DHS Whimps Out on IoT Protections

On November 15, the US Department of Homeland Security (DHS)

issued guidance to help stakeholders account for security in the development, manufacturing, implementation, and use of IoT devices.

The set of nonbinding principles and suggested best practices for IoT device security includes the following... more

Come on, DHS. Talk to Congress about regulations. ~Kevin

Brooklyn Prosecutor Allegedly Wiretapped Cop Love Interest's Cell Phone

NY - A Brooklyn assistant district attorney was arrested this week for allegedly wiretapping two cell phones so she could hear conversations between a cop love interest and another woman.

According to a criminal complaint, Tara Lenich, 41, forged judges' signatures to authorize the wiretapping of the aforementioned unidentified cop's cell phone, as well as a phone belonging to an unidentified woman. Lenich, who was in charge of the Violent Criminal Enterprises Bureau at the DA's office, may have been romantically attached to the cop, and tabloid reports speculate the wiretapped woman was his new love interest.

The complaint says Lenich forged warrants related to the wiretapping at least 20 times, using different judges' names, between August 20, 2015 and November 25, 2016. Lenich allegedly called the wiretapping a "secret outside investigation" when discussing it with colleagues. more

Basic Spy Tradecraft: "Beware of pretty faces that you find..."

A German spy's romantic time in Latvia has ended up in a Munich court. The love-struck agent has lost his job, and a court case. 

A German spy fell in love with a Latvian woman in Riga and lost his job for violating policy. He has lost a legal battle against the BND intelligence agency.

The unnamed spy dated a Latvian woman while station chief in Riga, despite being instructed against having romantic relations with locals. Instead of informing the BND, he asked Latvia's intelligence agency to run a background check on his girlfriend, who came up clean.

Only after the Latvian woman had moved in with him did the station chief inform his superiors. That landed him in hot water, leading the BND to recall the spy and find him unfit for duty.

The man then sought compensation from the BND for lost earnings and other losses to the tune of 400,000 euros ($421,920). more sing-a-long

50% of Email Users Deserve the Problems They Create

Security experts often talk about the importance of educating people
about the risks of "phishing" e-mails containing links to malicious websites. But sometimes, even awareness isn't enough.  

A study by researchers at a university in Germany found that about half of the subjects in a recent experiment clicked on links from strangers in e-mails and Facebook messages—even though most of them claimed to be aware of the risks. more

Mayor Charged: Strip Poker, Alcohol, Eavesdropping... with minors

CA - Stockton Mayor Anthony Silva was arrested Thursday at his youth camp on charges that he played strip poker with a minor and provided youngsters with alcohol, according to authorities...

http://documents.latimes.com/complaint-against-stockton-mayor-anthony-silva/

The 42-year-old mayor stands accused of one felony count of making an illegal recording and one misdemeanor count each of providing alcohol to a minor, cruelty to a child by endangering their health and contributing to the delinquency of a minor...

Amador County District Attorney Todd Riebe said the strip poker game occurred in Silva’s bedroom at the camp.

According to prosecutors, one of the participants was a 16-year-old boy. Prosecutors alleged that the audio was recorded secretly and that a “surreptitious recording clearly indicates that the participants did not want to be recorded.”

Witnesses also informed FBI agents that Silva provided alcohol to the poker game participants, all of whom were underage. Witnesses stated also that Silva had supplied alcohol and made it available to a number of underage counselors at the camp, according to officials.

Included in the evidence were details of a prior episode in which Silva audiotaped a conversation with a Stockton city employee without their consent, officials said. Prosecutors said that another witness told investigators that Silva had cameras installed in his bedroom and at the Stockton Kid's Club. more

Judge Flicks Off Uber and its Phony Private Eye

A strange side-show battle over snooping charges came to an end Monday when a judge in federal court ruled that Uber Technologies and its CEO Travis Kalanick could not use background information it dug up on a passenger who brought a price-fixing suit against Kalanick.

Courtesy of Thinkgeek

Judge Jed Rakoff said Ergo, the Manhattan-based firm Uber hired to conduct the investigation into the plaintiff and his lawyer, "engaged in fraudulent and arguably criminal conduct." Ergo was not licensed to conduct private investigations in New York state and its operative interviewed subjects under phony pretexts. He may also have violated state laws by taping the interviews without subjects' consent.

"It is a sad day," Rakoff began the 31-page opinion, "when, in response to the filing of a commercial lawsuit, a corporate defendant feels compelled to hire unlicensed private investigators to conduct secret personal background investigations of both the plaintiff and his counsel."

Uber declined to comment. more

Spies Gone Wild, or "Dude, where's MY car?"

This is the moment newly qualified Russian spies parade a cortege of black Mercedes Gelandewagens through the streets of Moscow while blasting their horns.


The cavalcade by recently-qualified 007s from Vladimir Putin's espionage ranks has stunned Cold War specialists schooled in staying in the shadows.

Veteran spies in Russia have reacted in horror after the show of strength by newly graduated agents from the foreign intelligence section of the FSB spy academy.

The FSB was once headed by Putin, who was also a KGB agent in Germany during the Cold War. more

Think Video Surveillance is Just for Crime Prevention? Think again...

Sure, surveillance video can be used to “catch the bad guy” and deter incidents. But it can do so much more!

Download the Top 10 Values of Video Surveillance by Pivot3 to see how you could be leveraging your video for strategic business purposes beyond security.

See how video can help you:

• Defend against fraudulent liability claims
• Avoid fines from non-compliance
• Improve the value of other business systems to your organization
• And more!

Proof Almost 50% of People are Computer Security Morons

In what’s perhaps the most enthralling episode of the hacker drama Mr. Robot, one of F-Society’s hackers drops a bunch of USB sticks in the parking lot of a prison in the hopes somebody will pick one up and plug it into their work computer, giving the hackers a foothold in the network. Of course, eventually, one of the prison employees takes the bait.

Using booby-trapped USB flash drives is a classic hacker technique. But how effective is it really? A group of researchers at the University of Illinois decided to find out, dropping 297 USB sticks on the school’s Urbana-Champaign campus last year.

As it turns out, it really works. In a new study, the researchers estimate that at least 48 percent of people will pick up a random USB stick, plug it into their computers, and open files contained in them. Moreover, practically all of the drives (98 percent) were picked up or moved from their original drop location. Very few people said they were concerned about their security. Sixty-eight percent of people said they took no precautions... more

Laker Rookie Secretly Filmed Teammate Admitting Cheating

A shocking video surfaced of Los Angeles Lakers forward Nick Young,

filmed by his rookie teammate D’Angelo Russell, admitting that he cheated on his fiancée Iggy Azalea.

The video shows Russell talking to Young saying, “You was 30 and she was 19?” referencing a woman the 30-year-old Young met in a nightclub...

According to Hollywoodlife.com the 25-year-old Azalea plans to now call off their wedding plans. more

SeaWorld Admits Employees Spied

SeaWorld admits employees posed as animal activists to spy on critics...

Multiple SeaWorld employees posed as animal-welfare activists so they could spy on critics, the company admitted Thursday.
The acknowledgment comes seven months after People for the Ethical Treatment of Animals accused SeaWorld of spying. The animal-welfare group, which has waged an intense campaign against SeaWorld, went public with evidence that a San Diego employee attended protests and made incendiary comments on social media while posing as an activist.

Reading from a statement while speaking with analysts, Chief Executive Officer Joel Manby said SeaWorld's board of directors has "directed management to end the practice in which certain employees posed as animal-welfare activists. more

Amateur Eavesdroppers in the News This Week

MA - Brianne St. Peter McMahon, 36, was indicted Wednesday by a Plymouth County Grand Jury on charges including wiretapping and misleading a police investigation, according to the office of Plymouth District Attorney Timothy J. Cruz.

In October 2015, McMahon allegedly slipped her cellphone into the pocket of a witness, who was set to appear before a grand jury at Brockton Superior Court, to record the proceedings and interviews related to the murder of 45-year-old Robert McKennacq, according to Cruz’s office.

Later that afternoon, State Police seized the phone from the witness, a friend of McMahon’s who was unaware the device had been placed in her pocket, according to the indictment. more

---

MA - Three employees at Wyman-Gordon company in Grafton, Massachusetts, are facing felony wiretapping charges for setting up a hidden camera with audio to record their coworker inside their workplace, reports CBS Boston. more

---

S. Africa - An electronics expert testified in court on Monday that he planted a “bugging” device in the Pietermaritzburg advocates’ chambers and helped put a GPS tracker on an advocate’s car at the request of KZN advocate Penny Hunt.

Houston Wayne Impey said he had, at Hunt’s request, also removed the CCTV hard drive installed at the advocates’ chambers to copy the footage captured on the system.

Hunt had told him to plant the bugging device in the ceiling of the advocates’ chambers so she could listen to, and record, conversations in her secretary’s office, because she suspected her of leaking confidential information, he said. more

Spies Accused of Winging It, or A Very Sordid Sortie

Israel Nature and Parks Authority officials are pleading for the release of a vulture after residents of a southern Lebanese town captured the bird, claiming it was being used for spying. 

Lebanese media reported that the bird – allegedly carrying Israeli spy equipment -- was caught Tuesday to prevent it from attacking citizens in the town of Bint Jbail, according to the Jerusalem Post...

Israeli officials said the bird was released in the Gamla Nature Reserve about a month ago after arriving from Spain in 2015. The bird, outfitted with a transmitter, was brought to Israel in hopes to increase its local population, the officials added. more

P.S. They came to their senses and released the vulture.

Why an RFID-blocking Wallet is Something You Don't Need

via Roger A. Grimes
You don't need a tinfoil hat, either. Opportunists have exploited consumer fears to create an industry that doesn't need to exist...

(summary)

First and foremost, does your credit card actually have an RFID transmitter? The vast majority does not. Have you ever been told you can hold up your credit card to a wireless payment terminal, and without inserting your card, pay for something? For most of my friends, and the world in general, the answer is no...

If you look at the number of credit cards with RFID, you can’t even represent it statistically. It’s not 0 percent, but it’s so far below 1 percent that it might as well be 0 percent...

On top of that, most of the world is going to wireless payments using your mobile device...

But did that bad guy ever sit on the corner in the first place? Sure, I’ve seen the demos, but I’ve yet to hear of one criminal who was caught using an RFID sniffer or who admitted to stealing credit card info wirelessly. We know about all sorts of cyber crime. Why not the theft of RFID credit card information if the risk is so high?

Here's why: It would be a lousy use of a criminal mastermind’s time. Today’s smart criminals break into websites and steal hundreds of thousands to tens of millions of credit cards at a time. Why would a criminal go to the effort and expense of stealing credit card info one card at a time when you can steal a million in one shot?  more

Did Your Lame Password Make the Top 25 List for 2015?

Here are the most popular passwords found in data leaks during the year, according to SplashData:

1. 123456
2. password
3. 12345678
4. qwerty
5. 12345
6. 123456789
7. football
8. 1234
9. 1234567
10. baseball
11. welcome
12. 1234567890
13. abc123
14. 111111
15. 1qaz2wsx
16. dragon
17. master
18. monkey
19. letmein
20. login
21. princess
22. qwertyuiop
23. solo
24. passw0rd
25. starwars 
    more 

Surveillance Footage of Taco Banditos Goes Mad Ave

BTW, excellent camera installation.

Smart Sheriff Chased Out of Town

Remember our Smart Sheriff post from May? 
South Korea created this spyware for cell phones. 
I'll wait while you check it out.

UPDATE: South Korea pulls plug on child monitoring app
The most widely used child surveillance app in South Korea is being quietly pulled from the market after security specialists raised serious concerns about the program’s safety...

Smart Sheriff’s disappearance is awkward news for South Korea’s effort to keep closer tabs on the online lives of its youngest citizens.

A law passed in April requires all new smartphones sold to those 18 and under to be equipped with software that parents can use to snoop on their kids’ social media activity. Smart Sheriff, the most popular of more than a dozen state-approved apps, was meant to keep children safe from pornography, bullying, and other threats, but experts say its abysmal security left the door wide open to hackers and put the personal information of some 380,000 users at risk. more

Man Admits Wiretapping, Harassment of Judge... and DUI

PA - An East Goshen man who secretly recorded telephone conversations with his ex-wife, her attorney’s office, two police officers and others, and who also made profane telephone calls to a Common Pleas Court judge and officials in the Chester County Domestic Relations Office, has admitted his culpability in those crimes.

On Wednesday, William Robert Wheeler pleaded guilty to charges of wiretapping and harassment, as well as driving under the influence, before Judge Patrick Carmody, who deferred formal sentencing to allow Wheeler to apply for the county’s alternative sentencing program for repeat DUI offenders. more

What is the First Thing a Spycam Sees?

All together now...
"The dumb owner setting it up!"

A bungling voyeur was captured on a video camera he set up to record women using the toilet at a party - in a stunt inspired by an American Pie film.

Adam Stephen Barugh, 26, used velcro to hide the small digital camera beneath a sink directly facing a toilet, after being invited to a house in Brotton.

His solicitor Paul Watson told Teesside Magistrates’ Court yesterday that the “prank” was inspired by watching the comedy film American Pie: Bandcamp, which features women being secretly filmed...

During the party, a female at the house noticed a small blue light coming from beneath the sink while using the toilet, and alerted her mum and sister.

Quickly hooking the camera up to a laptop, they discovered it had captured a full facial shot of Barugh setting up the camera, and videos of two women using the toilet. more

Private Investigator Posts a TSCM Question to an Industry Newsgroup - Scary

Q. Looking for a cheap, do it yourself debugging product. Any recommendations?

It's one thing to be ignorant. We all are at one point. But, we do our own homework and learn. Copying other people's homework never leads to the A+ answer.

It's a, "Which end of the soldering iron should I hold?" question. If you don't know, better find something else to do. 

The Editor-in-Chief of PI Magazine, kindly responded with the following cogent reply... 

A. There really is no such thing as a cheap do-it-yourself debugging product. Even the most basic TSCM / debugging inspect requires you search for RF (radio frequency) signals, hidden video cameras that are either wired or wireless, on or off, hidden audio records, telephone instrument and phone line inspection, as well as searching for GPS trackers that can be battery operated or hardwired.

Each of the categories listed above require specialized equipment unique to the item(s) being searched. Even if you were to acquire a cheap RF detector, you wouldn’t know what type of signal you’re picking up or the source...  Just because you own a piece of equipment doesn’t mean you’ll know how to use it.

By the way, the FTC has been known to criminally charge private individuals and PIs for “theft by deception” for conducting bugsweeps without the proper equipment and training.

For anyone seeking to hire a Technical Surveillance Countermeasures (TSCM) "expert", this is a cautionary tale. Please, do your due diligence. The TSCM field is littered with gum-under-the-table trolls out to make a fast buck with cheap sweeps. ~Kevin 

UPDATE: A Blue Blazer Regular writes in with his two cents... "Doing it yourself is like do-it-yourself brain surgery."