Spy Quote of the Week

"Peacetime espionage is best defined as not particularly illegal, and the lack of global governance is likely an intentional choice." ~Danielle Han, from the article: Aspymmetrical Powers: Economic and Cyber Espionage

Georgia Coaches Laugh Off Unfounded ‘Spy Camera’ Accusations

Georgia coaches laughed off Thursday’s hot rumor at the Chick-fil-A Peach Bowl. There was a loose accusation from an Ohio State sportswriter that the Bulldogs used a hidden camera to spy on the Buckeyes’ practices at Mercedes-Benz Stadium.

“I hope that’s true,” UGA offensive coordinator Todd Monken said, laughing aloud when asked about it during Media Day on Thursday. “I hope we’ve been in their hotel. I hope we’ve been in their practices. I hope we’re logged into their computers.”

Monken quickly added – “That’s a joke.” ...

The truth is, there was a camera found in the stadium before the Buckeyes’ first practice at Mercedes-Benz Stadium this week during a routine security sweep, according to people familiar with the situation. The camera belonged to the stadium as a permanent fixture and was not being operated at the time. Ohio State was informed about it, the camera promptly was removed and everybody moved on. more

Time to read:
Spies on the Sidelines: The High-Stakes World of NFL Espionage

EarSpy Attack Can Use Motion Sensors Data to Pry on Android Devices

As smartphone manufacturers are improving the ear speakers in their devices, it can become easier for malicious actors to leverage a particular side-channel for eavesdropping on a targeted user’s conversations, according to a team of researchers from several universities in the United States.

The attack method, named EarSpy, is described in a paper published just before Christmas by researchers from Texas A&M University, Temple University, New Jersey Institute of Technology, Rutgers University, and the University of Dayton.

EarSpy relies on the phone’s ear speaker — the speaker at the top of the device that is used when the phone is held to the ear — and the device’s built-in accelerometer for capturing the tiny vibrations generated by the speaker. more

Turning Google Smart Speakers into Wiretaps

I (@downrightnifty4874) was recently rewarded a total of $107,500 by Google for responsibly disclosing security issues in the Google Home smart speaker that allowed an attacker within wireless proximity to install a “backdoor” account on the device, enabling them to send commands to it remotely over the Internet, access its microphone feed, and make arbitrary HTTP requests within the victim’s LAN (which could potentially expose the Wi-Fi password or provide the attacker direct access to the victim’s other devices). These issues have since been fixed. more video

The Lasers are Coming - Killer Eyeglasses & Drones

For years, movies have teased us with the possibilities of augmented reality (AR) and mixed reality (MR), from Minority Report to Iron Man. But unlike robotic insects and flying suits, AR and MR smart glasses are much closer to reality for everyday consumers. One of the major barriers has been consumers’ desire for lightweight smart glasses that resemble standard eyeglasses and can be worn all day, every day. Compact, chic designs require projection technology and batteries that are as small and power-efficient as possible, which has been difficult to achieve. The internet hype that AR glasses are just around the corner has given into the reality that there are a number of large problems to solve before mass deployment in the consumer space can begin. more

---

Aerial drones are essentially the new improvised explosive devices (IEDs)—they’re relatively cheap and easily weaponized. Weaponized swarms of drones working together on a mission are an asymmetric threat that can quickly turn into an ugly situation. In the future, drones are expected to become faster, more autonomous, more difficult to detect or jam, and deadlier, with more sophisticated swarm attacks.

An arms race of sorts is quietly underway to be able to counter any countermeasures against drones. So the U.S. military is adopting a multilayered counter-drone approach to deal primarily with small drones (classified as Groups 1 and 2)—including commercial ones you can easily buy online and ones with fixed wings that look like tiny airplanes. Pinpoint accuracy at the speed of light makes high-energy lasers, a form of directed energy, one of the most promising options. more

FutureWatch: More Progress on the Electronic Dog Nose - TSCM Potential

Recap #1: Device can detect distress signals from plants that are harmed, under attack It turns out the best way to hear a plant scream is to smell it. (10/17/2008) more

Recap #2: Specially trained dogs have been used to sniff out covert electronic items, like cell phones in prisons, for quite a while now. The secret to detection is the device's electronic circuit boards. They contain these compounds: triphenylphosphine oxide (TPPO) and hydroxycyclohexyl phenyl ketone (HPK). This second compound is also found on CDs, DVDs, Blu-Rays, the old tech floppy disks. (5/18/2021) more

The latest development:
Researchers use biomimicry to enhance particle detection 16-fold by sniffing like dogs. more

FutureWatch: Technical Surveillance Countermeasures (TSCM) professionals have many types of technologies at their disposal for detecting illegal electronic surveillance devices. To name a few... Non-Linear Junction Detection, Infrared Thermography, and Radio-frequency Spectrum Analysis. We are now well on our way to adding EDN to our kit.

Eavesdropping & Anti-Eavesdropping Apps

Two new apps to be aware of…

The iEavesdrop app redirects internal microphone, external wired microphone or line input input audio to any Bluetooth audio device such as AirPods so that you can use your phone as a stealth listening device.

Using the correct line input cables, audio from any device such as an external microphone, in-flight entertainment or portable gaming device can be routed to your AirPods or other Bluetooth device. iEavesdrop will work with all iOS devices.

THIS APP CAN ALSO BE USED FOR MANY OTHER PURPOSES SUCH AS A BABY MONITOR, HEARING AID OR ANY OTHER APPLICATION THAT REQUIRES YOU TO LISTEN IN OR ROUTE MICROPHONE AUDIO TO A BLUETOOTH DEVICE.
(iOS)

———


(ANDROID)

About this app...
Ever thought someone might eavesdrop through your smart phone? Skewy is a privacy protection method, which is more than just a software setting. With Skewy you can mask your conversation with a simple – yet effective method. Simply making the audio data picked up by your phone unusable. Additionally, Skewy can detect ultrasonic signals to indicate the presence of device tracking technologies.

Last Minute Xmas Gift for Your TSCM Nerd

Most of these T-shirts are available on amazon.com

Reno 911: Mayor Finds GPS Tracker on Her Car – Sues PI

Reno mayor Hillary Schieve is suing a private investigator and his company after finding a device attached to her vehicle that was capable of tracking its real-time location.

The lawsuit alleges that the investigator trespassed onto her property to install the device without her consent. It says Schieve was unaware until a mechanic noticed it while working on her vehicle.

The complaint says, further, that the investigator was working on behalf of an “unidentified third party” whose identity she has not been able to ascertain...

There was no immediate response to a request for comment emailed Friday by The Associated Press to David McNeely, the investigator alleged to have placed the tracking device, and 5 Alpha Industries, the company... She brought it to police in neighboring Sparks, and they were able to determine that it had been purchased by McNeely. more

Do-it-Yourself Vehicle GPS Tracker Detection

Students Analyze, Hack, Remove Under-Desk Surveillance Devices

Northeastern University - In October, the university quietly introduced heat sensors under desk without notifying students or seeking their consent. Students removed the devices, hacked them, and were able to force the university to stop its surveillance.

Early in October, Senior Vice Provost David Luzzi installed motion sensors under all the desks at the school's Interdisciplinary Science & Engineering Complex (ISEC), a facility used by graduate students and home to the "Cybersecurity and Privacy Institute" which studies surveillance. These sensors were installed at night—without student knowledge or consent—and when pressed for an explanation, students were told this was part of a study on “desk usage," according to a blog post by Max von Hippel, a Privacy Institute PhD candidate who wrote about the situation for the Tech Workers Coalition’s newsletter.

More sensors were removed afterwards and put into a "public art piece" in the building lobby spelling out NO! more

Timothy Webster, Pinkerton Spy for the Union Army

In Chicago’s Graceland Cemetery, there is a headstone bearing the name, “Timothy Webster,” but the grave is empty. 

Webster is actually buried beneath a simple white marble stone in the township cemetery at Onarga, an Iroquois County village some 90 miles south of Chicago. 

The headstone in the Chicago cemetery is actually a memorial, part of the Pinkerton National Detective Agency’s burial plot for its deceased agents.

Timothy Webster died at the age of 40 in Richmond, Virginia, where he was hanged as a Union spy on April 29, 1862, by the Confederate government. He was the first spy executed by the Confederates during the Civil War. more

Twit Gets 3 1/2-Year Term on Spying for Saudis

A former Twitter Inc manager convicted of spying for Saudi Arabia by sharing user data several years ago and potentially exposing users to persecution was sentenced to 3-1/2 years in prison on Wednesday, U.S. prosecutors said. more

Can You Solve the GCHQ Christmas Card Challenge?

Today we've released the 2022 #GCHQChristmasChallenge. The puzzle, masterminded by a team of our in-house puzzlers, features on our Director's annual Christmas card. 

The card is sent to partners in the UK and around the world who work with us to counter threats, including hostile state activity, terror groups and organised crime gangs.

Whilst the Challenge has been designed for schools and colleges, we're also encouraging the wider public to take on the challenge to pit their wits against our puzzlers. more  video   And, of course, count on the Security Scrapbook to provide the solution.

Former Criminal Justice Professor Bugged Ex's Car

A former Iowa Wesleyan University criminal justice professor accused of stalking his ex-wife has been sentenced...charged with stalking and electronic or mechanical eavesdropping...

According to criminal complaints, Buffington is accused of placing a recording device on his ex-wife’s car, which recorded conversations within the vehicle.

Police said Buffington took his two daughters to his office at Iowa Wesleyan and played the recordings for them. Later, one of Buffington’s daughters obtained the recording device and a zip drive and gave them to law enforcement. That daughter told police she found it in Buffington’s bedroom nightstand...

Buffington also is accused of placing nails in the tires of his ex-wife’s car and admitting to her that he tracked her via OnStar. more

How to find GPS trackers and Bugs in your vehicle.

The National Cryptologic Museum is Open Again - Revamped - With New Spy Stuff

Vince Houghton (the new director of the National Security Agency's National Cryptologic Museum) and his team unveiled what they'd been working on during the COVID 19 pandemic: a complete overhaul of the aging, 1990s-era museum in Fort Meade, Md...

"These are artifacts that have never been on display before to the public at all," Houghton noted...

Until recently, historians believed many of the artifacts on display at the Cryptologic Museum were lost to history. For Houghton, unearthing old and unique pieces of cryptologic history has been an exceptionally satisfying part of his mission.

That's because the NSA maintains a large warehouse where employees have kept highly classified objects in the hopes that one day those stories could be told. Houghton compared the warehouse, where he and his colleagues spent hours before opening the museum, as "the end of Raiders of the Lost Ark," the 1981 Indiana Jones movie ending in a giant room full of treasure.

"It's floor to ceiling crates that are deteriorating, because they were sent back there in 1945," Houghton said. "To me it was like every day was Christmas, because I'm such a nerd about this stuff." more

Spy Christmas Present: George Orwell Lamp

Probably not a good gift for your paranoid Aunt. 

Seen recently on eBay.

Weird Science: Hacker Hacks Home Cam Then Reports it to Authorities

A former Davenport West High School science teacher has been found guilty of secretly recording people in various stages of undress in his Bettendorf home.

Clinton R. Vanfossen, 61, will be sentenced Jan. 5 on five counts of invasion of privacy, one count each of preventing apprehension and obstructing justice and electronic or mechanical eavesdropping...

District Court Judge Meghan Corbin filed a written ruling Monday. According to Corbin’s written ruling:

Bettendorf police received a tip from the National Center for Missing and Exploited Children.

According to the tip, a computer hacker in France hacked into the cameras of a home in Bettendorf and reported what he believed were people being unknowingly filmed in intimate moments.

Officers went to the location of the reported cameras, which were in Vanfossen’s Bettendorf home.

Officers searched the home and found two purported smoke detectors that appeared to contain a camera. The first camera was found in the second-floor hallway and the second camera was found inside a family member’s bedroom. more

Canada Awarded RCMP Contract to Firm with Ties to China

Canada - The federal government awarded a contract to provide and maintain RCMP communications equipment to a company with ties to the Chinese government, Radio-Canada has learned.

The contract has security experts raising concerns about potential Chinese access to RCMP communications and data.

On October 6, 2021, the federal government awarded Sinclair Technologies a contract worth $549,637 for a radio frequency (RF) filtering system. One of the system's purposes is to protect the RCMP's land-based radio communications from eavesdropping...

Conor Healy, a Canadian now based in Washington, said, "the risks include eavesdropping, collection of communications data and jamming or shutting down the radio communications system." more

PI Surveillance of Hand Injury Plaintiff Becomes 30.1 Billion Lawsuit

Cheap surveillance devices get expensive...

$11M settlement sparks $13.1B suit against American Family Insurance
A new lawsuit seeking billions of dollars in punitive damages claims AmFam and other parties illegally surveilled the plaintiff and her family...

It said that the lawyers hired the PI firm, at AmFam’s behest, to install surveillance devices around Mezqutal’s property and on family vehicles throughout the month of October 2019, or thereabouts.

“The AmFam defendants’ directions to the Martinelli Investigations Defendants included the mandate to have the investigators do whatever they needed to do to get surveillance of the plaintiff,” it said. “This direction was passed on to the Martinelli Investigations defendants by the Baker Donelson defendants.”

The PI defendants “unlawfully entered” Mezquitals’ property and “placed various electronic devices” on her property and two vehicles “to unlawfully record the activities of Plaintiff and her minor children. The electronic devices included at least one hidden video camera and multiple GPS tracking devices.”

The complaint said the PI team strapped a Spypoint Link-Dark “trail cam” digital camera, which is to a tree positioned to “capture plaintiff’s house, vehicles, and a portion of Plaintiff’s driveway. “The view provided by the Spypoint Link-Dark camera is not possible to obtain from a public road or from any other public property, it said. The “unlawful recordings were made without the consent of all persons observed and included photographs, videos, and electronic recordings of the activities of plaintiff and her minor children in a private place that was out of public view.”

The complaint includes claims for invasion of privacy, trespass to realty, trespass to personality, intentional infliction of emotional distress, negligence and punitive damages and seeks joint and several liability for all the defendants. more  (Spypoint camera sales video)

Just Because You are Paranoid... Device Found in CEO's Car

Eskom CEO, André de Ruyter, has doubled down on the claim that he stumbled upon a highly sophisticated tracking device under the driver’s seat of his Volvo...

This comes after details were provided to press in October about a circuit board, described as an “NSA-level device”, that De Ruyter found while cleaning his car.

Articles cited a preliminary report prepared by former police commissioner George Fivaz who claimed the device isn’t commercially available, and is typically used by law enforcement and intelligence agencies...

Journalists were provided photos of the circuit board, which they duly published....

Security researcher Daniel Cuthbert was willing to comment on the record.

He explained that, based on the evidence, the device was likely nothing more than a remote of some kind.

Such a remote button could be a gate or garage opener, a panic button, or a way to arm and disarm a home alarm.

MyBroadband’s in-house researcher and electronic engineer Wikus Steyn agreed.

“There is no GPS chip or antenna, so no tracking that way. I see no mic onboard, although there is what seems to be a 2-pin input at the top, but that is most likely for a push button,” Steyn stated. He also said the quality of soldering suggests cheap mass production. more

Our take... I agree with Dan and Wikus. (but be sure to read the last paragraph) If the TI IC info in the photo is correct TI lists the chip's applications as:

1.2 Applications

• Low-Power, High-Performance, Wireless Systems With Data Rate Up to 1250 kbps
• ISM/SRD Bands: 169, 433, 868, 915, and 920 MHz
• Possible Support for Additional Frequency Bands: 137 to 158.3 MHz, 205 to 237.5 MHz, and 274 to 316.6 MHz
• Smart Metering (AMR/AMI)
• Home and Building Automation
• Wireless Alarm and Security Systems
• Industrial Monitoring and Control
• Wireless Healthcare Applications
• Wireless Sensor Networks and Active RFID
• IEEE 802.15.4g Applications
• Wireless M-Bus, All Modes

Eskom CEO, André de Ruyter, may have misidentified this item, but it definitely doesn't mean he is not being surveilled. Thoughts of tracking and bugging are not normal. Something has made him suspicious. Trust your instincts, André. Get some professional TSCM help, and don't make it a public issue.

Sophos 2023 Threat Report

The Sophos 2023 Threat Report uncovers the latest cyberthreat trends and provides the insights you need to defend against evolving attacks.

Based on the research and real-world experiences of Sophos X-Ops – a new cross-operational unit that links Sophos' threat, incident response and AI cybersecurity experts, the report covers:

• The lasting cyber impact of the war in Ukraine

• The maturity of the “as-a-service” industry and how it has put advanced threat tactics into the hands of nearly any criminal

• How ransomware operators have evolved their activities and mechanisms, both to evade detection and to incorporate novel techniques

• A deep dive into the abuse of legitimate security tools by criminals to execute attacks

• An analysis of the threats facing Linux, Mac, and mobile systems

Spy Tech: Amazing Microphone Tricks

Forget about turning up the TV to block eavesdropping bugs. 

The EveryWord™ Ultra Far-Field AFE Processor is here.

ArkX Labs' EveryWord ultra far-field voice capture and control DSP solutions offer an unmatched voice experience for H2H and H2M interfaces. 

Utilizing 3-D reverberation technology, the AFE voice module and development kit capture voice commands from 3x the distance (up to 9+ meters) versus traditional beam-forming technology. 

These solutions work reliably around corners, and in noisy and reverberate environments without having to lower the playback volume from other loud or competing single-point noise sources... Just watch the video.

Quote of the Week

 “Realizing that espionage is not science fiction, but a tangible and real risk, is the first step to protect ourselves against it,” 

- Nicolas Fierens Gevaert, a spokesperson for the Belgian foreign affairs ministry. more