- cypherpunks@lists.ogf.org

Compromise of Soviet codes in WWII
by grarpamp 23 Jul '14

23 Jul '14

http://chris-intel-corner.blogspot.gr/2014/07/compromise-of-soviet-codes-in… Overview of Soviet cryptosystems The secretive Soviet state used various cryptosystems in order to secure its communications from outsiders. The task of preparing and evaluating cipher procedures was handled by two main Soviet organizations, the NKVD’s 5th Department and the Army’s 8th department of the main intelligence directorate GRU. In the 1920’s simple substitution systems were used and these were solved by ...

1 0

Alleged IOS backdoors
by Georgi Guninski 23 Jul '14

23 Jul '14

Alleged IOS backdoors http://www.zdziarski.com/blog/wp-content/uploads/2014/07/iOS_Backdoors_Atta… Identifying Back Doors, Attack Points, and Surveillance Mechanisms in iOS Devices JONATHAN ZDZIARSKI

4 4

Tor developers vow to fix bug that can uncloak users
by Eugen Leitl 23 Jul '14

23 Jul '14

http://arstechnica.com/security/2014/07/tor-developers-vow-to-fix-bug-that-… Tor developers vow to fix bug that can uncloak users Weakness was topic of talk abruptly pulled from security conference. by Dan Goodin - July 22 2014, 8:15pm CEST Developers of the Tor privacy service say they're close to fixing a weakness that researchers for an abruptly canceled conference presentation said provides a low-cost way for adversaries to deanonymize hundreds of thousands of users. The talk previously scheduled for next month's Black Hat security conference in Las Vegas was titled "You Don't Have to be the NSA to Break Tor: Deanonymizing Users on a Budget." The abstract said that the hack cost less than $3,000 and could uncloak hundreds of thousands of users. On Monday, Black Hat organizers said the presentation was canceled at the request of attorneys from Carnegie Mellon University (CMU), where the researchers were employed, as well as the Software Engineering Institute (SEI). The attorneys said only that the materials to be presented "have not yet been approved by CMU/SEI for public release." Researchers Alexander Volynkin and Michael McCord have yet to explain why their talk was pulled. Tor officials responded by saying that they're working on an update for individual Tor relay nodes that will close the unspecified security hole. "Based on our current plans, we'll be putting out a fix that relays can apply that should close the particular bug they found," Tor project leader Roger Dingledine wrote in an e-mail to Tor users. "The bug is a nice bug, but it isn't the end of the world. And of course these things are never as simple as 'close that one bug and you're 100% safe.'" He said the fix was complicated because the researchers didn't provide all the technical details when privately informing Tor officials of the vulnerability. "We've been trying to find delicate ways to explain that we think we know what they did, but also it sure would have been smoother if they'd opted to tell us everything," he wrote. "The main reason for trying to be delicate is that I don't want to discourage future researchers from telling us about neat things that they find. I'm currently waiting for them to answer their mail so I can proceed." In a previous e-mail, Dingledine said Tor developers "informally" received some materials related to the vulnerability. He went on to say Tor officials played no role in the cancellation of the Black Hat talk. "We did not ask Black Hat or CERT to cancel the talk. We did (and still do) have questions for the presenter and for CERT about some aspects of the research, but we had no idea the talk would be pulled before the announcement was made," he wrote. CMU is affiliated with CERT, which coordinates security disclosures between researchers and affected parties. A CMU spokesman contacted Monday didn't elaborate on the reasons for pulling the talk.

2 1

HackRF will likely start shipping in August
by Eugen Leitl 23 Jul '14

23 Jul '14

(the tinfoilhatterati will understand and rejoice) https://greatscottgadgets.com/hackrf/ HackRF One is now available for pre-order from: HakShop (US) NooElec (US/CA) Hacker Warehouse (US) Ada's Technical Books (US) Wall of Sheep (US) Store4Geeks (SE) Passion Radio Shop (FR) Passion Radio Shop UK (UK) TAPR (US) iSource Asia (CN) WiMo (DE) Pre-ordered units will ship immediately after all rewards have shipped to Kickstarter backers, estimated July 2014. For the latest information on development and manufacturing, follow the Kickstarter updates.

3 2

web based shared secret symmetric encryption application
by Cryptoparty Marseille 22 Jul '14

22 Jul '14

Hi! I'm looking for a decent free and open source application that would work similarly to "Hushmail Express message" (https://help.hushmail.com/entries/351388-I-have-received-an-encrypted-email…) that would allow me to deposit an encrypted message on an apache web server that would be decrypted by the recipient using a shared secret (that's already established, so I don't need a key exchange mechanism). I read Tony's posts and his blog article (http://tonyarcieri.com/whats-wrong-with-webcrypto) and I'm well aware that browser based encryption is not optimal but I'm just looking for something slightly more secure than plain text email that could be used by an end user not willing to install GPG, not an NSA proof secure system. The (apache2/debian7) web server is physically under my control, I'm the only root (I hope! :-) and SSL/TLS is enabled. Thanks for your advice. cryptomars

3 2

Fwd: [tor-talk] Carnegie Mellon Kills Black Hat Talk About Identifying Tor Users -- Perhaps Because It Broke Wiretapping Laws
by coderman 22 Jul '14

22 Jul '14

thanks Eugen! ---------- Forwarded message ---------- From: Eugen Leitl <eugen(a)leitl.org> Date: Tue, Jul 22, 2014 at 1:30 AM Subject: [tor-talk] Carnegie Mellon Kills Black Hat Talk About Identifying Tor Users -- Perhaps Because It Broke Wiretapping Laws To: tor-talk(a)lists.torproject.org, Liberation Technologies <liberationtech(a)lists.stanford.edu> https://www.techdirt.com/articles/20140721/11362227955/carnegie-mellon-kill… Carnegie Mellon Kills Black Hat Talk About Identifying Tor Users -- Perhaps Because It Broke Wiretapping Laws from the questionable-legality dept There's some buzz in security circles today after it came out that a session at the upcoming Black Hat Conference entitled "You Don't Have to be the NSA to Break Tor: Deanonymizing Users on a Budget" by Michael McCord and Alexander Volynkin (both of whom work for Carnegie-Mellon University and CERT) had been pulled from the conference at the request of CMU. A Black Hat spokeswoman told Reuters that the talk had been canceled at the request of lawyers for Carnegie-Mellon University, where the speakers work as researchers. A CMU spokesman had no immediate comment. There's been plenty of speculation about what's going on, but Chris Soghoian has a pretty good thesis that the researchers likely didn't have institutional approval or consent of the users they were identifying, meaning that they were potentially violating wiretapping statutes. As he notes, running a Tor server to try to spy on Tor traffic without talking to lawyers is a very bad idea. While it hasn't yet been confirmed that this is what happened, it certainly is a pretty sensible theory. Of course, none of that changes the fact that it's possible to identify some Tor users. But... that's also not particularly new. In fact, we've discussed in the past how the feds can identify Tor users. Tor adds an important layer of protection, but there are plenty of ways that you can still be identified while using Tor. Just ask Russ Ulbricht. The problem isn't so much Tor itself but how people use it -- and the simple fact is that most people use it in a way that will eventually reveal who they are. While it's not definite, it seems likely that this is what the talk would have revealed. Shutting it down wasn't any sort of big attempt to cover up this fact, but perhaps it was to protect the researchers and CMU (potentially) from a lawsuit for violating wiretapping laws.

2 1

shipment interdiction [was: BadBIOS forensics]
by coderman 21 Jul '14

21 Jul '14

On Wed, Jul 16, 2014 at 4:19 AM, Bluelotus <bluelotus(a)openmailbox.org> wrote: > ... > My laptops were indicted, infected and implanted. and now they're getting thoroughly cleaned, see attached. please note for all future reference that suspect materials should be delivered in person, even at cost of a plane ticket. so much for that inquiry, :/ best regards, (attached interdiction of shipment from Washington State to Oregon via Florida - usually they at least try to make it look plausible, heh) https://peertech.org/files/fedex-fail.jpg

2 2

Re: [liberationtech] Foxacid payload
by coderman 21 Jul '14

21 Jul '14

On Thu, Jul 17, 2014 at 12:19 PM, Andy Isaacson <adi(a)hexapodia.org> wrote: > ... > And once you've patched this bug, FOXACID will update to issue another > 0day. > > It's worth doing, for sure! Patching bugs makes us all incrementally > safer. > > But don't pretend that patching the specific attack your adversary is > currently using will disable or even seriously inconvenience the > adversary. this is exactly why some who have received these payloads are sitting on them, rather than disclosing. it is more useful to mitigate privately, and observe how/when an exploit is used, than burn it publicly for zero effective security improvement. (the less scrupulous would sell to highest bidder for other clandestine hacks) better ideas welcome! best regards, -- Liberationtech is public & archives are searchable on Google. Violations of list guidelines will get you moderated: https://mailman.stanford.edu/mailman/listinfo/liberationtech. Unsubscribe, change to digest, or change password by emailing moderator at companys(a)stanford.edu.

2 1

potential leak on Torpedo
by Eugen Leitl 21 Jul '14

21 Jul '14

https://pay.reddit.com/r/TOR/comments/2b8oq3/please_read_if_you_usedepend_o… Please read if you use/depend on Tor. Never before seen FH information. (self.TOR) submitted 16 hours ago * by Deepthroat2 [+1] Hello everyone, I have some information that I have been dying to share for months, but due to the circumstances, and to avoid detection, I had to wait for some time before I was able to safely make this post. My goal here is to provide information that I know is credible and for the Tor community to use it as they see fit, due to the nature of my work, and the severe penalties associated with breaking the rules and giving out information you aren't supposed too, I have no way of verifying or proving anything to you that I say here, I understand if find me less than credible, however, this is essentially a PSA, and you can take it for what it's worth to you. Just about one year ago, the Tor community was shaken by a Firefox exploit which utilized a javascript exploit and an old vulnerbility in the Tor Browser Bundle to unmask some users of Freedom Hosting. There has been rampant misinformation, and speculation to the point that I felt like pulling my hair out, or just simply bursting out into laughter when reading some of the outlandish claims made by people who have little to no idea what they are talking about. Today, I will set the record straight. The FH exploit was a government engineered, and deployed exploit that was designed in response to former Director Mueller's fustration at an earlier child pornography case in which the FBI was ridiculed for being unable to ascertain the source of child pornography, for those who aren't familiar with this case, it involved a man who had accessed child pornography by accident on a Tor hidden service, and then brought his desktop computer to the office, explaining what had happened and that he subsequently preformed a "Full wipe" on the disk. The agent who took the report had limited knowledge about Tor, however, at the time he knew that any directed effort to identify a specific Tor user was hopeless, and in the report he indicated that "There is currently no known way to ascertain the location of a Tor user, thus, no investigative leads exsist." This got leaked to the press, and they had a field day, hinting at the incompetency of the Bureau. Needless to say, the FBI had it's ego hurt quite badly by this public display of incompetency. Then Director Mueller directed the CEOS (Child exploitation and obscenity section) to find a way to penetrate the layers of protection provided by Tor, and to come up with a fesible way to conduct a sting operation in order to bring these people to justice. The FBI had previously conducted a sting on viewers of child pornography in a case out of Nebraska, that resulted in the arrest of about 25 people. This was the first successful take down of CP consumers that were utilizing a Tor hidden service. One of the errors that I see alot on these forums and others was that the Nebraska take down was done in a similar fashion to the FH exploit, with the code being deployed onto the pages of the boards, however, this is not the case. From my understanding, the Nebraska field office was able to find the actual server, take it over covertly, then upload a series of files that purported to be child pornography, but actually contained nothing but encrypted gibberish. They were video files that were embedded with code that called back to a computer that recorded the IP address of the requestor, date and time similar to the way windows media player attempts to recall album information and cover art for music cds and such. These were files that the user actually had to download and attempt to open. This is why the service was run for weeks, and only 25 people were identified as users. This method was described by the techs who deployed it as a "NIT" or "Network Investigational Tool". Now for Freedom Hosting.... The javascript exploit could not be deployed directly on the servers which Mr. Marques was using due to either technical reasons, or legal requirements by the AUSA in Maryland. So the decision was made to clone the services exactly, and transport then to the home of the FBI CEOS in the Greenbelt division of Maryland. This location was picked specifically because sentencing in this district for Child Pornography crimes is more severe. It was July 31st of 2013 when the exploit actually went live, and tried to identify criminals. It was installed previously, however, there were technical problems early on and the code had to be revised 3 times before it was running as intended, it ran for about 11 days before being shut down. The amount of people identified by this exploit is still a closely gaurded secret, with only agents having a direct "Need to know" being privy to this information. Howver, the victory dance was short lived as news started flowing around that the evidence may not be admissible in court, due to the manner in which it was collected, among other reasons. Although proper warrants were issued, it would take atleast 4-7 years to comb through the list of suspects, and question, arrest each one. The major problem is that after about 12 months, the courts start to presume your evidence is prejudicial to the defendant because you're supposed to have an indictment and serve it on the defendant within 30 days, and that just wasn't possible. You can request an extension of this time, however you must present a new, fresh reason for doing so..."We still aren't ready" doesn't cut it. There is no statue of limitations for the crime of "Accessing with intent to view child pornography" so barring any other limitations, the FBI can come after someone 10-15 years later. The AUSA became uncomfortable with the prospects of his legal case against the exploitees of FH and went to the US Attorney. There was disagreement as to whether or not the evidence would be viable, however, the operation went on anyways. One of the victims of the FH exploit was a man by the name of Grant Klein from Vermont. The Bureau had made arrangements with the local police for assistance with the raid (This is pretty much standard operation procedure, and is done for the saftey of the agents, as well as to maintain professional courtesy. Local cops get butt hurt when you arrest people on their turf without them knowing). The FBI had provided the local police with court documents and the affidavit of arrest regarding the cirsumstances of Mr. Klein's warrant, which they promptly posted onto their press release against the wishes of the FBI. This resulted in the termination of atleast one employee from local PD. He was raided and before even being asked a question ,he began spewing a confession. His home was searched, and a desktop computer with no hard disk was found, as well a laptop computer belonging to his wife Susan. There was no illegal materials found on these, however, he had a smartphone in the drawer of a nightstand which contained illegal images of minors. He was arrested and charged with 3 seperate crimes. To make a long story short, the FH related charges were dropped because the FBI had crossed a legal line by offering up child pornography de novo, by shutting down the server, then bringing it back online hosting real CP. They were uncomfortable with the prospects of this case, and were able to use a leon good faith exception to admit the evidence they found on his phone to make a single possession charge stick, however, he agreed to plead guilty. The rest of the leads which lead to foreign nationals were then distributed accordingly to the various LEA's. Also, earlier this wekk, the UK police arrested 660 people as part of Operation Notarise. The operation name of the FBI takedown in Nebraska was "Operation Torpedo" This was a cute poke at both the method they used, and the users they targeted Torpedo - Navy missile Tor Pedo - Tor Pedophile. -DT moar comments on Reddit

1 0

Huge collection of Security Data Science papers
by Eugen Leitl 21 Jul '14

21 Jul '14

(looks useful) https://pay.reddit.com/r/netsec/comments/2b8pk2/huge_collection_of_security… Over the past several years I have collected and read many security research papers/slides and have started a small catalog of sorts. The topics of these papers range from intrusion detection, anomaly detection, machine learning/data mining, Internet scale data collection, malware analysis, and intrusion/breach reports. I figured this collection might useful to others. All links lead to PDFs hosted here. I hope to clean this up (add author info, date, and publication) when I get some more time as well as adding some detailed notes I have on the various features, models, algorithms, and datasets used in many of these papers. Here are some of my favorites (nice uses of machine learning, graph analytics, and/or anomaly detection to solve interesting security problems): CAMP - Content Agnostic Malware Protection Notos - Building a Dynamic Reputation System for DNS Kopis - Detecting malware domains at the upper dns hierarchy Pleiades - From Throw-away Traffic To Bots - Detecting The Rise Of DGA-based Malware EXPOSURE - Finding Malicious Domains Using Passive DNS Analysis Polonium - Tera-Scale Graph Mining for Malware Detection Nazca - Detecting Malware Distribution in Large-Scale Networks PAYL - Anomalous Payload-based Network Intrusion Detection Anagram - A Content Anomaly Detector Resistant to Mimicry Attack Here is the entire collection: Intrusion Detection A Close Look on n-Grams in Intrusion Detection- Anomaly Detection vs. Classiﬁcation A Kill Chain Analysis of the 2013 Target Data Breach A Lone Wolf No More - Supporting Network Intrusion Detection with Real-Time Intelligence A Machine-learning Approach for Classifying and Categorizing Android Sources and Sinks Acquiring Digital Evidence from Botnet Attacks: Procedures and Methods (PhD Thesis) ALERT-ID - Analyze Logs of the network Element in Real Time for Intrusion Detection Anagram - A Content Anomaly Detector Resistant to Mimicry Attack Anomaly-based Intrusion Detection in Software as a Service Back to Basics - Beyond Network Hygiene Beehive - Large-Scale Log Analysis for Detecting Suspicious Activity in Enterprise Networks Behavioral Clustering of HTTP-based Malware and Signature Generation Using Malicious Network Traces Beheading Hydras - Performing Effective Botnet Takedowns Bloodhound - Searching Out Malicious Input in Network Flows for Automatic Repair Validation Boosting the Scalability of Botnet Detection Using Adaptive Traffic Sampling CAMP - Content Agnostic Malware Protection Casting out demons - Sanitizing training data for anomaly sensors CloudFence - Data Flow Tracking as a Cloud Service Comparing anomaly detection techniques for HTTP Cujo - Efficient detection and prevention of drive-by-download attacks Decoy Document Deployment for Effective Masquerade Attack Detection Detecting Spammers with SNARE - Spatio-temporal Network-level Automatic Reputation Engine Detecting Unknown Network Attacks Using Language Models Early Detection of Malicious Flux Networks via Large-Scale Passive DNS Traffic Analysis Effective Anomaly Detection with Scarce Training Data Efficient Multidimensional Aggregation for Large Scale Monitoring EFFORT - Efficient and Effective Bot Malware Detection ExecScent- Mining for New C and C Domains in Live Networks with Adaptive Control Protocol Templates - slides ExecScent- Mining for New C and C Domains in Live Networks with Adaptive Control Protocol Templates EXPOSURE - Finding Malicious Domains Using Passive DNS Analysis FiG - Automatic Fingerprint Generation Filtering Spam with Behavioral Blacklisting FLIPS - Hybrid Adaptive Intrusion Prevention HMMPayl - An Intrusion Detection System Based on Hidden Markov Models Kopis - Detecting malware domains at the upper dns hierarchy Large-Scale Malware Analysis, Detection, and Signature Generation Leveraging Honest Users - Stealth Command-and-Control of Botnets - slides Leveraging Honest Users - Stealth Command-and-Control of Botnets Local System Security via SSHD Instrumentation Machine Learning In Adversarial Environments Malware vs. Big Data (Umbrella Labs) McPAD - A Multiple Classifier System for Accurate Payload-based Anomaly Detection Measuring and Detecting Malware Downloads in Live Network Traffic Mining Botnet Sink Holes - slides MISHIMA - Multilateration of Internet hosts hidden using malicious fast-ﬂux agents Monitoring the Initial DNS Behavior of Malicious Domains N-Gram against the Machine - On the Feasibility of the N-Gram Network Analysis for Binary Protocols Nazca - Detecting Malware Distribution in Large-Scale Networks Netgator - Malware Detection Using Program Interactive Challenges - slides Network Traffic Characterization Using (p, n)-grams Packet Representation Notos - Building a Dynamic Reputation System for DNS On the Feasibility of Online Malware Detection with Performance Counters On the Infeasibility of Modeling Polymorphic Shellcode On the Mismanagement and Maliciousness of Networks Outside the Closed World - On Using Machine Learning For Network Intrusion Detection PAYL - Anomalous Payload-based Network Intrusion Detection PAYL2 - Anomalous Payload-based Worm Detection and Signature Generation Pleiades - From Throw-away Traffic To Bots - Detecting The Rise Of DGA-based Malware Practical Comprehensive Bounds on Surreptitious Communication Over DNS - slides Practical Comprehensive Bounds on Surreptitious Communication Over DNS Privacy-preserving Payload-based Correlation for Accurate Malicious Traffic Detection Revealing Botnet Membership Using DNSBL Counter-Intelligence Revolver - An Automated Approach to the Detection of Evasive Web-based Malware Self-organized Collaboration of Distributed IDS Sensors SinkMiner- Mining Botnet Sinkholes for Fun and Profit Spamming Botnets - Signatures and Characteristics Spectrogram - A Mixture of Markov Chain models for Anomaly Detection in Web Traffic The Security of Machine Learning Toward Stealthy Malware Detection Traffic Aggregation for Malware Detection Understanding the Domain Registration Behavior of Spammers Understanding the Network-Level Behavior of Spammers VAST- Network Visibility Across Space and Time Malware A static, packer-agnostic filter to detect similar malware samples A study of malcode-bearing documents A survey on automated dynamic malware-analysis techniques and tools APT1 Technical backstage (malware.lu hack backs of APT1 servers) Automatic Analysis of Malware Behavior using Machine Learning BitShred - Fast, Scalable Code Reuse Detection in Binary Code BitShred - Fast, Scalable Malware Triage Deobfuscating Embedded Malware using Probable-Plaintext Attacks Escape from Monkey Island - Evading High-Interaction Honeyclients Eureka - A framework for enabling static malware analysis Extraction of Statistically Significant Malware Behaviors Fast Automated Unpacking and Classification of Malware FIRMA - Malware Clustering and Network Signature Generation with Mixed Network Behaviors FuncTracker - Discovering Shared Code (to aid malware forensics) - slides FuncTracker - Discovering Shared Code to Aid Malware Forensics Extended Abstract Malware files clustering based on file geometry and visualization using R language Mobile Malware Detection Based on Energy Fingerprints — A Dead End Polonium - Tera-Scale Graph Mining for Malware Detection Putting out a HIT - Crowdsourcing Malware Installs Scalable Fine-grained Behavioral Clustering of HTTP-based Malware SigMal - A Static Signal Processing Based Malware Triage Tracking Memory Writes for Malware Classification and Code Reuse Identification Using File Relationships in Malware Classification VAMO - Towards a Fully Automated Malware Clustering Validity Analysis Data Collection Crawling BitTorrent DHTs for Fun and Proﬁt CyberProbe - Towards Internet-Scale Active Detection of Malicious Servers Demystifying service discovery - Implementing an internet-wide scanner gitDigger - Creating useful wordlists from GitHub PoisonAmplifier - A Guided Approach of Discovering Compromised Websites through Reversing Search Poisoning Attacks ZMap - Fast Internet-Wide Scanning and its Security Applications (slides) ZMap - Fast Internet-Wide Scanning and its Security Applications Vulnerability Analysis/Reversing A Preliminary Analysis of Vulnerability Scores for Attacks in Wild Attacker Economics for Internet-scale Vulnerability Risk Assessment Detecting Logic Vulnerabilities in E-Commerce Applications ReDeBug - Finding Unpatched Code Clones in Entire OS Distributions The Classification of Valuable Data in an Assumption of Breach Paradigm Toward Black-Box Detection of Logic Flaws in Web Applications Vulnerability Extrapolation - Assisted Discovery of Vulnerabilities using Machine Learning - slides Vulnerability Extrapolation - Assisted Discovery of Vulnerabilities using Machine Learning Anonymity/Privacy/OPSEC/Censorship Anonymous Hacking Group – #OpNewblood Super Secret Security Handbook Detecting Traffic Snooping in Tor Using Decoys Risks and Realization of HTTPS Traffic Analysis Selling Off Privacy at Auction The Sniper Attack - Anonymously Deanonymizing and Disabling the Tor Network The Velocity of Censorship - High-Fidelity Detection of Microblog Post Deletions - slides The Velocity of Censorship - High-Fidelity Detection of Microblog Post Deletions Tor vs. NSA Data Mining An Exploration of Geolocation and Traffic Visualization Using Network Flows to Aid in Cyber Defense DSpin - Detecting Automatically Spun Content on the Web Gyrus - A Framework for User-Intent Monitoring of Text-Based Networked Applications Indexing Million of Packets per Second using GPUs Multi-Label Learning with Millions of Labels - Recommending Advertiser Bid Phrases for Web Pages Real-Time Handling of Network Monitoring Data Using a Data-Intensive Framework Shingled Graph Disassembly - Finding the Undecideable Path Synoptic Graphlet - Bridging the Gap between Supervised and Unsupervised Profiling of Host-level Network Traffic Cyber Crime Connected Colors - Unveiling the Structure of Criminal Networks Image Matching for Branding Phishing Kit Images - slides Image Matching for Branding Phishing Kit Images Inside a Targeted Point-of-Sale Data Breach Investigating Advanced Persistent Threat 1 (APT1) Measuring pay-per-install - the Commoditization of Malware Distribution Scambaiter - Understanding Targeted Nigerian Scams on Craigslist Sherlock Holmes and the Case of the Advanced Persistent Threat The Role of the Underground Market in Twitter Spam and Abuse The Tangled Web of Password Reuse Trafﬁcking Fraudulent Accounts - The Role of the Underground Market in Twitter Spam and Abuse CND/CNA/CNE/CNO Ampliﬁcation Hell - Revisiting Network Protocols for DDoS Abuse Defending The Enterprise, the Russian Way Protecting a Moving Target - Addressing Web Application Concept Drift Timing of Cyber Conflict –Jason @jason_trost SECURITYDATA SCIENCERES

1 0