Spy Toolkit Item #141 - Dissolving Paper

Sources:
Mitsui USA
Endless Technologies
Nic Law Enforcement Supply
Defense Devices

Bonus...
Next time you venture out into that unhygienic world of ours, make sure you bring along our Dissolving Paper Soap! Simply wet your hands and rub them together with one sheet of paper soap -- and watch as the "paper" transforms into sudsy lather!

Meanwhile, over at Xerox...
Scientists demonstrated paper that can be reused after printed text automatically deletes itself from the paper's surface within 24 hours. Instead of trashing or recycling after one use, a single piece of paper can be used a second time, and reused up to 100 times, said Eric Shrader, area manager at PARC. (more)

Corporate TSCM - Bug Sweep Demand vs. Supply

The Australian Securities and Investments Commission (ASIC) released a request for tender (RFT) to source technical surveillance counter-measure (TSCM) services. ASIC hopes to find a company to sweep its offices and IT systems for spying devices, a task ASIC is mandated to do.

The problem with ASIC's RFT is that it wants the TSCM — a phrase coined by military describing scanning a site for spying devices — from a single company.

"For TSCM, which is the bug detection process, there are not enough qualified people in Australia with the right level of industry training or government experience to provide the service," Les Goldsmith, managing director of Australian counter-intelligence firm, ESD Australia told ZDNet.com.au.

Goldsmith said his company would not bid for the work due to the likely scale of it. However, he added, "I don't see for this contract they're going to find a single contractor that can do that scope of work."...

Goldsmith said that spying devices are found in around three out of every 10 inspections within Australia, with much higher rates in Asia, particularly in the government sector. (more)

Interesting statistic. Here in the US, the 35-year average I have seen (subjectively) is more like one in 20. (30% vs. 5%) This may be due to the already relatively high security posture of my client family. But, it doesn't matter. All it takes is one strategically located bug or wiretap to cripple a corporation.

More interesting, however, is the one-stop-shopping problem. The solution I had to develop about 10-years ago, due to client demand, can be seen here.

Note to ASIC: Don't let defeatist news reports fool you. I personally know of several quality TSCM providers in Australia who would pool their resources and offer you one-stop shopping, like I do. Please feel free to contact me if you need any help in getting this ball rolling.
Kevin

Question of the Week - Secure Conference Calls

"Are you aware of whether or not there is such a thing as a company that offers a 'secure' conference calling service? A company that provides an 800 number that people can call in to and participate in a 'secure' multi-party conference call?"

No one-stop solutions. How about a two-stop solution?

Set up encrypted conference calls via VoIP using ZFone. Combine this with an on-line conference call service which uses Asterisk software.

• Participant requirements
-- Access to the Internet.
-- ZFone software on their computer (lap or desktop). It's FREE.
-- Optional, for added privacy:
--- A plug-in headset $3.99
--- Or, plug-in ear-buds $23.99

• Teleconferencing requirements
-- Schedule calls with an Asterisk-based provider, like Rondee. It's FREE. (others)
-- Major carriers offer secure 'web-meeting' services for a fee. (example)
Note: Conference providers have access unencrypted calls; CALEA.

Other options
• VoIP telephony - Just route all calls through a Virtual Private Network (VPN). Good for inter-company conference calls.

"Very occasionally, there is a half second of delay when you have a few VPN-based users on a conference call together, but that has a nice social side effect of stopping people from trying to interrupt each other." Posted by Bradley M. Kuhn on June 20, 2008.

• Polycom Encrypted Video Conference Calling (Point to Point)

As I learn of new solutions I will let you know.
Until then, I hope this helps.
Kevin

SpyCam Story #480 - Clickjacking ALERT

A security researcher in Israel has released a demo of a “clickjacking” attack, using an JavaScript game to turn every browser into a surveillance zombie.

The release of the demo follows last month’s partial disclosure of the cross-platform attack/threat, which affects all the major desktop platforms — Microsoft Internet Explorer, Mozilla Firefox, Apple Safari, Opera and Adobe Flash.

In Guy Aharonovsky’s demo game, a Web page is set up to seamlessly hide another page in the background that’s actually managing the target’s Adobe Flash Player privacy settings manager.

Using a series of clicks bouncing around the rigged page, Aharonovsky is able to silently hijack the user’s clicks to modify the Flash privacy settings and take complete control of the installed webcam.

The wet dream of every private eye and peeping tom. Imagine this scenario, you play a short game on the web and by doing that you unknowingly grant someone full access to your webcam and microphone.

If you don’t want to try it or don’t have a webcam connected, you can see the attack in action in this YouTube video.
[more]
[ SEE: Clickjacking: Scary new cross-browser exploit]
[ UPDATE: The details are out. Lots of unresolved clickjacking issues]
[Quote of the Day: "...the average end user would have no idea what’s going on during a Clickjack attack." – Ryan Naraine]

FINAL UPDATE – 10/15/08
Adobe Systems has released a new version of its Flash Player software, fixing a critical security bug that could make the Internet a dangerous place for Web surfers.

The new Flash Player 10 software, released Wednesday, fixes security flaws in Adobe's multimedia software including bugs that could allow hackers to pull off what's known as a clickjacking attack, wrote Adobe spokesman David Lenoe in a blog posting.

For those who can't update to this new version of Flash, a Flash 9 security patch is still about a month off, he added. Adobe rates the clickjacking bug as 'critical.' (more)

In Brazil, Business as Usual Often Involves Wiretapping

via The Wall Street Journal...
Brazilian banker Daniel Dantas is a very wary guy. He avoids sending email, switches phones frequently and makes calls from moving cars...

It all wasn't enough to escape Federal Police Inspector Protógenes Pinheiro de Queiroz. Beginning early last year, investigators led by Inspector Queiroz began monitoring dozens of phones and email addresses belonging to Mr. Dantas, his family and associates.

Mr. Dantas still faces charges related to the arrest, but Inspector Queiroz's methods are under the spotlight, too.

The bearded, bespectacled detective was hauled before a congressional committee, and police opened an internal inquiry. The head of Brazil's intelligence agency, whose operatives took part, was suspended pending an investigation into illegal wiretapping. Now, there's a growing debate in Brazil over what some call rampant official -- and unofficial -- eavesdropping...

Mr. Dantas's side hired Kroll Inc., the U.S. risk-consulting firm, to investigate Telecom Italia, as well as political rivals and journalists; Kroll even had hidden-camera films taken of the then head of the Banco do Brasil. But Brazilian police were wiretapping Kroll personnel and broke up the operation in a 2004 raid. Kroll, whose employees now face espionage charges, denies it acted illegally.

Officials in Italy say former Telecom Italia employees operated their own spy ring, at one point breaking into Kroll's computers. Prosecutors there are seeking to indict six ex-staffers, part of a probe that has targeted more than 30 people. Telecom Italia declined to comment. (more)

A Busy Week for Spy Chiefs Worldwide

French spy chief to step down
The head of France’s foreign intelligence agency is to step down in the coming days, an official said yesterday, following a shake-up in the upper reaches of the country’s spying networks. Pierre Brochand, the 68-year-old director of the DGSE, has led France’s overseas intelligence gathering since July 2002, and was notably involved in operations to win the freedom of French hostages in Iraq and Afghanistan. (more)

Local council hires former spy chief
Gloucestershire County Council has hired the former head of GCHQ to look into its overall performance and "challenge" the way the authority runs. Sir David Pepper, who ran the government's huge intelligence gathering base in Cheltenham from 2003 until earlier this year has been hired as a non-executive director of the council, working two days a month until April 2009. (more)

Spy chief dodged torture arrest
Discreet negotiations between Israel and the Netherlands allowed a former chief of Israel's security agency to avoid arrest on torture charges, sources say. Citing unnamed sources, the Israel newspaper Yedioth Ahronoth reported Tuesday that Dutch authorities were considering a request from an alleged Palestinian torture victim that former Shin Bet head Ami Ayalon be detained and taken to the International Court of Justice in The Hague during a May visit to the Netherlands. (more)

Israelis say spy chief killed Hezbollah commander Mughniyah
A panel of experts assembled by Israel's most powerful television channel honored Israeli Mossad chief Meir Dagan as the nation's "man of the year" for, among other things, killing Hezbollah commander Imad Mughniyah in the Syrian capital in February, according to a recent report in the Israeli newspaper Haaretz. (more)

Pakistan’s New Spy Chief
The chief of the Pakistani Army on Tuesday appointed a new head of the nation's top spy organization in a move that consolidated his control over an agency that the United States contends has been helping the Taliban mount operations against U.S. forces in Afghanistan. The new spy chief is Lieutenant General Ahmed Shuja Pasha, 56, director general of military operations, the nerve center for the Pakistani Army. (more)

Former Kazakh spy chief hurt in suspected kidnap bid
Kazakhstan's former spy chief Alnur Mussayev, who is living in exile in Austria, was seriously hurt in a suspected abduction bid, the Austrian prosecutors office said Friday, AFP reported. (more)

Former spy chief joins 42-day detention critics
The government's 42 days counterterrorism legislation came under fresh fire last night when a former director general of MI5 said the provision to hold suspects for six weeks without charge was excessive. Dame Stella Rimington became the second former MI5 chief in three months to come out against the controversial measures. (more)

Seoul Spy chief says North Korean leader's health has improved
South Korea's spy chief says North Korean leader Kim Jong Il's health appears to have improved. Legislators from South Korea's ruling party say National Intelligence Service chief Kim Sung-ho told them Tuesday that his agency believes Kim Jong Il's health "has improved a little." (more)

Israeli spy chief who masterminded bombing of Western targets in Egypt dies
Binyamin Gibli, who as director of Israeli military intelligence in the early 1950s was a key player in his country's most debilitating political scandal, the Lavon affair, has died, aged 89. Gibli initiated an illicit campaign of bombing and sabotage against Western targets in Egypt — and after being forced to resign, admitted having forged documents that falsely implicated his boss, the Israeli defence minister Pinhas Lavon, in the plot. (more)

Spy Chief Questioned
Grenada's former spy chief, Assistant Superintendent of Police (ASP), Anthony De Gale has finally been questioned in connection with reports of missing files from the department. The Spy Master was sent on his 120 days accumulated leave by newly installed Police Commissioner, James Clarkson after it was discovered that at the files at Special Branch were destroyed immediately after the July 8 General Elections which brought the then opposition National Democratic Congress of Tillman Thomas to power. (more)

Spy chief to speak on Haneef arrest
AUSTRALIA'S domestic spy chief will give evidence today on the arrest and investigation of Indian doctor Mohamed Haneef. ASIO director-general Paul O'Sullivan will be interviewed by the Clarke inquiry, which is investigating the bungled arrest and charging of Dr Haneef in July last year in connection with terror attacks in Britain. (more)

Indonesian court to proceed with murder trial of former spy chief
An Indonesian court on Tuesday rejected a motion by the defence to drop charges against a former senior intelligence official accused of ordering the killing of a prominent human rights activist. Purwoprandjono (who like many Indonesians uses only one name), 59, a former deputy chief of Indonesia's National Intelligence Agency, is accused of ordering the murder of Munir Said Thalib, an outspoken critic of the country's military. (more)

Former Italian Spy Chief Wants Rice
Italy's former spy chief, on trial for participating with the CIA in the abduction of a Muslim cleric, says he wants Condoleezza Rice to testify in the case. Prosecutors say Niccolo Pollari, former head of the Italian military intelligence service SISMI, and eight other Italians participated in the 2003 "rendition" of Hassan Mustafa Omar Nasr. (more)

SpyCam Story #479 - The Cost of Star Gazing

Malaysia - The man who trespassed and installed a spy camera in model Nasha Aziz’s rented apartment six years ago will spend six months in Kajang Prison after he failed in his appeal to quash his conviction.

Supervisor cum maintenance manager Ahmad Bakhtiar Abdul Kayoom (pic), 31, was found guilty of two charges of trespassing into the apartment rented by Nasha, whose real name is Noraisha A. Aziz, and intruding upon her privacy by installing a closed-circuit camera between the month of April and July in 2002.

The camera was wired to a maintenance office by Ahmad Bakhtiar, whose father owned the entire apartment block. (more)

The Case of the 'Knotso' Safe House

UK - A handheld computer reportedly belonging to Britain's domestic spy agency (MI-5) has been stolen from a house in northern England.

Police in the city of Manchester confirmed in a statement that a house had been broken into over the weekend and that an encrypted handheld computer was stolen. It is believed the burglar entered the house through an open window.

Press Association said the house was being rented by the domestic spy service MI-5.

The intelligence services have been hit by a number of security breaches recently. (more)

Meanwhile over at MI-6...
...police are investigating the sale of a camera on eBay that is said to have contained MI-6 images of terror suspects. (more)

Don't laugh.
If it can happen at the MI's, it can easily happen at your company, and probably does. What are you doing about it? Need help? Call me.

SpyCam Story #478 - Wolf J. Flywheel II

Two former employees of a Neiman Marcus store in suburban Chicago who were fired for having sex at work say the department store's management illegally videotaped them.

Steven Chalem and Veronica Miranda filed a lawsuit Tuesday in Cook County Circuit Court, saying a manager used a hidden camera. The lawsuit says the security employees were fired last October for "engaging in sexual activity" twice at the Northbrook store. It alleges the manager shared the videotape with other people and posted it on the Web.

The plaintiffs want damages for violation of Illinois' eavesdropping statute, emotional distress and other complaints. (more) (similar story)

SpyCam Story #477 - Night Rider, SpyCam Car

Peering its leering nose around the corner, just in time for the holidays, we have a mobile night-vision spy toy for the kids.

If teaching integrity, morals and ethics is just too hard, consider giving your kids a career in the world of spying. Idea! Bulking up on the spy toy training tools now can put that college fund right back into your pocket!

from the seller's web site...
"Use the video feed on this radio-controlled car to maneuver it carefully into dangerous territory.
With near-silent motors, high-traction tread and IR illuminators, it stealthily travels in the dark, providing you with real-time visuals... you see what the car sees!

The spy headset plugs into the controller and displays the live video into the eyepiece."

Requires 12 AA batteries, not included.
• 2.4GHz monochrome TV
• 1/4 VGR CMOS camera
• IR emitter for night vision
• 49MHz control frequency
• Up to 75 ft. range
(more)
Stay tuned for our yearly review of children's spy toys. The list gets longer each year. You will either find it fascinating, or revolting ...depending upon your moral quotient.
But, who are we to judge?
Right, Santa?

"Spy Software for Mobile Phones" Skirts Laws

via Wired...
Arizona company Retina-X Studios has released the latest version of Mobile Spy, a monitoring software for smartphones.

The software allows users to spy on SMS text and call details in real time online. The program runs in total stealth mode and no entries are shown inside a phone's task manager, says the company... The details can be then checked online without any further access to the phone.

The software is available for Windows Mobile and Symbian OS smartphones and a version for the iPhone is in development for a December release, says the company. Currently it is priced at $50 for three months use and $100 for a year.

This may be legal in some circumstances but it raises privacy questions.
• In what circumstances is it okay to use this phone?
• Can spying on kids really help create a better relationship with them?
• Or, to what extent can taking away employees' privacy be justified in the name of protecting the secrets of a corporation? (more)

Note: "Mobile Spy" does not allow audio eavesdropping, which explains how it circumvents current U.S. privacy laws.

Skype Acknowledges Chinese Spying

Skype's president has acknowledged that users in China have had instant messages both blocked and copied to servers owned by TOM Online, Skype's partner in the country.

According to Skype president Tom Silverman, Skype knew when it partnered with TOM that TOM would censor instant-messages containing certain keywords, according to rules set down by the Chinese government. Although Skype provides the underlying software code, TOM is considered to be the majority partner in China.In his blog post, Silverman reminded Skype's customers that the company had no intention of spying on customers that used the official version of Skype outside of China...

As Reuters noted, however, the TOM-Skype version of the Skype software is the only version that can be accessed inside the company.

"It's important to remind everybody that the issues highlighted in yesterday's Information Warfare Monitor / ONI Asia report refer only to communications in which one or more parties are using TOM software to conduct instant messaging," Silverman added. "It does not affect communications where all parties are using standard Skype software. Skype-to-Skype communications are, and always have been, completely secure and private." (maybe not) (more)

32 SpyCams. 14 Mics. 20 Years. 2000 Charges.

A SpyCam World's Record?
PA - The Norristown landlord who allegedly concealed cameras throughout his tenants' apartments for two decades...

Thomas C. Daley hiked his light-blue denim shirt up over his face... on his way into district court. There, the 45-year-old Phoenixville resident was arraigned on more than 2,000 charges by Magisterial District Judge Francis Lawrence Jr....

Prosecutors withdrew the two criminal complaints filed last month against Daley, replacing them with one document that added offenses related to 25 additional victims. That brings the total of victims identified in the complaint to 34 - all of whom "feel completely violated," said Montgomery County District Attorney Risa Vetri Ferman...

Ferman said authorities believe the real number of victims is substantially higher than 34. She said that police found 32 cameras, 14 of which had audio capability, and that Daley admitted spying on his female tenants - and their guests - for 20 years.

The statute of limitations for Daley's crimes allows prosecutors to file charges dating back three years...

Surrounded by piles of Daley's electronic equipment, Ferman detailed the "incredibly sophisticated scheme" he employed to catch his female tenants, most aged 20 to 30, in "compromising positions."

In some instances, the screws holding doorbells, towel rods, and ceiling fans were hollowed out to create "pinholes" linked to hidden cameras, she said. Daley ran lines into the basements of his apartment buildings, connecting them to DVRs; those were then connected to the Internet so he could access the footage from home, Ferman said...

The judge scheduled a formal arraignment date of Dec. 3 for and set bail at $1 million; Daley, again covering his face with his shirt, was returned to the Montgomery County jail. (more) (history)

Spying on Chinese Skype

Among China’s community of dissidents and activists, there’s a commonly held belief that, while e-mail and regular phone conversations may be subject to surveillance, Skype is safe from such interference.

Not so, according to a new report, which has uncovered a far-reaching web of surveillance of text messages sent through Tom-Skype, a Chinese joint venture between Ebay, which owns Skype, and Tom Online, the Chinese Internet subsidiary of Tom Group, a Hong Kong-based company controlled by billionaire Li Ka-Shing...

The full report is available here. Key findings are summarized...

–Full text chat messages of Tom-Skype users are regularly scanned for sensitive keywords. If the keywords are found, the messages are uploaded and stored on Tom-Skype’s servers in China.

–The text messages and other records containing personal information are stored on publicly accessible Web servers along with the encryption key that allows the data to be decrypted.

–Keyword scanning looks for terms relating to sensitive topics such as Taiwanese independence, banned religious sect Falun Gong, and opposition to the Communist Party.

–The surveillance may not be solely keyword-driven, as a number of stored messages contained only common words. The report suggests that “that there may be criteria, such as specific usernames, that determine whether messages are captured by the system.”

–The report focuses on text messages, but it says that information on voice calls is also being stored. Logs dating from August 2007 contain records of the IP addresses and usernames of all participants in voice calls (including the username and/or phone number of the recipient). (more)

15 Great, Free Privacy Downloads

One of the worst privacy invaders the world has ever seen is the Internet. When you surf, Web sites can find out where you've been and can gather other information about you. Trojan horses and spyware can snoop on you. Key loggers can capture your keystrokes as you type. Eavesdroppers can steal your passwords.

It doesn't have to be that way. These free products can save you from malicious software and eavesdroppers. Don't leave your PC exposed and vulnerable. (more)