Some Landlords Illegally Spying On Tenants’ Stimulus Check Status

While millions are awaiting their payments to help with necessities, landlords are also eager for their tenants to receive stimulus checks, so they can pay rent. Unfortunately, some landlords have not just been waiting patiently...

In order to help Americans to track the status of their stimulus payments, the IRS and Treasury Department launched a new tool, Get My Payment. The tool provides individuals “with the status of your payment, including the date your payment is scheduled to be deposited into your bank account or mailed.”...

In order to check the status of a stimulus payment, one only needs to provide basic information, including name, date of birth, street address, and Social Security Number (SSN) ... This basic information is readily available on the dark web ... it is also readily available to many landlords through the applications that tenants complete when applying to rent a property.

You may want to speak with a lawyer to evaluate options if your landlord checks your payment status on the IRS portal. You may also want to consider filing a police report. more

7 Espionage Tricks to Avoid While Working From Home

Don't get tricked into giving away personal information. 
Why? Because this is what you use for your passwords.

1. Facebook Quizzes
   Quizzes are all over Facebook:  What does your eye color say about you? What kind of dog are you according to your zodiac sign? (Facebook says these were questions the criminals used.)


2. 10 Things About You
   As people try to connect during the stay-at-home order, they are answering cut-and-paste questionnaires from their friends. They usually start with something like “Tell me 10 things I don’t know about you” and go on to ask questions like: Who was your first love? ... Here's the problem: those are the exact same questions asked when you forget your password. So, be wary of posting the answers on social media.
   
   
3. Posting Information about Your Passwords
   People are posting all sorts of information about what’s going on at their homes with their children or with their pets. That’s fine, unless they use those same names as their passwords.


4. Photos of the Home Work Station
   At this point, people are pretty proud of their work from home stations. They have a new webcam, a makeshift desk, and maybe even a good microphone. But posting photos of that home work station might give criminals too much information. Can someone see the screen from a window? Are they giving away the brands and models of their IoT devices (which might or might not have exploitable vulnerabilities)?


5. Clicking Questionable Links
   There are a lot of questionable links on the internet. Users should be wary of sites they don’t recognize. While this is rudimentary advice, it’s a good reminder that the headline “New Pandemic Cure No One Is Talking About” likely leads to a malicious site.


6. Be Aware of What’s Public
   Savvy users have changed their Facebook and Instagram profile settings to make them more private. But as soon as you post to a group or comment on someone’s post without strong privacy settings, folks outside your friend's group can see what you’re doing. And, other sites like Twitter and Reddit are not generally private. more 

 Thanks to Jake Milstein, CI Security Inc. for compiling this list.

10 Best Spy Comedy Films, Ranked (According To IMDb)

There are better things to do other than watch CNN (Covid-19 News) 24/7.
Here are some suggestions. ~Kevin

• Mr. & Mrs. Smith (6.5)
• Burn After Reading (7.0)
• Red (7.0)
• Spy (7.0)
• Austin Powers: International Man Of Mystery (7.0)
• Top Secret! (7.2) *****
• True Lies (7.2)
• The Man From U.N.C.L.E. (7.3)
• Despicable Me (7.6)
• Kingsman: The Secret Service (7.7)

***** (Personal favorite)

A Few Others

• Spies Like Us 
• The Man Who Knew Too Little 
• The Spy Who Dumped Me
• Despicable Me 2 / 3
• My Spy 
• Johnny English / Strikes Again / Reborn
• Keeping Up with the Joneses
• This Means War
• Central Intelligence
• Kingsmen: The Golden Circle
• The Spy Next Door
• Austin Powers: The Spy Who Shagged Me / Goldmember
• Get Smart 
• OSS 117 Cairo (subtitles)
• Casino Royale
• Spy Hard
• Knight and Day
• Agent Cody Banks / Destination London
• Spy Kids / 2 / All the time in the World (kids)
• Our Man Flint / In Like Flint
• Confessions of a Dangerous Mind 
• The Tailor Of Panama
• Undercover Blues  
• Undercover Brother
• The Man With One Red Shoe
• The Tall Blond Man with One Black Shoe (subtitles)
  
• If Looks Could Kill
• Red 2
• The President's Analyst 
• Spies in Disguise (kids) 
• What’s Up, Tiger Lily?
• Gotcha! 
• Jumpin' Jack Flash
• My Favorite Spy 
• Real Men
• The Glass Bottom Boat
• The In-Laws
• Rio Rita
• A Southern Yankee
• The Tuxedo 
• One Of Our Dinosaurs Is Missing 
• Rendezvous
• The Fastest Guitar Alive (one star)

more (amazing, uh?)

Corporate Privacy & Information Security Challenges from Covid-19

This is an excellent information security article written by a respected colleague. ~Kevin
via Charles Patterson - Exec Security
The CoVid-19 response has had serious and often devastating effects on individuals and businesses throughout the world... But there are a number of side-effects from this, many of which affect privacy and information security...

Company offices may be left mostly empty with a skeleton crew, and access being granted to maintenance staff or a few lone employees who may still be carrying out basic operations or some who may have just needed to return to pick up something from their desk to help them work better from home.  This means the employees, cleaners, and other staff will be largely unsupervised and may have easy access to areas not normally permitted...

When reviewing your security during this period, here are some very important points to consider:

• How secure was your facility during the down time?
  • Note what areas were weakened, where was less manpower deployed?
• Who continued to have access?
  • What types of staff were still given access? Were employees still allowed back in?
• Were any private or classified areas left open and unattended?
  • Pay particular attention to board rooms, conference areas, and C-suites. Look for any signs of unauthorized activity.
• What incidents may have occurred during the period? 
  • Review logs of any security incidents, look for any correlations that could indicate suspicious activity.
• Were there any areas accessed by unauthorized personnel? 
  • Investigate thoroughly any reports of employees found in unauthorized areas.
• Did any break-ins or vandalism occur?
  • Security breaches or other incidents could be used as a cover for actual espionage activity. If a break-in or theft was reported, pay attention to any nearby areas that may have been accessed as well.

After returning to your offices, pay close attention to anything that has been disturbed, anything that may have been tampered with. Any indication of unauthorized access to offices or secure areas should be investigated thoroughly. Electronic sweeps of critical offices and confidential areas should be scheduled. more

How Not to be Seen - Evading CCTV Surveillance

It's theoretically possible to become invisible to cameras. But can it catch on? 



Right now, you're more than likely spending the vast majority of your time at home. Someday, however, we will all be able to leave the house once again and emerge, blinking, into society to work, travel, eat, play, and congregate in all of humanity's many bustling crowds.

The world, when we eventually enter it again, is waiting for us with millions of digital eyes—cameras, everywhere, owned by governments and private entities alike. Pretty much every state out there has some entity collecting license plate data from millions of cars—parked or on the road—every day. Meanwhile all kinds of cameras—from police to airlines, retailers, and your neighbors' doorbells—are watching you every time you step outside, and unscrupulous parties are offering facial recognition services with any footage they get their hands on.

In short, it's not great out there if you're a person who cares about privacy, and it's likely to keep getting worse. In the long run, pressure on state and federal regulators to enact and enforce laws that can limit the collection and use of such data is likely to be the most efficient way to effect change. But in the shorter term, individuals have a conundrum before them: can you go out and exist in the world without being seen?

Bottom line as of now...
All of the digital simulations run on the cloak worked with 100-percent effectiveness, he added. But in the real world, "the reliability degrades." The tech has room for improvement.

"How good can they get? Right now I think we're still at the prototype stage," he told Ars. "You can produce these things that, when you wear them in some situations, they work. It's just not reliable enough that I would tell people, you know, you can put this on and reliably evade surveillance." more

Attorney Warns Business Against Relaxing Security Standards

via Seyfarth Shaw LLP - Jeremy A. Cohen

And, of course, there are bad actors taking advantage of the current situation.

Relaxed security make systems and information far more susceptible to hacking and other data breaches, which often carry mandatory reporting obligations and hefty penalties, and invariably lead to class action lawsuits, not to mention privacy concerns.

Accordingly,  companies should think twice before loosening these security standards. By all accounts, the current COVID-19 crisis will be relatively short-lived (whether that means weeks or months is, of course, unknown), but as the saying goes, once a secret is known, it cannot be unknown.

And when this is all said and done, while courts will likely give some leeway as a result of the emergency situation, if basic safeguards were disregarded, courts may have a hard time concluding that a company undertook reasonable efforts to safeguard its information, as is required in all jurisdictions to merit trade secret protection. more

Interesting Article in Food Safety Magazine

In addition to nation-state industrial espionage, companies face a wide range of threats. 

“Hacktivists” launch attacks for ideological, political, or religious reasons, or simply for the challenge.

Criminal organizations attack for profit, trying to extract payment from the victim.

In addition, companies sometimes become victims even if they are not the intended target, such as the notpetya attack, which targeted a software company but had much broader impact, including the food and agriculture industry.

It is important to know that nation states and criminal organizations both do target corporations, and this article will provide solutions on how companies can better protect themselves. more

Zoom’s Encryption Is “Not Suited for Secrets” and Has Surprising Links To China, Researchers Discover

Meetings on Zoom, the increasingly popular video conferencing service, are encrypted using an algorithm with serious, well-known weaknesses, and sometimes using keys issued by servers in China, even when meeting participants are all in North America, according to researchers at the University of Toronto.

Related

Zoom Meetings Aren’t End-to-End Encrypted, Despite Misleading Marketing

The researchers also found that Zoom protects video and audio content using a home-grown encryption scheme, that there is a vulnerability in Zoom’s “waiting room” feature, and that Zoom appears to have at least 700 employees in China spread across three subsidiaries. They conclude, in a report for the university’s Citizen Lab — widely followed in information security circles — that Zoom’s service is “not suited for secrets” and that it may be legally obligated to disclose encryption keys to Chinese authorities and “responsive to pressure” from them.
Zoom could not be reached for comment. more


4/15/2020 UPDATE - More top companies ban Zoom following security fears. more

Guest Wi-Fi Access Comes with Risks for Organizations

Reported this week: A convicted sex offender downloaded indecent child images at a hostel where he was staying after using another resident's wi-fi code. more

In this case, a stolen access code was used to gain access. In many organizations the same guest code is given out to all guests. Sometimes it is even posted. Often it is never changed. Once the password is out, there is no telling who will access the system, or when, or for what purpose.

Downloading illegal images is only one of many guest access risks.

While hiding behind a reputable IP address unauthorized and anonymous "guests" can also conduct: drug transactions, video voyeurism, blackmail, financial scams, hacking, and more. The finger points at the organization's network. They might be legally held responsible. And, these are just the outward facing threats. Guest access can also be a pivot point to internal information theft.

Take this 15 second assessment.
Does your organization...

• Provide guest Wi-Fi access?
• Does guest access use the organization's network?
• Is access unencrypted?
• Do all guests use the same password?
• Is the password posted anywhere, as in a conference room?
• If posted, can it be seen from outside with binoculars or a drone?
• Has the password remained the same for over a month? 

If you said yes (and/or not sure) three or more times your organization needs a Wi-Fi Security Analysis.

Legal defense is expensive. Reputational damage is hard to quantify. A proactive professsional analysis is easy. Reduce risk and keep profits where they belong, in the bottom line.

8 Steps to Control Cybersecurity Risk in a Work From Home Environment

During the COVID-19 pandemic and response, workers are heading home in record numbers. In this short 23-min. webinar, CI Security CTO Mike Simon covers the the critical work-from-home cybersecurity risks that employees need help with now.


The material is geared toward InfoSec and IT professionals, technical users, and team managers.

Top 8 Work From Home (WFH) Cybersecurity Priorities...
Step 1: Control the WFH Environment
Step 2: Control the WFH Computer
Step 3: Up Your Phishing Game
Step 4: Worry About Sensitive Documents and Regulated Data
Step 5: Watch for Cyber-Threats
Step 6: Expanding VPN
Step 7: Say No to Split-Tunnels
Step 8: Keep Great Records

Remote Work, Security & Is Your Office Being Bugged While You're Home

It's a rule of thumb in cybersecurity that the more sensitive your system, the less you want it to touch the internet. But as the US hunkers down to limit the spread of Covid-19, cybersecurity measures present a difficult technical challenge to working remotely for employees... In some cases, working from home isn't an option at all...

Late last week, the US government's Cybersecurity and Infrastructure Security Agency issued an advisory to critical infrastructure companies to prepare for remote work scenarios as Covid-19 spreads...

But cybersecurity consultants who actually work with those high-stakes clients—including electric utilities, oil and gas firms, and manufacturing companies—say that it's not always so simple. For many of their most critical customers, and even more so for intelligence agencies, remote work and security don't mix. more

Special note to the business community...
Planting bugs is easy when your offices are empty. Business espionage types know this. 

Quality TSCM sweep teams will be in demand and hard to book when Covid-19 subsides. Prepare now. Put your team on retainer. 

If you don't have a quality provider contact us. We'll create a back-to-work inspection strategy, and a no-obligation estimate for you.  ~Kevin

Will Working from Home Increase Business Espionage Opportunities

I received a question today about inductive coupling; gleaning computer data leaked on to power lines (aka, mains) from keyboards, screens, etc. The person mentioned this was possible if the residences shared the same power transformer.

"So, does the increase in work-from-home offices these days increase the business espionage threat?"

Interesting question. Got me thinking.

I replied...
You're correct about sharing a transformer. Information can be induced onto the mains and intercepted on that side of the circuit. Several floors in an apartment building and usually 3-4 homes in a residential neighborhood can share one transformer.

But, let's think this through...
Back before we all became computerized the mains lines were relatively noise-free. Carrier-current bugs and wireless intercoms worked quite well for transmitting audio. These days, the noise level is a digital cacophony, created by everyone who shares the circuit.

The very low signal level a keyboard might contribute would be difficult to hear. Segregating the signal from other digital noise would also be a challenge. With diligence and the right instrumentation deciphering this digital data is doable. It would not be a nosy neighbor doing this. If you got that far, you're probably a government and the home worker has a bigger than average problem.

Realistically speaking...
A fairly static group of mains users also reduces risk. Your neighbors aren't deep cover spies who have waited years for the chance you might be forced to work from home. Moving into a neighborhood or apartment building with spying intentions is possible, but not easy to do on a moments notice. There are easier ways to obtain even more information, with a lot less work, and greater chance of success.

Worry about these things...
The weak links in a home office are: the computer, wireless keyboards, Wi-Fi, and internet modems. Current versions of wireless keyboards use Bluetooth (30 foot range) with some pretty good security features. As for date leaking onto the mains... Most smart people use a UPS battery backup with filtering for their computers, so no problem there. For anyone without a UPS getting one is a very worthwhile recommendation for multiple reasons.

Threats the average home office faces...

• shared cable internet, 
• Wi-Fi signal hacking, 
• spyware viruses (data, audio and video compromise), 
• Wi-Fi connected printer intercepts, 
• information phishing scams, 
• and none of the usual enterprise type protections. 

Attacks can be instituted by anybody, some staged from anywhere. Being on one side of a transformer isn't necessary. No need to tap the mains.

Imagine this...

• Step #1: The spy purchases a USB Rubber Ducky (to crack into the computer) and an o.mg cable (to crack into the smartphone). Total cost: <$200.00.
• Step #2: Spy plops these into an old Amazon box and mails it to "the mark."
• Step #3: Mark goes, "Wow, cool. I didn't order this. Amazon must have screwed up. Not worth sending back. I'll keep it."
• Step #4: Mark plugs this windfall into his computer and phone.
• Step #5: Gotcha! 

Think this isn't already happening? Think again. The USB Rubber Ducky is now on backorder.

Your company needs to have a technical security consultant on retainer—because there is more to know.

The Best Way to Sumggle a Filing Cabinet of Secrets

An American citizen will spend the next four or so years behind bars in the US for smuggling corporate secrets out of the states to his spymasters in China.

A federal district judge this week sentenced Xuehua Edward Peng, 56, of Hayward, California, after he admitted handing over the trade secrets to Beijing. Peng earlier confessed that SD cards loaded with information stolen from an unspecified US company were left for him to collect at hotels by a contact only known as Ed.

Peng would also hide tens of thousands of dollars in hotel rooms for Ed to collect as payment. Lawyers said Peng spent years trafficking confidential info. more

Flashback to 2009 when we made a point about this vulnerability... 

How to Delete Your Personal Information From People-Finder Sites

While some sites might have a link for removing personal information, the actual process could be convoluted.

Spokeo is, perhaps, the simplest. You just find your profile page on the site, go to spokeo.com/optout, and then type (or paste) the link along with your email address so you can confirm.

Others are not as straightforward. At Whitepages, you have to paste the URL to your profile at whitepages.com/suppression_requests, and then type the reason you want to opt-out. After that, you have to provide your phone number—yes, you have to give a data broker your phone number. You then receive a call from a robot, which gives you a verification code you have to type on the website to complete the process.

The ultimate indignity? 411.info actually charges a fee if you want it to remove your info. more

NIST - Detecting and Responding to Ransomware and Other Destructive Events

In response to growing ransomware attacks on businesses and governments small and large, the National Institute of Standards and Technology (NIST) has released draft guidelines to help organizations prepare for “data integrity cybersecurity events” that threaten their operations...

The free guide, which will be available for public comment through Feb. 26, focused specifically on potential tool sets for mitigating and containing cybersecurity attacks as well as what strategies security teams could adopt to respond...

Security teams and organization leaders can read the full report and provide public comment through NIST’s website. more

Android Users Beware: These Top Camera Apps May Secretly Be Spying

The latest warning has come from the research team at CyberNews, exposing “camera apps with billions of downloads [that] might be stealing user data and infecting them with malware.”

...But that’s exactly what some of the top beauty camera apps have been found guilty of doing. more

1. BeautyPlus – Easy Photo Editor & Selfie Camera
2. BeautyCam
3. Beauty Camera – Selfie Camera
4. Selfie Camera – Beauty Camera & Photo Editor
5. Beauty Camera Plus – Sweet Camera & Makeup Photo
6. Beauty Camera – Selfie Camera & Photo Editor
7. YouCam Perfect – Best Selfie Camera & Photo Editor
8. Sweet Snap – Beauty Selfie Camera & Face Filter
9. Sweet Selfie Snap – Sweet Camera & Beauty Cam Snap
10. Beauty Camera – Selfie Camera with Photo Editor
11. Beauty Camera – Best Selfie Camera & Photo Editor
12. B612 – Beauty & Filter Camera
13. Face Makeup Camera & Beauty Photo Makeup Editor
14. Sweet Selfie – Selfie Camera & Makeup Photo Editor
15. Selfie camera – Beauty Camera & Makeup camera
16. YouCam Perfect – Best Photo Editor & Selfie Camera
17. Beauty Camera Makeup Face Selfie, Photo Editor
18. Selfie Camera – Beauty Camera
19. Z Beauty Camera
20. HD Camera Selfie Beauty Camera
21. Candy Camera – selfie, beauty camera & photo editor
22. Makeup Camera-Selfie Beauty Filter Photo Editor
23. Beauty Selfie Plus – Sweet Camera Wonder HD Camera
24. Selfie Camera – Beauty Camera & AR Stickers
25. Pretty Makeup, Beauty Photo Editor & Selfie Camera
26. Beauty Camera
27. Bestie – Camera360 Beauty Cam
28. Photo Editor – Beauty Camera
29. Beauty Makeup, Selfie Camera Effects & Photo Editor
30. Selfie cam – Bestie Makeup Beauty Camera & Filters

"I found this thing. Is it a bug?"

At Murray Associates we occasionally receive calls asking, "I found this thing. Is it a bug?"

Usually, the identification is easy:

• it's a piece of electronic jewelry (blinky earring, or pin); 
• an old annoy-a-tron; 
• or Bluetooth tag, like a Tile item finder.

Today, a call comes in from a well-respected private investigator in Boston. He has a corporate client whose employee "found this thing."

She takes a photo, sends it to him, who sends it to us... via low resolution text message...

Rough guess...
A Bluetooth item finder, similar to a Tile, but a Chinese knockoff branded with some corporate logo. Possibly a promotional item?

We later learned it was in her bedroom, mounted to the wall, not found in a covert location. She had pulled it off the wall to take the photo. We did not receive a photo of the mounting piece, or a mention of its placement.

Later we eventually received a photo of the flip side...

Hummm... not too helpful, but no evidence of on the front of a pinhole for video, or a microphone on the circuit board. No battery seen, but the two large solder tabs and circles on the circuit board indicate there is a battery on the other side of the board.

Why would someone mount something like this on a bedroom wall?!?!

One possibility emerged... "How to find your lost iPhone with Tile."

Nope. Tiles have their logo on them. Ours looks different.

Another possibility... Yahoo changed their logo last Fall.

Could they have sent out a promotional "Tile" with their newly designed exclamation point logo on it?

Close, but no prize.

Okay, let's start fresh.
Say, the Tile is a MacGuffin.
Look elsewhere.

What other wall-warts do we know of?
HVAC sensors, for one.

Google search....

Ah ha.... that's what this thing is. 
Case closed.

This was a good investigative process refresher for us, and a thing we will all remember next time "this thing" shows up.

Extra Credit:

• If you find a thing and think it's a bug, read this.
• To learn about the other Thing—the famous spy eavesdropping device—read this.

~Kevin

Spybuster Tip #632: Fortify Your Two-factor Authentication

Two-factor authentication is a must, but don't settle for the SMS version. Use a more secure authenticator app instead.

 The most popular authenticator apps are Google Authenticator and Authy, but password managers 1Password and LastPass offer the service as well, if that helps you streamline. If you're heavy into Microsoft's ecosystem, you might want Microsoft Authenticator. While they all differ somewhat in features, the core functionality is the same no matter which one you use. more

The Art of Investigation (book)

The Art of Investigation examines the qualities required to be a professional, thorough, and effective investigator. As the title suggests, it delves into more than the steps and procedures involved in managing an investigation, it also covers the "soft skills" necessary to effectively direct investigations and intuit along the way.

The editors and contributing authors* are the best in their field, and bring a wealth of real-world knowledge and experience to the subject. There are several publications available on the nuts-and-bolts of the process and stages of an investigation. That ground has been covered. However, little has been published on the investigative skills required, the traits necessary, and the qualities endemic to an inquisitive mind that can be cultivated to improve an investigator’s professional skill-set.

Each chapter discusses the applicability of the traits to the contributor’s own work and experience as an investigator. more
*Robert Rahn (Lt. Ret.) is one of the excellent contributors.

ISBN-13: 978-1138353787

ISBN-10: 1138353787

U.S. Securities & Exchange Commission Issues Guidance on IP and Tech Risks

...Among the risks faced by companies is the risk of theft of technology, data and intellectual property through a direct intrusion by private parties or foreign actors, including those affiliated with or controlled by state actors.


While not exclusive, examples of situations in which technology, data or intellectual property may be stolen or compromised through direct intrusion include cyber intrusions into a company’s computer systems and physical theft through corporate espionage, including with the assistance of insiders... more