Proof 2018 will be a Great Year for TSCM Teams

The cost of eavesdropping, espionage, spying, and general snooping has gone the way of "long-distance" phone bills. For the cost of a visit to Starbucks, a few bucks can make everyone an eavesdropper, and apparently it's happening. Just look at the ad below for an FM wireless bug. China can't produce them fast enough. They are sold out! (more)

Click to enlarge.

But, fear not dear buggers, you can still obtain GSM USB charger plug bugs. Unlike the FM bug, you don't have to be somewhere nearby to listen-in. Just call it from your cell phone, anywhere in the world. (more)

Click to enlarge.

Happy New Year. Be safe... Support your favorite Technical Surveillance Countermeasures team.

Norway & Germany Call Time Out on Kiddy Smartwatches

Recently, Germany's Federal Network Agency (FNA) called foul on smartwatches that worked as listening devices — specifically those worn by children between the ages of 5 and 12, and used by parents, in particular, to eavesdrop on their kids while at school.

"Piss off."

The German regulating body said that parents would listen in on classes and teachers without consent...

These special watches, work like a baby monitor — allowing someone to tap into the device and listen in to anything happening around it. And people are being asked now to not only keep an eye out for these particular smartwatches — but destroy them, and then send proof back to the FNA....

Germany's not alone in worrying about children's smartwatches. The Norwegian Consumer Council (NCC) had the same type of reaction a full month before the FNA, issuing a report about security concerns around the devices.

The NCC noted that smartwatches — besides acting as listening devices — can also transmit the location of a child — presumably to parents — but have security flaws which could open that information up easily to others. more 

Glad they didn't have these forearm ankle bracelets when I was a kid. ~Kevin

Seoul Trained Trackers, or Party Police Bugged

South Korea - One maintenance office of a Seoul apartment complex is in hot water after it took its investigation into noise complaints one step too far.

According to residents and security personnel, during a recent five-day period, the maintenance office dispatched security guards to investigate the source of excessive noise among suites on floors 9 through 15 in one building. The guards, deployed from midnight to three in the morning on the apartment corridors, were armed with sound amplifying equipment.

“Throughout the course of the investigation, I ended up listening to the conversations of the residents in each suite, even though I didn’t want to,” one security guard said. “Problems of excessive noise should be resolved through legal and appropriate means, but I think that using a sound amplifier that can result in an invasion of privacy is taking things too far.” more

Vacuum Cleaner Spy - Dishin' Your Dirt to a Pervert

Your vacuum cleaner can spy on you and send the video to hackers.

Sound like a science fiction horror story?

It's reality in 2017.

Researchers at CheckPoint... discovered that as a vulnerability in the LG SmartThinQ app that accompanies the firm's smart devices. As can be seen in the video below, by exploiting that weakness, the researchers were able to force an LG Hom-Bot smart vacuum cleaner to relay a video feed to them from its camera to them.

The vulnerability apparently emanated from how SmartThinQ handled authentication and authorization of users... - that is, the tickets that allow users to access the device's video feed.



What this means is that if you have a vulnerable app and use a Hom-Bot with it anyone who knows your username - which is typically your email address - could potentially access your device's video feed or other data from the device.

Furthermore, besides creating a problem for Hom-Bot, the vulnerability may affect other LG smart devices that connect to the same app.

LG has already fixed the vulnerability, so, if you have any LG smart device and use SmartThinQ, make sure to download the latest version (1.9.23). more

Security Report: Kids Smartwatches Found to Act Like Bugs and Worse

The tests done by Mnemonic have uncovered critical security flaws in three of the apps and devices. 

As detailed in Mnemonic's report, two of the devices have flaws which could allow a potential attacker to take control of the apps, thus gaining access to children's real-time and historical location and personal details, as well as even enabling them to contact the children directly, all without the parents’ knowledge.

Additionally, several of the devices transmit personal data to servers located in North America and East Asia, in some cases without any encryption in place.

One of the watches also functions as a listening device, allowing the parent or a stranger with some technical knowledge to audio monitor the surroundings of the child without any clear indication on the physical watch that this is taking place. more

My Sister Bugged my Teddy Bear

Chicago - Nobody feuds like a rich family with lawyers on the payroll.

But even by the standards of the tony North Shore, the bitter courtroom battles between the children of the late property developer Aaron Israel stands out.

The Israel brothers — Harvey, Alan and David — have been fighting on and off in court with their sister, Diane, and their late father over the family fortune for 25 years.

Now David Israel is suing his sister for more than $1 million, alleging she hired a private eye who bugged his Northbrook office with a recording device hidden inside a teddy bear.

A recently filed federal complaint includes a photo of the scarf-wearing pink bear, which David says he received from a cancer charity. According to the lawsuit, David cut open the bear and found a listening device inside it after he was taunted by an anonymous text-messager who told him about his office being bugged and said there was “a big surprise” inside the bear.

The taunting text and other creepy anonymous messages (including one telling him “A bit hot to be wearing that shirt don’t you think David?”) were sent by a private eye hired by Diane, according to David’s lawsuit, which also alleges that a listening device was installed in a plant pot, and that his Highland Park home and Gold Coast condo were bugged along with his cars.

Though the private eye, Michael Bucon, in April pleaded guilty to planting the bugs, Diane denies the allegations and wants U.S. District Judge Andrea Wood to throw out the lawsuit... more

Google Home Mini Caught 'Spying' on Owner

A flaw has been discovered in the new Google Home Mini that allows the device to secretly record without the user knowing and sending the information to Google.

The flaw was discovered last week by tech blogger Artem Russakovskii and written about on Android Police. Russakovskii, who was given a free sample device before the official launch later this month, first noticed the device continually turned on and off on its own. Later, when he checked the activity logs, he saw that the device was recording without being prompted.

"My Google Home Mini was inadvertently spying on me 24/7 due to a hardware flaw," Russakovskii wrote.

In a letter to Google, he added: "Needless to say, if a listening device records almost every minute of every day and stores it remotely, we're talking about a huge privacy violation." Google then sent out an engineer to pick up and examine the next day. They then said the problem stemmed from a a glitch on the device's touch pad.

Spying Using Acoustic Imaging Via Smart Devices

A team of student hackers have demonstrated a method for using music to turn smart devices into tools for spying. The system is based on sonar, and embeds an inaudible signal into songs played on a smartphone or TV. The system can then use the device’s microphone to listen to how the signal bounces, and track the movements of anyone near the audio source.

The University of Washington research team behind the technology, known as CovertBand, tested it using a 42-inch Sharp TV in five different Seattle homes.

They found that the method is able to track the physical movements of multiple people to within 18 centimeters of accuracy, and even differentiate between particular gestures and motions. The tech can also track people, though less accurately, through walls.

They also demonstrated that listeners couldn’t distinguish between songs containing the hidden sonar signals, and those without it. ...and all CovertBand needs to work is a speaker and a microphone. more

So You Named Your Robot Bedmate, Mata Hari. Cute.

At the Hack in the Box security conference later this week in Singapore,

Argentinian security researchers Lucas Apa and Cesar Cerrudo plan to demonstrate hacker attacks they developed against three popular robots: the humanoid domestic robots known as the Alpha2 and NAO, as well as a larger, industrial-focused robotic arm sold by Universal Robots.

The duo plan to show that they can hack those machines to either change critical safety settings or, in the case of the two smaller bots, send them whatever commands they choose, turning them into surveillance devices that silently transmit audio and video to a remote spy.

"They can move, they can hear, they can see," says Cesar Cerrudo, the chief technology officer of IOActive, where both of the researchers work. Those features could soon make robots at least as tempting a target for spies and saboteurs as traditional computers or smartphones, he argues. "If you hack one of these things, the threat is bigger."...

Privacy invasion presents a more realistic worry... domestic robots contain mobile cameras and microphones whose data a spy could not only intercept, but manipulate and move at will around a target's house.  more

Security Director Alert # 522 - Spying USB Power Plugs & Charging Cables

Freely for sale on Amazon's marketplace, and plenty of other online stores, are USB and iPhone cables that can be used to listen to your phone calls and track your location.

When these cables are connected to a power source they can use a SIM card to connect to a mobile network. The hardware is unsophisticated but can send both audio and very coarse location data to a third-party...

A more worrying feature is the ability of the cable to detect sound over a certain threshold and then call a pre-programmed number. Once it has done this is relays the sound near it, be that a phone call or conversation, and allows a third-party to listen in.

Not only are there cables that do this, there are also USB power adaptors for your wall outlet that have the same SIM functionality.

Cables and power adapters like this should also be something of a worry to firms that need their security too, they may well not be noticed by security checks and could be responsible for a lot of sensitive information walking out the front door. more

Best Practice: Include the inspection of cables and charging blocks as part of your TSCM inspections.

Murray's TSCM Tip # 623 - Hiding in Plain Sight - The USB Microphone

USB microphones have many legitimate uses, students recording lectures, for example. Much more sensitive than a laptop's built-in microphone, they are perfect for that application. They also make eavesdropping on co-workers very easy.

The Plausible Deniability Bonus... Hey, it's not a bug. It's a legitimate piece of office equipment.

If you see one of these in a laptop, always assume it is recording. Some USB microphones have a red tally light, but a dot of black paint (or a piece of electrical tape) can cripple that tip-off. 

From the seller...
"This microphone is capable of picking up all of the sounds in large room (range of approximately 80 feet) or it can pick up small area its up to you, because you control the amplifier power! It's small size makes it perfect for situations where you don't want to draw attention to the fact that you are recording audio right into your computer."

Visit counterespionage.com to learn more about what you can do to detect and deter electronic eavesdropping.

Security Researchers: Amazon Echo Can be Turned Into a Spying Device

Security researchers have recently shown that the popular Amazon Echo speaker can be hacked to eavesdrop on conversations without permission.

Security firm MWR InfoSecurity claims it was able to exploit a vulnerability which turns the Alexa-fueled device into a “wiretap” without altering its standard functionalities.

But before you get all alarmed, let us tell you the vulnerability was found to affect only 2015 and 2016 versions of the Amazon Echo. On top of that, in order to successfully hack the speaker, a hacker would need to have physical access to it. So you might want to lock your Amazon Echo away when your computer wiz cousin comes over for a visit. more

Amazing $1.00 Gadget for Savvy Investigators

I recently came across this gadget on eBay.

It's a Bluetooth wireless remote control for smartphones (iOS & Android). Basically made for the selfie crowd, investigators will find applications for it as well. Not bad for a buck.

It comes with a battery. No instructions needed. Just flip the side switch, and pair it with your phone.

You can now be up to 30 feet away from your phone and snap photos, or take movies.

How can you go wrong for $1.00? Did I mention shipping was FREE! The catch... it will take about a month to arrive. Mine came from Thailand, probably via message in a bottle.

Need one quicker, a California ebay'er has them for $4.20, Free shipping.

Shops Using Spy Techniques to Monitor Customers' Facial Expressions

New technology being installed by retailers in Europe and the US, and being trialed in the UK, can spot if a customer cannot find a product, read their reaction to an outfit or spot thieves in a bid to keep up with online retailers. 

Shops are using new spy techniques to monitor customers' facial expressions, heart rate and even pupil dilation while they browse the aisles.

Technology installed by one French bookseller is able to detect shoppers' movements and facial expressions and alert staff that they may require assistance.



The technology could save retailers thousands of pounds by ditching the laborious marketing method of interviewing shoppers and focus groups. more

15 Photos of ATM Scams

Take note of some of the most common ways thieves will try to steal your credit card details.


 Fourteen more photos.

NSA’s Leaked Bugging Devices - Reverse Engineered

Radio hackers have reverse-engineered some of the wireless spying gadgets used by the US National Security Agency. Using documents leaked by Edward Snowden, researchers have built simple but effective tools that can be attached to parts of a computer to gather private information in a host of intrusive ways.

The NSA’s Advanced Network Technology catalogue was part of the avalanche of classified documents leaked by Snowden, a former agency contractor. The catalogue lists and pictures devices that agents can use to spy on a target’s computer or phone. The technologies include fake base stations for hijacking and monitoring cellphone calls and radio-equipped USB sticks that transmit a computer’s contents.

But the catalogue also lists a number of mysterious computer-implantable devices called “retro reflectors” that boast a number of different surreptitious skills, including listening in on ambient sounds and harvesting keystrokes and on-screen images. more

Install an Internet Connected Microphone and Camera in Your Bedroom?!?!

Amazon is giving Alexa eyes. 

And it's going to let her judge your outfits.

The newly announced Echo Look is a virtual assistant with a microphone and a camera that's designed to go somewhere in your bedroom, bathroom, or wherever the hell you get dressed. more

Amazon is betting you will. I'm taking bets on how long before the hackers over. ~Kevin

New High Seas Spybot - Submaran S10

Part sailboat - part submarine, a new remarkable drone can patrol the oceans for months without stopping, powered by only the wind and the sun.

Developed by Ocean Aero, the Submaran S10 is autonomous, able to conduct missions on its own. This drone can sail on the surface of the ocean and then transform to dive beneath the surface traveling, similar to a submarine.

The hybrid drone can dive to depths of about 660 feet, which makes it useful not only for avoiding detection, but to discreetly conduct its own surveillance as well.

Along with protecting the US coastlines, technology like this could be used to quietly monitor, surveil and collect information for defense and intelligence.  more

Spy Satellite Calibration Crosses

via wired.com 
Venture into the Sonoran Desert about an hour south of Phoenix 

Click to Enlarge

and you’ll eventually stumble upon a concrete cross. More than 100 dot the terrain, each of them 60 feet across and spaced precisely one mile apart. The government used them to calibrate the world’s first spy satellites as they peered down on Russia and China while photographing more than 750 million square miles of the planet.

The 95 satellites of the once top-secret Corona project sent their last images in 1972, but the calibration markers still stand in a grid that once measured around 16 square miles. “It’s such a massive thing in terms of its scale, but it pales in comparison to the scale of history that it’s a part of,” says Julie Anand. She and Damon Sauer have spent the better part of three years photographing the markers and mapping the satellites that pass over them for Ground Truth: Corona Landmarks.

The Cold War’s Least Believable Surveillance Strategy

In an effort to gather information from behind the Iron Curtain, the U.S. Air Force launched hundreds of spy balloons to float over the Soviet Union, collect photographic coverage, and hopefully reappear in friendly airspace for midair recovery...

In the days before reconnaissance satellites, balloons were seen as a safer alternative to proposals for manned overflights, and less provocative than plans to attach cameras to cruise missiles. But the audacity of the balloon program also reflected the tremendous appetite for recon information in Washington. In his 1991 history of the Moby Dick program, as it was known, Curtis Peebles describes how “the reconnaissance balloon had the highest national priority of 1-A. The only other project to share this priority was the hydrogen bomb. Knowledge is power.”

The balloons carried a 150-pound metal box with the approximate dimensions of an old television. Inside, a camera, film, and electronics were shielded from the conditions by several inches of styrofoam. Two additional tubs of ballast provided the balloons with rudimentary navigational aids. If sensors indicated a drop in altitude, magnetic valves inside the tubs could gradually release its steel dust to lighten the load. more