El Chapo Got Wiretapped Because the IT Guy Screwed Up

It only took five weeks, but jurors in the trial of Joaquín “El Chapo” Guzmán finally got hear the infamous drug lord speak. Chapo's voice filled the courtroom Thursday as prosecutors played a taped phone call between the alleged Sinaloa cartel leader and members of the FARC guerrilla group. The two sides could be heard negotiating a six-ton cocaine deal. The exchange was damning...

It’s still unclear exactly how U.S. authorities obtained the recording, but witness Jorge Cifuentes seemed to have a pretty good idea. He blamed the cartel’s IT guy...

Cifuentes appeared to be vigilant about digital security. Prosecutors showed the jury his detailed accounting records, which included items like "cellular inhibitors" and "microphone searchers" among his expenses. "You turn it on during a meeting and there's no way anyone can tape it or send out anything," Cifuentes said, describing one of the devices...

The irony was that authorities were only able to obtain the call because the men were forced to use conventional cellphones while their secure network was down. Cifuentes called Cristián "an irresponsible person," and said the engineer screwed up by forgetting to renew the license on the software they had purchased. more

Note: This also reveals what can happen when someone with a little knowledge (Jorge Cifuentes) tries to play TSCM expert... "You turn it on during a meeting and there's no way anyone can tape it or send out anything,"

Be careful who you hire to advise you on corporate technical counterespionage.

Quote of the Week

"It’s generally the government’s view that corporations are as responsible for their own information technology security as they are for their own physical security." — Dick Fadden, former national security adviser to Stephen Harper and past director of the Canadian Security Intelligence Service (CSIS)

National Security Agency (NSA) - 136 issues of its internal Cryptolog periodical spanning 1974 through 1997.

Five years ago, the National Security Agency (NSA) released 136 issues of its internal Cryptolog periodical spanning 1974 through 1997. The collection offered a look into the some of the discussions being held within one of America’s most secretive intelligence agencies. Today the GWU-based National Security Archive is providing a complete index of all 1,504 items in the declassified collection, including but not limited to articles, interviews, and puzzles. more

Man's IoT Security Camera Starts Giving Him Advice

An Arizona real estate agent was shocked when a voice started broadcasting from his Nest security camera recently, addressing him directly.

Andy Gregg was in his backyard when he heard the voice, belonging to someone who claimed to be a “white hat hacker” from Canada, Gregg told the Arizona Republic. A white hat hacker is a hacker who exposes security vulnerabilities for the greater good, rather than their own benefit.

Gregg recorded the conversation that followed. In the video, a voice can be heard over the speaker telling Gregg that he was contacting him in the creepiest way possible to warn him about the security risks of his internet-connected camera. more

Federal Court Rules Cops Can't Arrest You for Secretly Filming Them

Contrary to popular belief, in many states, recording the police is a crime.

Laws in 38 states plainly allow citizens to openly film the police in public. However, there are 12 states–California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Pennsylvania, and Washington–where wiretap laws prohibit citizens from secretly recording police. These states require “two-party consent,” which means every party must agree before they are recorded.

But in a victory against Boston’s police commissioner and district attorney, a federal judge ruled on Tuesday that a Massachusetts law used by Massachusetts police to target people who secretly recorded them was unconstitutional. more

Just Add One More Thing and The Counterespionage Law Works

The following sounds good, but as is, it is just more of what hasn't worked.
The missing element: requiring the victims to lock their doors. 
Pennsylvania was the first to get it right. 

U.S. Senator Kamala D. Harris (D-CA), a member of the Senate Judiciary Committee, introduced the Deterring Espionage by Foreign Entities through National Defense (DEFEND) Act, which would update the Economic Espionage Act (EEA) to better address the growing threat of economic and industrial espionage perpetrated by foreign actors. The legislation increases the damages available for victims of trade theft, extends the statute of limitations, and expands the scope of the EEA to encompass a broader range of offenses occurring outside of the United States, including cybercrime and hacking. more

Landlord Plants Spycams - Watches While Jetsetting

Australia - An accused pervert landlord who has been charged with hiding secret cameras in tenant bathrooms could allegedly spy on renters live from wherever he was jetsetting around the world.

Barbadian-born James Maxwell, who calls himself “Tiger”, allegedly installed tiny secret spy cameras in the male bathrooms and a bedroom of the apartments in Pyrmont, Sydney, which he managed.

When police allegedly uncovered the cameras they also allegedly found an app on Mr Maxwell’s phone which enables accessing video footage from anywhere in the world...

....also alleged that Mr Maxwell had had tiny cameras in his watch and key ring...

News.com.au understands the cameras included a black rectangular digital clock and wall clocks in a bedroom and two bathrooms. more

Your Mobile Device Could Spill Its Guts (and worse) Get You Arrested

Last year, over 29,000 travelers had their devices searched at the US border.

A new report by the Department of Homeland Security’s internal watchdog has concluded that the agency does not always adequately delete data seized as part of a border search of electronic devices, among other concerns.

According to a new 24-page document released Tuesday by DHS’ Office of Inspector General, investigators found that some USB sticks, containing data copied from electronic devices searched at the border, "had not been deleted after the searches were completed."...

Federal authorities do not need a warrant to examine a phone or a computer seized at the border. They rely on what’s known as the "border doctrine"—the legal idea that warrants are not required to conduct a search at the border. This legal theory has been generally recognized by courts... more

Spybuster Tip #841: Device searches occur (even more often) when entering (or leaving) certain foreign countries. If you need to take your mobile device on a trip you should consider doing a data extraction on your device, before you leave... and before they do it for you.

1. To be sure you are not carrying data that you can't afford to loose.
2. To be sure you are not carrying contraband data (porn, propaganda, etc.).
   Remember, even erased data can be exhumed by them.
3. To document the actually data you are taking—to counter false accusations.

Learn more here. Upon returning a spyware detection inspection is also recommended.

A Spycam that Sucks

Blown by theregister.co.uk
Next time you're closing a big drug deal you may want to watch the cleaner. Or more specifically their vacuum cleaner. That's right, because thanks to publicly available federal acquisition records we now know that America's Drug Enforcement Agency (DEA) has planted cameras in cleaners. Canon cameras in Shop-Vacs appear to be the latest tool in the drug war.

To be fair, we don't know it's a Shop-Vac for certain because like the brand "Hoover," "Shop-Vac" has become a generic term for a heavy-duty vacuum cleaner. The DEA could be planting surveillance equipment in a Rigid, a Craftsman or even a Stanley. What we do know for sure is that is a Canon M50B.

And we know that because it lists "custom shop vac concealment with Canon M50B" in the contract, dated November 28.

It's a good choice: The Canon VB-M50B is a network camera so video can be live-streamed - presumably to agents parked in a van nearby – and it has a very large aperture ratio, meaning that you get good color and clarity out of it even in low-light situations. more

FutureWatch: Tooth Bugs

Sonitus Technologies, creators of the Sonitus Sensory Interface Platform, is enabling real-time wireless communications and monitoring of physiological information of users in the most challenging defense, security and commercial environments.

The company’s initial sensory platform-based solution is Molar Mic, a novel personal communications device that snaps-easily to the back teeth of a user and creates an entirely new audio interface.

By creating a new audio path (bone conduction), it eliminates the need for ear pieces, microphones and wires on a user’s head.

Incorporating a miniaturized microphone and receiver into a dime-sized mouthpiece, Molar Mic sustains unbroken two-way voice connectivity in communications networks critical to personal safety and performance across defense, public safety, aerospace, power, oil & gas, and professional applications.

Molar Mic is in its final field testing with the US Air Force. more

Flashback: "Green You're Clean - Red You're Dead"

Detecting landline telephone taps was never as easy as this, but that didn't stop the hucksters and their magazine ads. Over thirty years ago, they preyed on people seeking cheap magic bullets to protect their privacy. Here are some of these bullets.

Most of these devices will tell you if someone picks up an extension phone (assuming basic phone service). Decently constructed wiretaps remain invisible, however.

One of these devices is totally bogus. (I tested and dissected it.)

The Technical Surveillance Countermeasures (TSCM) hucksters are still out there, these days with "professional looking" websites and even more blinky light gadgets.

Need a reality check, or second opinion, before you buy?
Ask away!

                       

Some of these gadgets date back to the 1970's. Some are still being sold today!

       

Detecting smartphone spyware is another story.

 

Thanks for viewing this collection of anti-eavesdropping mental band-aids.

  

Fob-U-Less Auto Theft on the Rise ...and a solution!

As predicted in 2011, and documented in previous Security Scrapbook posts, it is time to remember where to keep your car key fob overnight... in a closed tin (cost $0.93). ~Kevin

CA - Auto theft on the rise in Toronto area, and a security expert thinks he knows why...
According to Markham automotive security specialist Jeff Bates, owner of Lockdown Security, wireless key fobs have a role to play in many recent car thefts, with thieves intercepting and rerouting their signals — even from inside homes — to open and steal cars.

...many of these thieves are using a method called "relay theft."

Key fobs are constantly broadcasting a signal that communicates with a specific vehicle, he said, and when it comes into a close enough range, the vehicle will open and start.

"The way that the thieves are getting around this is they're essentially amplifying that low power signal coming off of the push start fob," he said.

"They will prey upon the general consensus that most people are leaving their key fobs close to the front door of their home and the vehicle will be in the driveway."

The thief will bring a device close to the home's door, close to where most keys are sitting, to boost the fob's signal.

They leave another device near the vehicle, which receives the signal and opens the car.

Many people don't realize it, Bates said, but the thieves don't need the fob in the car to drive it away. more

Many thanks to our Canadian Blue Blaze Irregular (WM) for this latest alert!

Extortionography: Hilton Facing $100 Million Lawsuit Over Spycam Incident

A Chicago woman says she's traumatized for life because of what happened to her inside an Albany hotel room. That woman is suing the hotel chain for $100 million. 

The alleged incident happened in July 2015, but the alleged victim didn't find out about it until about two months ago. Now, she's scared for her life.

The woman had just graduated from Albany Law School. She was staying in town so that she could take the New York State Bar Exam.

Inside her hotel room, someone allegedly placed a hidden camera in her bathroom that recorded her taking a shower. The video was then posted on numerous X-rated websites.

Later there were blackmail attempts. The emailer wanted thousands of dollars to remove the video from the internet. more

Note to Hilton: A proactive due diligence defense costs about $25.00 per hotel, a price Hilton cannot afford... to pass up.

13 Members Sue Gym Over Ceiling Spycam

MI - Members of a Clinton Township gym have sued the former owner who is accused of spying on members with a hidden camera.

Thirteen members filed the lawsuit in Macomb County Circuit Court earlier this month against Matthew Krakowski, who ran Switch Crossfit gym, alleging he invaded their privacy by filming gym-goers while changing their clothes and possibly using the bathroom in private areas...

Krakowski also faces criminal charges. He initially was charged with one count of surveiling an unclothed person last May after a woman reported seeing a camera in a ceiling tile in April while she changed in a private area. Police sifted through thousands of other images garnered from Krakowski’s computer or devices and found victims to produce 13 more charges. more

Like most of these cases which hit the courts, this camera was found serendipitously, by the victim. 

Businesses involved this way have no defense. In court, the case is viewed as a respondeat superior issue—the business is responsible for the actions of their employees. Defense is costly, as are the financial penalties. 

A proactive due diligence defense costs about $25.00, a price your business cannot afford... to pass up.

No Matter Where You Go, There You Are

Global automakers are feeding real-time location information and dozens of other data points from electric vehicles to Chinese government monitoring centers, potentially adding to China’s rich kit of surveillance tools as President Xi Jinping steps up the use of technology to track Chinese citizens.

Generally, it happens without car owners’ knowledge, The Associated Press found.

More than 200 automakers selling electric vehicles in China — including Tesla, Volkswagen, BMW, Daimler, Ford, General Motors, Nissan, Mitsubishi and U.S.-listed start-up NIO — send at least 61 data points to government-backed monitoring platforms, under rules published in 2016. Automakers say they are merely complying with local laws, which apply only to alternative energy vehicles. more