The CyberWire Daily Briefing 07.22.15

Cyber Attacks, Threats, and Vulnerabilities

Anonymous and ISIS engaged in bitter cyber warfare (Silicon Republic) The internet is now a war zone between the collection of hackers known as Anonymous and ISIS (Islamic State) sympathisers on social media to discredit them

U.S. decides against publicly blaming China for data hack (Washington Post) Months after the discovery of a massive breach of U.S. government personnel records, the Obama administration has decided against publicly blaming China for the intrusion in part out of reluctance to reveal the evidence that American investigators have assembled, U.S. officials said

China's New Intelligence War Against the United States (War on the Rocks) The Chinese intelligence threat is set to change dramatically as hackers believed to be linked to China's civilian intelligence agency, the Ministry of State Security (MSS), acquired millions of personal records from the U.S. Office of Personnel Management (OPM). Although the full extent of the damage remains unknown, fears have emerged about the compromise of data gathered during security clearance background checks, including foreign national contacts

Reflections on virtualization security and the VENOM vulnerability (Help Net Security) Virtualization is undoubtedly a great IT tool that enables organizations to quickly run new instances of servers and workstations, helps isolate environments, and allows for a more efficient use of the IT infrastructure

Bug in widely used OpenSSH opens servers to password cracking (Ars Technica) Flaw dating back to 2007 allows crackers to try huge number of guesses

Secure DNS: Beyond Hijacks, Defacement (GovInfoSecurity) Akamai's Mike Smith on Attack Techniques and Mitigations

Bartalex malspam pushing Pony/Dyre (Internet Storm Center) Earlier this year, we started seeing reports of macro-based Bartalex malware. Bartalex has been used in Microsoft Office documents sent through malicious spam (malspam). On Tuesday 2015-07-21, we found a sample to examine for today's diary. We used this example of Bartalex to infect a Windows host with Pony malware that downloaded a Dyre banking Trojan

Angler Climbing To Top Of Exploit Heap (Dark Reading) Exploit kit dominates the field, making up 82 percent of all exploit kits currently used

'State Dept' email just tried to infect my computer (Federal Times) Someone pretending to be from the State Department just sent me a virus, a variation of a particularly nasty piece of malware that reportedly brought down the State Department's email system last year and compromised the White House's unclassified network

Statement From Avid Life Media Inc. (PRNewswire) We were recently made aware of an attempt by an unauthorized party to gain access to our systems. We immediately launched a thorough investigation utilizing leading forensics experts and other security professionals to determine the origin, nature, and scope of this incident

Is the Ashley Madison data breach worse than other data breaches? (Avast Blog) Ashley Madison calls itself the "most famous website for discreet encounters between married individuals". Now, the platform for infidelity and dating has been hacked and its user database of 40 million cheaters with their real names, addresses, financial records, and explicit information were stolen. Discreet is done

Is It OK to Cheat on the AshleyMadison Cheaters? (Poll) (F-Secure: Safe & Savvy) The user register of AshleyMadison has been hacked. You don't know what that is? Well, that's perfectly fine. It's a dating site for people who want to cheat on their spouses. Many dislike this site for moral reasons, but there is apparently a demand for it. The Canadian site has some 37 million users globally! Some user data has already been leaked out and the hackers, calling themselves Impact Team, have announced that they will leak the rest unless the site shuts down. So this hack could contribute to many, many divorces and a lot of personal problems!

Ashley Madison hits back at 'act of cyber-terrorism' (Computer Business Review) Dating firm drops data deletion charge after hack hits 37 million

No Ashley Madison, you weren't burgled by terrorists (Graham Cluley) I'm not a big fan of the phrase "cyber terrorism"

Leak Shows That Hacking Team Targeted Cryptocurrency (eWeek) By hacking targets' systems, grabbing their wallet files and waiting for victims to enter passwords, Hacking Team eliminated the anonymity cryptocurrency users seek

Hacking Team hacked by whom? (CSO) I tried. $deity I tried not to comment on the story

Hackers Remotely Kill a Jeep on the Highway — With Me in It (Wired) I was driving 70 mph on the edge of downtown St. Louis when the exploit began to take hold

Analyst: Cars aren't safe from cyberattacks (WTOP) Two security researchers attacked a Jeep Cherokee earlier this month to show drivers how easy it is to hack the computer system

Smartwatches Are Extremely Vulnerable to Security Threats, Study Shows (Hot for Security) Smartwatches harbor significant vulnerabilities, including insufficient authentication, lack of encryption and privacy concerns, according to HP's security assessment

Security Patches, Mitigations, and Software Updates

Car-hacking expert urges Jeep owners to install security update (Graham Clulely) Jeep owners — you don't want someone having "unlawful access" to your vehicle's systems, right?

Stable Channel Update (Chrome Releases) The Chrome team is delighted to announce the promotion of Chrome 44 to the stable channel for Windows, Mac and Linux. Chrome 44.0.2403.89 contains a number of fixes and improvements

Google Patches 43 Bugs in Chrome (Threatpost) A new version of Google Chrome is available, and it contains patches for 43 security vulnerabilities, many of them in the high-risk category

Windows 10 Sharpens Browser Security With Microsoft Edge (TrendLabs Security Intelligence Blog) Internet Explorer is possibly the most popular target for vulnerabilities around today. In 2014 alone, a total of 243 memory corruption vulnerabilities in Internet Explorer were disclosed and patched

Cyber Trends

FuTuRology: A Look at Impending Threats to Popular Technologies (TrendLabs Security Intelligence Blog) How do you think will the threat landscape evolve in the next two years? Three years?

It's official: The average DDoS attack size is increasing (Help Net Security) New global DDoS attack data from Arbor Networks shows strong growth in the average size of DDoS attacks, from both a bits-per-second and packets-per-second perspective

Perimeter security no longer enough: RSA (ComputerWorld) RSA president Amit Yoran says companies need to re-think their traditional approaches to cyber defence

Many execs still insist top role for CISO is to be security 'fall guy' (FierceCIO) A growing number of organizations are appointing or hiring chief information security officers to lead security initiatives, but don't expect most of those executives to be welcomed into the C-suite anytime soon

Nonstop Cyber Attacks Drive Israel to Build Hack-Proof Defense (BloombergBusiness) In 2013, Israel Electric Corp. registered several hundred potential hacks on its grid each hour. Last year, the figure grew — to 20,000

Are Asian governments the next major cybercrime targets? (eGovInnovation) In recent months, a disturbing trend happening right here in the Asia Pacific region has come to light — Cyber espionage groups are placing governments and military organizations in the region on their hit list, with an objective of gathering geo-political intelligence

Marketplace

Hardware encryption market revenue to reach $36.4 billion by end of 2015 (Help Net Security) There are a variety of ways to secure data, either on the perimeter or within the LAN, but the most fundamental method in a defense-in-depth model is hardware encryption. The advantage of hardware-based solutions is that they bypass many of the typical drawbacks of software-based solutions like performance degradation or vulnerability to attacks aimed at the encryption key stored in memory

LookingGlass Announces Acquisition of Kleissner and Associates (BusinessWire) Leader in global botnet monitoring enhances LookingGlass' comprehensive threat intelligence capabilities and opens up new market opportunities

LookingGlass Acquires Prague-based Kleissner and Associates (The CyberWire) Mergers and acquisitions are of particular interest in a growing sector like cyber security. We spoke with LookingGlass CEO Chris Coleman about his company's acquisition of Prague-based Kleissner & Associates, and he shared his views on the importance of aligning acquisition with strategic goals

Synopsys Completes Acquisition of Seeker from Quotium (PRNewswire) Synopsys, Inc. (Nasdaq: SNPS) has completed its acquisition of certain assets of Quotium (NYSE Euronext: QTE), including the Seeker® product and R&D team. The asset acquisition adds talent and technology that will accelerate Synopsys' efforts in the software application security market and extend the company's Coverity® platform with interactive application security testing (IAST) functionality

Microsoft Buys FieldOne for Mobile CRM, Adallom for Cloud App Security (The VAR Guy) Microsoft (MSFT) made two mobile/cloud/security strategic purchases in the past few days, the first a $39 million deal to buy New Jersey-headquartered FieldOne Systems, which makes field service management solutions, and a second to buy Adallom, a cloud app cybersecurity provider, for some $320 million

Darktrace Raises Growth Equity From Summit Partners (PRNewswire) Darktrace, the leader in Enterprise Immune System technology, announced today that it has raised $22.5 million in Series B funding from Summit Partners, a global growth equity investor that has raised more than $16 billion in capital since inception

Mike Lynch-backed Darktrace valued at $100 million in new funding (Reuters) Darktrace, a cyber-security firm backed by former Autonomy boss Mike Lynch, said it had raised $22.5 million from U.S.-based venture capital company Summit Partners in a funding round that valued the company at more than $100 million

Keybase Raises $10.8M to Develop Encrypted Messaging Using Public Keys (CoinTelegraph) Keybase, a cryptographic message and verification startup, has raised US$10.8 million in a Series A funding round led by Andreessen Horowitz and including angel investors and entrepreneurs such as Reddit co-founder Alexis Ohanian, MakerBot co-founder Bre Pettis and Chain.com CEO Adam Ludwin

Israeli cybersecurity startup WireX raises $9.3M (GeekTime) The network forensics firm receives a major boost with its latest round of funding to improve its security solutions and reach new markets — and could give RSA a run for their money

Another Shark attack as Robert Herjavec launches cybersecurity business in Australia, reveals his best Shark Tank deal (BRW) Famous as a seven-season veteran on the US version of Shark Tank, Robert Herjavec has two lesser-known connections to Australia — his Dancing With The Stars partner-turned-girlfriend, Sydneysider Kym Johnson, and his plans to use us as a base for Asia-Pacific expansion of his $160 million cybersecurity business

ISE Seeks "Hacker Backers" To Protect Internet of Things (PRNewswire) Firm also announces speakers selected to present at the inaugural IoT Village

Intercede to be key player in the battle for digital trust (Proactive Investors) The proliferation of user names and passwords provides a huge commercial opportunity

Palo Alto Networks: Transitioning Toward A One-Stop Service (Seeking Alpha) All under one roof — the company is moving toward establishing itself as a one-stop security platform vendor gaining traction

Five Reasons Intel Should Spin Off McAfee (Forbes) In August of 2010 Intel announced one of the most ill-advised acquisitions in IT security industry history. Intel went on to pay $7.68 billion for Mcafee

Lockheed Martin Could Spin Off Its $6 Billion Government IT Business (Nextgov) Lockheed Martin on Monday announced plans to acquire helicopter-maker Sikorsky for $9 billion in cash, prompting analysts to wonder how much bigger the Bethesda-based defense contractor can get

With Smartphone Market Maturing, Qualcomm Plans To Cut Thousands Of Employees (Forbes) Unless you're Apple AAPL -0.89%, making money from hardware in the mobile market keeps getting harder and harder

Accounting scandal could prompt Toshiba PC exit, says analyst (CRN) Selling off notebook division would help Toshiba get house in order following resignation of CEO over £780m accounting black hole, says Canalys

Former Hacking Team supplier stops selling zero-day exploits on ethical grounds (IDG via ITWorld) Italian surveillance software maker Hacking Team recently claimed that it hasn't lost any customers after the massive leak of its internal data two weeks ago. But it has lost at least one business partner: U.S.-based penetration testing specialist and zero-day exploit broker Netragard

Researcher takes umbrage after finding his code in Hacking Team malware (Ars Technica) Tool for capturing audio from Android devices folded into spyware sold to governments

ACE Hackware Announces Sponsorship Of Social Engineering Contest At DefCon 23 Hacking Conference (Digital Journal) Atlanta, GA based security tools supplier ACE Hackware announced that they will be a sponsor of the Social Engineering Capture the Flag Contest (SECTF) at the upcoming DEF CON 23 conference

ThreatMetrix Named to the 2015 AlwaysOn Global 250 Top Private Companies List (Benzinga) The AlwaysOn Editorial Team and Industry Experts Identified the Most Innovative Private Technology Companies for the Distinguished Annual List

Cyber-Security Startup enSilo Names Brett Wilson as VP Sales (Virtual Strategy Magazine) Veteran cyber-security executive to lead expansion of enSilo's global operations in North America

Products, Services, and Solutions

Hacking Team Detection Tools Released By Rook, Facebook (Dark Reading) Organizations get help keeping up with Hacking Team threats, and Microsoft releases an out-of-band patch for a new Hacking Team 0-day

CESG gives security seal of approval for Samsung Galaxy smartphones (SC Magazine) Communications and Electronics Security Group (CESG), the information security arm of GCHQ, issues security guidance for various end-user communication devices, and has just certified the Samsung Galaxy S6 and S6 edge encryption under its Commercial Product Assurance (CPA) programme for data-at-rest. Samsung Electronics says it is the first mobile handset vendor to receive a certification of this type in UK

Haystax Threat Analytics: Mitigating Insider Threats Before It’s Too Late (Homeland Security Today) Two men escaped from prison in upstate New York last month with the aid of two employees who provided tools and a cell phone. Their successful getaway shows that no matter how many safety measures an organization or government agency has in place, it's only as secure as the employees it hires

New RSA® ECAT Release Engineered to Extend Ability to Rapidly Detect and Block Advanced Threats on Endpoints (PRNewswire) Provides enhanced protection for endpoints by offering actionable risk-based intelligence and comprehensive visibility into threats

Award-Winning WatchGuard Dimension Changes Set the Bar for Network Security Visibility (WatchGuard News) Sleeker interface, role-based controls, and new management features make it easier and more intuitive for network IT pros to see threats and stop them instantly

Gigamon launches security delivery platform for visibility into malicious network traffic (Network World) A company known for visibility for network management launches a cybersecurity tool with a similar approach

Townsend Security and Phase2 Partner to Bring Encryption & Key Management to Atrium (PRWeb) Atrium now offers Alliance Key Manager, Townsend Security's NIST-compliant encryption and FIPS 140-2 compliant key manager, to meet stringent data security and compliance requirements (FISMA, HIPAA, PCI DSS, etc.)

Druva Doubles Down on Governance With Launch of Proactive Compliance for the Enterprise (Sys-Con Media) Industry's first solution to identify and proactively take action against at-rest data risks on mobile devices and in the cloud

Technologies, Techniques, and Standards

Energy commission looks to strengthen grid's cyber security (Business Insurance) The Federal Energy Regulatory Commission is proposing rules intended to improve the nationwide electric system's cyber security

Wi-Fi Security Needs Work, Says IEEE Group (eSecurity Planet) An IEEE study group hopes its research will improve Wi-Fi security

Corporate Espionage Risk Management For Financial Institutions (Tripwire: the State of Security) In the financial industry, business success and sustainability depends on the health of information systems. Damage to a firm's information systems can tarnish its reputation, compromise its data, as well as result in legal fines and penalties. Large firms often depend on thousands of such systems interconnected via the internet, which raises a major security concern of corporate espionage

How to apply threat intelligence feeds to remediate threats (Help Net Security) IT organizations are recognizing the value of threat intelligence feeds, and that's good. Threat intelligence is a must-have for identifying malware and other threats that evade preventive security controls. But threat intelligence is only as good as how you apply it — and many organizations aren't applying it in a way that enables them to get the full value

Creating an Intelligence-Led Security Organization (Cisco Blogs) I recently had the opportunity to sit down with Roland Cloutier, Global Chief Security Officer at ADP and former CISO at EMC, to discuss how they integrate and leverage threat intelligence into their security operations centers as well as their greater security technology infrastructure. It's pretty rare for the CISO of a F500 company to discuss what technologies they use in such an open way, but it was really a testament to the trust they have for the solutions they have chosen. To hear Roland discuss it himself, watch the video at the end of this post or read the case study

Finding The ROI Of Threat Intelligence: 5 Steps (Dark Reading) Advice from a former SOC manager on how to leverage threat intel without increasing the bottom line

How Do You Protect Your Systems From Ransomware? (Lumension) In my previous two posts How Does Ransomware Work? Part 1 and Part 2 I described the process ransomware goes through to get on your systems, encrypt your files, and collect your money. Like any malware, all of the steps in the process need to be successful in order for ransomware to work. In the case of most malware, if you can interrupt it at any point in the cycle you've neutralized it

Incident Tracking In The Enterprise (SANS Institute) Some organizations employ Computer Security Incident Response Teams (CSIRTs) to investigate and respond to security incidents. They often find these investigations to be poorly executed, time consuming, and ultimately ineffective at discovering the root cause of a breach. Unfortunately, this is not usually due to the skill of the investigators, but rather due to the tools and processes they use to manage the investigations

Design and Innovation

How gamers can help improve critical software security (Help Net Security) There's now a game where sophisticated gamers can help improve security of the country's critical software

Why Isn't the Inventor of SMS Better Known? (TechCrunch) Alexander Graham Bell invented a telecommunications system that connected people around the world and became indispensable to businesses, governments and individuals, changing the way we interact forever

Academia

Southern Utah University to Host Cybersecurity Boot Camp & Competition to Train Elite Talent (USCC) Next week, U.S. Cyber Challenge (USCC) and Southern Utah University (SUU) will host an executive roundtable during the USCC Western Regional Cyber Camp to discuss the nation's need for highly-skilled professionals to mitigate cyber risks

Dakota State University hosts NSA Cyber Summer Camp (CNN via KSFY) Summer camp evokes memories of nature hikes and canoeing in bucolic woodsy settings

New Jersey Institute of Technology (NJIT) Certified as a National Center of Academic Excellence (CAE) in Cyber Defense Education (WBOY) The National Security Agency (NSA) and Department of Homeland Security (DHS) have designated NJIT as a National Center of Academic Excellence (CAE) in Cyber Defense Education through the 2020 academic year.

Legislation, Policy, and Regulation

State media: Turkey blocks access to Twitter over images of bombing and Kurdish protest calls (AP via the Washington Post) State media: Turkey blocks access to Twitter over images of bombing and Kurdish protest calls

Cyber industry assails anti-hacking regulations (The Hill) The cybersecurity industry is up in arms over looming export regulations that researchers warn would crush important digital defense work and empower America's foes

Wassenaar Arrangement 2013 Plenary Agreements Implementation: Intrusion and Surveillance Items (Regulations.gov) The Bureau of Industry and Security (BIS) proposes to implement the agreements by the Wassenaar Arrangement (WA) at the Plenary meeting in December 2013 with regard to systems, equipment or components specially designed for the generation, operation or delivery of, or communication with, intrusion software; software specially designed or modified for the development or production of such systems, equipment or components; software specially designed for the generation, operation or delivery of, or communication with, intrusion software; technology required for the development of intrusion software; Internet Protocol (IP) network communications surveillance systems or equipment and test, inspection, production equipment, specially designed components thereof, and development and production software and technology thereof

Proposed Wassenaar pact changes will harm cyber defenders instead of attackers (Help Net Security) The comment period for the proposed amendments to the Wassenaar Arrangement regarding "cybersecurity items" has ended, and the overwhelming majority of the 150+ comments submitted are negative

This is a Comment on the Bureau of Industry and Security (BIS) Proposed Rule: Wassenaar Arrangement Plenary Agreements Implementation; Intrusion and Surveillance Items (Regulations.gov) I am a published and respected forensics expert who pioneered the very first forensic techniques to extract data from the iPhone as early as 2008.. Since then, I have spend several years, and much of my time, assisting numerous law enforcement and military agencies around the world, including our own. I've trained government agencies in the US, Canada, and UK, and trained law enforcement from dozens of our allies here at home in the US. My work has been validated by the NIJ/NIST. I have invested my time in providing free assistance to many US-based federal and state agencies who have flown personnel into my small town for help in the middle of the night. Because of my research and hard work, I've provided the necessary information to the rest of the industry to be able to perform iOS forensics, and a vast majority of today's forensics solutions are founded upon my techniques

This is a Comment on the Bureau of Industry and Security (BIS) Proposed Rule: Wassenaar Arrangement Plenary Agreements Implementation; Intrusion and Surveillance Items (Regulations.gov) I am an information security expert who has authored 3 books in computer security and given hundreds of talks at information security conferences. I have a Phd, have worked at the NSA, and am currently employed on the security team at Twitter. The proposed rule regarding exploitation licensing would outlaw almost everything I do and have done in my professional career

Google, the Wassenaar Arrangement, and vulnerability research (Google Online Security Blog) As the usage and complexity of software grows, the importance of security research has grown with it. It's through diligent research that we uncover and fix bugs — like Heartbleed and POODLE — that can cause serious security issues for web users around the world

Google is furious about proposed changes to US rules on cyberweaponry that it thinks will backfire on web users (Business Insider) Google has criticised proposed legislation that would let the US government control the export of security research and technologies, saying it will hurt general web users

Google and Black Hat hit out against cyber security export bans through Wassenaar Arrangement (Techworm) Black Hat and Google are making themselves heard, as today is the last day for public comments on the Wassenaar Arrangement

Hacked Opinions: Vulnerability disclosure — Chuck Bloomquist (CSO) InteliSecure's Chuck Bloomquist talks about disclosure, bounty programs, and vulnerability marketing

OPM to Charge Agencies for Services Offered to Hack Victims (Government Executive) The Office of Personnel Management is asking agencies to pitch in to help pay for the credit monitoring services being offered to the 21.5 million individuals affected by the hack of background investigation data it maintains

Leading OPM back to the future (Federal Times) I was profoundly saddened to learn of Katherine Archuleta's resignation two weeks ago as Office of Personnel Management director, not only because of the personal toll it took on a friend and colleague of mine, but because of what OPM's massive data breaches did to the reputation of one of my former agencies

As Nations Hack Each Other, Protecting Personal Information Must Become National Security Priority (Forbes) The nation with the most powerful military in the world suffered a major strategic loss — and for several months not a single person even noticed. That's because that attackers didn't use traditional weapons or seek out conventional targets. They hacked their way in, exploiting lax security and management practices at the Office of Personnel Management. More than data, they shattered the foundation of secrets and information that our government has used to protect American interests at home and abroad

Public-private intelligence sharing partnerships key to keeping pacing with cybersecurity concerns: study (Cybersecurity Dojo) Information technology (IT) executives within critical infrastructure organizations see a need for public-private threat intelligence sharing partnerships to keep pace with escalating cybersecurity threats, according to a survey released on Monday by The Aspen Institute and Intel Security

Sen. Warner to Introduce Bipartisan Cyber Security Bill with 3 Other Senators (NBC29) Virginia Senator Mark Warner will help introduce a bill Wednesday that will strengthen cyber security on government websites

Senate Bill Aims To Lock Hackers Out Of Connected Cars (Huffington Post) The road to our connected future may be paved with good intentions, but it may not be secure enough to drive on

SOCOM Battles The Enemy Within (Strategy Page) The U.S. Army intelligence bureaucracy is again in trouble with SOCOM (Special Operations Command) over a long-term dispute about computer software. Troops in combat zones and especially SOCOM prefer to use an intelligence database management system called Palantir

Litigation, Investigation, and Law Enforcement

U.S., Israel make arrests related to JPMorgan hack (Reuters via Business Insurance) U.S. and Israeli law enforcement agencies have arrested four people in Israel and Florida related to securities fraud tied to computer hacks of JPMorgan Chase & Co. and other financial institutions, Bloomberg reported, citing sources

FBI again thwarts Tor to unmask visitors to a Dark Web child sex abuse site (Naked Security) The FBI has once again launched its harpoons into the Deep Web, piercing the anonymizing layers of Tor to drag out the identities of two New York men who were indicted earlier this month on charges of possessing child abuse images

Hacking Team Claims It Always Sold 'Strictly Within the Law' (Threatpost) Hacking Team officials are disputing reports that the company sold its surveillance and intrusion software to oppressive regimes in countries that were under sanction. The company said it sold its products "strictly within the law and regulation as it applied at the time any sale was made" - See more at: https://threatpost.com/hacking-team-claims-it-always-sold-strictly-within-the-law/113894#sthash.PdXi2QO8.dpuf

Opinion: Ashley Madison hack reveals need for new approach to guard intimate data (Christian Science Monitor Passcode) After its users' data was exposed online, Ashley Madison issued copyright takedown notices to have it removed. It's a bad use of copyright law but reflects a troubling legal environment where digital media companies own users' most personal images and information

FTC sues identity protection service LifeLock again (IDG via CSO) The agency contends the company hasn't complied with a 2010 settlement

Experian Hit With Class Action Over ID Theft Service (KrebsOnSecurity) Big-three credit bureau Experian is the target of a class-action lawsuit just filed in California. The suit alleges that Experian negligently violated consumer protection laws when it failed to detect for nearly 10 months that a customer of its data broker subsidiary was a scammer who ran a criminal service that resold consumer data to identity thieves

Facebook Must Relinquish New York Users' Info in Social Security Fraud Case, Court Says (Newsweek) A state appeals court said Facebook cannot challenge search warrants New York prosecutors used to get information from its site on users suspected of Social Security fraud. The Manhattan District Attorney's office served the warrants on Facebook in 2013, seeking information on dozens of people later indicted for Social Security fraud

Morrisons auditor jailed for eight years after leaking data on 100,000 employees (V3) A former employee of UK supermarket chain Morrisons has been jailed for eight years after leaking the personal details of 100,000 employees on the internet

Silk Road heroin dealer who helped convict Ulbricht will serve 2.5 years (Ars Technica) "Deezletime" bought from the street, doubled the price, then sold online

ISP: Cyber Crime section has new area commander (Chesterton Tribune) The Indiana State Police's Special Investigation Command, Cyber Crime and Investigative Technologies Section of the Indiana State Police's Special Investigation Command for Area 1-which includes the Lowell Post-has a new chief

For a complete running list of events, please visit the Event Tracker.

Upcoming Events

California Cybersecurity Task Force Quarterly Meeting (Walnut Creek, California, USA, Jan 20, 2015) The California Cyber Security Task Force serves as an advisory body to California's senior government administration in matters pertaining to Cyber Security. Quarterly Cybersecurity Task Force meetings address State and Federal cyber legislation; provide updates on Task Force efforts to improve California's cyber workforce and education; promulgate critical information to enhance California's cyber awareness and preparedness; discuss state advances in cybersecurity and digital forensics; and grant residents an opportunity to share cyber information and innovation

CyberMontgomery 2015 (Rockville, Maryland, USA, Jul 30, 2015) Montgomery County, Maryland, is home to the National Institute of Standards and Technology (NIST), the National Cybersecurity Center of Excellence (NCCoE), the FDA, NIH, NOAA, NRC and more than a dozen other Federal agencies, plus regional State and local agencies, educational institutions (such as Montgomery College, the Universities at Shady Grove, a satellite campus of Johns Hopkins, and the Bethesda-based SANS Institute), plus scores of cyber companies, ranging from start-ups to multinational corporations such as Lockheed Martin, employing upwards of 37,000 people in cyber-related jobs. With cybersecurity constituting a major growth engine in the region for many years to come, and with leading Federal government, industry and academic assets already in place in the region, the annual CyberMontgomery conference serves to bring them together so that they can coalesce and elevate the cyber ecosystem to a level of national prominence. In that light, CyberMontgomery provides clear direction on finding business opportunities, contracting, forecasted demand areas, workforce development, recruiting & staffing, legal responsibilities for businesses, updates on technologies being developed in the County, and summary updates regarding our NCCoE neighbors, federal civilian agencies and commercial sector leaders

Career Discovery in Cyber Security: A Women's Symposium (New York, New York, USA, Jul 30, 2015) Our annual conference brings together some of the best minds in the industry, with the goal of guiding women with a talent and interest in cyber security into top-flight careers

PragueCrunch IV: The Enpraguening (Prague, Czech Republic, Jul 31, 2015) Here it comes, Central Europe: PragueCrunch IV! This annual celebration of all things startup is coming to your town on Friday, July 31, 2015 from 7:00 PM to 11:00 PM (CEST). We'll be holding the event on the terrace at Střelecký Ostrov. If you've been to any of the previous events you'll know it's a good time

Black Hat USA (Las Vegas, Nevada, USA, Aug 1 - 6, 2015) Black Hat — built by and for the global InfoSec community — returns to Las Vegas for its 18th year. This six day event begins with four days of intense Trainings for security practitioners of all levels (August 1-4) followed by the two-day main event including over 100 independently selected Briefings, Business Hall, Arsenal, Pwnie Awards, and more (August 5-6)

ISSA CISO Forum: Third Party Oversight (Las Vegas, Nevada, USA, Aug 2 - 3, 2015) The CISO Executive Forum is a peer-to-peer event. The unique strength of this event is that members can feel free to share concerns, successes, and feedback in a peer only environment. Membership is by invitation only and subject to approval. Membership criteria will act as a guideline for approval. Invitations can be made by a CISO Members or ISSA Management. Guest, renewing, and new members are all subject to approval

BSides Las Vegas (Las Vegas, Nevada, USA, Aug 4 - 5, 2015) BSides Las Vegas is an Information/Security conference that's different. We're a 100% volunteer organized event, put on by and for the community, and we truly strive to keep information free. There is no charge to the public to attend BSidesLV. Our costs are covered by our generous donors and sponsors, who share our vision of free dissemination of information. The conversations are getting more potent and the "TALK AT YOU" conferences are starting to realize they have to change. BSidesLV is making this happen by shaking-up the format

Defcon 23 (Las Vegas, Nevada, USA, Aug 4 - 7, 2015) DEF CON has been a part of the hacker community for over two decades. See the organization's website for more information

USENIX Security (Washington, D.C., USA, Aug 12 - 14, 2015) The USENIX Security Symposium reunites researchers, practitioners, system administrators, system programmers, and others specialists interested in the latest advances in the security and privacy of computer systems and networks

5th Annual Cyber Security Training & Technology Forum (CSTTF) (Colorado Springs, Colorado, USA, Aug 19 - 20, 2015) The Information Systems Security Association (ISSA) Colorado Springs Chapter and FBC, Inc. will once again co-host the 5th Annual Cyber Security Training & Technology Forum (CSTTF). CSTTF 2015 will bring together cyber experts from the DoD, federal government, business, research, and academia to address a variety of current cyber topics

Decepticon 2015 (Cambridge, England, UK, Aug 24 - 26, 2015) Decepticon brings together researchers and practitioners in the detection and prevention of deception. Previously, deception research has been fragmented across conferences in many different disciplines, sub-disciplines and countries. To cover the great diversity of approaches to deception research, our scientific committee has members covering several domains

AFCEA OKC Technology & Cyber Security Day (Oklahoma City, Oklahoma, USA, Aug 27, 2015) FBC and the Armed Forces Communications & Electronics Association (AFCEA) Oklahoma City Chapter will be partnering once again to host the annual Technology Day & "Scholarship" Golf Tournament at Tinker AFB. This is the only Technology Day held at Tinker AFB each year. The annual Technology Day allows exhibitors the opportunity to have access to information technology, communications, cyber, engineering, and contracting personnel at Tinker AFB. Over 300 attendees participated in the 2014 Technology Day and we expect the same level of attendance in 2015

Power Grid Cyber Security Exchange 2015 (San Diego, California, USA, Aug 30 - Sep 1, 2015) The Power Grid Cyber Security Exchange will take a deep dive into the cyber security strategies, innovative approaches and strategic planning necessary to balance the competing priorities of today's technology and information security executives. This program is tailored to utility executives and industry stakeholders that are responsible for addressing threat intelligence, analysis and monitoring; network architecture; and cyber incident response

2015 HTCIA International Conference & Training Expo (Orlando, Florida, USA, Aug 30 - Sep 2, 2015) Bringing together experts from all over the world to share their latest research and techniques related to cybersecurity, incident response and computer forensics

ICFP 2015 (Vancouver, British Columbia, Canada, Aug 31 - Sep 2, 2015) ICFP 2015 provides a forum for researchers and developers to hear about the latest work on the design, implementations, principles, and uses of functional programming. The conference covers the entire spectrum of work, from practice to theory, including its peripheries