Outrageous - Anyone else would have landed in prison.

Companies agree to stop spying, taking secret photos on rented home computers
 

The US Federal Trade Commission has reached a settlement with seven computer rental companies and a software firm over what the agency said was flagrant computer spying on customers of the rental stores.

In a statement Wednesday, the FTC said that DesignerWare LLC and seven rent-to-own computer stores agreed to cease using malware-like monitoring software to track rental PCs and from using information gathered by the spying software for debt collection purposes.

According to the FTC, the software captured screenshots of confidential and personal information, logged users' keystrokes, and in some cases took "webcam pictures of people in their homes, all without notice to, or consent from, the consumers."

The settlement stems from what an FTC complaint (PDF link) says was a years-long campaign of electronic spying by PC rent-to-own firms against customers using PC Rental Agent, a remote monitoring application made and marketed by DesignerWare that can disable or remotely wipe a rented computer, but also monitored a user’s online activity and physical location using a feature called "Detective Mode." (more) (sing-a-long)


P.S. It also presented a fake software program registration screen that tricked consumers into providing their personal contact information.

eBlaster Shatters Crystal - $20,000 Loss

The ex-wife of a wealthy businessman must pay him $20,000 for installing spyware on his computers and using it to illegally intercept his emails to try to gain an upper hand in their divorce settlement, a federal judge in Tennessee ruled.

U.S. Magistrate Judge William Carter ordered Crystal Goan to pay ex-husband James Roy Klumb $20,000 for violating federal and state wiretap laws when she used Spectorsoft's eBlaster spyware to intercept Klumb's email. (more)

$50 Hacking Device Opens Millions of Hotel Room Locks

If you're staying at hotel, it might be a good idea to check the manufacturer of your door lock. A black hat hacker has unveiled a method that allows a fairly simple hardware gadget to unlock door locks manufactured by Onity.

Mozilla software developer Cody Brocious recently discovered two vulnerabilities within Onity's locks. Brocious was able to exploit said vulnerabilities with a device that cost him $50 to build. The schematics for the device are open source and available on the Web. Brocious will present his findings at the Black Hat Security Conference in Las Vegas on Tuesday night.

Onity tells PCWorld that it is aware of Brocious' work, but has declined to comment until it reviews additional information on the hack itself. (more)
 

Chilling thought...

Framing hotel staff for murder
"Given the ability to read the complete memory of the lock, it is possible to gain access to the master key card codes. With these -- in combination with the sitecode for encryption -- it is possible to create master cards which will gain access to locks at the property.

Let's look at a hypothetical situation:
• An attacker uses the before-mentioned vulnerabilities to read the memory of the lock
• Attacker uses the site-code and master key card codes to generate one or more master cards
• Attacker uses a master card to enter a room
• Attacker murders the victim in the room
• Attacker escapes

During the course of investigation, it's quite possible that the criminal investigators may look at the audit report for the lock, to see who entered the door at what time. Upon doing so, they will see a specific member of the staff (as the key cards are uniquely identified in the ident field) using a master key card to gain access to the room near the time of death.

Such circumstantial evidence, placing a staff member in the room at the time of death, could be damning in a murder trial, and at least would make that staff member a prime suspect. While other factors (e.g. closed circuit cameras, eyewitnesses, etc) could be used to support the staff member's case, there's no way we can know whether or not the audit report is false."

On the other hand... Brocious's work has just given hotel workers a "Get out of jail" card.

你好, 你好! Is anybody listening?

The Chinese government has “pervasive access” to some 80 percent of the world’s communications, giving it the ability to undertake remote industrial espionage and even sabotage electronically of critical infrastructures in the United States and in other industrialized countries.

The Chinese government and its People’s Liberation Army are acquiring the access through two Chinese companies, Huawei Technologies Co. Ltd and ZTE Corporation, telecommunications experts have told WND.

With this access, the sources say, the Chinese are working on the other 20 percent. The two companies give the Chinese remote electronic “backdoor” access through the equipment they have installed in telecommunications networks in 140 countries. The Chinese companies service 45 of the world’s 50 largest telecom operators. (more)

No Sir'ee. No Siri here. Seri-ously!

If you work for IBM, you can bring your iPhone to work, but forget about using the phone’s voice-activated digital assistant. Siri isn’t welcome on Big Blue’s networks.

The reason? Siri ships everything you say to her to a big data center in Maiden, North Carolina. And the story of what really happens to all of your Siri-launched searches, e-mail messages and inappropriate jokes is a bit of a black box.

IBM CIO Jeanette Horan told MIT’s Technology Review this week that her company has banned Siri outright because, according to the magazine, “The company worries that the spoken queries might be stored somewhere.”

It turns out that Horan is right to worry. In fact, Apple’s iPhone Software License Agreement spells this out: “When you use Siri or Dictation, the things you say will be recorded and sent to Apple in order to convert what you say into text,” Apple says. Siri collects a bunch of other information — names of people from your address book and other unspecified user data, all to help Siri do a better job. 

How long does Apple store all of this stuff, and who gets a look at it? Well, the company doesn’t actually say. (ask Siri!) (more)

"Houston, we have a problem."

The "algorithms used to command and control the International Space Station" were lost when an unencrypted NASA laptop computer was stolen in March 2011. 

That tidbit came in testimony Wednesday delivered by NASA Inspector General Paul K. Martin as he reported on the space agency's IT security track record. The loss of the ISS command code was symbolic of one glaring deficiency: a lack of data encryption on mobile devices. (more)

Security Alert: Time to Update Your HP Printers' Firmware

Not a real HP fire. Just shown to get your attention.

HP announced that the potential existed for a certain type of unauthorized access (info-theft, fiery sabotage, etc.) (more) to some HP LaserJet printers and confirmed it has received no customer reports of unauthorized access. HP has issued the following statement:

HP has built a firmware update to mitigate this issue and is communicating this proactively to customers and partners. No customer has reported unauthorized access to HP. HP reiterates its recommendation to follow best practices for securing devices by placing printers behind a firewall and, where possible, disabling remote firmware upload on exposed printers.

The firmware update can be found at www.hp.com/support and selecting Drivers.

Additional printer security information is available at www.hp.com/go/secureprinting.

The Latest Video Enhancement Trick: De-Blurring

About a year ago I looked at work by two video enhancement specialists; Doug Carner, CPP/CHS-III of Forensic Protection and Jim Hoerricks - author of Forensic Photoshop, a comprehensive imaging workflow for forensic professionals. 

Today, Doug advised me of a trick that every security professional should have up their sleeve, de-blurring. He explained how he de-blurs motion this way...

"Light originates and reflects from objects in very predictable ways. As the camera and object move, they distort the captured image. These distortions can be reversed using a filter that acts like mathematical eye glasses.

For this example, we used the bent light streak seen at the far right of the license plate. The process could have just as easily been applied to the mud flaps or tires."

Wow, major difference!

This got me thinking. How good will this technology become?

Just two months ago, Adobe gave the world a sneak peek.

When you view this video, set it to HD and go full screen. The magic begins about 2 minutes into the clip and continues with several photos being blur corrected.

Unfortunately, this was only a sneak preview. It is not available to the general public in Photoshop yet.

Just to re-cap, here are some of the things Doug can do to enhance your crummy videos...

• High-resolution video and audio extraction or capture
• Adaptive military-grade video jitter stabilization
• Video de-interlace, de-sequence and de-multiplex
• Intelligent temporal noise and artifact suppression
• Fast-Fourier compression and camera age reversal
• Sub-pixel shift fusion over time, space and frequency
• Adjust video brightness, contrast, saturation and size
• Color channel isolation and focus/motion blur correction
• Audio noise suppression and speech amplification
• Video zoom, trim, crop and speed adjustments
• Multiplex to original with event highlight for court exhibit
• Image extraction, cropping, enlarging and printing
  
Want to conduct your own experiments with de-blurring?
Visit the Department of Computer Science and Engineering at The Chinese University of Hong Kong. Play with their GPU Blur Removal Software v2.0 just released last month. (Windows Trial Version)

Could Facial Recognition Become the Next Emergency Broadcast System

The Emergency Broadcast System (EBS), a communications system which allows the government to commandeer radio and television broadcasting outlets to distribute emergency messages quickly, was tested this past week. The EBS started in 1963, and was preceded by a similar service called, CONELRAD. Electronic eminent domain has been around a long time. Hold that thought.

Today, The New York Times reports Face Recognition Makes the Leap From Sci-Fi.

"SceneTap, a new app for smart phones, uses cameras with facial detection software to scout bar scenes. Without identifying specific bar patrons, it posts information like the average age of a crowd and the ratio of men to women, helping bar-hoppers decide where to go. More than 50 bars in Chicago participate... The spread of such technology — essentially, the democratization of surveillance — may herald the end of anonymity. 

Those endeavors pale next to the photo-tagging suggestion tool introduced by Facebook this year... “Millions of people are using it to add hundreds of millions of tags,” says Simon Axten, a Facebook spokesman. Other well-known programs like Picasa, the photo editing software from Google, and third-party apps like PhotoTagger, from face.com, work similarly. 

And this technology is spreading. Immersive Labs, a company in Manhattan, has developed software for digital billboards using cameras to gauge the age range, sex and attention level of a passer-by.

Using off-the-shelf facial recognition software, researchers at Carnegie Mellon University were recently able to identify about a third of college students who had volunteered to be photographed for a study — just by comparing photos of those anonymous students to images publicly available on Facebook."

Have you connected the dots yet? 

Here is another clue...  

CALEA, a law passed in 1994, "To amend title 18, United States Code, to make clear a telecommunications carrier's duty to cooperate in the interception of communications for Law Enforcement purposes, and for other purposes." Telecommunications yet another type of mass communications device which may now be commandeered by government.

Internet connected, facial recognition systems are rapidly becoming mainstream mass communications technology, just like radio, TV and telephones. It only makes sense that this too will be commandeered. The question is, will it be commandeered like EBS to broadcast emergency messages, or will it be commandeered like CALEA to be used for surveillance? Both, perhaps?

So far, the benefits of letting government commandeer mass communications (verses the abuse potential) make the gambit worthwhile. For this, we thank our legal system. It is time for them to walk the high wire again. Please, get us through this technical conundrum with grace and balance one more time.

The noose tightens... "You can run, but you can't hide." 

Should this all come to pass (it will), there may be some interesting social outcomes. Just as mass communications pulls society closer together, mass surveillance capabilities like CALEA, license plate readers, and the multitude of facial recognition surveillance systems may push people apart. Imagine a world where the density of: commercial video billboards and kiosks; business surveillance cameras; and government street/toll booth cameras, in urban areas, squeezes criminals into the suburbs and beyond.

How best to take advantage of the changes in our brave new world? 

I have a career tip for you.

~ Kevin

Cell Phone SpyWare Goes Legit

Realizing that the huge demand for parental monitoring programs for computers could also apply to phones, Dublin-based mobile web service company Associate Mobile has developed MobileMinder - a smartphone application running on a secure and encrypted network that allows parents to monitor their child's location, contacts, call history, photos, and web use. (more)

Free Likejacking Prevention — Plug-In for Firefox, Google Chrome and Safari

ThreatLabZ, the research arm of Zscaler, released a free tool to combat the biggest threat on Facebook -- Likejacking.

Called Zscaler Likejacking Prevention, it was developed for the sole purpose of helping consumers stop being further victimized.

This popular attack leverages clickjacking to trick users into "Liking" a fake video, survey or web link, propagating the scam further as it spreads virally from one person to their network, and on to their networks’ networks, and so on. (download) (more)

The End of Anonymous On-Line Dating Has Arrived

Science fiction writers have long imagined a future in which facial recognition technology makes anonymity in public obsolete. A research study at Carnegie Mellon University suggests that this Minority Report future has already arrived, thanks to facial recognition products now commercially available, combined with the 750-million-person identity database called Facebook.

A CMU research team led by associate professor Alessandro Acquisti took candid photos of 93 random students on campus using a $35 webcam. Within seconds the researchers were able to determine the identities of a third of their photogenic guinea pigs, using off-the-shelf facial recognition software from PittPatt, a software company recently acquired by Google, and publicly available profile photos from Facebook. The researchers had an even higher rate of success using the same technology to identify more than 100,000 Pittsburgh singles with otherwise pseudonymous accounts on a dating site, adding yet more complexity to the world of online dating. (more)

From the Land of Paladin, Have Antidote, Will Travel

Google's search engine is now fighting against a strain of malware that secretly intercepts Web browser activity on Windows PCs. FREE

Infected users will see a big yellow box at the top of search results, directing them to a Google Web page that explains how to remove the malware. That page urges users to download or update their antivirus software, and also provides manual instructions for removing the malware from Windows computers. (To see if you're infected, run any search on Google.com and look for the yellow box.) (more)

Click to enlarge.

50 Ways to Get in Ethical Trouble with Technology

Originally written for attorneys, but great advice applicable to many of us...

Technology makes everything easier and faster. In fact, it makes it possible to commit malpractice at warp speed. We can fail to represent diligently, lose our clients data, perform incompetently, and violate the rules regarding attorney advertising—all in sixty seconds or less.

There are so many ways to potentially commit malpractice with technology that it is impossible to list them all. Still, let us make a credible stab at some of the more common missteps. (more)

Could Your Hard Drives (and other electronics) be Time-Bombed?

A Department of Homeland Security (DHS) official acknowledged the persistent threat of pre-existent malware on imported electronic and computer devices sold within the United States, sparking renewed interest in a problem the federal government has been trying to mitigate for some time.

Calling the threat "one of the most complicated and difficult challenges we have," Greg Schaffer, acting deputy undersecretary for the National Protection and Programs Directorate for the DHS, said that he is "aware that there are instances where that has happened," although he did not go into specifics about those instances. (more)

Apple Cedes to Patch

Apple Inc. said Thursday it is working to resolve a security hole in its iPhone and other mobile products that German authorities warned could allow cyber criminals to access confidential information or intercept phone conversations.

Users are particularly vulnerable when they view Portable Document Format, or PDF, files, which give attackers an opportunity to infect the devices with malicious software, giving them administrative rights to the device, the German Federal Office for Information Security said Wednesday.

Once the device is infected, cyber criminals could read confident information such as passwords, online-banking data, calendars, e-mails and other information, as well as intercept telephone conversations and the location of the user. The security hole is present in several versions of Apple's iOS software on its iPhone, iPad and iPod Touch products, the agency added. (more)

When Board Members Phone It In - One Anti-Eavesdropping Solution

Click to enlarge.

Problem 1: Conference calls very often contain highly confidential and sensitive information – such as Board and Executive Management Team calls, Intellectual Property discussions, high value business deal talks, or crisis management calls. 
 
Problem 2: Traditional conference bridges make it difficult to control who is on a call. Long lived PINs are often distributed freely, making conference calls easy to access by unauthorized parties such as ex-employees.

Cellcrypt Secure Conference Service™ is a solution for extra-secure access and encrypted calling within a secure conference bridge, accessible from cell phones.
 
Cellcrypt secure conference calling uses strong cryptographic authentication in combination with pre-defined phone numbers to ensure that only authorized phones can join. The service has an easy-to use web-based management console for setting up any number of bridges with eligible participants defined using a white list policy.

An optional policy setting enables eligible participants to gain access to the bridge from a standard phone, if required, using a pre-defined phone number and PIN. This allows an administrator to mix unencrypted calls from selected phones over the public telephone network with secure calls from other locations where calling is a concern. (more)

It's One Thing If You Lose Your Wallet...

It's another thing if Google loses it... 

"Your phone will be your wallet." That's what Google's promising with Google Wallet and Google Offers, which'll combine payments and deals in one neat package. And it's a pretty compelling little vision of the future of paying for stuff.

Google Wallet isn't really one thing, so much as a bundle things tied together in one package. It's an Android app. It's a way for you to pay for things with your credit or debit cards, using your phone. It's a coupon collector and loyalty card system. It's another way for merchants to let you pay and offer up deals. It hooks into other Google services, like Shopper (which shows you nearby deals) and Google Offers. And Google is planning for it to eventually store everything you'd keep in a wallet. (more)


It's the future. 
No escaping it. 
Déjà vu time. 
"With new conveniences comes new security vulnerabilities."

Two CyberWar Hacking Stories. Just Coincidence? You decide.

China has admitted for the first time that it had poured massive investment into the formation of a 30-strong commando unit of cyberwarriors - a team supposedly trained to protect the People's Liberation Army from outside assault on its networks.

While the unit, known as the "Blue Army", is nominally defensive, the revelation is likely to confirm the worst fears of governments across the globe who already suspect that their systems and secrets may come under regular and co-ordinated Chinese cyberattack.

In a chilling reminder of China's potential cyberwarfare capabilities, a former PLA general told The Times that the unit had been drawn from an exceptionally deep talent pool. "It is just like ping-pong. We have more people playing it, so we are very good at it," he said. (more)

Lockheed Martin Cyber Attack: Routine, a Warning or a Possible Act of War?

Last Thursday, Reuters ran a story that the US defense firm Lockheed Martin was experiencing a major disruption to its computer systems because of cyber attack.

The Reuters story said that the attack began the weekend before and indicated that it involved the company's SecurID tokens which allow Lockheed's 126,000 employees "... to access Lockheed's internal network from outside its firewall."

As a result of the attack, Lockheed reset all of its employees' passwords.

Thought Wall Stickers:
• "You have no idea how many people are freaked out right now [about the SecurID breach] ... TASC is no longer treating the RSA device as if it were as secure as it was beforehand."

• As one military official in the WSJ article stated it: "If you shut down our power grid, maybe we will put a missile down one of your smokestacks."

A while back, I visited the new Cyber-war exhibit at the Spy Museum in DC. It was about just this sort of thing, and the consequences of remotely destroying electrical generators using code. The outcome is very scary. Glad to see folks waking up and smelling the coffee.

The hackers have done us a favor, this time. ~Kevin

Security Tip - $5 p/m Stolen Laptop Solution

Eighteen-year-old "technology entrepreneur" and Bentley College student Mark Bao had his MacBook Air stolen in February. Unlike other bright-eyed college freshmen, Bao didn't write his laptop off as gone forever (ok, maybe he did--he went out and purchased another laptop the very same night it was stolen), he set out to find the thief.

Using online backup software BackBlaze that he'd installed on his laptop, Bao was able to see the machine's browser history and track any hard drive updates.

"Woah. Thanks to @Backblaze, I think I might be able to figure out who stole my MacBook Air at college. Creeping through the Safari history!" Bao Tweeted on March 19.

(D'oh!)

Apparently the first thing the thief did was take a photo of himself using the laptop's Photo Booth program... After discovering the photo, Bao discovered a video the thief had taken of himself dancing to Tyga's "Make it Rain." Bao uploaded the video to Vimeo, managed to hunt down the guy's Facebook page using the aforementioned Safari history, and then turned everything over to the police. 

Bao told the Daily Mail that he holds no grudges against the thief, because "I don't have time nor patience to. There are more important things in life." Mark no longer has any use for his old laptop, so he's selling it and donating the proceeds to the Red Cross Japan fund. (more)