McDonald's... "Over 4 Million Stolen"

Australia - Two men are being extradited to Perth to face charges of stealing more than $4 million from customers at fast food outlets in what police say is Australia's biggest-ever EFTPOS card skimming operation...

Officer-in-charge of the major fraud squad, Detective Senior Sergeant Don Heise, said the skimming occurred through September after the pin pads at the drive-thru counters of more than 20 McDonald's restaurants in the Perth metropolitan area were replaced with compromised machines.

The bogus keypad would then transmit the card's information to a nearby mobile or laptop.

The accounts of 4000 victims have been hacked into after the first withdrawal took place on October 5, with one suffering a loss of about $6000 to $7000.

During October, more than $4 million was stolen from bank accounts, using ATMs in NSW, Victoria, Canada, Great Britain, the USA, India and Malaysia. (more)

The device is the Ingenico PX328 pinpad, a decade-old terminal type, which is not tamper proof. Upgrade, if you got them! (more)

"Talk is over-rated as a means of settling disputes."

Tom Cruise is being sued for allegedly hiring a private investigator to illegally wiretap a magazine editor's phone, according to documents obtained by TMZ.com.

Michael Davis Sapir claims the movie star, along with attorney Bert Fields and jailed private investigator Anthony Pellicano, conspired to spy on him. (more) (more)

The One Minute TSCM Quiz

Our corporate clients are pretty smart. They learn quite a lot when they retain us. (They can ace this quiz.)

Think you know as much about TSCM and spybusting as they do?

Find out, take The One Minute TSCM Quiz.

If our quiz leaves you feeling up a pole, without a clue, you're not alone. Everyone starts that way.  Solution: Retain us in 2010.

FutureWatch - Video Surveillance Predictions

It is really not too hard to predict the future of CCTV. 

The future is here...

2010 - The end of the "Video Wall"

"Clean and green," is coming to the security center Situational Awareness Center. Video analytics is the brain in the box catalyst of change. 

One human. One screen. One unblinking computer, watching every video feed; analyzing everything it sees and popping it onto the "Situational Awareness Officer's" screen (or internal projection node) only when deemed necessary.

Video analytics is smart. Facial recognition with file linking, movement interpretation, psychological action profiling, letter/number/bar code reading, RFID tag sensor incorporation, intelligent threat assessment, people/vehicle counting, congestion/loitering assessment, and more.

Not impressed yet?
Look at it from management's point of view...
• Lower hardware investment.
• Lower maintenance costs.
• Lower electric bill.
• Lower payroll.
(more)

Scalable Situational Awareness

The Port of Brisbane is turning itself into a 3D video game. Brian Lovell, project surveillance leader, explains...

"You could imagine a single desktop interface that gives you all the information you need at a port, like the Port of Brisbane," he said. "The reason to go single desktop is that is the modern trend. It also means you can provide that information to emergency responders so if there is an incident at the Port of Brisbane you can provide not just the video feed but all the context information to emergency providers like the police, etc.

"What we do is have all the video feeds, which are placed [superimposed] on a 3D texture map surface – sort of like a game of Doom or a video game environment. The beauty of that is you don't need to know the camera numbers or where they are positioned because it is implicit in the display. So if you go, for example, to the oil bunkering facility on the map you just scroll along with your mouse and then zoom in and if there is any video camera present you can see, live, what is happening at that spot. It is a little like Google Street View except when you go in you are seeing a live camera feed." (more)

Slip the Mouse a Mickey

We are rapidly approaching 3D video... no, I am not talking about the kind with the goofy red/green glasses. This 3D will be extremely useful to the person monitoring the "Situational Awareness Center" of the future. No mouse in this person's hand. A tilt of the head will move them around their semi-virtual world. Apple's latest patent clued me in...

"An electronic device for displaying three-dimensional objects, comprising control circuitry, a display and a sensing mechanism, the control circuitry operative to:direct the display to display a three-dimensional object;direct the sensing mechanism to detect the current position of the user; transform the object to appear to be viewed from the detected current position; anddirect the display to display the transformed object."  (this worthwhile video will give you the idea)

Some of these things are already here and the really cool stuff is coming soon. ~Kevin

The Great Seal Bug - Part II

"The Thing" - World's Most Famous Bugging Device
This spybusters.com history page now has a Part II.
Here is some background from The Great Seal Bug (Part I)...

"In 1946, Soviet school children presented a two foot wooden replica of the Great Seal of the United States to Ambassador Averell Harriman. The Ambassador hung the seal in his office in Spaso House (Ambassador's residence). During George F. Kennan's ambassadorship in 1952, a routine security check discovered that the seal contained a microphone and a resonant cavity which could be stimulated from an outside radio signal."

Part I explains "The Thing" (as it was originally called), its first public display by Henry Cabot Lodge, Jr. at the United Nations General Assembly, an exploded view of the novel device, background on the inventor - Leon Theremin, and information from confidential sources.

Part II (released 12/17/09) is about, John W. Ford, the man who lead the TSCM team (of one) who discovered the device; Joseph Bezjian was his technician. Mr. Ford was well-regarded by diplomats and presidents and had many other exploits during his career. Some of these are included in The Great Seal Bug - Part II. Here is a quick example...
"Scott McLeod, suspecting that a certain safe in the Dept of State contained material compromising and embarrassing to a member of Congress, called in a safe expert to attempt to open the safe, after hours. Damaging the safe drawer beyond repair, and fearing an FBI or police inquiry, the damaged drawer was dumped off the 14th Street bridge into the Potomac."

Stop by, and pass the word. It is a great read.
The Great Seal Bug - Part I
The Great Seal Bug - Part II
-----------
Help document this historic bug in greater detail. If you have any knowledge, personal recollections, photographs, or know the current whereabouts of the original Great Seal or its bug, please contact me.

And, a big thank you to everyone who has already contributed! ~Kevin

Why ‘In-House TSCM’ Reminds Me of Trepanation

...published this month in WhiteNews
2010 is upon us and TSCM in the United States has changed dramatically since 2000. Yet, once in a while, I still hear from a client who wants to start an in-house electronic countermeasures department!

Seems a quaint notion today. But, who can blame them? In-house efforts were once commonplace. In fact, we used to provide training, and specified instrumentation purchases.

Over these past ten years, the landscape changed and organizations phased out their in-house efforts. In-house TSCM is pretty much a dead issue now. There are several good reasons for this...

1. These are not your father’s surveillance devices. Eavesdropping and recording devices these days may be purchased in a wide variety of excellent covert disguises. A physical inspection by an amateur (even with training) will miss all but the most obvious surveillance items. Today, an in-house search is barely adequate even for a small company with a few spartan conference rooms. At a multinational corporate headquarters, who’s executive floors are showplaces of technology, an in-house inspection is not just inadequate, it is negligent.

2. Human nature works against an in-house staff inspection. Physical searching is work. It involves bending, stooping, looking under tables. This is not to slight an otherwise excellent staff, but consider the reality...
- If you give someone more work, longer hours, they will want more money to do it. No money, no serious search.
- If you give someone the job of finding something they can’t recognize even if they see it, they will start thinking “there is nothing to see, so why look.”
You may get them to do it a few times, but it will fizzle out.

3. Unless a technician is active several days each week, the initial training will be forgotten. Inspecting the same, limited environment is mind-numbing as well.

A few years ago, one of our clients called us in for “advanced” training. They had purchased equipment and initial training from a manufacturer 3-4 years prior. Turned out their spectrum analyzer was working at only 30% sensitivity... and they weren’t aware they had a problem! “It always worked like this as far as I recall.”

4. Executives are sensitive about their privacy. On one hand executives want protection against electronic surveillance. On the other hand, they would be pleased if this could be accomplished without someone poking around their office... Especially, a lower-level, company employee who has a vested interest in, and understanding of, all the paperwork in their drawers.

Engaging a professional counterespionage research team addresses these issues.
- They know how to look, and what they are looking for.
- Their instrumentation is more likely to be the most current.
- Their searches are focused. They have no interest in company politics, and won’t be there the next day to gossip with other employees.
- They are acclimated to being in executive offices, i.e. they don’t play with the shelf toys.
- Most importantly, a professional team brings with them a wealth of field experience and knowledge that no part-time, in-house “tech” can possibly possess.

An in-house TSCM effort is a mental band-aid that doesn’t adhere well. It can only make the security department look bad in the long run. ~Kevin

SkyGrabber Snags Drone Feeds

Militants in Iraq have used $26 off-the-shelf software to intercept live video feeds from U.S. Predator drones, potentially providing them with information they need to evade or monitor U.S. military operations. (more)

FutureWatch - This will be fixed, but it was fun watching the video feeds (here in the U.S.) when drones were first being developed.

PI claims "I didn't know" & cops a plea ...zzzzz

FL - A private investigator linked to illegal electronic surveillance of some doctors at the Florida Eye Institute in early 2008 has entered a plea that could spare her jail time. Brenda Doan Johnson, of the 3400 block of Atlantic Boulevard, pleaded no contest on Tuesday as part of a deal reached with the State Attorney’s Office, her attorney, Andrew Metcalf said... Outside Hawley’s courtroom, Johnson tearfully said she apologizes to doctors Karen Todd, Val Zudans and Mark Gambee. “I didn’t know this was illegal,” she said. (more)

Illegal Eavesdropping Indictment for Cop

NY - A suspended Schenectady police officer has been indicted on felony charges of eavesdropping, computer trespass, computer tampering, harassment and stalking in connection with a series of incidents between November 2008 and November 2009. As a result of the indictment, Officer John Lewis has been suspended from the department for a period of 30 days without pay, said Sgt. Eric Clifford. (more)

Wiretap World News

Columbia - Last week’s cover story in the leading Colombian newsweekly Semana—known for investigations that have shaken the core of the administration of President Alvaro Uribe Vélez—revealed further evidence of illegal wiretapping of journalists by the Administrative Department of Security (DAS), the country’s national intelligence service. The article, titled “A handbook for threats,” disclosed outrageous details about the intimidation techniques used by the DAS on journalists it considered dangerous. (more)

Turkey - A long-running power struggle between secular elites and the religiously conservative government in Turkey is back on the agenda, as accusations of illegal wiretappings and a controversial court decision have triggered speculations about possible new efforts by the judiciary to close down the ruling party... government critics claim that the AKP has been eavesdropping on judges and prosecutors in an effort to intimidate them. (more)

Indonesia - A meeting between the chairmen of the Corruption Eradication Commission (KPK) and Communications and Information Minister Tifatul Sembiring ends Tuesday with both sides agreeing to keep cooperating in fixing a draft on wiretapping regulation... “There were two matters discussed [in the meeting], court permission [for wiretapping] and [the establishment] of a national interception center... (more)

United States - Warrantless wiretapping of communications and other illegal electronic surveillance operations are continuing under the Obama administration at levels commensurate with those seen during the George W. Bush administration. WMR has learned from informed sources that the Eric Holder Justice Department is also pursuing a criminal indictment against at least one intelligence agency official for leaking details of the National Security Agency’s warrantless wiretapping program with the previous Top Secret code name of “STELLAR WIND.” (more)

The U.S. Supreme Court yesterday agreed to decide whether users of text-messaging services have a reasonable expectation of privacy in the contents of copies of messages the service provider stores on its network. In a brief order, the justices granted certiorari in City of Ontario v. Quon and USA Mobility Wireless v. Quon, 08-1332 and 08-1472. The Ninth U.S. Circuit Court of Appeals ruled last year in those cases that the Ontario Police Department violated the Fourth Amendment rights of one of its officers and three others with whom he had exchanged text messages on a department-issued pager. (more)

Kenya - A section of human rights organisations have proposed a raft of amendments to the Harmonised Draft Constitution on issues of national security, including limiting the powers of the National Security Intelligence Service (NSIS). ...said the draft should enact provisions which will bar the NSIS from tapping into people’s conversations without obtaining court orders. (more)

Guatemala - Supervisor of Presidential Security Detail Assassinated in Guatemala
The attack is the latest in a series of incidents involving the Secretariat for Administration and Security (SAAS). In September, the director of SAAS was detained on espionage charges following the discovery of covert audio and video recording equipment in the president’s offices and residence. (more)

SpyCam Story #564 - Hokey may go to Pokey

Spain - The owner of a wedding venue and disco in Cazorla (Jaén) has been arrested after police discovered spy cams he had installed in the women's toilets.

C.D.M.V. (30), a local resident of Cazorla and owner of El Clan, a popular local disco and restaurant, installed secret cameras in the stalls of the toilets in the Ladies of his establishment "with the intention of procuring indecent images", according to the police report.

The police say that images from as long ago as the 8th of December 2008 were found on the hard drive. The police operation was launched after a woman discovered one of the cameras and notified authorities.

Police are now attempting to discover if the man was working with any organised group or if any of the images have been uploaded to the internet. (more)

Christmas Gift List from Weburbanist.com

"15 Cool Hi-tech Spy Gadgets,
Oh Wait…
Creepy Gifts for Stalkers?"
(more)
Nothing new. The usual spy gadgets we warn you about all year.

SpyCam Story #563 - Fed Up

PA - An FBI security officer who videotaped teenage girls as they undressed and tried on prom gowns at a charity event has been convicted of invasion of privacy.

Thirty-five-year-old Charles Brian Hommema of Buckhannon was sentenced Wednesday to six months in jail, but Marion County Magistrate Hank Middlemas suspended that and imposed a year of probation. (more)

Wiretapping a Video Teleconference

John Kindervag discusses video teleconferencing wiretapping...
"Now while this technology has some real business value there are also inherent security flaws in video conferencing systems running across a corporate network. Because these internal networks are rarely, if ever, encrypted, it is possible to perform an eavesdropping attack on TelePresence or any other similar videoconferencing system.

Recently I was lucky enough to attend a hands-on VoIP and UC hacking class at VIPER Lab VIPER is run by my good friend and former colleague, Jason Ostrom. Jason and his team have been instrumental in developing new research and tools related to voice over IP (VoIP) and unified communications (UC) security. Their live distro VAST is available on SourceForge and contains several ground-breaking UC security tools.

Using one of the tools UCSniff I was able to recreate a scenario similar to the 30 Rock episode and intercept and view a live videoconference in real time. Here is a screenshot showing the UC Sniff tool intercepting a video call between Jason and me:


Anyone with access to your network can use this tool to eavesdrop on your voice or video conversations. This is why VoIP and UC security is so critical. Any unencrypted call is susceptible to this attack. Imagine that your employees can now listen in as your CEO discusses potential mergers or acquisitions. The risks are real but UC security is often overlooked." (more)

Supper Club Sale Reveals Owner's Bugs

Clarence Hartwig's Gobbler Supper Club, icon of Wisconsin, is heading for auction...
"Whoever buys the building will also get a few dozen gold-colored listening devices that were installed throughout the facility by Hartwig so he could eavesdrop on his employees..." (more)