The CyberWire Daily Briefing for 3.31.2014

Cyber Attacks, Threats, and Vulnerabilities

Google claims Turkey intercepts their DNS (ZDNet) Apparently in order to enforce a government ban on certain services, Turkish ISPs are intercepting access of Google's public DNS service

Google reports new shenanigans in ongoing Turkish internet blockade (Naked Security) Turkey goes to the polls today amongst an ongoing brouhaha over internet access

Turkey's online censorship just took a sinister Orwellian turn (Quartz) Over the weekend, Google reported that Turkey had intercepted traffic to its public domain name system (DNS) service—part of prime minister Recep Tayyip Erdogan's increasingly draconian crackdown against the social media networks that are being used to distribute damaging information about him

Cyber attack equal to military attack: Davutoglu (Turkish Press) 'This is not an attack to AK Party. This is an attack to Turkish Republic,' says Turkey's FM. Turkish Foreign Minister Ahmet Davutoglu said Friday everybody and everything will be investigated to find the "pawns and the mastermind behind" responsible for eavesdropping of a high-level security meeting

Pakistani Consulate in Jeddah Website Hacked against Corrupt Government (HackRead) A Pakistani hacker going with the handle Hasnain Haxor from Pakistan Haxor Crew has hacked and defaced the official website of Pakistani consulate in Jeddah, Saudi Arabia against corrupt government in the country

Anonymous Ecuador Hacks Official Twitter Account of Ecuador President (HackRead) The official Twitter account of Ecuadoran president Rafael Correa was hacked last Thursday with several anti-government tweets spammed over the social media. The hacked Twitter account which has 1.45 million followers was found spamming messages against the government, containing links of Anonymous Ecuador's website where official documents and emails uploaded by the hacktivists were published

Google: Moroccan Journalists are the Targets of Cyber Attacks (Morocco World News) Moroccan journalists and news organizations are the targets of a cyber-attack, according to a study recently presented by two Google engineers, during the Black Hat Conference on hackers, held in Singapore on Friday

WordPress sites hijacked via "free" premium plugins (Help Net Security) If you run a WordPress site, and are trying to make some money through it, think twice before installing "free" versions of premium plugins

DIY automatic cybercrime-friendly 'redirector generating' service spotted in the wild — part two (Webroot Threat Blog) Cybercriminals continue actively abusing/mixing legitimate and purely malicious infrastructure, on their way to take advantage of clean IP reputation, for the purpose of achieving a positive ROI (return on investment) out of their fraudulent/malicious activities, in terms of attribution and increasing the average lifetime for their campaigns. Acting as intermediaries within the exploitation/social engineering/malware-serving chain, the market segment for this type of cybercrime-friendly services continues flourishing, with more vendors joining it, aiming to differentiate their UVP (unique value proposition) through a variety of 'value-added' services. We've recently spotted yet another managed/on demand redirector generating service, that's empowering potential cybercriminals

Malicious PDF sent in massive scam to Colombian users claiming to be from Credit score agency (Internet Storm Center) We got reports for a massive scam sent to Colombian users claiming to be from one of the two credit score agencies in Colombia. The agency is called Datacredito, affiliated to Experian

'A' for Angela: GCHQ and NSA Targeted Private German Companies and Merkel (Der Spiegel) The headquarters of Stellar, a company based in the town of Hürth near Cologne, are visible from a distance. Seventy-five white antennas dominate the landscape. The biggest are 16 meters (52 feet) tall and kept in place by steel anchors. It is an impressive sight and serves as a popular backdrop for scenes in TV shows, including the German action series "Cobra 11"

Exclusive: NSA infiltrated RSA security more deeply than thought - study (Reuters) Security industry pioneer RSA adopted not just one but two encryption tools developed by the U.S. National Security Agency, greatly increasing the spy agency's ability to eavesdrop on some Internet communications, according to a team of academic researchers

Who's Behind the 'BLS Weblearn' Credit Card Scam? (Krebs on Security) A new rash of credit and debit card scams involving bogus sub-$15 charges and attributed to a company called "BLS Weblearn" is part of a prolific international scheme designed to fleece unwary consumers. This post delves deeper into the history and identity of the credit card processing network that has been enabling this type of activity for years

A "Kill Chain" Analysis of the 2013 Target Data Breach (US Senate Committee on Commerce, Science, and Transportation) In November and December 2013, cyber thieves executed a successful cyber attack against Target, one of the largest retail companies in the United States. The attackers surreptitiously gained access to Target's computer network, stole the financial and personal information of as many as 110 million Target customers, and then removed this sensitive information from Target's network to a server in Eastern Europe

MtGox Lost 'Barely 386 Bitcoins' Due to Cyber Attacks — Not 850,000 (International Business Times) A study carried out by the Swiss Federal Institute of Technology in Zurich has concluded that, at most, MtGox lost 386 bitcoins in cyber attacks trying to take advantage of the transaction malleability flaw inherent in the bitcoin source code — not the 850,000 bitcoins its CEO Mark Karpeles claims

University of Wisconsin Hacked (eSecurity Planet) 15,000 students' names, addresses, phone numbers, e-mail addresses and Social Security numbers may have been exposed

Albuquerque Police Department website hacked in cyber-attack (KOAT News) 'Anonymous' takes credit for crash APD website

Payroll Data Breach Impacts Sorenson Communications Employees (eSecurity Planet) Employees' names, birthdates, addresses, income history, Social Security numbers, W-2 information and emergency contact data may have been exposed

Caution: Malware pre-installed! (SecureList) China's leading TV station, CCTV, has a long-standing tradition of marking World Consumer Rights Day on March 15 with its '315 Evening Party'. The annual show makes a song and dance about consumer rights violations. This year's party reported on cases where smartphone distribution channels pre-install malware into Android mobiles before selling them on to unwitting customers. As the program showed, the malware pre-installed is called DataService

China's CERT blames US for a THIRD of all attacks on Middle Kingdom PCs (The Register) Government sites declared a 'disaster area'

Prominent Porn Site Hacked (Nextgov) Users of adult sites often pick up computer infections because the site operators practice poor security hygiene, but the explanation for why malicious code was injected into beeg[dot]com could be different

How Many Patients Will Die Along with Windows XP? (Information Security Buzz) According to NetMarketShare at the end of Feburary, 2014, 30% of all PC users were running Windows XP. Over the past year I've been working closely with a huge medical devices group. Don't have a heart attack (especially if you have a pacemaker running on XP), but based upon what I've learned during that time, I anticipate the percentage of medical devices running on XP is a greater percentage than this. Several months ago many of the medical device manufacturers indicated they also use embedded XP for the GUIs to devices as well as to provide a link to external databases (containing vital medical data collected and used by the devices)

Security Patches, Mitigations, and Software Updates

Critical Vulnerabilities Patched in Schneider Electric Serial Modbus Driver (Threatpost) Schneider Electric, a leading provider of industrial control systems, recently patched a remotely exploitable vulnerability in a driver found in 11 of its products

Cisco Patches Denial-of-Service Vulnerabilitites in iOS (Threatpost) Cisco this week patched a handful of denial-of-service vulnerabilities in its IOS software. The security updates are part of a biannual release from Cisco; the next one is due in September

Cyber Trends

Unleash security rock stars through automation (InfoSecurity Europe) With analysts stating that there is a 20 year backlog of available cyber-security jobs to be filled, making current resources as effective and efficient as possible is crucial. Today's threat landscape requires specialised skills and analytical agility than ever before. Yet some of the best security talent lies buried, overwhelmed by manual tasks and procedures

NTT Innovation Cyber Security Study Finds Major Gaps (Converge! Network Digest) Network malware detection and purpose-built solutions are absolutely essential for enterprise cybersecurity as endpoint antivirus solutions are failing to catch a surprising amount of malware, according to a newly published Global Threat Intelligence Report (GTIR) from NTT Innovation Institute (NTT I³)

Bit Errors & the Internet of Things (Dark Reading) Internet traffic, misdirected to malicious bitsquatted domains, has plagued computer security for years. The consequences will be even worse for the IoT

'Thingularity' Triggers Security Warnings (Dark Reading) The Internet of Things is creating 50 billion Internet-connected devices. Who is going to keep them updated and secure?

Incident Response Now Shaping Security Operations (Dark Reading) How an organization reacts to hackers infiltrating its network is becoming the key to damage control for data — and the corporate image

Hackers Are Focused On Finding The Vulnerabilities (Information Security Buzz) In October 2013, a public exploit in PHP was disclosed using a vulnerability that was first published in 2012, categorized as CVE-2012-1823. The exploit suggested that PHP, in conjunction with Apache, suffered from command injection vulnerability. Soon after the exploit was released, Imperva's honeypots detected web servers being attacked with this exploit. In the first weeks following this discovery, Imperva recorded as many as 30,000 attack campaigns using the exploit

Risky business: Protecting US energy supplies (CNBC) The energy industry's search for new sources of power will come to nothing if its delivery systems are vulnerable to attack and disruption

Why Privacy Is Actually Thriving Online (Wired) Privacy is dead—or so we're told, both by those who would mourn the loss and by those who would dance on its grave

Even the Innocent Should Worry About Sex-Offender Apps (Quartz) The average citizen may not feel that they have anything to fear from the rise of apps that promise to identify sex offenders in their area but they are part of a worrying trend that should act as a warning about what happens when personal data is flattened out and sliced up into apparently user-friendly services

Marketplace

All of these Baltimore-area cyber security firms are hiring (Baltimore Business Journal) It's you against the bad guys — and technology is your weapon. Finding new and better ways to guard against cyber threats is crucially important these days, and new talent who are up for the challenge are in demand

Tim Reardon on Lockheed's Recent Reorg, More Than $1B Cyber Business and Int'l Expansion (ExecutiveBiz) Tim Reardon_Lockheed Martin_EMTim Reardon serves as vice president and general manager of Bethesda, Md.-based Lockheed Martin's defense & intelligence solutions business units, a 15,000-employee organization

Leadership Profile: Jerry Irvine, CIO, Prescient Solutions (HS Today) When it comes to cybersecurity, Prescient Solutions CIO Jerry Irvine has pretty much seen it all, beginning long before "cyber" — anything was etched in the public's conscience

Products, Services, and Solutions

Rapid7 Pushes Defense Prioritization, Segmentation Testing In Latest Product Updates (SecurityWeek) Rapid7 announced a number of enhancements to its IT security data and analytics solutions portfolio this week, including its Nexpose, UserInsight and Metasploit Pro offerings

Brisbane company launches internationally patented digital locker (ARN) Brisbane company release Your Digital File for online transfer of confidential documents

HHS unveils security risk assessment tool (FierceHealthIT) A new security risk assessment (SRA) tool aimed to help healthcare providers in small to medium sized offices conduct risk assessments of their organizations is now available from the U.S. Department of Health & Human Services

Worldwide cyber threats map goes online in Runet (Voice of Russia) Kaspersky's Lab has launched a new Internet service, which in real time shows cyber threats registered worldwide. According to the company's report, their virtual globe displays malicious objects detected in computers in different parts of the world, triggerings of mail and web anti-viruses, and detected network attacks. You can rotate the globe in different directions, and also draw it nearer of farther

Scrutinizing Auroracoin (Bitcoin Magazine) People at the center of Iceland's tiny cryptocurrency, cryptography, and tech scenes are questioning the good intentions of Baldur Friggjar Odinsson, the pseudonymous creator of Auroracoin. The Litecoin-based coin has become the darling of Western media in recent days thanks to its free "Airdrop" distribution to Icelandic citizens on March 25th, and has been met with great enough demand that Coinmarketcap.com now ranks Auroracoin as the fourth largest cryptocurrency by capital volume

PACK - Password Analysis & Cracking Toolkit (Ethical Hacking) PACK (Password Analysis and Cracking Toolkit) is a collection of utilities developed to aid in analysis of password lists in order to enhance password cracking through pattern detection of masks, rules, character-sets and other password characteristics. The toolkit generates valid input files for Hashcat family of password crackers

Cisco Security Response Team Opens Its Toolbox (Cisco Blogs) Cisco's network is a massively complex environment that requires extensive monitoring and remediation. In today's world of advanced threats and attacks, the company that possesses and positions its tools to preemptively identify and mitigate threats is the one left standing when the dust settles

How Dropbox Knows When You're Sharing Copyrighted Stuff (Without Actually Looking At Your Stuff) (TechCrunch) Late last night, a tweet was spread far and wide showing that a DMCA notice had blocked a file from being shared on a Dropbox user's account

You've uploaded files to Dropbox. But just how private are they? (Graham Cluley) Dropbox user Darrell Whitelaw got a surprise this weekend. He uploaded a movie file to his Dropbox folder, and — during an instant message conversation — shared a link to it with an online friend

Dropbox clarifies its policy on reviewing shared files for DMCA issues (Ars Technica) Service matches publicly shared content against hashes of previously blocked files

University improves security and access control on wireless network (ProSecurityZone) Student and staff BYOD security challenges have been overcome at Nottingham Trent University with the use of ForeScout CounterACT for security monitoring and risk mitigation

Toughpad tablets gain MOD standard encryption (ProSecurityZone) Becrypt has worked with Panasonic to provide encryption to the requirements of the UK MoD for use in the Toughpad tablet computer

Technologies, Techniques, and Standards

When Security Tools Cry Wolf (Tripwire: The State of Security) With the recent Target and Nieman Marcus breaches, we have seen that the attacks did not go without detection by the retailers' security tools. However, both cases reveal a larger problem: With the rising number and complexity of security tools at our fingertips, sometimes everything looks like an alert so nothing becomes actionable

5 "Actionable Intelligence" Questions Enterprises Should Ask Before Being Breached (SecurityWeek) From ongoing threat research, to crowd sourcing information, to Big Data analytics, and the list goes on, some security solutions provide mountains of data that are getting higher all the time. And while all of this "intelligence" is important (and potentially overwhelming), enterprises need to take a step back and ask a significant question before they find themselves breached; not after: is the intelligence supplied by our security solution truly actionable?

NIST to review standard for cryptographic development — do we really care? (Naked Security) Whether you use it to protect personal data, protect customer data or secure your communications, cryptography is an integral part of our digital world, but the announcement late in 2013 that NIST is reviewing its standards for cryptography seems to have gone largely unnoticed

Industrial Internet Group Launches (EE Times) AT&T, Cisco, GE, IBM, and Intel officially formed the Industrial Internet Consortium (IIC) to accelerate work on areas such as interoperability standards for the Internet of Things in industrial markets. Just what the group will do and when remains a work in progress

Overcoming BYOD security risks: Policy transparency, foresight key (TechTarget) Gretchen Herault, a VP at Monster and speaker at the GRC Summit in Boston, discusses BYOD security risks and how effective policy helps overcome them

Building security around Bitcoin (SC Magazine) Recent news reports have already indicated that as cryptocurrencies such as Bitcoin become more widely used, the risk of a cyber attack also increases. The latest string of stories revealing high-value digital heists of cryptocoins from exchanges, users and service providers has highlighted the ever-present skepticism of the currency's viability as well as its security

Tools for lawyers worried that NSA is eavesdropping on their confidential conversations (ABA Journal) Are you concerned that Big Brother (including the National Security Agency) is not only watching, but listening, recording and even transcribing your confidential client conversations? The good news for lawyers worried about maintaining their duty of confidentiality is that there are tools and safeguards to help them

A 'cloud first' strategy calls for strong security: Five tips to get there (TechTarget) Security is still a major obstacle for IT when it comes to cloud adoption. That was made crystal clear at the Massachusetts Technology Leadership Council seminar on securing data, availability and reputation in the cloud, which attracted a mix of security, IT, entrepreneurs and business folks. As one attendee succinctly put it, "Why should we trust AWS [Amazon Web Services] when we have no visibility into their other side?"

Having a backup solution doesn't prevent data loss (Help Net Security) Results from a survey of customers who lost valuable computer data shows the majority of consumers and businesses are taking steps to back up their data, but a range of minor oversights rendered those steps ineffective, according to Kroll Ontrack

Surprise, surprise: my online metadata actually reveals where I've been (Ars Technica) In an attempt to simulate the NSA's capability, Ars tracks its own editor for 11 days

Design and Innovation

A digital fortress? (The Economist) Windows is "spyware with an operating system attached" according to the old sysadmin joke. Riddled with unpatched security vulnerabilities ("zero-days") that let criminal hackers and intel agencies take control of the operating system, Windows is a computer security professional's nightmare

Research and Development

The Anatomy Of A Forgotten Social Network (MIT Technology Review) While network scientists have been poring over data from Twitter and Facebook, they've forgotten about Tumblr. Now they've begun to ask how this network differs from the rest

Lockheed Martin to field-test artificial intelligence to counter adaptive electronic warfare (Indian Defense) Electronic warfare (EW) experts at Lockheed Martin Corp. will field-test a prototype artificial intelligence system designed to counter adaptive wireless communications threats under terms of an upcoming sole-source contract from the U.S. Defense Advanced Research Projects Agency (DARPA) in Arlington, Va

Academia

Students test cyber skills in competition at Johns Hopkins APL (Baltimore Sun) This year's winter weather is a mere dusting compared to the winter storm that college students are grappling with this weekend at the Johns Hopkins University Applied Physics Laboratory

Cyber Aces program continues to cultivate cybersecurity talent (WDDE) The Governor's Cyber Aces State Championship over the weekend capped a six-month search to discover and develop new cybersecurity experts

Cyber Security a Hot Spot for Jobs in Lawrenceville (MMGlobalwire) When we saw this story recently about the number of postings for cyber security jobs in Lawrenceville, it made sense. The Washington D.C. area's large government complex, New York City's financial sector, and the Silicon Valley's technology hub are documented targets for cyber incursions aimed at gaining access to key assets and sensitive data

Pennsylvania's charter school funding debate no closer to resolution (TribLive) The contract that ousted PA Cyber Charter School founder Nick Trombetta brokered with its curriculum provider remains in place months after prosecutors indicted the former school chief on 11 counts of mail fraud, bribery, tax conspiracy and filing false tax returns

Legislation, Policy, and Regulation

No clear path to NSA reform on Hill (The Hill) President Obama's proposal to end government collection of Americans' phone records is expected to face a rocky path on Capitol Hill as lawmakers and pressure groups disagree on details and the scope of NSA reform

Joint Statement by Attorney General Eric Holder and Director of National Intelligence James Clapper on the Declassification of Renewal of Collection Under Section 215 of the USA PATRIOT Act (50 U.S.C. Sec. 1861) (IC on the Record) Earlier this year in a speech at the Department of Justice, President Obama announced a transition that would end the Section 215 bulk telephony metadata program as it existed, and that the government would establish a mechanism that preserves the capabilities we need without the government holding this bulk data. As a first step in that transition, the President directed the Attorney General to work with the Foreign Intelligence Surveillance Court (FISC) to ensure that, absent a true emergency, the telephony metadata can only be queried after a judicial finding that there is a reasonable, articulable suspicion that the selection term is associated with an approved international terrorist organization

Obama's proposal on NSA phone records draws support (Los Angeles Times) President Obama's proposal to balance national security and privacy concerns by stopping the government from storing records of millions of phone calls from the U.S. — on condition the data remain accessible from the telecommunications companies — won diverse backing on Sunday

Feinstein Pushes Court Approvals for NSA Phone Searches (Bloomberg) Senate intelligence committee Chairman Dianne Feinstein said she supports requiring court approval for all searches of U.S. telephone records, setting the stage for a legislative fight over how to rein in the powers of the National Security Agency

President's Plan Insufficient to Rein in NSA, Privacy Advocates Say (CIO) President Barack Obama's plan to stop the National Security Agency's bulk collection and storage of telephone records is a good first step that needs to go much further to protect Americans' privacy rights, advocates say

Two-track minds on security and privacy (Seattle Times) Arguments leveled against Real ID are being recycled to bash the National Security Agency's surveillance program. They inevitably lead to the assumption that the government is up to no good, writes syndicated columnist

Spying for national security in the United States has a price (China Post) The U.S. government is working to restrain intelligence agencies, and Americans should applaud. On March 25, major proposals were announced. The Obama administration seeks to end government bulk collection of phone records by the super-secret National Security Agency (NSA) and require court approval to monitor individual phone numbers

Chuck Hagel Thanks Alexander, Cyber Community for Defense Efforts (American Forces Press Service via the SOP) Defense Secretary Chuck Hagel has paid tribute to retiring Army Gen. Keith B. Alexander, who is stepping down as head of U.S. Cyber Command and the National Security Agency, crediting him with leading key assets in the intelligence community through one of the most challenging periods in history

Heavy Is the Head That Wears Two Hats (Slate) If confirmed to head the NSA and U.S. Cyber Command, Adm. Michael Rogers will face big challenges

Hagel, ahead of China trip, urges military restraint in cyberspace (Reuters via the Chicago Tribune) Defense Secretary Chuck Hagel, pushing for openness ahead of a trip to China, said on Friday in an unusual live broadcast from a secretive base the Pentagon would exercise restraint in using the military in cyberspace and urged other nations to do so as well

U.S. cyberwarfare force to grow significantly, defense secretary says (Washington Post) The Pentagon is significantly growing the ranks of its cyberwarfare unit in an effort to deter and defend against foreign attacks on crucial U.S. networks, Defense Secretary Chuck Hagel said Friday

DoD Looks Within to Build Cyber Force (GovInfoSecurity) Petty Officer First Class Chase Hardison is the future face of the cyberdefenders at the U.S. Cyber Command, the military organization charged with defending Defense Department networks and the nation's critical infrastructure

Did Obama Order a New Cyber Attack? (Foreign Policy) On June 21, 2013, the Chairman of the Joint Chiefs of Staff, Gen. Martin Dempsey, issued a classified order authorizing the military to conduct an operation in cyberspace. That the order came down through the military chain of command, from President Barack Obama to Secretary of Defense Chuck Hagel and then to Dempsey, seems beyond doubt. The question is, did the military actually launch a cyber attack on a computer network — which would be one of the few in documented history — as a result of the order?

Intel Community Loses Key Defender With Rogers's Retirement (Foreign Policy) The retirement of House Intelligence Committee Chairman Mike Rogers sent shockwaves through the intelligence community on Friday, as the powerful Republican from Michigan announced his intentions to quit Congress and pursue a career in conservative talk radio. The decision comes as public trust in America's spies, in particular the NSA, is at an all-time low — making the loss of the one of their staunchest defenders a particularly harsh blow for the beleaguered agencies

Secretary of Homeland Security Supports Cyber Security Proposal (Binghamton Homepage) The nation's first Secretary of the Department of Homeland Security visited Greater Binghamton…Ridge voiced his support for a Hanna proposal that would make Guardsmen with cyber security skills available to local governments in the event of a cyber attack on public infrastructure

Litigation, Investigation, and Law Enforcement

Trustwave plans to fight "baseless allegations" over Target breach (CSO Salted Hash) Last week, Trustmark National Bank and Green Bank NA, filed a complaint in Chicago federal court accusing Target and Trustwave of failing to properly secure customer data, and enabling the theft of 110 million records, including 40 million credit cards

Trustmark Pulls out Of Class-Action Suit Against Target And Trustwave (BH Consulting) Last week I wrote about how two banks — Trustmark National Bank of New York and Green Bank of Houston — had come together to file a class action lawsuit against Target, Inc. in the wake of a data breach at the US retailer which saw 40 million credit cards details, and 70 million other personal details, stolen

Here Comes the Cyber Chill? (Huffington Post) Disturbing news from the legal world this week, as cybersecurity vendor Trustwave was sued because it allegedly "failed to live up to its promises or to meet industry standards," according to an article in CIO Magazine

Court Extends NSA Bulk Data Collection Program for 90 Days (NBC News) The Foreign Intelligence Surveillance Court on Friday approved the government's request to renew for another 90-day cycle the National Security Agency's program of collecting phone call data in bulk — the final time it will do so

Newly Released and Reprocessed Documents Responsive to a Freedom of Information Act Request by the Electronic Frontier Foundation (IC on the Record) Docket Number BR 08-13 March 2, 2009 — Order from the Foreign Intelligence Court (Updated) In light of the compliance incidents identified and reported by the Government, the FISC ordered NSA to seek Court approval to query the telephony metadata on a case-by-case basis…Docket Number BR 09-06 June 22, 2009 — Order (Updated) In response to the Government's reporting of a compliance incident related to NSA's dissemination of certain query results discovered during NSA's end-to-end review, the FISC ordered the Government to report on a weekly basis, any disseminations of information from the metadata telephony program outside of NSA…Docket Number BR: 10-82 November 23, 2010 — Supplemental Order from the Foreign Intelligence Surveillance Court (Newly Released) Supplemental Order issued by the FISC in response to a government request for records concerning an individual target, not an application requesting records in bulk. The order interprets the relationship between the Right to Financial Privacy Act and Section 215 of the USA PATRIOT Act

FTC Settles with Fandango, Credit Karma Over SSL Issues in Mobile Apps (Threatpost) The makers of two major mobile apps, Fandango and Credit Karma, have settled with the Federal Trade Commission after the commission charged that they deliberately misrepresented the security of their apps and failed to validate SSL certificates. The apps promised users that their data was being sent over secure SSL connections, but the apps had disabled the validation process

After outcry, Microsoft changes course and won't access user data in theft probes (IT World) Microsoft will no longer go through email messages and other personal data that users of its online services have stored on its servers, a decision taken after being sharply criticized for accessing a person's inbox as part of an internal investigation

Op-ed: The legality of virtual currency (Ars Technica) Attorney and former IRS-man explains 3 major regulations facing Bitcoin

Man called UAE fatwa hotline for permission to hack ex-wife's Facebook page (The National) A jealous Egyptian divorcé claimed he hacked his former wife's Facebook account after receiving permission from the fatwa hotline

Judge denies gov't request to search suspect's iPhone in ricin case (Ars Technica) Georgetown U student told FBI he learned to make the poison via his iPhone

Australian Hacker May See All Charges Dropped (eSecurity Planet) 'It's a travesty, and it's taken nearly a year to get to this point,' said Matthew Flannery's solicitor Manny Conditsis

Phone-hacking trial: Charlie Brooks 'feared porn leak' (BBC) Racehorse trainer Charlie Brooks has told a court he hid pornography from police because he feared embarrassing details would be leaked to the press

Government psychologist, robbed of laptop by a prostitute, must undergo evaluation (Nextgov) A Washington state therapist who neglected to immediately confess that a hooker stole a computer containing medical information on 652 state Department of Social and Health Services clients must submit to a mental health evaluation if he wants to practice again

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

The National Security Agency at a Crossroads (, Jan 1, 1970) The Intelligence Studies Project is a joint venture of the Strauss Center and Clements Center at the University of Texas at Austin, aiming to encourage policy-relevant academic inquiry into the past, present, and future of intelligence agencies and the legal, policy, and technological environments in which they operate. Nothing better illustrates the need for such inquiry than the events of the past year surrounding the National Security Agency. As part of a larger effort to improve public understanding of those events, the Robert S. Strauss Center for International Security and Law and the William P. Clements Jr. Center for History, Strategy & Statecraft are hosting a major interdisciplinary conference focused on the NSA from April 3rd through 4th. It will cover topics including the history of the NSA, the role of the media in revealing classified information about its activities, the legal architecture in which it operates, the compliance and oversight mechanisms associated with the NSA, the diplomatic fallout from the recent revelations, and the prospects for reform.

2014 Honeynet Project Workshop (, Jan 1, 1970) The 2014 Honeynet Project Workshop is organized by the Honeynet Project and coordinating with CERT Polska under NASK, held in The Adgar Plaza Conference Center in Warsaw, Poland from 12-14 May 2014. The workshop is a 3-day event to bring together top information security experts from around the globe to present their research efforts as well as discuss insights and strategies to combat new emerging threats through briefing sessions along with live demonstrations and hands-on training in state-of-the-art tools and techniques.

Interop Conference (, Jan 1, 1970) Interop Conference sessions help you find actionable solutions to your current IT headaches and plan for future developments.

SyScan 2014 (Singapore, Mar 31 - Apr 4, 2014) SyScan is a deep knowledge technical security conference. It is the aspiration of SyScan to congregate in Asia the best security experts in their various fields, to share their research, discovery and experience with all security enthusiasts in Asia.

InfoSec World Conference & Expo 2014 (, Jan 1, 1970) With the primary objective of providing top-notch education to all levels of information security and IT auditing professionals, InfoSec World delivers practical sessions that give you the tools to strengthen your security without restricting your business.

NIST IT Security Day (Gaithersburg, Maryland, USA, Apr 8, 2014) The Office of the Chief Information Officer, OCIO, is hosting NIST IT Security Day as a means to heighten awareness for all NIST users on the many aspects of operational information technology security and networking at home and in the office. This event's objective is to educate users on IT security and related topics. The event will feature guest speakers on general and technical IT security topics and tutorials on internal services and products.

IT Security Entrepreneurs Forum (ITSEF) 2014 (, Jan 1, 1970) IT Security Entrepreneurs Forum (ITSEF) is SINET's flagship event, designed to bridge the gap between the Federal Government and private industry. ITSEF brings unique value to the Cybersecurity community by providing a venue where entrepreneurs can meet and interact directly with top government agency and industry officials in an open and collaborative environment. This SINET community of interest and trust facilitates broadened awareness of the government's challenges, needs, and its future direction regarding Cybersecurity, while shining a spotlight on the entrepreneurs and their innovative technologies that are helping to address and solve today and tomorrow's security challenges.

Defensive Cyberspace Operations & Intelligence Conference (, Jan 1, 1970) Two days of presentations, workshops, training, and networking on defensive operations and intelligence activities in cyberspace. Speakers from government, universities, and industry will share their insights with participants.

SOURCE (, Jan 1, 1970) The purpose of SOURCE Conference is to bridge the gap between technical excellence and business acumen within the security industry. SOURCE fosters a community of learning where business and security professionals come together to gain knowledge and skills, network with peers, and advance their careers and professional development. SOURCE enables individuals, teams, and organizations to leverage information to improve decision-making, optimize performance, and achieve business objectives.

2014 GovCon Cyber Summit (McLean, Virginia, USA, Apr 9, 2014) The U.S. Computer Emergency Readiness Team (US-CERT) noted that last year federal networks saw a substantial increase in hacking incidents, with 48,000 attacks reported by agencies. In recognition of this fact, and to help emphasize the importance of a secure framework, the Obama administration released the Cybersecurity Cross-Agency Priority (CAP) Goal to help agencies improve secure performance through network consolidation, strong identity management, and continuous monitoring. Agencies are implementing new procedures and technologies to shore up defenses before it's too late, and it's clear that the federal government is not going to stop in their increased efforts to minimize and prevent cyber security attacks. Bottom line, the federal government will continue to place significant focus on securing the nation's cyber infrastructure and it's having an impact on the entire GovCon community.

Women in Cyber­security Conference (Nashville, Tennessee, USA, Apr 11 - 12, 2014) WiCyS is an effort to bring together women (students/faculty/researchers/professionals) in cybersecurity from academia, research and industry for sharing of knowledge/experience, networking and mentoring. Any individual or organization interested in recruitment/retention of women in this field and/or diversification of their cybersecurity workforce is especially encouraged to get involved.

NSA Procurement in today's business arena (Elkridge, Maryland, USA, Apr 16, 2014) An opportunity to gain inside perspective on market trends in NSA Procurement. The guest speaker will be William Reybold, National Security Agency's Deputy Senior Acquisition Executive (SAE), who manages all Agency procurements, from off-the -shelf supplies to developing and deploying large, highly technical, and complex new system. He is directly accountable for delivery of all major systems acquisitions and includes as part of the organization, the NSA Contacting Group.

Suits and Spooks San Francisco (, Jan 1, 1970) S3+: Surveillance, Security, Sovereignty and other Critical Issues. Not another hacker conference. Suits and Spooks is a unique gathering of experts, executives, operators, and policymakers who discuss hard challenges in a private setting over two days. CFP is now open. If you're interested in being a speaker at Suits and Spooks San Francisco, please send an email with your topic title, short abstract, and your bio by February 15th.

US News STEM Solutions: National Leadership Conference (, Jan 1, 1970) The STEM crisis in the United States demands solutions—and nowhere is the search more concentrated than at U.S. News STEM Solutions. Now in its third year, this premier national leadership conference is an outcome-focused forum for the entire network of experts, advocates and change-makers who are proactively working to fill jobs now and advance the future of the STEM workforce. More than a broad-based discussion of the issues, this year's conference will zero in on tangible results, real successes and collaborative strategies that are already moving the needle. If you have a vested interest in the development of the STEM pipeline, make your voice heard where it will have the most impact.

East Africa Banking and ICT Summit (Kampala, Uganda, Apr 25, 2014) The global event series for Banking and ICT Summit enters its third year. The summit will continue to provide delegates with technical & practical sessions, lectures and showcase for banking and ICT innovations, and unique networking opportunities.

National Collegiate Defense Cyber Competition (, Jan 1, 1970) Registration for the 2014 CCDC season is underway! Visit your region's website or contact your regional for registration and competition information.

InfoSecIndy (Indianapolis, Indiana, USA, Apr 26 - 27, 2014) Join us on April 26-27, 2014 in Indianapolis, Indiana for the premier Midwest Information Security and Digital Forensics Conference.

United States Cyber Crime Conference 2014 (, Jan 1, 1970) This is the only event of its kind that provides both hands-on digital forensics training and an interactive forum for cyber professionals to network. The conference covers the full spectrum of topics facing defenders as well as law enforcement responders. All aspects of computer crime will be covered, including intrusion investigations, cyber crime law, digital forensics, information assurance, along with research and development, and testing of digital forensic tools.

Infosecurity Europe 2014 (, Jan 1, 1970) Infosecurity Europe is Europe's number one Information Security event. Featuring over 350 exhibitors, the most diverse range of new products and services, an unrivalled education programme and over 12,000 visitors from every segment of the industry, it's the most important date in the calendar for Information Security professionals across Europe.