has not been confirmed by the Serbian authorities, the hackers have leaked a screenshot of what seems to be details of Serbian citizens

Russia targeted by another large-scale cyber espionage campaign — Kaspersky Lab (Russia Today) Russian companies in oil, finance, military, and other sectors — as well as the country's embassies abroad — have become the primary targets of a new espionage campaign, labeled 'Cloud Atlas' by global information security powerhouse Kaspersky Lab

Oil Pipeline Attack Proves Cyber Threats To Physical Infrastructure Are Real and Serious (Threat Brief) Reporting by Jordan Robertson and Michael Riley in Bloomberg is shedding new light on a destructive attack against an oil pipeline that caused a massive explosion in Refahiye Turkey in 2008. The event occurred six years ago, but information is just coming out indicating the cyber attack component of this event

Exclusive: Iran hackers may target U.S. energy, defense firms, FBI warns (Reuters) The Federal Bureau of Investigation has warned U.S. businesses to be on the alert for a sophisticated Iranian hacking operation whose targets include defense contractors, energy firms and educational institutions, according to a confidential agency document

British energy sector acknowledges cyber threats (UPI) Department tight-lipped out of fear of more exposure

North Korea And Iran: Partners In Cyber Warfare? (Forbes) North Korea has denied any involvement in the massive hacking attack last month on Sony Pictures Entertainment, and absent evidence clearly pinning the deed on Pyongyang, it may be fair to keep an open mind. With investigators still digging into the case, it's too soon to rule out a role in the attack by some of North Korea's closest friends — for instance, Iran

Iran Poses Huge Worldwide Cyber Threat (Sci-Tech Today) "Hopefully the Operation Cleaver report serves as a wake up call for global critical infrastructure providers," writes Cylance CEO and founder Stuart McClure, the man behind a riveting new report that positions Iran as the number one threat to global cyber security

What I Took Away From The Operation Cleaver (#OpCleaver) report (Threat Brief) If you track cyber security you have no doubt heard of the recently published report by Cylance titled Operation Cleaver. It has been extensively referenced in the press (including here and here) and has generated significant dialog among practitioners, pundits and policy wonks including on Twitter with the hashtag #OpCleaver. The report was so good and so well documented it resulted in the FBI taking the action of publishing special alerts warning infrastructure providers of possible Iranian cyber attacks. This was a very important report

Sony hackers release more data, promise 'Christmas gift' (CSO) A further dump of Sony Pictures corporate secrets appears to have been put on the Internet over the weekend, with hackers warning of more to come

Sony's Hacking Nightmare Gets Worse: Employees Medical Records Revealed (Bloomberg) Documents stolen from Sony Corp. (6758) by hackers include detailed and identifiable health information on more than three dozen employees, their children or spouses — a sign of how much information employers have on their workers and how easily it can become public

James Bond 'Spectre' Script Stolen In Sony Hacking, Producers Say (Deadline Hollywood) An "early version" of the script for the next James Bond film, Spectre, was among the vast trove of documents stolen in the hacker attack on Sony Pictures, according to an official statement from the Bond producers, Eon Productions

Sony Has Reportedly Suspended Production On Movies Amid Hack (Business Insider) The Sony hack keeps getting worse. The Times reports filming on Sony Pictures movies has come to a halt due to money issues

Crackle pushes back hacker movie release in light of Sony cyber attack (Boston Herald) Crackle, Sony Pictures Television's online-video site, has pushed back the release of its upcoming hacker movie "The Throwaways" in the wake of Sony's hack attack, Variety has confirmed

Sony to media: stop publishing our stolen stuff or we'll get nasty (Register) Is this the moment celebrity rags get busted for making stuff up?

Sony Pictures hit by 'fightback on filesharers' DDoS claims — report (Register) War on Guardians of Peace?

Why the Sony hack should scare feds (FCW) Sony Pictures Entertainment was brought to a virtual standstill by the recent cyberattack and the damage it caused. As the fallout from the unprecedented electronic attack on Sony Pictures Entertainment continues, cybersecurity experts said federal IT managers — while likely facing no immediate threat from the group that attacked Sony — should be paying close attention

How Not to Be Sony Pictures (IEEE Spectrum) The scope of the recent hack of Sony Pictures — in which unidentified infiltrators breached the Hollywood studio's firewall, absconded with many terabytes of sensitive information and now regularly leak batches of damaging documents to the media — is only beginning to be grasped. It will take years and perhaps some expensive lawsuits too before anyone knows for certain how vast a problem Sony's digital Valdez may be

Hacking after Sony: What companies need to know (CBS News) The massive breach at Sony Pictures has raised fears that cyber crime is outpacing corporate security and that hackers have achieved a new height of technical ingenuity in their attacks. But experts tell CBS News there's more to the story — and that while not every hack can be prevented, some of the damage can be

Attack on Sony Marks a Dangerous Escalation in Cyber Warfare (TIME) House intel chief warns that U.S. continues to ignore all-but-certain impending disaster

Alleged UK Hacking of Belgian Telecom Firm Was Far-Reaching: Reports (NDTV) Hacking of computers at Belgian telecoms firm Belgacom, alleged to have been carried out by a British spy agency, was more far-reaching than previously thought and went undetected for more than two years, according to reports published on Saturday

Revealed: spy equipment in central Oslo (The Local (Norway Edition)) Spy equipment that can be used to eavesdrop on the mobile phones of politicians and ordinary Norwegians has been discovered in several places in the Oslo area, including close to the country's parliament, newspaper Aftenposten has revealed

Worm Uses ShellShock to Infect QNAP Network Storage Systems (SecurityWeek) Researchers have uncovered a worm that's designed to plant backdoors on QNAP network-attached storage (NAS) devices. The malware is distributed through the exploitation of the GNU Bash vulnerability known as ShellShock

Spammers Accelerate Dyre Distribution (ThreatTrack Security Labs) ThreatTrack Security Labs researchers continue to monitor the evolution Dyre (aka Dyreza), the banking-credential-stealing Trojan that appears to be quickly filling the gap left by the takedown of GameOver Zeus

SoakSoak Malware Compromises 100,000+ WordPress Websites (Sucurui) This Sunday has started with a bang. Google has blacklisted over 11,000 domains with this latest malware campaign from SoakSoak

Solaris Boxes Possibly Targeted by Linux Turla Backdoor, Too (Softpedia) The Linux variant for the Turla remote access Trojan (RAT) could have initially targeted machines running the Solaris operating system, recent analysis of the malware revealed

CloudFlare SSL Certificate Used for Phishing Scam (Softpedia) SSL usage for criminal purposes is expected to increase

Facebook Password Change Email Leads to Asprox Malware (Softpedia) Malware checks the operating system and web browser

Pirated Assassins Creed Spreads Malware (Infosecurity Magazine) Assassins Creed, that wildly popular mobile and console video game, will take players to the French Revolution, World War II, or even to the Crusades as part of the Knights Templar. But a fake version will take users somewhere else entirely: to the great Malware War of 2014

'Security by Antiquity' Bricks Payment Terminals (KrebsOnSecurity) Last week, several thousand credit card payment terminals at various retailers across the country suddenly stopped working, their LCD displays showing a blank screens instead of numbers and letters. Puzzled merchants began to worry that this was perhaps part of some sophisticated hacker attack on their cash registers. It turns out that the incident was indeed security-related, but for once it had nothing to do with cyber thieves

BitDefender Exposes Potential Android Wear Vulnerability (TechAeris) Bluetooth communication is great, but how secure is it really? A team at BitDefender — an Antivirus company — wanted to find out just how much information could be intercepted from the communication between an Android phone and an Android Wear device. Just how much they were able to see might be surprising

Norse Discovers Buffer Overflow Vulnerability In FreeBSD (Dark Reading) Norse, the leader in live attack intelligence, today announced that its engineering team discovered a buffer overflow vulnerability in FreeBSD, which was shared with the FreeBSD security team and announced in their FreeBSD-SA-14:27.stdio security advisory

UK banks ill-prepared for return of the rabid POODLE (Register) Only 4,096 requests needed to uncover a 16-character cookie

Employment Websites in Belgium Hacked by Rex Mundi (Softpedia) The servers of Tobasco.be and Z-Staffing.org have been breached by an entity operating under the name of Rex Mundi, which extracted sensitive information about job applicants and published it online

University of California, Berkley suffers data breach (CSO) On September 16th of this year, the servers that were used for the capital projects and physical plant units at the University of California, Berkley were compromised. The breach involved servers and workstations in the Real Estate division which is responsible for commercial leasing and campus filming and facility use permits to name a few of their functions

Holiday Downtime Brings Big Risk for Enterprises (Infosecurity Magazine) A combination of irresponsible user behavior and weaknesses in the protection of networks could create more risks for data breaches during the holiday period than at any other time

Flights in UK disrupted by air-traffic software failure (Ars Technica) Bug in Lockheed Martin-managed flight planning system caused groundings in London

Ontario government says websites back to normal after hacking problem (O Canada News) A hacking problem that affected the Ontario government's websites have been resolved and the province says full service is being restored

Cyber Attack Sends Sweden Offline (CardsChatNews) Telia, the largest Internet service provider in Sweden, released details of its outage that occurred Tuesday evening and intermittently throughout Wednesday

ER Nurse Canned for Racking up Charges with Patients' Cards (Nextgov) Authorities found a fraudulently obtained item and a handwritten ledger listing personal information and credit card numbers for approximately 20 patients in the Florida health worker's home

Bulletin (SB14-349) Vulnerability Summary for the Week of December 8, 2014 (US-CERT) The US-CERT Cyber Security Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. The NVD is sponsored by the Department of Homeland Security (DHS) National Cybersecurity and Communications Integration Center (NCCIC) / United States Computer Emergency Readiness Team (US-CERT). For modified or updated entries, please visit the NVD, which contains historical vulnerability information

Security Patches, Mitigations, and Software Updates

Microsoft reissues withdrawn Exchange 2010 update (ZDNet) One of several updates for various versions of Exchange Server released Tuesday, the Exchange Server 2010 SP3 Update Rollup 8, was pulled Wednesday and reissued Friday

New Azure Releases by Microsoft Include Active Directory Enhancements (Redmond Magazine) Microsoft released multiple Azure products and previews yesterday, with lots of Active Directory improvements

Microsoft antimalware to lock down system settings (ZDNet) New rules will stop apps from interfering with user control of extensions and settings in all browsers. Other products do this, but Microsoft now makes it a baseline protection

Microsoft to end browser toolbar mayhem (Myce) Starting next year, Microsoft will be stricter on toolbars and other software that make changes to a browser without the explicit permission of the user. This includes applications that limit users in the choice of search engines or that mislead users in tricking them to change their default search engine or homepage

Docker 1.3.3 — Security Advisory [11 Dec 2014] (Seclists) Docker 1.3.3 has been released to address several vulnerabilities and is immediately available for all supported platforms

Cyber Trends

Avast CEO: Cyber attacks 'less dangerous' than dropping bombs (Wired) State-sponsored cyber attacks are less damaging than "dropping bombs" according to Vince Steckler, CEO of antivirus firm Avast. The threat of government spy agencies is also exaggerated, with Android alarm clock apps more of a danger to ordinary people

Tacoma cybersecurity company predicts major Internet changes (News Tribune) The Internet as we know it — free, open and accessible — might be on its death bed. The result will be more crime that's less detectible and possibly even more spam in your inbox

Security Trends 2015: CISO Needs To Think Differently (CXO) With cyber attacks getting more sophisticated by the day, security will continue to remain a major concern for enterprises in 2015. As adoption of cloud and mobility is on the rise, data security gets significant focus, as threats and risks are high

6 Strategies That WIll Save Cybersecurity in 2015 (Computer Business Review) Industry experts tell us the solutions for dangerous threat landscape

Security concerns will dampen cloud enthusiasm in 2015: WatchGuard (CSO Australia) Ongoing concerns about the security of cloud-hosted data will drive many companies to put their cloud initiatives on the back burner in 2015, security firm WatchGuard has predicted as it singles out the most and least concerning security trends for the new year

Most Organizations Don't Properly Secure Sensitive Data, Report Finds (eWeek) The "2014 State of Risk Report" from Trustwave spots a few surprising data security trends, including the fact that most organizations don't have a fully mature method to control and track sensitive data

Health-Care Breaches Cost More Than Financial Services, Retail Lapses (CRN) Health-care data breach costs are substantially higher than expenses associated with any other data breach, according to a new study that reviewed cyberinsurance claim payouts over the past year

Humans are the biggest threat to the future of security (Inquirer) Eset CTO says we must pay attention to education

IT Infrastructure Continues March into the Cloud (Datacenter Dynamics) Security of IaaS providers, however, remains a concern

Biometrics could hold key for secure BYOD (FierceMobileIT) Security remains a concern for companies considering or implementing a BYOD program. One solution to improve the security of mobile devices is biometrics, the use of human characteristics, such as fingerprints, for identification

Prepare for Cyber Armageddon (Real Clear Defense) The United States is woefully unprepared to deal with the inevitability of a major cyber attack. Recent hacks of private companies such as Sony, Home Depot, Target and the like are warnings of greater dangers to come; like the proverbial canary in the coal mine. These companies don't represent critical infrastructure such as the power grid, banking system, food distribution and storage or air traffic control. A successful attack on any one of these could bring this country to its knees

Oman tops in Middle East, is third in global cyber security index (Times of Oman) Oman took the top spot in the Middle East and finished third internationally in the International Telecommunications Union (ITU) Global Cybersecurity Index (GCI) 2014

Marketplace

BAE's US Arm Inks Deal for Eclipse Electronic Systems, Parent Closes SilverSky Buy (GovConWire) BAE Systems Inc. — the British defense contractor's U.S. subsidiary — has agreed to acquire Eclipse Electronic Systems from Esterline Corp. for nearly $28 million cash in order to add new intelligence, surveillance and reconnaissance products to BAE's portfolio

CYREN Ltd. (NASDAQ:CYRN) Loses All Shine on Thursday: VASCO Data Security International Inc. (NASDAQ:VDSI), Symantec Corporation (NASDAQ:SYMC), (Streetwise Report) Shares of CYREN Ltd. (NASDAQ:CYRN) [Detail Analytic Report] were down to knees 1.5% after rallying 48.5% to $2.59 Wednesday following the security software firm declared a new alliance with the China-based mobile security firm Bangcle

Traders Sell Nice Systems Ltd on Strength (NICE) (Mideast Times) Traders sold shares of Nice Systems Ltd (NASDAQ:NICE) on strength during trading hours on Wednesday

NICE Systems Receives Award From Relatório Bancario For Advanced Technologies In Financial Services Sector (SourceSecurity) NICE Systems recently announced that it is the recipient of an award from Relatório Bancario (Banking Report) for its advanced technologies and contribution to innovation in the financial services sector

Palantir Technologies: The Big Data Firm That Purportedly Helped Kill Bin Laden Just Raised $50 Million (International Business Times) Palantir Technologies, the big data company with clients like the NSA, FBI and CIA, raised $50 million in a financing round, according to an SEC filing. Forbes contributor Ryan Mac reports that the latest round could raise eight times that amount

Business Briefs: CipherCloud Raises $50 Million in Funding (IndiaWest) San Jose, Calif.-based CipherCloud, a provider of cloud information protection, has closed an $50 million round of financing led by Transamerica Ventures, with participation by Delta Partners and existing investors Andreessen Horowitz and T-Venture, the venture capital arm of Deutsche Telekom

Carlsbad's DB Networks raises $17 million (San Diego Union-Tribune) Start-up company makes database cyber security products

Nokia Opens Mobile Broadband Security Center in Berlin with Live 4G/LTE Test Network (Policy Charging Control) Nokia, this week opens a new Security Center in Berlin — a test laboratory to help operators protect networks against increasing security threats by providing hands-on experience with Nokia's security portfolio, live demos of potential attacks and their prevention

The Curious Case of FireEye (NASDAQ: FEYE) (Financial Buzz) 2014 has been, among other things, a year full hacks. Numerous cyber attacks on large businesses taught us that hackers are becoming more sophisticated, and more dangerous. Starting from the damaging attacks on retailers like Target (NYSE: TGT), Staples (NASDAQ: SPLS), entertainment companies like Sony (NYSE: SNE), which has been hacked twice, one attack targeted the PlayStation network, and the second targeted Sony Pictures in a successful attempt to damage property and reveal private information. Just to make the cyber-attack wave a little scarier than it already is, Turkey may have witnessed one of the first cyber attacks that caused physical damage to infrastructure, making an oil pipeline explode

Hiltzik: Tech giant struggles to shake cyberspy concerns (Go Upstate) In mid-November, the giant Chinese telecommunications firm Huawei invited networking executives from some of the more than 170 countries where it does business to attend a two-day Global Mobile Broadband Forum

Lieberman Software recruiting for EMEA campaign (ChannelPro) New entrant Lieberman Software on establishing EMEA channel 10 months after launch

The Skills Gap: Business Leaders Offers Experience — and Solutions (Business Roundtable) The skills gap is not a new issue for Business Roundtable, our member CEOs or this blog. I have written extensively on it, and CEOs have talked at length about it

Products, Services, and Solutions

AEGIS launches first cyber insurance product (Actuarial Post) AEGIS London, a Lloyd's of London syndicate, launches the first cyber insurance product to offer property damage, bodily injury, environmental pollution and cyber terrorism wrapped around existing policies

TraceSecurity and Rapid7 Partner to Add Value for Shared Customer Base (Thomasnet) TraceSecurity, a pioneer in cloud-based IT Governance, Risk and Compliance (GRC) management solutions, and Rapid7, a leading provider of security analytics software and services, today announced an integration partnership that teams the market-leading strengths of each company and enables mutual customers to leverage Rapid7's vulnerability management data when deploying their information security and compliance programs using TraceSecurity's TraceCSO

ESET Launches All-New Business Security Suite (PRNewswire) ESET®, a global leader in proactive internet security protection, today announced the launch of its all-new business security suite, with seven completely redesigned and reengineered solutions available now in North America

Vectra Launches Real-Time Detection Platform To Curb Insider Threat (HS Today) In response to the growing complexity of cyber attacks, Vectra Networks announced release of a real-time detection platform to protect organizations and government agencies from insider and target threats

Porticor Honored for Innovative Cloud Key Management (Newsfactor) Porticor®, a leading cloud data security company delivering the only cloud-based key management and data encryption solution that infuses trust into the cloud and keeps cloud data confidential, today announced that TMC, a global integrated media company, has named the Porticor Virtual Private Data™ (VPD) platform as a 2014 Cloud Computing Product of the Year Award winner

BestCrypt By Jetico Is OPSWAT Gold Certified Disk Encryption (BusinessWire) Jetico, pioneer in disk encryption software, is pleased to announce that BestCrypt Volume Encryption has now received OPSWAT Gold Certification. By being compatible with leading technology solutions that employ the OESIS Framework, Jetico's certified encryption can be used alongside many other technologies, ensuring a seamless user experience

Radware's Attack Mitigation Device Helps Protect Data Centers of Leading Telecom Provider (Nasdaq) Radware's attack mitigation device helps protect data centers of leading telecom provider

NICE Systems and CloudScann provide a new perspective for security organizations with mobile app solution (Security Info Watch) Video cameras help maintain safety and security, but a new partnership is providing a new perspective on the ground for security organizations. NICE Systems and CloudScann have announced an integrated mobile application solution, turning smartphones into reporting tools to document incidents as they happen and allowing officials to act faster to resolve them

StarLink becomes Splunk distributor in Middle East, Turkey and Africa (IT Web) StarLink, the region's trusted security-specialised "true" value-added distributor (VAD), today announced an agreement with Splunk, provider of the leading software platform for real-time operational intelligence, to become a distributor of Splunk software. StarLink will distribute Splunk products through its extensive network of channel partners to enterprise and government customers in the Middle East, Turkey and Africa

IBM's banking security software demands the right to spy on you (BoingBoing) IBM's Trusteer Rapport is a security package that many banks recommend to their customers — but its latest license agreement includes this gem

Technologies, Techniques, and Standards

Security Risks and Benefits of Docker Appllication Containers (Lenny Zeltser on Information Security) Running applications in containers rather than virtual machines is gaining traction in the IT community. This ecosystem presently revolves around Docker, a platform for packaging, distributing and managing Linux apps within containers. Though this technology is not very mature yet, it will evolve along the trajectory similar to that of VLANs and virtual machines. In the meantime, let's explore the security risks and benefits of using such containers

5 Ways To Limit Damage Caused By XSS Flaws (Techweek Europe) XSS may be the easiest way for someone to attack your website, but there are self-defence steps you can take

Cloud Regulation (Cloud Tweaks) When talking about cloud and regulation in financial services, it is important to approach it with a clear understanding of the typical policies that your national regulator will require you to adhere to

HIPAA security compliance: How risk tolerant are you? (Help Net Security) At the heart of HIPAA lies a set of core security tenets for which every affected organization is responsible. These fundamentals are absolutely non-negotiable — but the Security Rule as a whole actually allows for a certain degree of flexibility in how requirements are implemented. When it comes to HIPAA compliance, many organizations lose sight of the fact that they have the power to balance risk and keep costs down

Fundamentals of endpoint security: Antimalware protection in the enterprise (TechTarget) Expert Ed Tittel explains how endpoint antimalware protects end-user devices and the networks they connect to from malicious code

Secret CIO: Stop Making Stupid Software Decisions (InformationWeek) The way we evaluate and implement software is broken. Stop shooting for consensus from line-of-business VPs and start asking IT to become business experts

How You Think About Big Data For Cyber Security — And What You're Doing About It — May Not Agree (Forbes) It's inevitable. Whether in the boardroom or around the office, you're bound to have "the talk" about big data analytics for cyber security — if you haven't already. At issue is whether or not your organization is optimizing its data collection and analytics efforts to your best ability to detect and defend against cyber intrusions

Design and Innovation

People Want Safe Communications, Not Usable Cryptography (Technology Review) For encryption to be widely used, it must be built into attractive, easy-to-use apps like those people already rely on

Academia

U.S. Cyber Challenge Presents at Tomorrow's DHS 2014 Cyber Security Division R&D Showcase (US Cyber Challenge) Tomorrow, the National Director of U.S. Cyber Challenge (USCC), Karen S. Evans, will present at the Department of Homeland Security Science and Technology Directorate (DHS S&T) Cyber Security Division R&D Showcase in Washington, DC

UK spy agency makes an Android app — but it won't spy on you (Ars Technica) Goal is to teach students about cryptography

Northrop Grumman Does K-12 STEM Ed Both Nationally and Locally (Inside Philanthropy) Given its aerospace and defense technology corporate inclination, it's no surprise that Northrop Grumman places primary focus on STEM education, including emphasis at the K-12 level. What makes Northrop Grumman unique is that it places parallel emphasis on national STEM education programs and local STEM education programs

SANS, CSIS unveil cyber scholarships for Air Force vets (FCW) The SANS Institute and the Center for Strategic and International Studies are offering cybersecurity training scholarships for 12 veterans of the Air Force. It is the pilot phase of a broader program to get veterans top public- or private-sector jobs in cybersecurity

Trident University International Addresses Demand For Information Security Professionals with New Cyber Security Concentration (Broadway World) In response to the growing demand for expertly trained information technology and security professionals, Trident University International (Trident) began offering a Cyber Security concentration in the Bachelor of Science in Computer Science program effective Fall 2014 session

Legislation, Policy, and Regulation

National Centre of Cyber Security will start functioning as of 2015 in Lithuania (Baltic Course) The National Centre of Cyber Security formed on the basis of a section of the Ministry of National Defence will be inaugurated on 1 January, as provided for in the amendments of the Law on Cyber Security and other related legal acts approved by the Seimas of Lithuania on 11 December, informs BC the Ministry of National Defence

Schedule Slips on Israeli Cyber Defense Command (Defense News) Budgetary limbo, turf wars delay debut by year or more

Congress Passes Four Cybersecurity Bills (National Law Review) Congress approved a package of four cybersecurity bills after a series of votes in the House and Senate this week, increasing the likelihood that some cybersecurity-related legislation will be enacted by the end of the year

FBI outlines proposals for dealing with cybercrime to Congress (WeLiveSecurity) Joseph Demarest, assistant director at the FBI, has been testifying on the threats of cybercrime to a Senate Committee on Banking, Housing and Urban Affairs, and Network World reports that the agency has three specific recommendations of how Congress could assist with the ever-evolving problem

Cyberdéfense: Ashton "Ash" Carter pourra-t-il faire face au cyber Pearl Harbor? (ZDNet) Sécurité : 61% des experts en sécurité informatique outre Atlantique croient à l'antienne de l'attaque électronique de grande ampleur, touchant les intérêts vitaux de l'Amérique. Le nouveau secrétaire à la défense a un plan pour contrer la menace, mais veut rester vertueux

Who Might Control Your Telephone Metadata (Schneier on Security) Remember last winter when President Obama called for an end to the NSA's telephone metadata collection program? He didn't actually call for an end to it; he just wanted it moved from an NSA database to some commercial database

Cybersecurity codes now attached to jobs governmentwide (FedScoop) Every position in the federal workforce now has a cybersecurity job code listed in its description for more effective tracking of the lagging cyber workforce, even if the job isn't cybersecurity-related

Litigation, Investigation, and Law Enforcement

UK — A new GCHQ-NCA unit will catch pedophiles in the Deep Web (Security Affairs) Prime Minister Cameron announced that a newborn cyber unit composed by officials from GCHQ and NCA will fight online pedophiles even in the Deep Web

How cyber-vigilantes catch paedophiles and terrorists lurking in the dark web (International Business Times) Buying marijuana, cocaine and heroin has never been easier. Neither has finding a contract killer or viewing horrifying pornography. The dark web — the dark underbelly of the internet — is growing and allowing users to surf beneath the ordinary surface web with almost complete anonymity

SpamHaus, CloudFlare Attacker Pleads Guilty (KrebsOnSecurity) A 17-year-old male from London, England pleaded guilty this week to carrying out a massive denial-of-service attack last year against anti-spam outfit SpamHaus and content delivery network CloudFlare, KrebsOnSecurity has learned

Indian Police Arrest 'Jihadi Tweeter' (SecurityWeek) Indian police on Saturday arrested a 24-year-old executive believed to be the handler of an influential Twitter account supporting the Islamic State group, officials said

British Police Arrest Mother of Six for Promoting Terrorism (Threat Brief) British authorities arrested a 35-year-old mother of six from Luton for encouraging Muslim women to goad their male relatives into fighting for the jihad

Android Users in UK Subscribed to Premium Rate Services Without Consent (Softpedia) Three UK companies fined for delivering malicious apps

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

Cyber Security Division 2014 R&D Showcase and Technical Workshop (Washington, DC, USA, Dec 16 - 18, 2014) The cybersecurity threat continues to evolve and in order to keep ahead of the threat, new cutting-edge cybersecurity technologies are needed. DHS S&T's Cyber Security Division (CSD) is funding many R&D efforts through academia, small businesses, industry and government and national labs. Each year CSD gathers these researchers along with our stakeholders and partners to present the status of the research CSD is funding, enable collaboration among the researchers and government agencies, and to connect the technologies to transition partners. This year, we are excited to include an R&D Showcase featuring 11 innovative technologies selected from the CSD portfolio that addresses today's complex cybersecurity challenges and have the potential for transition into the marketplace

Cybersecurity World Conference (New York, New York, USA, Jan 9, 2015) Welcome to Cyber Security World Conference 2015 where renowned information security experts will bring their latest thinking to hundreds of senior business executives and officials focused on protecting the information of today's enterprises and government agencies, respectively. Cyber security experts will discuss topics such as protecting individuals and companies against cyber-attacks, cyber security in the Internet of Things age, biometrics as the future of security, risks brought by mobile computing, and protecting corporate and national infrastructure against foreign attacks

FloCon 2015 (Portland, Oregon, USA, Jan 12 - 15, 2015) FloCon is an open network security conference organized by Carnegie Mellon University

FIC 2015 (Lille, France, Jan 20 - 21, 2015) The International Cybersecurity Forum (FIC) forms part of a thinking and exchange process that aims at promoting a pan-European vision of cybersecurity and strengthening the fight against cybercrime, a priority for the European Union as stated in the Stockholm Programme for 2010–2015. Its objective is to open up the cybersecurity debate by bringing together security and risk management experts with non-specialists to enable them to compare viewpoints and lessons learnt

4th Annual Human Cyber Forensics Conference: Exploring the Human Element for Cloud Forensics (Washington, DC, USA, Jan 21 - 22, 2015) The Human Cyber Forensics Conference addresses the human element of cyber. Presentations will look at the tradecraft and efforts required to identify, understand, navigate, and possibly influence human behavior within and across networks. The conference will bring together subject matter experts to discover and share new means of recognizing human related cyber indicators, and the evolution of these human indicators in the coming decades. The Human Cyber Forensics Conference will focus on such topics as insider threat, next generation social engineering, progressive communications, neuroscience, social cognition, social media, and neuro-ethics

Cyber Security for Critical Assets: Chemical, Energy, Oil, and Gas Industries (Houston, Texas, USA, Jan 27 - 28, 2015) Cyber Security for Critical Assets Summit will connect Corporate Security professionals with Process Control professionals and serve to provide a unique networking platform bringing together top executives from USA and beyond. They are coming together not only to address the continuing cyber threats and set precautions framework, but most importantly to provide necessary tools, insights and methodological steps in constructing a successful secure policy. These policies will after all protect the critical assets needed to safeguard their company assets

Data Privacy Day San Diego — The Future of IoT and Privacy (San Diego, California, USA, Jan 28, 2015) Join the Lares Institute, Morrison & Foerster, and the National Cyber Security Alliance for Data Privacy Day in San Diego. DPD San Diego will bring together privacy luminaries to discuss fundamental issues facing consumers and business, including in-depth panel discussions on privacy, the Internet of Things (IoT), and many other critical topics