This Week in Corporate Espionage

HONDA
Calling corporate espionage a threat to its competitive advantage in the all-terrain vehicle market, Honda of South Carolina is going to court to find out who posted unauthorized photos of its Talon side-by-side vehicles on the Internet...

...photos and detailed, confidential information about the Talon models started showing up on Internet sites hondasxs.com and HondaProKevin.com.

According to Honda’s complaint, someone using the screen name “hondasecrets” posted photos of Talons taken inside the factory. Another using the name “HondaTalon” posted specifications “regarding the horsepower, maximum speed, and measurements, which Honda had not yet released to the public,” the complaint states. more

-----

TESLA
Tesla Inc. accused one of its former engineers of stealing highly confidential autopilot information before bolting to the Tesla of China, Xpeng Motors, eight months after one of Apple Inc.’s ex-employees was charged with taking sensitive robocar secrets to a new job with Xpeng.

Allegations that a second Silicon Valley giant (see below) was betrayed by one of its own workers bound for the same Chinese startup come amid a major U.S. crackdown on Chinese corporate espionage. more

-----

APPLE
A former hardware engineer (Zhang Xiaolang) for Apple’s autonomous vehicle development team who went to work for Xpeng is facing criminal charges brought by the U.S. Justice Department. He has pleaded not guilty...

Zhang told Apple he wanted to be closer to his ailing mother in China just before revealing to his supervisor that he intended to work for Xpeng. Apple grew more suspicious after seeing his increased network activity and visits to the office before he resigned, prosecutors said in a criminal complaint. He was arrested after he passed through the security checkpoint at Silicon Valley’s San Jose International Airport to board a flight to China. more

Corporate Romper Room - Don't Bee a Slack Slacker

More than 10 million people use Slack every day, mostly to communicate with co-workers. The app has gained so much popularity in the five-plus years since its launch that private investors value the company at over $7 billion.

“I love my people, but they never shut up on Slack,” said the CEO of a security company who asked not to be named so he could speak openly about his concerns. “It’s very good for productivity, but the problem is we’re working on security, so we have to be careful about what we say.”

Employees communicate on Slack using “channels” to focus conversations on various topics specific to different departments. It followed corporate chat tools from Microsoft, Google and Cisco as well as a plethora of start-ups, but none gained Slack’s level of adoption or had so much success in pulling workers away from email and into messaging groups. more

Spybuster Tip # 629 - Watch What You Say at the Drive-Thru

Next time you have a private conversation while in a drive-through, you might want to keep it quiet — as workers in fast food restaurants are able to hear you, even when you can’t hear them.

Well, as long as they are wearing a headset and you’re parked next to the microphone with your window down, that is.

...the revelation on r/LifeProTips: They posted; “If we apologize [sic] and say we’ll be with you in a minute – you’re not on hold, we can hear everything. If you’ve ordered but the drive-thru line won’t let you pull ahead yet – we can hear every single thing you’re saying.

Suggesting that having the ability to eavesdrop isn’t always a good thing, they added: “I wish I could forget some of the stuff I’ve heard.” more

Cybercriminals Home in on Ultra-High Net Worth Individuals

Research shows that better corporate security has resulted in some hackers shifting their sights to the estates and businesses of wealthy families.

Threat intelligence experts and research groups have seen a shift of cybercriminals increasingly targeting ultra-high net worth (UHNW) individuals and their family businesses...

More than half the attacks were viewed as malicious. And, nearly one-third came from an inside threat, such as an employee intentionally leaking confidential information. more

Congratulations to the corporations who have instituted better information security practices. Their elevated security includes periodic checks for electronic surveillance, or Technical Surveillance Countermeasures (TSCM). 

These checks are absolutely necessary at family compounds and home offices. There, guests, staff, and tradespeople have great opportunities to plant audio, video and data electronic surveillance devices.

Practice Saying, "Yes Master"...like you really mean it!

ROBOTS spying on your social media profiles could stop you from getting your dream job.

Recruitment AI used by companies to pick out applicants scans your posts for signs you might not be right for the role.

Known as DeepSense, the tool assesses your personality based on your online activity – even if you haven't applied for the role and don't know you're being assessed. The language you use, your photos, how often you post and more is merged into a data profile that tells recruiters your interests, teamwork skills, how extroverted or introverted you are, and even your emotional stability. more

Security Director Alert - Well Produced Information Security Awareness Videos for Employees

Foreign intelligence entities, which may include foreign governments, corporations, and their proxies, are actively targeting information, assets, and technologies that are vital to both U.S. national security and our global competitiveness. 

Increasingly, U.S. companies are in the cross-hairs of these foreign intelligence entities, which are breaching private computer networks, pilfering American business secrets and innovation, and carrying out other illicit activities.

The National Counterintelligence and Security Center is dedicated to raising awareness among government employees and private industry about these foreign intelligence threats, the risks they pose, and the defensive measures necessary for individuals and organizations to safeguard that which has been entrusted to their protection.

The following products will enable personnel to better understand these threats and provide guidance and tips for protecting the sensitive information, assets, technologies, and networks to which employees have access. It will also serve to help them protect their personal, confidential information that may be used by others to gain their trust. more

Videos:
Social Media Deception Trailer
Social Media Deception
Social Media Deception Full Video
Social Engineering
Spear Phishing (30 second trailer)
Spear Phishing 2017
Spear Phishing Full Video
Travel Awareness
Human Targeting
Supply Chain Risk Management
Economic Espionage  (True story.)

Spy Rule #629 - Don't Order Bugs Using Company Email

Eavesdropping charges have been filed against a central Illinois schools administrator who allegedly planned to secretly record a closed session of the school board.

The News-Gazette reports Champaign County State's Attorney Julia Rietz alleged Thursday that Samuel Byndom used a device disguised as a pen to record an Oct. 28 closed session of the school board. The 35-year-old Byndom is Urbana District 116's assistant superintendent of learning and instruction.

Click to enlarge.

Rietz said Urbana police have been investigating Byndom since a school district employee found an email order confirmation on a school district computer for a voice-activated recorder pen from a company called "SpyGuy."

Members of the school board members went forward with the closed session after learning about the recording device order, but searched the room before starting. They found the device and removed it. more

Is Your Boss Spying on You?

(Modern workplace "spying" began with the time clock back in 1888.)

New numbers show almost every single employer is spying on employees.

From keeping an eye on your internet usage to tracking your car, NBC Charlotte found out how they're doing it and if it's legal.

"It's getting to a point people are realizing they don’t have much privacy in the workplace," said Kevin Murray. more

P.S. Make sure your employees are not spying on you.

Business Espionage Info-Theft: When they can't hack it, they grab the employees.

Investigators discovered what they believed to be a major infiltration campaign.

Two years before Equifax Inc. stunned the world with the announcement it had been hacked, the credit-reporting company believed it was the victim of another theft...

In the previously undisclosed incident, security officials feared that former employees had removed thousands of pages of proprietary information before leaving and heading to jobs in China. Materials included code for planned new products, human-resources files and manuals...

According to the people familiar with the probe, the investigators, by talking to Equifax employees and examining email accounts and LinkedIn messages sent to them, saw indications that recruiters purporting to represent Ant affiliate Alibaba had offered to triple salaries for certain ethnically Chinese Equifax employees—and provided instructions on specific Equifax information they should bring along if they jumped ship. more

Council President Accused of Planting Hidden Cameras in Borough Hall and Reaping Kickbacks

PA - Republican Mitchell, 75, of Fourth Street in Upland, is accused of orchestrating a $133,000 kickback scheme, which included allegations of planting hidden cameras in borough hall when he served as borough council president. In addition to felony theft, he is charged with ethics and wiretapping offenses...

Arrested along with Mitchell and charged with similar offenses was Thomas Willard of Downingtown, the owner of the Eddystone-based Logan Technology Solutions...

According to the charges, Mitchell and Willard received up to $133,000 in kickbacks for covert recording devices, cameras and security systems installed at inflated costs throughout borough buildings in Upland. Whelan previously said he believed Mitchell went to Willard with the idea for the scam.

According to invoices and bank records reviewed during the investigation, Willard and his company were paid almost $1 million between 2009 and 2015 for various security-related projects.

According to authorities, video and audio equipment were installed sometime in 2013. A covert camera system installed in Upland’s borough hall was being disguised as the motion sensors for the building’s alarm system. There were three cameras – one in the secretary’s office and two in borough council chambers- brought to the attention of law enforcement by then-Upland Mayor Michael Ciach. more

Israeli Cyber Warfare Firm Employee Caught Selling Eavesdropping Software...

...which is why we say there is no such thing as a secure 'back door'.

Israel’s cyber warfare giant, NSO’s former employee stole company’s ‘Pegasus’ eavesdropping program software and tried to sell it on the ‘dark web’. 

The Pegasus is a classified security tool that can eavesdrop on any person in the world without their knowledge, Globes reported Friday.

The accused is believed to have stolen NSO products and the program worth hundreds of millions of dollars. An indictment filed against the employee last week charged him with security offenses, in addition to theft from his employer. more

Infographic - Countries Where Private Security Outnumber Police

Whether they're patrolling shopping malls, conducting screening at airports or protecting VIPs, private security guards have become an increasingly common sight across the world. 

In many countries, they are armed with handguns and even dress in uniforms similar to the police.

The sector has experienced huge growth in recent years and today there are an estimated 20 million private security workers worldwide while the industry is worth approximately $180 billion. That is expected to grow even further to $240 billion by 2020, greater than the GDP of 100 countries including Portugal, Romania and Hungary.

According to research conducted by The Guardian, half of the planet's population lives in countries where there are more private security workers than police officers. more

Click to enlarge.

It is likely these are very conservative statistics, as they don't include security specialists, like: professional security consultants, Technical Surveillance Countermeasures (TSCM) specialists, private investigators, computer security specialists, and people working in the alarm and video surveillance sectors. ~Kevin

U.S. Embassy in China Sends Alert About Mystery Health Issue

The U.S. Embassy in China sent its second alert in two weeks Friday to its citizens over unexplained health issues that have prompted the evacuation of a number of U.S. government employees working at a consulate in a southern city...

The incidents have raised fears the unexplained issues that started in Cuba in 2016 have expanded to other countries. China says it has uncovered no information that could point to a cause...

Friday's alert called for people to be attentive of symptoms including "dizziness, headaches, tinnitus, fatigue, cognitive issues, visual problems, ear complaints and hearing loss, and difficulty sleeping." It urged them "not to attempt to locate the source of any unidentified auditory sensation. Instead, move to a different location." more

Two theories. One solution.

A new theory.
Attackers can cause potentially harmful hard drive and operating system crashes by playing sounds...

The attacks use sonic and ultrasonic sounds to disrupt magnetic HDDs as they read or write data. The researchers showed how the technique could stop some video-surveillance systems from recording live streams. Just 12 seconds of specially designed acoustic interference was all it took to cause video loss in a 720p system made by Ezviz. Sounds that lasted for 105 seconds or more caused the stock Western Digital 3.5 HDD in the device to stop recording altogether until it was rebooted.

School Super Suspended over Eavesdropping on Testimony Against Him

MI - The superintendent of Hale Area Schools (HAS) is facing one felony count of eavesdropping, which is punishable by up to two years of incarceration and/or fines of $2,000...

...the HAS Board of Education placed Vannest on paid administrative leave, following allegations that he had recorded a closed session meeting of the board in a manner contrary to Michigan law.

...a formal complaint had been filed against Vannest by the parent of a student.

...the recording begins as the meeting is called into a closed session. None of the recording takes place during the “open” portion of the meeting.

Vannest’s phone was allegedly left in the room, recording the testimony of witnesses and board members’ questions to those witnesses.

The statement in support reads that it is believed that Vannest intentionally left the device in the room to record/eavesdrop on the conversation and testimony of the witnesses and teachers who were called in for the complaint filed against him.

When police interviewed Vannest, he allegedly stated that he felt the recording was gathered by himself in error. more

A Tale of Corporate Espionage in Silicon Valley

...The computer that was funneling information, therefore, didn’t register on the roster of machines controlled and owned by the I.T. department. This left the security team with one definitively old-school option: they literally followed the wire that ran from the server to the rogue computer.

One by one, they plucked up the tiles in the server room, followed the Cat-5 cable as it swam alongside hundreds of other cables, inside the walls, past yellow and white power wires, and through the labyrinthine office, until they found themselves at the end of the cord, which terminated inside a small closet. There, seated behind a laptop, was a young Chinese woman.

The security specialists searched her personal computer and immediately discovered more than 30 pieces of malware that were funneling information out of the servers and back to dozens of computers in China....

Spies and corporate espionage are a fixture of Silicon Valley. Employees at companies from Twitter to SpaceX have privately told me they suspect spooks work within their walls, stealing corporate secrets, plans for new technologies, or entire servers full of code to replicate back home...

The C.E.O. of one of the big tech companies in Silicon Valley once confided in me that not only was there “no question” that Russian and Chinese agents worked at the company, but that it was impossible to know who they were or prove that they were indeed foreign agents. more

A Very Weird Tale of Corporate Espionage and Murder and More Corporate Espionage

Apotex claims longtime chemist went rogue and stole drug secrets...

Apotex Inc., the generic-drug giant founded by murdered billionaire Barry Sherman, has been waging a year-long court battle against an ex-employee who was fired for allegedly stealing millions of dollars’ worth of pharmaceutical trade secrets from a laboratory computer—in the hopes of launching a rival company in his native Pakistan...

Barry Sherman, 75, and his wife, Honey Sherman, 70, were discovered strangled inside their North York mansion nearly three months ago, the victims of what police have labeled a “targeted” double homicide. Since then, detectives have said little else about the high-profile murders...

News of the lawsuit comes at the same time as Apotex tries to defend itself against similar allegations of corporate espionage. In a court action launched last July in the United States, Sherman’s company is accused of using sex, lies and USB drives to illegally obtain valuable trade secrets from the world’s largest generic drug-maker, Israel’s Teva Pharmaceutical Industries Ltd. As Maclean’s reported last month, a Pennsylvania judge denied Apotex’s attempt to throw out the sensational lawsuit, which accuses a former Teva executive of leaking confidential information to her boyfriend—then-Apotex CEO Jeremy Desai. Desai abruptly resigned in January, six weeks after the Shermans were killed, “to pursue other opportunities.” more

Further insights... Business Espionage: The Employee Competitor… and what to do about it.

The Employee Competitor: Spy in the Yogurt

Click here.

The American yogurt market has remained pretty steady over the past few years, yet the yogurt areas in all my go-to grocery stores keep expanding, meaning it’s an increasingly competitive industry, and this fosters the sort of tense environment that sometimes can lead to suspicions of corporate espionage.

On Wednesday, Bloomberg reported that Dannon Co. sued its former senior vice president, Federico Muyshondt, alleging he divulged trade secrets to colleagues at his new job, which is with Chobani LLC. Both of these companies, obviously, are renowned for their yogurt.

According to the complaint—filed in a federal court in White Plains, New York—Muyshondt stands accused of pilfering details of Dannon’s business strategy, plans for forthcoming products, and lists of customers before he left the company in January to take a job with Chobani, which was not named as a defendant in the lawsuit. more

Report Reveals 50% of Organizations Don't Provide Employee Information Security Training

New cybersecurity reports just released by Cisco and Verizon Wireless say that businesses are faced with more sophisticated security threats from wireline and wireless devices running on their networks.

Perhaps the more disturbing revelation of Verizon’s study is that it’s not hacktivists, criminals or those engaging in corporate espionage that pose the greatest threat, but a company’s own employees. However, only 50% of all organizations provide IT training when a new employee joins a company. more

Observation: Interestingly, even fewer businesses proactively check for all the other methods of corporate espionage, e.g. regular information security surveys and technical surveillance countermeasures inspections. 

Coincidentally, the few that are pro-active seem to be among the most successful and profitable companies in America. Just coincidence?

Derailed CEO Accused of Spying on Board Members

South Africa - Railway Safety Regulator board members had their movements monitored and their cars fitted with tracking devices - and their boss allegedly orchestrated the whole thing.

Times Select can reveal that embattled Railway Safety Regulator CEO Nkululeko Poya allegedly spied on board members. She is currently on precautionary suspension after being charged for a string of alleged irregularities, including irregular staff appointments...

The new allegations facing Poya stem from a whistle blower who revealed how he had been engaging in clandestine activities on Poya’s behalf... He that said he worked on Poya’s instructions to spy on board members and find dirt against them. more

Hawaiian Emergency Management - Passwords on Post-it Notes on Computer Screens

The Hawaii Emergency Management false alarm mess was not caused by pressing the wrong button. It was caused by poor design.

Ever select the wrong thing from a drop-down menu? Sure, it happens all the time.

The Washington Post reports...

The menu, which triggers alerts, contains a jumble of options, ranging from Amber alerts to Tsunami warnings to road closures. Some of them, such as “High Surf Warning North Shores,” are in plain English.

Others, including the one for a missile attack, “PACOM (CDW)-STATE ONLY,” use shorthand initials. (PACOM refers to the United States Pacific Command based in Hawaii.)

And the menu contained no ballistic missile defense false alarm option — which has now been added at the top of the image, marked up by officials for explanatory purposes. more

 Suggestions: 
1. Separate the messages into smaller groups: Routine Tests | Advisories | Life Threatening
2. Drop the jargon. Say what you mean, clearly.
3. Do not use instant-select dropdown menus.
4. Use radio buttons to select the message, plus a CONFIRMATION and CANCEL button to activate the selected alert, or not. Two extra seconds of thought can prevent a lot of mistakes.

If you need help with design, call on the master, John McWade. He can teach you.

And, what's with posting the passwords to an emergency management computer screen?!?!
If the personnel can't memorize a password as lame as this, they shouldn't be allowed anywhere near a keyboard. more

Password: Warningpoint2