Book Review - The Shadow Factory - NSA

Once upon a time the NSA was so secret that its acronym was said to mean No Such Agency.

Today we know a great deal more about it, in part because of James Bamford, who in The Puzzle Palace (1982), a portrait of the agency, offered secrets so sensitive that the NSA attempted to block the book's publication.

Now, with The Shadow Factory: The Ultra-Secret NSA from 9/11 to the Eavesdropping on America Mr. Bamford takes a close look at the National Security Agency's performance just before 9/11 and after. (more)

Bright Idea: LED WiFi Hotspots

Folks at Boston University's College of Engineering are researching a program aimed at developing the next generation of wireless communication -- based on visible light.

The aim of the initiative is to eventually develop an optical communication technology which would make an LED light, the equivalent of a Wi-Fi access point.

BU Engineering Professor Thomas Little paints the ideal scenario for these LEDs: "Imagine if your computer, iPhone, TV, radio and thermostat could all communicate with you when you walked in a room just by flipping the wall light switch and without the usual cluster of wires..."

Additionally, as these networks work on the "line of sight" theory, it would be impossible to eavesdrop into a network by a person sitting across the wall. (more)
Humm...
• Light reflects.
• Fiber optics channel.
• Photocells convert.
• Appearance points can be tapped.
Impossible-to-eavesdrop type "progress" often brings with it info-vulnerabilities to be discovered. I can't wait. ~Kevin

Meanwhile, from the minds at MIT...
Talking-Lights.com "The Talking Lights System (using fluorescent lamps) can be used to form a hybrid network that combines the advantages of optical location-finding with broadband WiFi duplex data transfer... The systems can also be used to offer information and guidance to shoppers, museum-goers and trade show attendees, improve security in office buildings and secure facilities..."

Historical Note: Both LEDs and fluorescent lights are already being used for electronic eavesdropping bugging purposes.

Spies, Get Ready For Halloween...

Learn from the Masters of Disguise
Magicians, like spies, excel at the art of misdirection and deception. Join Jonna and Tony Mendez, both former CIA chiefs of disguise, as they explore how magic and illusion have been used through the centuries to deceive the enemy.
Spy Magic: Disguise, Deception, Illusion and Espionage
At the International Spy Museum
Tuesday, 28 October; 6:30 pm $15.00 / Members $12.00 (more)

Get Your Disguise Gear Ready
Black Bar Glasses.
Make yourself photo-proof.
$8.99 (more)




And, above all...
Don't Act Furtive
Play this CD.
It features some really disturbing noises... unforgettable tracks like Unhappy Dog, the agonizing squeal of Violin Practice, and the exquisitely excruciating din of House Party.
$7.00 (more)

Remember Alex Allan?

Right, now do you remember Alex Allan?

If not check here. If so, read on and learn more about this spook.

Although the press knocked him a bit, his creative mental outlook and humor makes him perfect as an intelligence adviser. His resume is impressive. My kind of guy!

This Alex Allan caught the attention of Philadelphia, PA bookplate maven, Louis Jaffe...

"I was looking through an album of 20th century British bookplates this morning and selected a few of my favorites. There is never enough time to research every bookplate so the backlog grows.

If you know something about any of these owners or the artists please share it with us.

I purchased the Alex Allan bookplate in England after seeing it in The Bookplate Society Journal (vol.v11,1989). It is a wood engraving by Anne Jope and it is one of the earliest if not the first plate depicting a computer. The owner may be the larger than life Alex Allan, Chairman of The Joint Intelligence Commission Of The United Kingdom and Grateful Dead enthusiast." (more)
Update... This is, indeed, Mr. Allan's bookplate.

First quantum encrypted network goes live

The first network protected by quantum encryption has gone live at a scientific conference in Vienna...

The quantum cryptography systems rely on an application of the Heisenberg Uncertainty Principle, which broadly states that it is impossible to observe quantum information without altering it.

This makes eavesdropping impossible, since as soon as it takes place the change in data can be recognised and the network shut down. (more)

FutureWatch – Fistfights between network operators and governments demanding surveillance capabilities. Result: This level of protection may never trickle down to the average user of data services unless a back-door compromise can be reached. — Retrospect

Spy Toolkit Item #141 - Dissolving Paper

Sources:
Mitsui USA
Endless Technologies
Nic Law Enforcement Supply
Defense Devices

Bonus...
Next time you venture out into that unhygienic world of ours, make sure you bring along our Dissolving Paper Soap! Simply wet your hands and rub them together with one sheet of paper soap -- and watch as the "paper" transforms into sudsy lather!

Meanwhile, over at Xerox...
Scientists demonstrated paper that can be reused after printed text automatically deletes itself from the paper's surface within 24 hours. Instead of trashing or recycling after one use, a single piece of paper can be used a second time, and reused up to 100 times, said Eric Shrader, area manager at PARC. (more)

Corporate TSCM - Bug Sweep Demand vs. Supply

The Australian Securities and Investments Commission (ASIC) released a request for tender (RFT) to source technical surveillance counter-measure (TSCM) services. ASIC hopes to find a company to sweep its offices and IT systems for spying devices, a task ASIC is mandated to do.

The problem with ASIC's RFT is that it wants the TSCM — a phrase coined by military describing scanning a site for spying devices — from a single company.

"For TSCM, which is the bug detection process, there are not enough qualified people in Australia with the right level of industry training or government experience to provide the service," Les Goldsmith, managing director of Australian counter-intelligence firm, ESD Australia told ZDNet.com.au.

Goldsmith said his company would not bid for the work due to the likely scale of it. However, he added, "I don't see for this contract they're going to find a single contractor that can do that scope of work."...

Goldsmith said that spying devices are found in around three out of every 10 inspections within Australia, with much higher rates in Asia, particularly in the government sector. (more)

Interesting statistic. Here in the US, the 35-year average I have seen (subjectively) is more like one in 20. (30% vs. 5%) This may be due to the already relatively high security posture of my client family. But, it doesn't matter. All it takes is one strategically located bug or wiretap to cripple a corporation.

More interesting, however, is the one-stop-shopping problem. The solution I had to develop about 10-years ago, due to client demand, can be seen here.

Note to ASIC: Don't let defeatist news reports fool you. I personally know of several quality TSCM providers in Australia who would pool their resources and offer you one-stop shopping, like I do. Please feel free to contact me if you need any help in getting this ball rolling.
Kevin

Question of the Week - Secure Conference Calls

"Are you aware of whether or not there is such a thing as a company that offers a 'secure' conference calling service? A company that provides an 800 number that people can call in to and participate in a 'secure' multi-party conference call?"

No one-stop solutions. How about a two-stop solution?

Set up encrypted conference calls via VoIP using ZFone. Combine this with an on-line conference call service which uses Asterisk software.

• Participant requirements
-- Access to the Internet.
-- ZFone software on their computer (lap or desktop). It's FREE.
-- Optional, for added privacy:
--- A plug-in headset $3.99
--- Or, plug-in ear-buds $23.99

• Teleconferencing requirements
-- Schedule calls with an Asterisk-based provider, like Rondee. It's FREE. (others)
-- Major carriers offer secure 'web-meeting' services for a fee. (example)
Note: Conference providers have access unencrypted calls; CALEA.

Other options
• VoIP telephony - Just route all calls through a Virtual Private Network (VPN). Good for inter-company conference calls.

"Very occasionally, there is a half second of delay when you have a few VPN-based users on a conference call together, but that has a nice social side effect of stopping people from trying to interrupt each other." Posted by Bradley M. Kuhn on June 20, 2008.

• Polycom Encrypted Video Conference Calling (Point to Point)

As I learn of new solutions I will let you know.
Until then, I hope this helps.
Kevin

SpyCam Story #480 - Clickjacking ALERT

A security researcher in Israel has released a demo of a “clickjacking” attack, using an JavaScript game to turn every browser into a surveillance zombie.

The release of the demo follows last month’s partial disclosure of the cross-platform attack/threat, which affects all the major desktop platforms — Microsoft Internet Explorer, Mozilla Firefox, Apple Safari, Opera and Adobe Flash.

In Guy Aharonovsky’s demo game, a Web page is set up to seamlessly hide another page in the background that’s actually managing the target’s Adobe Flash Player privacy settings manager.

Using a series of clicks bouncing around the rigged page, Aharonovsky is able to silently hijack the user’s clicks to modify the Flash privacy settings and take complete control of the installed webcam.

The wet dream of every private eye and peeping tom. Imagine this scenario, you play a short game on the web and by doing that you unknowingly grant someone full access to your webcam and microphone.

If you don’t want to try it or don’t have a webcam connected, you can see the attack in action in this YouTube video.
[more]
[ SEE: Clickjacking: Scary new cross-browser exploit]
[ UPDATE: The details are out. Lots of unresolved clickjacking issues]
[Quote of the Day: "...the average end user would have no idea what’s going on during a Clickjack attack." – Ryan Naraine]

FINAL UPDATE – 10/15/08
Adobe Systems has released a new version of its Flash Player software, fixing a critical security bug that could make the Internet a dangerous place for Web surfers.

The new Flash Player 10 software, released Wednesday, fixes security flaws in Adobe's multimedia software including bugs that could allow hackers to pull off what's known as a clickjacking attack, wrote Adobe spokesman David Lenoe in a blog posting.

For those who can't update to this new version of Flash, a Flash 9 security patch is still about a month off, he added. Adobe rates the clickjacking bug as 'critical.' (more)

In Brazil, Business as Usual Often Involves Wiretapping

via The Wall Street Journal...
Brazilian banker Daniel Dantas is a very wary guy. He avoids sending email, switches phones frequently and makes calls from moving cars...

It all wasn't enough to escape Federal Police Inspector Protógenes Pinheiro de Queiroz. Beginning early last year, investigators led by Inspector Queiroz began monitoring dozens of phones and email addresses belonging to Mr. Dantas, his family and associates.

Mr. Dantas still faces charges related to the arrest, but Inspector Queiroz's methods are under the spotlight, too.

The bearded, bespectacled detective was hauled before a congressional committee, and police opened an internal inquiry. The head of Brazil's intelligence agency, whose operatives took part, was suspended pending an investigation into illegal wiretapping. Now, there's a growing debate in Brazil over what some call rampant official -- and unofficial -- eavesdropping...

Mr. Dantas's side hired Kroll Inc., the U.S. risk-consulting firm, to investigate Telecom Italia, as well as political rivals and journalists; Kroll even had hidden-camera films taken of the then head of the Banco do Brasil. But Brazilian police were wiretapping Kroll personnel and broke up the operation in a 2004 raid. Kroll, whose employees now face espionage charges, denies it acted illegally.

Officials in Italy say former Telecom Italia employees operated their own spy ring, at one point breaking into Kroll's computers. Prosecutors there are seeking to indict six ex-staffers, part of a probe that has targeted more than 30 people. Telecom Italia declined to comment. (more)

A Busy Week for Spy Chiefs Worldwide

French spy chief to step down
The head of France’s foreign intelligence agency is to step down in the coming days, an official said yesterday, following a shake-up in the upper reaches of the country’s spying networks. Pierre Brochand, the 68-year-old director of the DGSE, has led France’s overseas intelligence gathering since July 2002, and was notably involved in operations to win the freedom of French hostages in Iraq and Afghanistan. (more)

Local council hires former spy chief
Gloucestershire County Council has hired the former head of GCHQ to look into its overall performance and "challenge" the way the authority runs. Sir David Pepper, who ran the government's huge intelligence gathering base in Cheltenham from 2003 until earlier this year has been hired as a non-executive director of the council, working two days a month until April 2009. (more)

Spy chief dodged torture arrest
Discreet negotiations between Israel and the Netherlands allowed a former chief of Israel's security agency to avoid arrest on torture charges, sources say. Citing unnamed sources, the Israel newspaper Yedioth Ahronoth reported Tuesday that Dutch authorities were considering a request from an alleged Palestinian torture victim that former Shin Bet head Ami Ayalon be detained and taken to the International Court of Justice in The Hague during a May visit to the Netherlands. (more)

Israelis say spy chief killed Hezbollah commander Mughniyah
A panel of experts assembled by Israel's most powerful television channel honored Israeli Mossad chief Meir Dagan as the nation's "man of the year" for, among other things, killing Hezbollah commander Imad Mughniyah in the Syrian capital in February, according to a recent report in the Israeli newspaper Haaretz. (more)

Pakistan’s New Spy Chief
The chief of the Pakistani Army on Tuesday appointed a new head of the nation's top spy organization in a move that consolidated his control over an agency that the United States contends has been helping the Taliban mount operations against U.S. forces in Afghanistan. The new spy chief is Lieutenant General Ahmed Shuja Pasha, 56, director general of military operations, the nerve center for the Pakistani Army. (more)

Former Kazakh spy chief hurt in suspected kidnap bid
Kazakhstan's former spy chief Alnur Mussayev, who is living in exile in Austria, was seriously hurt in a suspected abduction bid, the Austrian prosecutors office said Friday, AFP reported. (more)

Former spy chief joins 42-day detention critics
The government's 42 days counterterrorism legislation came under fresh fire last night when a former director general of MI5 said the provision to hold suspects for six weeks without charge was excessive. Dame Stella Rimington became the second former MI5 chief in three months to come out against the controversial measures. (more)

Seoul Spy chief says North Korean leader's health has improved
South Korea's spy chief says North Korean leader Kim Jong Il's health appears to have improved. Legislators from South Korea's ruling party say National Intelligence Service chief Kim Sung-ho told them Tuesday that his agency believes Kim Jong Il's health "has improved a little." (more)

Israeli spy chief who masterminded bombing of Western targets in Egypt dies
Binyamin Gibli, who as director of Israeli military intelligence in the early 1950s was a key player in his country's most debilitating political scandal, the Lavon affair, has died, aged 89. Gibli initiated an illicit campaign of bombing and sabotage against Western targets in Egypt — and after being forced to resign, admitted having forged documents that falsely implicated his boss, the Israeli defence minister Pinhas Lavon, in the plot. (more)

Spy Chief Questioned
Grenada's former spy chief, Assistant Superintendent of Police (ASP), Anthony De Gale has finally been questioned in connection with reports of missing files from the department. The Spy Master was sent on his 120 days accumulated leave by newly installed Police Commissioner, James Clarkson after it was discovered that at the files at Special Branch were destroyed immediately after the July 8 General Elections which brought the then opposition National Democratic Congress of Tillman Thomas to power. (more)

Spy chief to speak on Haneef arrest
AUSTRALIA'S domestic spy chief will give evidence today on the arrest and investigation of Indian doctor Mohamed Haneef. ASIO director-general Paul O'Sullivan will be interviewed by the Clarke inquiry, which is investigating the bungled arrest and charging of Dr Haneef in July last year in connection with terror attacks in Britain. (more)

Indonesian court to proceed with murder trial of former spy chief
An Indonesian court on Tuesday rejected a motion by the defence to drop charges against a former senior intelligence official accused of ordering the killing of a prominent human rights activist. Purwoprandjono (who like many Indonesians uses only one name), 59, a former deputy chief of Indonesia's National Intelligence Agency, is accused of ordering the murder of Munir Said Thalib, an outspoken critic of the country's military. (more)

Former Italian Spy Chief Wants Rice
Italy's former spy chief, on trial for participating with the CIA in the abduction of a Muslim cleric, says he wants Condoleezza Rice to testify in the case. Prosecutors say Niccolo Pollari, former head of the Italian military intelligence service SISMI, and eight other Italians participated in the 2003 "rendition" of Hassan Mustafa Omar Nasr. (more)

SpyCam Story #479 - The Cost of Star Gazing

Malaysia - The man who trespassed and installed a spy camera in model Nasha Aziz’s rented apartment six years ago will spend six months in Kajang Prison after he failed in his appeal to quash his conviction.

Supervisor cum maintenance manager Ahmad Bakhtiar Abdul Kayoom (pic), 31, was found guilty of two charges of trespassing into the apartment rented by Nasha, whose real name is Noraisha A. Aziz, and intruding upon her privacy by installing a closed-circuit camera between the month of April and July in 2002.

The camera was wired to a maintenance office by Ahmad Bakhtiar, whose father owned the entire apartment block. (more)

The Case of the 'Knotso' Safe House

UK - A handheld computer reportedly belonging to Britain's domestic spy agency (MI-5) has been stolen from a house in northern England.

Police in the city of Manchester confirmed in a statement that a house had been broken into over the weekend and that an encrypted handheld computer was stolen. It is believed the burglar entered the house through an open window.

Press Association said the house was being rented by the domestic spy service MI-5.

The intelligence services have been hit by a number of security breaches recently. (more)

Meanwhile over at MI-6...
...police are investigating the sale of a camera on eBay that is said to have contained MI-6 images of terror suspects. (more)

Don't laugh.
If it can happen at the MI's, it can easily happen at your company, and probably does. What are you doing about it? Need help? Call me.

SpyCam Story #478 - Wolf J. Flywheel II

Two former employees of a Neiman Marcus store in suburban Chicago who were fired for having sex at work say the department store's management illegally videotaped them.

Steven Chalem and Veronica Miranda filed a lawsuit Tuesday in Cook County Circuit Court, saying a manager used a hidden camera. The lawsuit says the security employees were fired last October for "engaging in sexual activity" twice at the Northbrook store. It alleges the manager shared the videotape with other people and posted it on the Web.

The plaintiffs want damages for violation of Illinois' eavesdropping statute, emotional distress and other complaints. (more) (similar story)

SpyCam Story #477 - Night Rider, SpyCam Car

Peering its leering nose around the corner, just in time for the holidays, we have a mobile night-vision spy toy for the kids.

If teaching integrity, morals and ethics is just too hard, consider giving your kids a career in the world of spying. Idea! Bulking up on the spy toy training tools now can put that college fund right back into your pocket!

from the seller's web site...
"Use the video feed on this radio-controlled car to maneuver it carefully into dangerous territory.
With near-silent motors, high-traction tread and IR illuminators, it stealthily travels in the dark, providing you with real-time visuals... you see what the car sees!

The spy headset plugs into the controller and displays the live video into the eyepiece."

Requires 12 AA batteries, not included.
• 2.4GHz monochrome TV
• 1/4 VGR CMOS camera
• IR emitter for night vision
• 49MHz control frequency
• Up to 75 ft. range
(more)
Stay tuned for our yearly review of children's spy toys. The list gets longer each year. You will either find it fascinating, or revolting ...depending upon your moral quotient.
But, who are we to judge?
Right, Santa?