Proof the Surveillance Society is Making us Crazy - CV Dazzle

This is how bad things are getting...

"The NSA made me slather my face in make-up... I had slathered the paint on my face in order to hide from computers. The patterns in which I applied the paint were important: To the pixel-calculating machinations of facial recognition algorithms, they transformed my face into a mess of unremarkable pixels. In the computer’s vision, my face caused a momentary burst of confusion. That’s why the patterns are called computer vision dazzle (or CV dazzle). When it works, CV dazzle keeps facial-recognition algorithms from seeing a face...

...more unexpected was what CV dazzle taught me about the physical world. It reminded me of another tech experiment I’d undertaken: 

My phone’s Reminders app can tie a message to a specific place, it triggers an alert tone every time a user comes within 500 feet. I’d tried tying these reminders to a different kind of location—the 176 embassies and diplomatic missions in Washington, D.C. Whenever I got within a couple hundred feet of one, my phone sent me a little ping: “Iceland.” “Thailand.” “Equitorial New Guinea.”...

...here is the essence of CV dazzle’s strangeness: The very thing that makes you invisible to computers makes you glaringly obvious to other humans."  (more) (official site cvdazzle.com)


Blank Reg would have loved this.

How do the FBI and Secret Service know...

...your network has been breached before you do?
 
Knock, knock! Secret Service here. "Is this your customer payment card data?"

By all accounts, many of the massive data breaches in the news these days are first revealed to the victims by law enforcement, the Secret Service and Federal Bureau of Investigation (FBI). But how do the agencies figure it out before the companies know they have been breached, especially given the millions companies spend on security and their intense focus on compliance?

The agencies do the one thing companies don’t do. They attack the problem from the other end by looking for evidence that a crime has been committed. Agents go undercover in criminal forums where stolen payment cards, customer data and propriety information are sold. They monitor suspects and sometimes get court permission to break into password-protected enclaves where cyber-criminals lurk. 

They have informants, they do interviews with people already incarcerated for cybercrime, and they see clues in the massive data dumps of information stolen from companies whose networks have been breached. (more)

Facilities Managers: Everything You Need to Know about Counterespionage Bug Sweeps

You know everything about managing facilities, but a request from management to debug your building can throw even the most seasoned FM for a loop. With the help of an outside professional, you can ensure speech privacy and business security.

Business espionage is a growing concern, yet it’s mistakenly thought of as an IT department problem. The reality is that the information IT protects is vulnerable to theft long before it is put into the computer – what people talk about and with whom provides the most valuable information.

Electronic eavesdropping has also become cheap and easy. Spy gadgets, such as bug transmitters, micro voice recorders, and covert video cameras, were once expensive and hard to come by. All are now available online for under $100. Some even use Wi-Fi, Internet, and cell phone networks as communication conduits.

Because building owners are focused on physical security, the chances are slim that a corporate spy will be detected or caught. A technical information security survey, however, can put an end to electronic eavesdropping and remote surveillance. (more) P.S. If you like the article, please give it a nice star rating, and have it help others via a social media plug. Thank you.

TSCM Find Confirmed - Three Bugs Found in Jakarta Governor's Home Office

Indonesia - Jakarta Governor, Joko `Jokowi` Widodo confirmed the bugging device findings at his home office... 

Jokowi stated that the findings of some bugging devices in his home office was found using a detector device in December 2013...

He described, those bugging devices were found in three different places, such as bedroom, private living room, and dining room used to hold meetings "Actually, I don`t want to talk about this. But in fact there are three devices in the home office found," he disclosed. (more)

FutureWatch: When Light Bulbs Become Eyeballs

Visitors to Terminal B at Newark Liberty International Airport may notice the bright, clean lighting that now blankets the cavernous interior, courtesy of 171 recently installed LED fixtures. But they probably will not realize that the light fixtures are the backbone of a system that is watching them. 

Using an array of sensors and eight video cameras around the terminal, the light fixtures are part of a new wireless network that collects and feeds data into software that can spot long lines, recognize license plates and even identify suspicious activity, sending alerts to the appropriate staff...

Fred H. Cate, director of the Center for Applied Cybersecurity Research at Indiana University, described the potential for misuse as “terrifying.” ...

The light fixtures are outfitted with special chips and connect to sensors, cameras and one another over a wireless network. Data that is collected — say, a particular car pulling up to the terminal — can then be mined and analyzed for a broad range of applications...

“No one really wanted the smartphone 20 years ago because they didn’t know they could have it,” said Fred Maxik, founder and chief technology officer of Lighting Science Group, which manufactures LEDs. “And I think the same is true of lighting today: No one knows what lighting is going to be capable of.” (more)

Totally Invasive Video Surveillance Can Be Good For You

The US Food and Drug Administration (FDA) has now approved a device for use after an incomplete procedure (colonoscopy) that is minimally invasive and can achieve similar imaging results to a colonoscopy. PillCam Colon is a pill-sized camera that is swallowed and passes through a patient's gastrointestinal tract.

The device itself is a pill-sized video camera measuring 12 x 33 mm (0.47 x 1.3 in) that captures color video from both of its ends at 4 or 35 frames per second. An LED provides the necessary illumination for image capture and, once swallowed by the patient, it wirelessly relays footage to a recording device worn by the patient for approximately 10 hours. (more)

Think Changing Your SIM Card Can Mask Who You Are? Think Again

Tech-savvy criminals try to evade being tracked by changing their cellphone's built-in ID code and by regularly dumping SIM cards. But engineers in Germany have discovered that the radio signal from every cellphone handset hides within it an unalterable digital fingerprint — potentially giving law enforcers a simple way of tracking the handset itself.

Developed by Jakob Hasse and colleagues at the Technical Univ. of Dresden the tracking method exploits the tiny variations in the quality of the various electronic components inside a phone.

When analogue signals are converted into digital phone ones, the stream of data each phone broadcasts to the local mast contains error patterns that are unique to that phone's peculiar mix of components. In tests on 13 handsets in their lab, the Dresden team were able to identify the source handset with an accuracy of 97.6 percent. (more)

You’ve Nicked Hackers... Now Expose the Buggers

UK - Phone hacking is a crude but preventable means of invading someone’s privacy.

You can go to jail for it — and many journalists face this risk as they await trial.

By comparison, breaking into a telecoms substation, plugging into a landline and intercepting private phone calls and computer traffic is a really serious crime.

Yet while those journalists were arrested at dawn and charged after long periods on police bail, nobody has been arraigned for bugging despite evidence over many years.

The difference between the two offences is important.

Hacking is opportunistic eavesdropping. Bugging is nothing less than espionage.

Once a bug is attached by stealth, it can monitor every spoken word and keystroke without the subscriber ever knowing.  (more)

Mobile Security Apps Perform Dismally Against Spyware

via Josh Kirschner at Techlicious...

Mobile spyware can have a devastating effect on your life; the constant fear that a spouse, significant other or even employer is following your every move, knows everything about your life and has completely removed any vestige of privacy...

And spyware is not as rare as you may think. According to mobile security company Lookout, .24% of Android phones they scanned in the U.S. had surveillance-ware installed intended to target a specific individual. Sophos reports a similar .2% infection rate from spyware. If those numbers hold true for Android users in general, that would mean tens of thousands could be infected.

I set out to test the leading Android anti-malware vendors to see how they fared at protecting us against the threat of spyware...

The results, generally speaking, were dismal. Of twelve products I tested, none was able to detect more than two-thirds of the samples. Many missed half or more of the spyware apps. And, surprisingly, the potential spyware apps least likely to be detected were those widely available in Google Play. (more)

Josh did an excellent job researching this topic and we thank him for publicly exposing the flaws. 

Now, what can be done about really detecting spyware?

Murray Associates was approached by two clients several years ago who had come to the same conclusion as Josh via their own research. They asked us to develop a solution – based on the following conditions:
  1. The solution must make quick and reasonable spyware evaluations. 
  2. No special forensic tools should be required. 
  3. No special skills should be necessary.
  4. No assistance should be necessary once the initial training is over. The phone owner must be able to conduct the test him- or herself—anytime, anyplace.
  5. Advancements in spyware software and cell phone hardware should not render the test ineffective.

The results of this project are published in the book, "Is My Cell Phone Bugged?", and are used in SpyWarn 2.0, a unique Android spyware detection app.

Android Malware that Gives Hackers Remote Control is Rising (Technical but important news.)

via... Sean Gallagher - Ars Technica 
Remote access tools have long been a major part of targeted hacker attacks on individuals and corporate networks. RATs* have been used for everything from hacking the e-mail boxes of New York Times reporters to capturing video and audio of victims over their webcams. Recently, wireless broadband and the power of smartphones and tablets have extended hackers’ reach beyond the desktop. In a blog post yesterday, Symantec Senior Software Engineer Andrea Lelli described the rise of an underground market for malware tools based on Androrat, a remote administration tool that can give an attacker complete control over devices running the Android OS.

Androrat was published on GitHub in November 2012 as an open source tool for remote administration of Android devices. Packaged as a standard Android application (in an APK file), Androrat can be installed as a service on the device that launches at start-up or as a standard “activity” application. Once it’s installed, the user doesn’t need to interact with the application at all—it can be activated remotely by an SMS message or a call from a specific phone number.

The app can grab call logs, contact data, and all SMS messages on the device, as well as capture messages as they come in. It can provide live monitoring of call activity, take pictures with the phone’s camera, and stream audio from the phone’s microphone back to its server. It can also post “toasts” (application messages) on the screen, place phone calls, send text messages, and open websites in the phone’s browser. If it is launched as an application (or “activity”), it can even stream video from the camera back to the server.

Hackers have taken Androrat’s code and run with it. Recently, underground marketplaces for malware have begun to offer Androrat “binder” tools, which can attach the RAT to the APK files of other legitimate applications. When a user downloads what appears to be a harmless app that has been bound to Androrat, the RAT gets installed along with the app without requiring additional user input, sneaking past Android’s security model. Symantec reports that analysts have found 23 instances of legitimate apps that have been turned into carriers for Androrat. The code has also been incorporated into other “commercial” malware, such as Adwind—a Java-based RAT that can be used against multiple operating systems.

Lelli said that Symantec has detected “several hundred” cases of Androrat-based malware infections on Android devices, mostly in the US and Turkey. But now that binders are available to anyone willing to pay for them, the potential for infection to spread is growing rapidly. (more)

*Spybusters Countermeasure: Android app SpyWarn detects RAT spyware activity. (http://tinyurl.com/SpyWarnApp)

TSCM Bug Sweep Cost Question & Infrared Instrumentation Example

Security Director: "When I ask for TSCM bug sweep quotes I get some prices which seem incredibly low. Shouldn't everyone be in the same ballpark?"

Answer: There are many reasons for this. Most revolve around skimping by the vendor — on everything from insurance to training to instrumentation.

Let's look at one representative example, thermal imaging...

Most TSCM providers these days offer thermal imaging as a detection technique. The skimpers use ineffective, cheap cameras – just so they can claim this capability. It is a dishonest marketing ploy which lets skimpers "say" they are in the game.

Cost:
• Outdated and low-end utility thermal cameras are available on ebay for less than $2,000.
• High-sensitivity / resolution thermal cameras cost between $25,000-$50,000.

DIY Test:
A TSCM-capable infrared thermal camera will clearly show heat from a fingerprint after an object has been lightly and briefly, touched.

Generally speaking, low-cost equals low probability of detection. Effective TSCM service costs are driven by capital / educational investment... and sincere commitment.

Moral: A cheap sweep is worse than no sweep. Bugs aren't eliminated, just your sense of caution, and budget.

[sotto voce] If you like cartoons, hire a clown.

Wi-Vi Sees Movement Behind Walls Using Cheap Wi-Fi Tech

A new system allows researchers to track up to three separate people through a wall, solely with the help of low-power Wi-Fi signals.

The Wi-Vi system relies on two antennas to broadcast Wi-Fi signals and a receiver to read them, according to the researchers’ paper. The Wi-Fi signals degrade in quality each time they pass through a wall, so the receiver must be prepared to pick up on very weak signals. It is also quickly overwhelmed if there are too many to sort through...

 
Researchers think the Wi-Vi system could also be used to find survivors in destroyed buildings or count and track criminals. Compared to previous military-oriented tracking systems, Wi-Vi is cheap, compact and lightweight, which makes it practical for consumer uses such as personal safety. (more)

They Know Who You Are... and it ain't the NSA!

Many Internet advertisers rely on cookies, digital code stored on your browser. Some websites place multiple cookies when you visit, allowing them to track some of your activity over time (you can see who is tracking you by installing an application such as Ghostery or Abine’s “DoNotTrackMe”).

The problem for marketers is that some users set their browsers to reject cookies or quickly extinguish them. And mobile phones, which are taking an increasing chunk of the Web usage, do not use cookies.

To combat the cookie’s flaws, advertisers and publishers are increasingly turning to something called fingerprinting. This technique allows a web site to look at the characteristics of a computer such as what plugins and software you have installed, the size of the screen, the time zone, fonts and other features of any particular machine. These form a unique signature just like random skin patterns on a finger...

Fingerprinting may prove a more robust tracking technology than cookies because the user’s identify endures even if they erase their cookies. Making changes to your software and settings only makes you more identifiable, not less. An EFF study several years ago found that it is easy to track when someone changes their profiles by adding software updates, for example. You can see what details your computer is transmitting right now by visiting this site. (more)

Try it. You'll be amazed. ~Kevin

Laser Beam Eavesdropping - The Trinidad and Tobago Case

Trinidad and Tobago ‎- At the height of the Section 34 controversy, a sophisticated laser spying device was discovered in the Office of the Director of Public Prosecutions (DPP), Roger Gaspard, SC. T&T Guardian (newspaper) investigations revealed the device was detected in November last year inside the conference room of the DPP’s office at the Winsure Building, Richmond Street, Port-of-Spain. Gaspard offered no comment on the matter when contacted by the T&T Guardian on Wednesday. Investigations revealed the device was detected after a search was carried out by both foreign and local information technology (IT) experts on the fifth floor of the building.

The T&T Guardian learned that an invisible infrared beam that is used to transmit conversations was found in the conference room, which is where the DPP normally holds briefings on various high-level cases involving past and former government officials and other matters such as the Calder Hart probe and the Clico enquiry. The conference room is also used when the advice of the DPP is sought by police officers on homicides and other criminal offences. On Monday, Opposition Leader Dr Keith Rowley, during debate of a no-confidence motion laid by him against Prime Minister Kamla Persad-Bissessar and her Government, revealed 31 e-mails, one of which referred to a plan to spy on the DPP during the Section 34 debacle and to offer him a judgeship so as to be able to replace him in the office...

The bug at the DPP’s office was discovered after Gaspard received a tip-off and arranged for his office to be swept for spying and bugging devices by highly-qualified IT experts. The IT experts detected beams that showed a laser was being used to spy on the DPP’s conversations. One of the IT specialists who was part of the exercise revealed, “They detected certain rays that showed a laser was being used to spy on the DPP. “Someone can stay from the Port-of-Spain International Waterfront Centre and once they have a straight line of sight, and using the laser device, the conversations of the DPP can be heard.” The T&T Guardian understands the find sent shockwaves through the DPP’s office and steps have been taken since then to conduct frequent independent security sweeps of the building to ensure it is clean of such devices.

...there have been calls for an independent investigation. (more)

Even though the details are sketchy, I can think of about four good reasons why this particular "find" might be baloney. Laser listening systems have been built and patented, however, physics still makes this type of eavesdropping very difficult in the field. Read up on laser beam eavesdropping here. ~Kevin

How to Bug an Entire Country - Drop Poop & Rocks

During the Cold War, both sides liberally used the “bug”--the remote listening device--to surreptitiously get wind of what the other side was up to by listening in on a room, a building, or, in the case of East Berlin, an entire city.

Click to enlarge

But in America’s cooling war in Afghanistan, U.S. forces may undertake what could be the biggest bugging operation of all time, planting sensors all over the entire country that could feed the U.S. military intelligence from inside that country for the next two decades. It’s the rough equivalent of bugging an entire country.


The palm-sized devices at the U.S. military’s disposal aren’t listening devices per se, but they would detect anyone moving nearby and report the movement back to an intelligence outpost, letting special operators know when a remote mountain pass or a known smuggling trail is being utilized. Some of the sensors could be buried, others disguised as rocks or other geological artifacts. 

CIA monkey poop sensor - Vietnam era.

The point is, they would be littered all across Afghanistan’s landscape, a lingering legacy of a decade-long conflict that would last 20 years more. (more)

Interesting Security Technologies - Sunpass Bug & Butterfly Authentication

Doug Blakeway, President & CEO, Nanotech Security Corp., reveals new surveillance technologies in the company's Annual Report...

(from their subsidiary) "The CTR-1300 JOEY, a disguised Variable Power Audio Transmitter Utilizing a new LiPo internal battery and incorporated into the Garage Door Opener, EZ Pass, and Sunpass as disguises."

and, the latest in anti-counterfeiting technology...

Click to enlarge.

"Nanotech is developing what it sees as a highly sophisticated and commercially viable nanotechnology for use in anti-counterfeiting as well as product and document authentication. It will potentially be used to authenticate a huge range of items, including currency, legal documents and commercial products.
 
The specialized optical features are comprised of arrays of hundreds of millions of nano-holes–implanted directly onto various substrates and which emit unique light signatures that we believe cannot be reproduced by a counterfeiter.  

KolourOptics® is the trade name for this revolutionary authentication feature which produces nano-scale surface structures similar to those found on the wings of the iridescent blue Morpho Butterfly.
 
The features can be directly applied to banknotes and other valuable documents and products and will produce light signatures are both “overt” (visible to the naked eye) and some that are “covert” (machine readable only)." (more)

Cell Phone Fingerprinting - GPS Tells WHO You Are

Can you be identified only by where you take your phone? Yes, according to a new study, which finds it's not very hard at all.

While most of us are free to go wherever we want, our daily and weekly movement patterns are pretty predictable. We go to work, to school, to church, to our neighborhood gym, grocery store or coffee shop, and we come home -- all quietly tracked by the GPS in our phone.

Click to enlarge.

And with nothing more than this anonymous location data, someone who wanted to badly enough could easily figure out who you are by tracking your smartphone. Patterns of our movements, when traced on a map, create something akin to a fingerprint that is unique to every person.
 
"Four randomly chosen points are enough to uniquely characterize 95% of the users (ε > .95), whereas two randomly chosen points still uniquely characterize more than 50% of the users (ε > .5). This shows that mobility traces are highly unique, and can therefore be re-identified using little outside information."

Those are the findings of a report by researchers from MIT and elsewhere, published this week in the journal Scientific Reports. (more)

Pwn Pad - Use it IT, Before it is used against IT

The folks at security tools company Pwnie Express have built a tablet that can bash the heck out of corporate networks. - Wired Magazine

The Pwn Pad - a commercial grade penetration testing tablet which provides professionals an unprecedented ease of use in evaluating wired and wireless networks.

The sleek form factor of the Pwn Pad makes it an ideal product choice when on the road or conducting a company or agency walk-through. This highspeed, lightweight device, featuring extended battery life and 7” of screen real estate offers pentesters an alternative never known before. (more)

TOOLKIT INCLUDES:
Wireless Tools
Aircrack-ng
Kismet
Wifite-2
Reaver
MDK3
EAPeak
Asleap-2.2
FreeRADIUS-WPE
Hostapd
Bluetooth Tools:
bluez-utils
btscanner
bluelog
Ubertooth tools Web Tools
Nikto
Wa3f Network Tools
NET-SNMP
Nmap
Netcat
Cryptcat
Hping3
Macchanger
Tcpdump
Tshark
Ngrep
Dsniff
Ettercap-ng 7.5.3
SSLstrip v9
Hamster and Ferret
Metasploit 4
SET
Easy-Creds v3.7.3
John (JTR)
Hydra
Medusa 2.1.1
Pyrit
Scapy

" I heard that law enforcement has some sort of scanner that...

...tells them if a car has a large amount of money and then proceed to pull the car over where they eventually confiscate the cash. Is there really a "money scanner" like that?"

I get a lot of strange questions. 

This one was particularly intriguing.

Answer
For now, this appears to be an urban legend.
However, developing a technique to do this is on their radar screen...
"As U.S. financial institutions continue to improve legislation that reduces money laundering, criminals with large quantities of cash have shifted their focus to bulk currency smuggling, making deposits in foreign banks. Current DHS and law enforcement technologies catch only a fraction of the currency passing through the ports and borders. To date, a dedicated currency detector has never been developed. Lattice Government Services (LGS) will work with the University of Washington to define requirements and a Concept of Operations, research gaseous chemical detection, and physical spectral/magnetic detection technologies, and down select ideal systems..." (more)

From the fine state that brought you the light bulb, tetracycline, the visible-light lasers, bubble wrap, oral ACE inhibitors and the TV dinner...

"Paul Burgess, the chief executive of New Jersey-based Lattice Inc, the parent of Lattice Government Services, described challenges: “it isn’t just currency moving through an airport, a body scanner will pick that up. The bigger problem is at border crossings. You can put money in a side door and it’s going to be very difficult to detect."

As of May, 2011 we know that...

"DHS will soon begin reviewing the companies’ reports to decide whether there are any ideas worth pursuing, Verrico said. If the agency decides to move forward, one or more prototypes will be built and field-tested. “We will evaluate them over the next 30 to 60 days before we make any further decisions on ‘phase two,’” he said.” (more)


Stay tuned.

Personally, I think money detection will eventually be accomplished by embedding micro-RFID chips into the paper. Of course, the countermeasure would then be to carry money in a shielded container or wallet. 

Perhaps "smell" is the answer. Dogs are slow and scarce. But, these problems are being worked out...
 
"Tai Hyun Park and Seunghun Hong, of Seoul National University, with their colleagues, recreated a simplified version of the detecting cells in a dog’s nose using tiny bubbles made from cell membrane." 

They are working on artificial noses in Japan and Germany, too. You can buy an electronic nose today from Alpha MOS, but it is not portable enough for sniffing out money. The Cyranose 320 is portable but doesn't know what money smells like. We'll check back with you folks later.

Got any ideas for money detection?  
Send them (along with a case of M&M's) to:
"Show me the money!"
PO Box 668
Oldwick, NJ 08858

Forensically Find Fake Photos Fast - Further Discussion

As most readers of the Security Scrapbook know, I do not sell products, nor do I profit in any way from items brought to your attention. The sole purpose when mentioning a product is to inform and educate. Sometimes, my readers provide additional insights and information. This helps all of us.

The other day I posted, "Fourandsix Technologies, Inc. has introduced their first product, FourMatch, which instantly distinguishes unmodified digital camera files from those that may have been edited." Wow! Cool stuff. Gimme, gimme.

Reality Check...
While this statement is technically accurate, one reader cautions that the company's other marketing information may lead one to expectations the product can not fulfill.

Read the review by Jim Hoerricks, and the response by Kevin Connor of Fourandsix Technologies, Inc.. Their discussion is very useful and illuminating, especially if you are in need of this technology.

P.S. The answer to the last "What's wrong with this picture?" (Rolling Stones album cover) is... "Former Rolling Stones’ bassist Bill Wyman was digitally removed from the cover..."

Next up...

What's wrong with this picture?