Yahoo breach fallout. ShadowBrokers' discount rack. EAC and DNC hacking notes. Restrictive laws considered in Germany, Australia, and (possibly) the UK.

Cyber Attacks, Threats, and Vulnerabilities

Poor security led to military hacking by North (JoongAng Daily) Earlier this month, the South Korean military accused Pyongyang of hacking South Korea’s defense intranet, and cyber experts are now pointing out holes in the security system

Hacked Yahoo data is for sale on dark web (Financial Review) Some time around August 2013, hackers penetrated the email system of Yahoo, one of the world's largest and oldest providers of free email services

Hacked Yahoo data worth $300,000 on the dark web (Yahoo! Finance) It’s been yet another bad week for Yahoo, the perpetually beleaguered internet giant based in Sunnyvale, California

Yahoo hack shows data as tool of information warfare (France 24) The massive hack affecting a billion Yahoo users shows how seemingly innocuous bits of data gleaned from cyber attacks can be exploited for profit -- and potentially for espionage and information warfare

Merry Haxmas! Shadow Brokers strike again! (HackerHouse) The ShadowBrokers have released details of another selection of software from the Equation Group auction files. This time they are listed as individual sale items on a zeronet website including a brief description of what each software could be used for. We took a look at the latest leaked data to attempt to determine what the impact of these files could be

SQL Injection Attack is Tied to Election Commission Breach (Threatpost) Just as cybersecurity concerns over the U.S. presidential election reach a fevered pitch, the U.S. agency responsible for certifying that voting machines work properly says it may have been hacked

U.S. Election Assistance Commission Reports Potential Breach of Web-Facing Application (U.S. Election Assistance Commission) The U.S. Election Assistance Commission (EAC) has become aware of a potential intrusion into an EAC web-facing application. The EAC is currently working with Federal law enforcement agencies to investigate the potential breach and its effects

Security Firms Almost Brought Down Massive Mirai Botnet (Bleeping Computer) Following a failed takedown attempt, changes made to the Mirai malware variant responsible for building one of today's biggest botnets of IoT devices will make it incredibly harder for authorities and security firms to shut it down

How ThyssenKrupp Fended Off a Cyber Attack (Handlesblatt Global) For over six months, a reporter from WirtschaftsWoche was granted exclusive access as German industrial goliath ThyssenKrupp defended itself against a major cyber attack. An inside report from the front line

Tordow 2.0 Android banking trojan gains root access, mimics ransomware (Graham Cluley) Ask yourself if you really trust smartphone apps downloaded from a third-party website

0-days hitting Fedora and Ubuntu open desktops to a world of hurt (Ars Technica) If your desktop runs a mainstream release of Linux, chances are you're vulnerable

It's Been a Bad Week for Linux as Several Security Flaws Surface (Bleeping Computer) Two security researchers published details this week about several security flaws that allow attackers to execute code on affected machines and take over devices

Turkey’s Akbank Faces Possible $4M Liability After Cyber Attack – But It’s Insured (Insurance Journal) Hackers targeted Turkish lender Akbank in a cyber attack on the SWIFT global money transfer system, the bank said, adding it faced a liability of up to $4 million from the incident but no customer information was compromised

Ameriprise leak exposes millions of dollars worth of accounts (ZDNet) An internet-connected backup drive exposed social security, bank account, and financial planning data

LinkedIn's Lynda.com suffers database breach (ZDNet) LinkedIn resets 55,000 passwords after Lynda.com experiences database breach

DDoS Attack by Phantom Squad: EA, Battlefield 1 servers go down (HackRead) Users are still unaware of what’s going on and apparently same goes to EA

Bleacher Reports Suffers Data Breach as "Unauthorized Party" Accesses User Data (Bleeping Computer) Sports news portal Bleacher Report announced today a security breach that affected readers that signed up for accounts on the site

PayAsUGym Breach Exposes More Security Failings (Infosecurity Magazine) Fitness firm PayAsUGym has been hacked and the personal details of 300,000 customers compromised, according to reports

Phishing email scams 108 government employees, 756,000 people affected by breach (CSO) A single Phishing email scammed 108 LA County employees

Reported cyber-attack against Dighton Police Department (WJAR NBC 10 News) A reported cyber-attack against the Dighton Police Department cost the town nearly $5,000, according to records

Sophisticated cyber attack on Meath County Council targeted €4.3m (Newstalk 106-108 FM) In a statement, the council said the attack was detected before the transaction was completed and the funds have now been secured

Malicious tweet gives journalist Kurt Eichenwald a seizure (Ars Technica) It's not the first time he claims to have been attacked with an epileptogenic message

Why Hackers Love The Cloud (Fox Business) For a skilled hacker, a major company’s cloud system is a treasure trove – sensitive data, including millions of bank account logins, email addresses and Social Security numbers can be just a few clicks away

Security Patches, Mitigations, and Software Updates

Hidden code in Android Nougat will stop ransomware from resetting lockscreen passwords (Get 360 Review) Ransomware is one of the nastier types of malicious software that which compromised millions of devices – both mobiles and PCs

Nagios Core 4.2.4 closes serious root privilege escalation bug (Help Net Security) If you’re using Nagios Core to monitor your systems, networks and infrastructure, and you have not updated to version 4.2.4, you better hop to it

Cyber Trends

Who is the hacker of 2017, and how can we tackle them? (Computing) Dr Konstantin Malkov, CTO of 5nine Software, reveals what today's hackers are capable of - and the measures companies can take to combat their continuously evolving methods

Highly lucrative Ransomware as a Service attacks poised to accelerate in 2017 (Help Net Security) Ransomware can be likened to global warming. It’s been around for years, but it’s now becoming an epidemic which needs serious attention

SecureAuth Survey: 93 Percent of Organizations Adopt Advanced Identity and Access Management Methods, Up from 66 Percent Last Year (MarketWIred) Findings also reveal that 8 out of 10 cybersecurity professionals are concerned about stolen credentials

Cybersecurity Approaches Are Maturing but Spending Is Misdirected and People Are Still the Problem: Nuix Executive Survey (PRNewswire) Global technology company Nuix today released the findings from its third annual survey of corporate information security practitioners who almost universally agreed that human behavior was their largest security threat

Deadlines for investigating and reporting data breaches (Help Net Security) 75% of organisations set fixed time limits for investigating potential security incidents, according to Balabit. However, 44% of respondents reported missing internal or external deadlines for investigating or reporting a breach in the last year, and 7% said a missed deadline had resulted in serious consequences

For Travelers, Safe Access to Social Media is Bigger Than Secure Banking (Infosecurity Magazine) Travelers are 83% more likely to want safe and secure access to social media apps than their finances online when traveling this holiday season

The difficult path to cyber resilience (Help Net Security) Global organizations are more confident than ever that they can predict and resist a sophisticated cyber attack, but are falling short of investments and plans to recover from a breach in today’s expanding threat landscape, according to EY

Cybersecurity Christmas Wish List (Wapack Labs) It’s that time of year again, when we place our faith and trust in imaginary entities who always deliver exactly what is needed, under impossible circumstances, just in the nick of time

What 2017 has in store for cybersecurity (CSO) Donald Trump's administration seems to be the biggest concern

AAA security among 5 enterprise technologies that will shake things up in 2017 (CSO) Triple A security, the Internet of Things and AR/VR to make their marks

Technology trends in 2017: A bluffer’s guide (IDG Connect) If bluffers have become used to calling on our old composite friend SoCloMo to remind themselves that social, cloud and mobile have been the uber trends of the last few years then it might be time for a new coinage

Revealed: Cyber attacks that hit UAE in 2016 (Gulf News Banking) Hackers continue to penetrate networks, pilfering money and customer data in the process

Filipinos brace for more online threats (Business Inquirer) A more digitally connected world also means a world that is more vulnerable to online threats: phishing, spying, tracking, frauds and scams. On top of that, most people now are also multidevice users—which only means more avenues for such threats

Marketplace

Yahoo could face more trouble as data breach questions company’s security policies (Top News) Yahoo has been suffering in terms of user base and its stock market valuation as the company failed to compete with Google, Facebook and other online networks that have spread their base over the last few years

Yahoo under scrutiny after latest hack, Verizon seeks new deal terms (Reuters via the Deccan Chronicle) Shares of the Sunnyvale, California-based internet pioneer fell more than 6 percent after it announced the breach of data

Verizon seeking to amend Yahoo deal (Otago Daily Times) The latest breach of Yahoo accounts has left Verizon Communications looking at ways to modify its multibillion-dollar bid to buy the core internet business from the technology company

If Verizon Cancels $4.8 Billion Yahoo Acquisition After New Security Breach, What Might The Carrier Do Next? (Tech Times) Last week, Yahoo disclosed that it was the victim of another security breach, which has turned out to be even worse than the first one that the company identified a few months ago

After the Mega-Hack, Why Haven't We Heard From CEO Marissa Mayer? (NBC News) This would be a busy week for any tech CEO: One billion user accounts hacked, and a $4.83 billion deal on the line. Yet we haven't heard a peep from Yahoo CEO Marissa Mayer

Will Peter Thiel's Palantir Technologies Be the Best IPO of 2017? (Nasdaq) Whether it be the wild presidential campaign, unusual number of celebrity deaths, or the disappointingly sluggish IPO market, 2016 has been a rough year

Will Security Stocks Escape Penalty Box Next Year Amid Cloud Shift? (Investor's Business Daily) Down-on-their-luck security software stocks face headwinds going into 2017, but Pacific Crest Securities still likes Palo Alto Networks (PANW), Barracuda Networks (CUDA) and Fortinet (FTNT)

Vkansee Raises Additional $10M To Fuel Biometric Sensor Innovation (Payment Week) Vkansee, creator of the world’s first under-glass and most secure, patented and ultra-thin optical fingerprint sensor, today announced $10M in additional funding

BAE, Cyber London Extend Collaboration to Help Security Startups (ExecutiveBiz) BAE Systems has extended a partnership with Cyber London for another three years in support of efforts to foster innovation and develop talent in U.K.’s cybersecurity sector

Why Facebook, Amazon, Microsoft, and Google all desperately need you to know that the robots are coming (Business Insider) It's been an unusual year in tech: Apart from maybe Snapchat's elusive Spectacles, there hasn't been a truly game-changing, mass-market piece of technology that's totally dominated the conversation

The New Microsoft and Its Partnership Strategy for Internet of Things (IoT) (1redDrop) Microsoft’s new business mantra seems to be “If we can’t do it, let’s just find someone who can"

NATO and FireEye Announce Cyber Information Sharing Agreement (MarketWIred) High-fidelity FireEye iSIGHT intelligence to enhance NATO network and systems protection

ODNI Technology Office Opens Up Dialogue With Private Sector (National Defense) The science and technology arm of the Office of the Director of National Intelligence has little to no money to buy products from the tech industry. But companies are lining up to come in for meetings

MacGibbon leads US cyber mission (InnovationAus) The Prime Minister’s special advisor on cybersecurity will join with freshly-minted Australian Cyber Security Growth Centre Network CEO Craig Davies to lead an Austrade delegation of 20 local companies to the United States in February

Pegasus - a DarkMatter Company - Reaches MoU with Dubai Police to Improve Safety and Security by Harnessing the Power of Big Data (Yahoo! Finance) Pegasus will provide Dubai Police with advanced analytic capabilities in solving and preventing crime

3 firms land $53.7M worth of contracts with work in C. Fla. (Orlando Business Journal) As the year winds down, defense contracts are ramping up, due to expiring government budgets. And that's a benefit to the local economy

Raytheon to modernize cryptographic materials for U.S. Air Force (UPI) Raytheon has received a $458.9 million contract to modernize various cryptographic equipment for the U.S. Air Force

CyberX Names Cybersecurity Veteran Phil Neray as Vice President of Marketing (PRNewswire) Brings global experience from executive roles at Veracode, IBM Security/Q1 Labs, Guardium and Symantec

New CEO Amit Yoran will helm Tenable Network Security’s ‘next phase’ of growth (Technical.ly Baltimore) Yoran, currently the president of Dell-owned RSA, fills the vacancy that emerged after Ron Gula's departure at the fast-growing Columbia cybersecurity firm

Products, Services, and Solutions

New infosec products of the week​: December 16, 2016 (Help Net Security) Ixia enhances network assessment and monitoring platform...First digital identity certificate for drones...Microsoft customers can now secure content on Office 365...DB Networks launches AI-based agentless database activity monitoring...Percipient Networks defends against social engineering and malware...Radiflow introduces security assessment service for Industrial Control Systems...Barracuda offers Next-Generation Firewall for Google Cloud platform customers...Resilient Access enables data-sensitive organizations to connect securely...Fall 2016 Everbridge platform update improves global security...Iris authentication reference designs for deployment across IoT devices

Veris Group steps up it's advanced security game with Endgame (App Developer Magazine) Endgame has announced that Veris Group's Adaptive Threat Division (ATD), a provider in adversary simulation and detection services, will utilize Endgame's endpoint detection and response platform

Cloud Armor That’s Not Quite So Fluffy (BloombergBusinessWeek) Blockchain-style ledgers can log changes to files stored online

Corero says its always-on DDoS defense system automatically safeguards service providers (Network World) Legacy approaches and mitigation techniques don’t seem to be capable of fighting off DDoS attacks. Corero claims it can stop them instantaneously

IBM’s Cyber Range: A Flight Simulator for Online Threats (Techspective) IBM isn’t a name that typically springs to mind when it comes to leading IT security technologies and services

Absolute Logic Unveils Compliance Solutions for New NYSDFS Cybersecurity Requirements for Financial Services Companies (EIN News) New NY State Department of Financial Services regulations affect financial services businesses in New York State; Wilton company delivers compliance solution

Vodafone to build infosec centre with DiData and FireEye (IT News) Vodafone has partnered with Dimension Data and FireEye to set up its new cyber defence and response centre

What keeps Splunk’s CEO up at night? An exabyte of security data per day (CSO) Flexible analytics platform becoming a universal in-box for security data – lots and lots of it

Salient CRGT Expands Voyager Mobility Query For Law Enforcement (American Security Today) Salient CRGT, is expanding its software product offerings of Appix Financial Services, Assure6i™ Cyber Security Solutions, and Voyager™ Mobility Solutions to add enhanced features, be more widely available and decentralized, and offer multi-platform accessibility

Technologies, Techniques, and Standards

How the Death Star’s demise would look in a galaxy with cyber attacks (Technical.ly Baltimore) In honor of this year's Star Wars release, The CyberWire has a cybersecurity take — for education purposes

Playing the blame game: Breaking down cybersecurity attribution (Help Net Security) Attributing the adversary behind a cyber attack ranks as perhaps the hardest challenge in all of cyber security, well beyond securing networks from intrusions, for the simple reason that bits are simply bits and do not belong to any single person

Blocking Powershell Connection via Windows Firewall. (SANS Internet Storm Center) In my last post, I mapped controls to stop a malicious doc calling out via Powershell. I’m now going to cover how using the Windows firewall can stop the attack chain

Contactless Payments: Addressing the Security Issues (InfoRisk Today) PCI Council's Jeremy King on authenticating mobile payments with biometrics

Secure websites brought to you by the letter S (Help Net Security) What’s so special about the letter S?

Accepting your network will be breached is your first step to implementing a cyber incident response plan (BAE Systems Blog) According to recent research conducted on behalf of BAE Systems, the length of time since an organisation's most recent known cyber attack is on average nine months

Tips for maintaining security while employees are out of the office for the holidays (Networks Asia) Ho-ho, whoa The downtime created by the holiday season is a fan favorite for enterprise employees and hackers alike

Design and Innovation

What is the difference between adaptive and cognitive electronic warfare? (C4ISRNET) Ask any lawyer and they’ll say semantics matter. The same can be said in the military. For example, what is the difference between adaptive and cognitive electronic warfare? Does it even matter?

“Find my Phone” is an amazing short film about a stolen cell (TechCrunch) For your weekend consumption I present Find my Phone, a 30 minute film about a stolen phone

Here’s our first look at Waymo’s new self-driving Chrysler Pacifica minivans (TechCrunch) Waymo, the newly-minted Alphabet company that was previously Google’s self-driving car project, has a new addition to its vehicle fleet: 100 Chrysler Pacifica hybrid minivans

Research and Development

BlackBerry opens a research center for self-driving tech in Canada (TechCrunch) A former smartphone powerhouse wants to be an instrumental part of the coming smart car revolution, and BlackBerry is deepening its investment int he field with a new autonomous driving research center opening for business on Monday in Ottawa

Raytheon wins DARPA cyber contracts (C4ISRNET) Raytheon has been awarded multiple DARPA contracts to develop cyber defenses for the U.S. electrical power grid

The Bittersweet Sweepstakes to Build an AI That Destroys Fake News (Wired) Autonmous 18-wheelers are now driving the highways. Coffee table gadgets are recognizing spoken English nearly as well as humans. Smartphones apps instantly translate conversations between people speaking as many as nine different languages. But for Dean Pomerleau, none of this is all that surprising

Academia

The Crypto Capitalism Center at Western University’s Ivey Business School (Data Currency Executive Brief) The Crypto Capitalism Center is a research project that collects and analyzes data on fintech and the rise of the bitcoin economy

Legislation, Policy, and Regulation

GCHQ asked to step up action against cyber-attack threat to financial services (Guardian) Treasury select committee says existing vulnerabilities and accountability need to be addressed in the wake of Tesco Bank hacking

Labour Party to call for regulation of technology companies' algorithms (Computing) Labour's industrial strategy to compel Amazon, Google, Facebook and others to open-up algorithms to official scrutiny

Cybersecurity experts guilty until proven innocent under proposed Aussie law (CSO) Defendants would be forced to prove their innocence, as opposed to the prosecution having to prove their guilt beyond a reasonable doubt

German law would fine social media sites “publishing” fake news (Ars Technica) Social media sites must kill hoaxes within 24 hours, offer prominent corrections

All the News Unfit to Print: What Beijing Quashed in 2016 (Foreign Policy) Dozens of leaked censorship directives reveal a Chinese government increasingly insecure about its image

France unveils cyber command in response to 'new era in warfare' (SC Magazine) The French government has launched a new cyber command unit that will have offensive as well as defensive capabilities to defend itself on the "new cyber-battlefield"

Who are Russia's cyber-warriors and what should the West do about them? (Telegraph) Western intelligence services and cyber security firms say they have identified two particular groups involved in the hack of the Democratic National Committee (DNC) that led to a series of embarrassing emails being leaked to the public ahead of the US presidential election

How Russia overtook China as our biggest cyber-enemy (Financial Review) In June 2015, the US government discovered something horrifying: The US Office of Personnel Management had been hacked by China

Obama Curbed Chinese Hacking, But Russia Won’t Be So Easy (Wired) As outrage swells over Russian hacks against Democratic targets throughout the presidential election, panic over Kremlin meddling has led to a form of short-term amnesia

Obama: US Will Retaliate Against Russian Cyberattacks In Proportional Manner (Dark Reading) US action will include both covert and explicit response, President says. Meanwhile, a Russian-speaking hacker was discovered behind a data breach of the US Election Assistance Commission (EAC)

Pressure rises on Obama to retaliate against Russia for hacks (Christian Science Monitor Passcode) Lawmakers and cybersecurity experts say the Obama administration should have acted faster to retaliate against Moscow once it learned that Russian hackers tampered with the US presidential election

Obama’s cyber conundrum: how hard to hit back (New York Times News Service via the Central Oregon Bulletin) Over the past four months, U.S. intelligence agencies and aides to President Barack Obama assembled a menu of options to respond to Russia’s hacking during the election, ranging from the obvious — exposing President Vladimir Putin’s financial ties to oligarchs — to the innovative, including manipulating the computer code that Russia uses in designing its cyberweapons

How to Really Punish Russia for Hacking (Daily Beast) We must respond to Russia’s hacking—but any response risks escalation

Air Putin’s wealth as payback (Columbia Daily Tribune) Disclosure is the best of Obama’s limited options

Barack Obama warned against taking revenge on Russia for cyber attack (Mirror) Ex-Chief of the Defence Staff General Lord Richards cautioned Mr Obama against launching a revenge attack over the hacking of Democratic officials’ e-mails

Trump and His Lieutenants Are Cyber Hawks. Will They Play Hardball With Putin? (Foreign Policy) The president-elect is caught between promises to be more aggressive in cyberspace, and U.S. demands for payback against a Russian hack apparently done for his benefit

A civil defense for the cyber age? (Boston Globe) The Russians are coming — again. So are the Chinese, the North Koreans, and an array of international bad actors, threatening American security — not with nuclear weapons but with computer hacks

In Trump, beleaguered intelligence community faces a new challenge: A disparaging boss (Baltimore Sun) It's been a bruising few years for America's spies

Blog: Farewell to Hale, the Chief (SIGNAL) The Pentagon will miss its longtime chief information security officer

Botnet centre set for launch, to monitor virus-hit devices (Economic Times) The government’s Computer Emergency Response Team is readying for a soft launch of its botnet centre, which will help people disinfect their devices as part of efforts to protect citizens online

Litigation, Investigation, and Law Enforcement

Statement on Requests for Additional Information on Russian Interference in the 2016 Presidential Election (IC on the Record) Recently, the Office of the Director of National Intelligence has received requests from Members of Congress, several Electors of the Electoral College and the general public for additional information on Russian interference in the 2016 presidential election

Bipartisan group of senators seeking panel on Russia hacking (Help Net Security) A bipartisan group of senators announced on Sunday that they will push for an investigative panel to look into allegations that Russia tried to manipulate the U.S. election by hacking into Democratic officials and groups' email servers

Donald Trump’s Team Tones Down Skepticism on Russia Hacking Evidence (Wall Street Journal) Reince Priebus suggests a unified presentation from U.S. agencies could convince the president-elect

Obama points finger at Putin for hacks during U.S. election (Reuters) President Barack Obama on Friday strongly suggested that Russian President Vladimir Putin personally authorized the computer hacks of Democratic Party emails that American intelligence officials say were aimed at helping Republican Donald Trump win the Nov. 8 election

Russia's role in political hacks: What's the debate? (C|Net) The US is wrestling with what we really know about hacks during the presidential campaigns. Here's why it's so hard to pin down -- and why it matters

Report: FBI Agrees Russia Hack Aimed at Helping Trump Win Election (US News and World Report) The agencies had previously been seen to be split on the issue

Obama: 'We handled it the way it should have been handled’ (USA Today) President Obama called for a bipartisan effort to address the hacking of the Democratic National Committee as part of the president's last press conference of 2016

Trump is wrong to call Russian hacking a 'conspiracy theory': Cybersecurity expert (AOL) Early Friday morning, President-elect Donald Trump again attacked emerging reports claiming Russia was behind a cyber attack aimed at swinging the 2016 presidential election in the billionaire businessman's favor

My Turn: The Russian issue and the rhetoric surrounding it (Gaston Gazette) I think it would be helpful if there was an explanation of the differences in intelligence gathering and criminal investigations and how this difference impacts the current election emotions connected to the alleged Russian intrusion into our political process

Why Are the Media Taking the CIA’s Hacking Claims at Face Value? (Nation) Despite the CIA’s uninspiring record for the past 70 years, the media are defending the agency for all it’s worth

Coulter Drops A Bomb About BERNIE SANDERS And The Russia Hacks — Twitter Loses It (Daily Caller) Ann Coulter tweeted early Friday morning that former Democratic presidential candidate Bernie Sanders was the source of the Democratic National Committee leaks and threw her followers into a frenzy in the process

Republican National Committee Security Foiled Russian Hackers (Wall Street Journal) Investigation calls it a less aggressive and much less persistent effort than the hacks of the Democratic National Committee

NSA asked its IG to resign after revelations of whistleblower retaliation (Federal Times) A new investigative report by the Project on Government Oversight’s Adam Zagorin has uncovered an unclassified but not widely public decision finding George Ellard, inspector general of the NSA, retaliated against an NSA whistleblower

U.S. to disclose number of Americans our government spied on as soon as January 2017 (Boing Boing) The United States intelligence community has promised lawmakers it will provide as soon as January 2017 a public estimate of the number of Americans whose digital communications were subject to surveillance under the pretense of capturing foreign espionage, according to a bipartisan group of congressional lawmakers' letter that Reuters saw and reports here

Regulators step in to Yahoo’s vast data breach (Financial Times) Cyber security must become a bigger priority for internet companies

Trump’s security advisor dismisses ‘insignificant’ data-sharing fears (Naked Security) US President-elect Trump’s pick for National Security Advisor, retired three-star army general Michael T Flynn, “inappropriately” shared classified information, according to a military investigation report completed in 2010 and only recently made public via a Freedom of Information Act filing by the Washington Post

Uber, defiant, says it won’t apply for an autonomous car permit in California [Updated] (Ars Technica) VP says Uber’s system is more like Advanced Driver Assist Technologies

Bayrob Fraud Ring Extradited to US (Infosecurity Magazine) Symantec is claiming victory after a Romanian fraud ring thought to have made as much as $35 million from their illegal activities was arrested and extradited to the US

Symantec Research Provides Key Evidence for International Cybercriminal Takedown (Yahoo!) Symantec Corp. (SYMC), the global leader in cyber security, today revealed the findings of a decade-long research campaign that helped unearth an international cybercriminal gang dubbed “Bayrob"

FBI Arrests Customer of Xtreme Stresser DDoS-for-Hire Service (Bleeping Computer) The FBI arrested this past week Sean Krishanmakoto Sharma, 26, from La Canada, California, for launching DDoS attacks against Chatango, an online chat service

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Black Hat Asia (, Jan 1, 1970) Black Hat is returning to Asia for the first time since 2008, and we have quite an event in store. Here the brightest professionals and researchers in the industry will come together for a total of four days--two days of deeply technical hands-on Trainings, followed by two days of the latest research and vulnerability disclosures at our Briefings.

Upcoming Events

CES® CyberSecurity Forum (Las Vegas, Nevada, USA, Jan 5, 2017) Now in its second year, the CES® CyberSecurity Forum presented by CyberVista is designed to ensure all stakeholders in developing high tech solutions understand the complexity and the need for action in the cybersecurity arena. The IoT, connected cars, new payment systems, VR and AR, wearables and our mobile devices all add new levels of concern to protecting our personal and corporate data. In this day-long conference, we’ll tackle the world of cybersecurity that demands we go far beyond the simple passwords and anti-virus protection of yesterday.

SANS Security East 2017 (New Orleans, Louisiana, USA, Jan 9 - 14, 2017) Start the year off right by choosing from outstanding, cutting-edge courses presented by our top-rated instructors. SANS is looking forward to an exciting kickoff of 2017 with SANS Security East 2017 in the "Big Easy" in January. Now is the time to improve your information security skills and laissez les bons temps rouler!

Global Institute CISO Series Accelerating the Rise & Evolution of the 21st Century CISO (Scottsdale, Arizona, USA, Jan 11 - 12, 2017) These intimate workshops address the challenges that Board of Directors are placing on security and risk executives, and how to successfully manage and communicate today’s enterprise and organizational threats. These are an intense “roll your sleeves up” thought leadership discussions on How Cyber is Driving the New Board Perspective on Enterprise Risk Management. Attendance is limited to 30 Security and Risk Executives from Global 2000 corporations. For Chief Security Information Officers, Chief Information Officers, and Chief Risk Officers, by invitation only (apply to attend).

Cybersecurity of Critical Infrastructure Summit 2017 (College Station, Texas, USA, Jan 11 - 13, 2017) An inaugural event to convene thought-leaders, experts, and strategic decision makers from government, industry, and academia to discuss the technology and policy implications of the ever-evolving cyber-threats to critical infrastructures. This summit will focus on two sectors that are among those at greatest risk, the energy and manufacturing sectors. Highlighting emerging technologies and policy initiatives, this event will foster the development of high impact strategies to address the many interrelated cybersecurity challenges we face in the protection of our nation’s critical infrastructures.

ShmooCon 2017 (Washington, DC, USA, Jan 15 - 17, 2017) ShmooCon is an annual east coast hacker convention hell-bent on offering three days of an interesting atmosphere for demonstrating technology exploitation, inventive software and hardware solutions, and open discussions of critical infosec issues. The first day is a single track of speed talks called One Track Mind. The next two days bring three tracks: Build It, Belay It, and Bring It On.

SANS Las Vegas 2017 (Las Vegas, Nevada, USA, Jan 23 - 28, 2017) Attend SANS Las Vegas 2017, where SANS will provide outstanding courses in IT security, forensics, and security management presented by the best cybersecurity teachers in the country. At SANS events you get the kind of hands-on, immersion training that you can put to work immediately.

BlueHat IL (Tel Aviv, Israel, Jan 24 - 25, 2017) Announcing BlueHat IL – a special edition of Microsoft's leading cyber security conference for top professionals, to be held for the very first time in Tel Aviv, Israel. Over the past 10 years, BlueHat conferences have drawn the brightest minds in security to discuss key industry challenges. And now, BlueHat IL is here to crank it up by exploring and creating new cyber security thoughts and boundaries. This exclusive, by invitation only, single track event will host top cyber security professionals from around the world, who will come together to tackle the present and peek into the future. It will feature brilliant speakers and focus on breakthrough research, key trends and emerging threats in the field. Registration closes December 28.

SANS Cyber Threat Intelligence Summit & Training 2017 (Arlington, Virginia, USA, Jan 25 - Feb 1, 2017) Join SANS at this innovative Summit as we focus on enabling organizations to build effective cyber threat intelligence analysis capabilities. Most organizations are familiar with threat intelligence, but have no real concept of how to create and produce proper intelligence. The 2017 Summit will focus on specific analysis techniques and capabilities that can be used to properly create and maintain Cyber Threat Intelligence in your organization. Attend this summit to learn and discuss directly with the experts who are doing the CTI analysis in their organizations. What you learn will help you detect and respond to all ranges of adversaries including some of the most sophisticated threats targeting your networks

Blockchain Protocol and Security Engineering (Stanford, California, USA, Jan 26 - 27, 2017) This conference will explore the use of formal methods, empirical analysis, and risk modeling to better understand security and systemic risk in blockchain protocols. The conference aims to foster multidisciplinary collaboration among practitioners and researchers in blockchain protocols, distributed systems, cryptography, computer security, and risk management.