Fink RAT Co-creator Meets Big Daddy Uncle Sam

One of the co-creators of the Blackshades Remote Access Trojan (RAT) that infected more than 500,000 computers has pleaded guilty to charges of hacking.

 Alex Yücel, 24, faces up to 10 years in prison for his involvement with the $40 program designed to secretly remotely control victims' computers...

Through his creation and sale of the Blackshades RAT, Alex Yücel enabled anyone, for just $40, to violate the property and privacy of his victims...

According to documents filed in the Manhattan federal court, the Blackshades RAT - which was used to secretly take nude photos of Miss Teen USA - could give an attacker complete control over an infected system...
(more)

Indian Oil Ministry Investigating Possible Bugging

India - A sticky tape with a micro-insertion found beneath a table in the office of a top bureaucrat in the ministry has raised suspicion over snooping attempts to tap information on sensitive energy related matters, sources told HT.

“We cannot rule out any possibility... the matter has been brought to the notice of the investigative agencies, who will look into the matter,” a top petroleum ministry bureaucrat told HT requesting not to be identified...

A similar incident of a possible bugging of a government office was reported in June 2011 when suspicion surrounded the office of the then finance minister Pranab Mukherjee. The office of the home ministry and the Intelligence Bureau later confirmed that it was just a suspicion and no bugging took place in the office.
(more)

Indian Corporate Espionage Scandal Deepens

India - A corporate espionage scandal involving allegations of stolen documents from India’s government deepened this weekend, following the arrests of employees at conglomerates controlled by four of the country’s most prominent tycoons, including billionaire brothers Mukesh and Anil Ambani.

The arrests mark the first time since the election of Narendra Modi as prime minister last year that police have launched an investigation targeting such high-profile industrial businesses, and are set leave the companies and their wealthy owners facing a lengthy and potentially damaging legal investigations.
(more)

C.S.I. yi-yi - DNA Can Be Faked!

In a recent story in The New York Times, Andrew Pollack reports that "scientists in Israel have demonstrated that it is possible to fabricate DNA evidence, undermining the credibility of what has been considered the gold standard of proof in criminal cases.

"The scientists fabricated blood and saliva samples containing DNA from a person other than the donor of the blood and saliva. They also showed that if they had access to a DNA profile in a database, they could construct a sample of DNA to match that profile without obtaining any tissue from that person."

“You can just engineer a crime scene,” Dan Frumkin, lead author of the paper, which has been published online by the journal Forensic Science International: Genetics, told the Times. “Any biology undergraduate could perform this.”
(more)

Smart TVs Are Not The Only Things Eavesdropping On You

When the story broke that certain Sansung television sets were eavesdropping on their owners -- a polite way of saying the sets were spying -- it raised some alarms and forced Samsung to rewrite its privacy policy. But if you think hi-tech TVs are the only things capable of gathering your private information and sharing it with others, think again:

Our smartphones and computers, of course, listen to us when we're making audio and video calls. But the microphones are always there, and there are ways a hacker, government, or clever company can turn those microphones on without our knowledge. Sometimes we turn them on ourselves. If we have an iPhone, the voice-processing system Siri listens to us, but only when we push the iPhone's button. Like Samsung, iPhones with the "Hey Siri" feature enabled listen all the time. So do Android devices with the "OK Google" feature enabled, and so does an Amazon voice-activated system called Echo. Facebook has the ability to turn your smartphone's microphone on when you're using the app.
(more)

This is something my clients don't have to worry about. I give them SpyWarn MicSpike™... free. ~Kevin

Spyware Makes Android Phones Play Possum

A particularly devious new Android malware can make calls or take photos even if you shut the device down, according to security research firm AVG.

To achieve this, the malware hijacks the shutting down process — making it appear as though your Android device is shutting down. You see the animation, the screen goes black, but the phone is actually still on.

In this state, the malware can use the phone to send your messages to a third party, record a call or take a photo, essentially turning your phone into a device that spies on you.

AVG, which posted code excerpts showing some of the malware's functionality, names this threat Android/PowerOffHijack.A. According to the company, it infects devices running Android versions below 5.0 and requires root permissions in order to act.

The company spokesperson told us some 10,000 devices were infected so far, mostly in China where the malware was first introduced and offered through the local, official app stores.
(more)

Spywarn™ can detect this.

...and what do you do with electronics returning from International trips?

Officials at the departments of Justice and Homeland Security typically expect employees’ smartphones will be bugged when they travel overseas. So, they are experimenting with various ways to neutralize foreign spy gear.

For years, the FBI has warned government and corporate executives not to use hotel Wi-Fi connections, because of reports that foreign travelers were unknowingly downloading spyware.

When DHS personnel travel, “we understand you go there, you go to Ukraine, you come back, there's a good chance that the BlackBerry or any other device, Androids, iOS, whatever, is probably owned. We get that," said Vincent Sritapan, a cybersecurity division program manager at the DHS Science and Technology Directorate.

To contain the damage, Homeland Security limits what employees can see on their mobile device overseas, and "when it comes back, it's usually quarantined," he added.
(more)

No sure what you should be doing? Call us.

Workplace Video Voyeurism: Rabbi Pleades Guilty to 52 Counts

DC - A prominent US rabbi has pleaded guilty to 52 counts of voyeurism after secretly filming women in his congregation's ritual baths.

Barry Freundel, 63, may have recorded as many as 150 women in the changing area at his orthodox synagogue in Washington DC.

Murray Associates case history photo.

Court documents revealed that Freundel set up a recording device hidden within a digital clock radio in the changing and showering area.

The women were disrobing for the ritual Jewish bath, known as a mikvah.

He has confessed to recording at least 52 nude or partially nude women. Prosecutors say he should be jailed.

They say the actual number of women filmed is likely to have been much higher.

Before his arrest in October 2014, Barry Freundel was a rabbi at the Kesher Israel synagogue in the Georgetown area of the US capital for more than 25 years.
(more)

World's Smallest Voice Recorders

Disclaimer: I do not sell, endorse or promote products.
The following is advertising from the manufacturer. It is posted for two reasons.
1. My private investigator and security director readers are interested in investigation tools.
2. My corporate TSCM clients need to know the type of business espionage tools they face.

Smallest sizes, longest recording time, clearest record sound!

Edic-mini Tiny + А77

This is almost weightless and the smallest recorder in the series, enabling it to conduct recording from built-in rechargeable battery for more than two days. The recorder is perfectly suited for everyday use, recording everyday events and unexpected situations in life.

Technical characteristics:

• Dimensions: 29x15x12 mm;
• Weight: 7 g;
• Battery life in record mode: up to 55 hours;
• Power supply: rechargeable battery.

Detailed description here

Edic-mini Tiny+ B76 

Owing to standard battery as a power supply, B76 is flexible and effective in operation. Due to low power consumption the recorder is able to operate in record mode up to 36 hours. It is perfectly suited both for everyday use and for those who keep the Recorder handy without recording too much.

Technical characteristics:

• Dimensions: 31x25x6 mm;
• Weight: 16 g (without battery);
• Battery life in record mode: up to 55 hours;
• Power supply: battery of CR2016 type.

Detailed description here

Edic-mini Tiny 16+ A75

Professional voice recorder Edic-mini Tiny16 + A75 is the thinnest among the recorders of the Tiny16 + series. The main distinctive feature of the that model is 16-bit audio codec enable to reduce digital noise. Built-in Automatic Gain Control (AGC) makes it possible to perfectly record very loud sounds and amplify silent ones. It is a professional recording device designed for high- quality audio recording in complicated acoustic environment and from long distance, up to 15 meters.

 Technical characteristics:

• Dimensions: 77x27x4 mm;
• Weight: 12 g (without battery);
• Battery life in record mode: up to 55 hours;
• Power supply: rechargeable battery.
  
  Detailed description here

Is Your Home Security System Putting You at Risk? ...news at eleven.

HP has released results of a security testing study revealing that owners of Internet-connected home security systems may not be the only ones monitoring their homes. The study found that 100 percent of the studied devices used in home security contain significant vulnerabilities, including password security, encryption and authentication issues.

Home security systems, such as video cameras and motion detectors, have gained popularity as they have joined the booming Internet of Things (IoT) market and have grown in convenience... The new HP study reveals how ill-equipped the market is from a security standpoint for the magnitude of growth expected around IoT...

The HP study questions whether connected security devices actually make our homes safer or put them at more risk...
(more)

Busman's Holiday, or Moonlighting Surveillance

Australia - A police officer installed a tracking device on a woman's car illegally to detail her movements, a magistrates court in Perth has been told.

The detective sergeant, who has been a police officer for more than 20 years, was on holiday at the time of the alleged offence with the woman's boyfriend, also a police officer.
(more)
(Sing-a-long)

Yet another Hollywood Bugging Scandal

CA - A West Hollywood City Council aide has been suspended and is being investigated by sheriff’s detectives on charges of eavesdropping on another council deputy and then e-mailing portions of her private conversations to local bloggers and residents in the city.

Ian Owens, a deputy to Councilman John Duran, is accused of bugging the City Hall office of Fran Solomon, the deputy to Councilman John Heilman, said city officials who requested anonymity because they were not authorized to discuss the matter.

But, wait. There's more...

Last month, City Council candidate Larry Block was sued by celebrity spray tanner Jimmy Jimmy Coco. The professional tanner... claimed in his suit that Block was his landlord, that he wrongly evicted him and that he had installed “spy cameras” to catch him in the nude.
(more)

Science Magazine - The End of Privacy

The whole magazine is devoted to privacy.

At birth, your data trail began. You were given a name, your height and weight were recorded, and probably a few pictures were taken. A few years later, you were enrolled in day care, you received your first birthday party invitation, and you were recorded in a census. Today, you have a Social Security or national ID number, bank accounts and credit cards, and a smart phone that always knows where you are. Perhaps you post family pictures on Facebook; tweet about politics; and reveal your changing interests, worries, and desires in thousands of Google searches. Sometimes you share data intentionally, with friends, strangers, companies, and governments. But vast amounts of information about you are collected with only perfunctory consent—or none at all. Soon, your entire genome may be sequenced and shared by researchers around the world along with your medical records, flying cameras may hover over your neighborhood, and sophisticated software may recognize your face as you enter a store or an airport.
(more)

Private Investigators Are Being Nailed for Hacking

Private investigators may be the newest front for federal prosecutors in cracking down on the hacker-for-hire business.

In the coming weeks, a private investigator in New York is expected to plead guilty to charges of paying a so-called hacker-for-hire firm to steal email passwords and credentials, said three people briefed on the matter, who spoke on the condition of anonymity because no charges had been filed yet. The guilty plea would wrap up a nearly yearlong investigation by the Federal Bureau of Investigation and federal prosecutors in New York.

Separately, federal prosecutors in San Francisco on Wednesday announced the indictment of two private investigators and two computer hackers on charges that they illegally entered email and Skype accounts to gather information for matters they were working on for clients. Some of the illegally gathered information was intended to support a lawsuit, authorities said.

The identity of the private investigator in New York, who works for a small firm, could not be determined.
(more)

Study - 16 Million Smartphones Infected with Spyware / Malware

About 16 million mobile devices are infected by malicious software that is secretly spying on users, stealing confidential information and pilfering data plans.

That’s the word from Alcatel-Lucent’s Motive Security Labs, which in a study found that malware infections in mobile devices rose a full 25% in 2014, compared to a 20% increase in 2013. In fact, the uptick is so spectacular that Android devices have now caught up with Windows laptops, which had been the primary workhorse of cybercrime, with infection rates between Android and Windows devices split an even 50/50 in 2014.

“With one billion Android devices shipped in 2014, the platform is a favorite target of cybercriminals who can have lots of infection success without a lot of work,” said Kevin McNamee, director of Motive, in a blog. “Android is more exposed than rivals because of its open platform and by allowing users to download apps from third-party stores where apps are not always well-vetted.”

The mobile infection rate in 2014 was 0.68%. Fewer than 1% of infections come from iPhone and Blackberry smartphones.
(more)

Build Your Own Invisiability Device for Under $150

Researchers at the University of Rochester create a 3-D, transmitting, continuously multidirectional cloaking device. ... and they say you can too!
(more)
(more)
To build your own Rochester Cloak, follow these simple steps:

For their demonstration cloak, the researchers used 50mm achromatic doublets with focal lengths f1 = 200mm and f2 = 75mm

1. Purchase 2 sets of 2 lenses with different focal lengths f₁ and f₂ (4 lenses total, 2 with f₁ focal length, and 2 with f₂ focal length)
2. Separate the first 2 lenses by the sum of their focal lengths (So f₁ lens is the first lens, f₂ is the 2nd lens, and they are separated by t₁= f₁+ f₂).
3. Do the same in Step 2 for the other two lenses.
4. Separate the two sets by t₂=2 f₂ (f₁+ f₂) / (f₁— f₂) apart, so that the two f₂ lenses are t₂ apart.

NOTES:

• Achromatic lenses provide best image quality.
• Fresnel lenses can be used to reduce the total length (2t₁+t₂)
• Smaller total length should reduce edge effects and increase the range of angles.
• For an easier, but less ideal, cloak, you can try the 3 lens cloak in the paper.

A patent has been filed for this cloaking device. Please contact UR Ventures for additional information.

5 Million People Wiretapped in One Year (Must be some sort of record.)

Some 5 million people in Turkey were listened in on in 2012, Interior Minister Efkan Ala has stated, referring to a calculation that around 250,000 people who were wiretapped spoke to at least 20 people on the phone. He blamed officers affiliated with the movement of U.S.-based Islamic scholar Fethullah Gülen for the scandal.

“A decision was made [to wiretap] one person, but that person speaks to tens of people. Imagine that he or she spoke to 20 other people - this adds up to 5 million people,” Ala said told state-run Anadolu Agency.

“All these [conversations] were stored and used for blackmailing or threatening. How can such a thing happen?” he asked.
(more)

Why Hotels Check Your ID ...and who gets to see it.

If you’re a privacy-conscious traveler, you may have wondered from time to time why hotels ask for ID when you check in, or why they ask you to give them the make and model of your car and other information that isn’t essential to the transaction. What’s the ID-checking for? ...

DIY ID card

Well, in many jurisdictions around the country, that information-gathering is mandated by law. Local ordinances require hotels, motels, and other lodgers (such as AirBnB hosts) to collect this information and keep it on hand. These laws also require that the information be made available to the police on request, for any reason or no reason, without a warrant.
(more)

Extra...
13 Things Your Hotel Front Desk Clerk Won't Tell You

Privacy Quote of the Week

"The age of information-sharing is brilliant, as long as you have no secrets."
~ Heather du Plessis-Allan

 

...your spoken words will be transmitted to a third party via Voice Recognition.

As the number of connected devices — aka the Internet of Things, aka the sensornet — proliferates so too does the number of devices leaning on voice recognition technology as an interface to allow for hands free control...

The potential privacy intrusion of voice-activated services is massive. Samsung, which makes a series of Internet connected TVs, has a supplementary privacy policy covering its Smart TVs which includes the following section on voice recognition:

You can control your SmartTV, and use many of its features, with voice commands... Please be aware that if your spoken words include personal or other sensitive information, that information will be among the data captured and transmitted to a third party through your use of Voice Recognition.

When all the objects in your home have networked ears that are fine-tuned for commercial intelligence gathering, where will you go to talk about “personal” or “sensitive” stuff?
(more)

Some Simple Corporate Spy Countermeasures

Some information spies navigate the hiring process with every intention to steal corporate secrets for a competitor or foreign state once inside. Others turn against an employer when angered and leave, lured by job offers and incentives to haul out as much data as they can when they go.

Meanwhile, enterprise efforts to spot traitors and limit their access to sensitive data may not be enough. With the right job and the right access, operatives posing as janitors, mailroom employees, or IT staff can skirt efforts to defend data, using their broad access to walk data out the door.

CSO looks at enterprise barriers to these information sleeper agents, how corporate spies get past the protections, and what security leaders can do technically and otherwise to keep their data vaults safe from prying eyes...
(more)

Summary... Thorough background checks, limit access, keep your eyes open.

Security Director Alert - DarkLeaks - The Espionage Bazaar

It looks like the days when concerned individuals share the inner secrets of corporations and governments only due to their nagging consciences are numbered, from here on in they will do so for nothing more than a fast buck. 

A new WikiLeaks-style website has recently been announced that will reward its contributors with Bitcoins in exchange for information.  

If the most valuable commodity is information then it is about to get its own hypermarket; DarkLeaks will allow uses to sell leaked data to the highest bidder in an anonymous blockchain-powered environment where anything goes.

DarkLeaks is being developed by unSystem who are behind DarkWallet, and DarkMarket an anonymous ebay-style marketplace which unlike Silk Road operates on the P2P model so that there is no central point of failure for law enforcement to take down.

The DarkLeaks system is so secure that it does not even allow communication between the seller and the buyer of information. Their website states: “The software uses bitcoin’s blockchain to encrypt files which are released when payment is claimed by the leaker. Files are split into segments and encrypted. These segments are unlocked only when the leaker reveals the key by claiming his bitcoins.”

There are also no limits on the type of content that can be bought and sold. Everything from evidence of corporate corruption to naked pictures of celebrities is up for grabs. UnSystem developer Amir Taaki has told CoinDesk that platforms like DarkLeaks provide a financial incentive for insiders to reveal information thereby “devaluing business models based around proprietary secrecy”.
(more)

This is going to be a BIG problem for corporations. 
Those without a counterespionage strategy will hurt first.

Night Janitor Admits to Hiding Spycam in Staff Bathroom

NV - A former school district janitor told police he hid a video camera in a staff bathroom with the intent to record people using the bathroom in various stages of undress, according to the arrest report.

Gary Wayne Higbee, who has only been employed part-time with the district since September 2014, is facing three counts of capturing an image or the private area of another person...

The video camera was discovered when an employee at Givens Elementary School noticed what appeared to be something hidden next to a silk plant on the bathroom sink.

Another employee told police she noticed Higbee checking out the unisex bathroom every time someone came out of it.

According to the arrest report, Higbee told police he took the camera from his other job at Southwest Airlines, where he works as a ramp agent. He said, he researched on the Internet how to do hidden recordings of people.
(more)

Chinuts - Move Here, Give Us Source Code and Build Some Back Doors (wtf?!?!)

China plans to unveil new cybersecurity rules that require tech companies to hand over source code and build back doors in hardware and software for government regulators. The rules only apply to companies selling computer products to Chinese banks, but they have already sparked anxiety on the part of Western tech companies about being trapped between either giving up intellectual property or not doing business in China.

The new rules—part of cybersecurity policies intended to protect China’s critical industries—first appeared in a 22-page document at the end of 2014, according to a New York Times report. Such rules have not been officially announced yet. But the U.S. Chambers of Commerce joined a number of other foreign business groups in sending a letter [pdf] to the Central Leading Group for Cyberspace Affairs, chaired by President Xi Jinping, that called for “urgent discussions” about the policies. Tech giants such as Microsoft, Cisco, and Qualcomm have also independently voiced their concerns.

Under the bank rules, tech companies would have to hand over source code, set up research and development centers in China, and build hardware and software back doors that would permit Chinese officials to monitor data within their computer systems.
(more)

Workplace Video Voyeurism - Streaming Covert Dressing Room Camera

Reality TV star and Las Vegas showgirl Holly Madison said managers at Mandalay Bay’s 1923 Bourbon and Burlesque watched secret, intimate recordings of her and other women in their dressing room.

Madison and her company, Awesometown Inc., filed a lawsuit Monday against multiple individuals involved with her show, 1923 Bourbon and Burlesque by Holly Madison. A second suit was filed on behalf of the other dancers by the same Las Vegas firm, Garcia-Mendoza and Snavely.

The court documents allege that the corporations and managers who hired Madison and ran the venue filmed, transmitted and disseminated images of the women naked and changing costumes for about five months last year without the women’s knowledge or consent.

Robert W. Sabes, Noel Bowman, Robert Fry and Avi Kopelman, the individuals named in the suit, are accused of secretly placing a digital video recorder capable of storing 17 days of film in the women’s changing room. Video was then streamed to the men’s computers and other digital devices, according to the lawsuit...

In addition to the men named in the lawsuit, the action targets the corporations involved, Fat Hat LLC, ICE Lounge Las Vegas LLC and J. F. Sabes Investment Inc, as well as 20 unnamed people and corporations, which were involved in building the dressing room and setting up the surveillance camera.
(more)

Australian PI Goes Undercover and Gets Sacked (no, really)

Australia - A private investigator who gets paid by councils to have undercover sex inside illegal brothels has been fired after withholding information about a prostitute whom he met on a job.

Over the past four years, "Fred Allen" has received tens of thousands of dollars from at least 10 Sydney metropolitan councils in exchange for evidence that is required, in court, to help close underground parlours.

But in October the investigator was accused, by Sydney-based consultancy firm Brothel Busters, of having "deliberately omitted" important details from a brief of evidence to "protect" an illegal sex worker, with whom he had become "enchanted", while working covertly inside an underground vice den.
(more)

Three Grumpy Spies Nailed with Bugs and Taps

Three men accused in the latest Russian spy case didn't hide behind fake identities and weren't stealing military secrets. The evidence even suggests they were annoyed that their assignment wasn't more like a James Bond film.

Their alleged plot to dig up "economic intelligence" on possible banking penalties and alternative energy sources may not be the stuff of Hollywood movies, but U.S. authorities insist the case is proof that Russian spying is thriving in America more than two decades after the end of the Cold War.

It also shows the time and resources the U.S. still throws at those suspected of being Putin-era spies, using methods developed before many of them were born: listening bugs, hidden cameras and intercepted phone calls.
(more)

Ex-Spy Chief Wanted on Charges of... Spying

Colombia — The former head of Colombia’s intelligence agency ended several years on the run and surrendered to face charges of spying on opponents of former President Alvaro Uribe.

Maria del Pilar Hurtado late Friday turned herself over to authorities in Panama, where she fled in 2010. She was taken on a pre-dawn flight to Bogota, where a judge ordered her to be jailed at the chief prosecutor’s office while charges are considered.

Chief prosecutor Eduardo Montealegre said Hurtado was being processed for at least five offenses that could bring 15 to 20 years in prison for a conviction. He said he would urge Hurtado to cooperate and reveal “who gave the order for the illegal wiretapping.”
(more)