The End of Anonymous On-Line Dating Has Arrived

Science fiction writers have long imagined a future in which facial recognition technology makes anonymity in public obsolete. A research study at Carnegie Mellon University suggests that this Minority Report future has already arrived, thanks to facial recognition products now commercially available, combined with the 750-million-person identity database called Facebook.

A CMU research team led by associate professor Alessandro Acquisti took candid photos of 93 random students on campus using a $35 webcam. Within seconds the researchers were able to determine the identities of a third of their photogenic guinea pigs, using off-the-shelf facial recognition software from PittPatt, a software company recently acquired by Google, and publicly available profile photos from Facebook. The researchers had an even higher rate of success using the same technology to identify more than 100,000 Pittsburgh singles with otherwise pseudonymous accounts on a dating site, adding yet more complexity to the world of online dating. (more)

The Top Twenty Information Security Tips for Business Travelers to Closed Society Countries

Foreign travel always brings security questions. For many countries the advice is mild, like "don't carry too much cash," and "don't drink the water".

Some countries are far different. They want your information. These are usually, but not always, "closed society countries".

The following is General Information Security Awareness & Advice to keep in mind while traveling in (or through) closed society countries. You may not be able to employ every bit of advice, in every situation. but everything that you can do will help. Security is a "how high can we build the wall" effort. 

Awareness
1. Assume your communications can be monitored by the government. This includes hotel, meeting room, business office bugging, and all forms of electronic communications.

2. The use of communications encryption is generally illegal. Certain exceptions may be available to financial industry transactions. Encryption of data on your personal devices is usually allowed, though if seized you will be asked for the decryption key or password.

3. Conducting a full Technical Surveillance Countermeasures (TSCM) inspection in a closed society country is problematic. Most of the instrumentation required is not allowed to be imported, or requires a special permit. The answer or approval you receive from one government official may not be honored by another government official. Equipment may be confiscated without remuneration. This type of activity could be classified (mistakenly or intentionally) as spying, thus subjecting the participants to imprisonment, and the company to fines, loss of business, etc.

4. Anything left unattended may is subject to retrieval of information from it. This includes: computers, cell phones, USB sticks, external hard drives, and written items.

5. Spyware may be introduced onto computers, cell phones, and other devices which can hold computer instructions. This may be accomplished while the device is unattended, or via unintentional download from email or web sites.

6. Gifts may contain surveillance electronics (bugs, tracking, etc.).

7. Electronic surveillance devices may be planted in your transportation (rental car, corporate aircraft, etc.)

8. Personal surveillance and social engineering tactics may be used against you. Tactics may include: location tracking, to "the friendly stranger" who wants to help or talk, to engineering compromising positions for blackmail purposes.

9. Be aware that foreign nationals employed by your company may also be employed by, or under obligation to, the host government.

10. Provide business travelers a copy of: Staying Safe Abroad: Traveling, Working & Living in a Post-9/11 World by Edward L Lee II

Advice
11. Bring only "isolated" electronics (cell phones, cameras, laptops, USB sticks – electronics only to be used on the trip, and which are never connected to other systems (like the company LAN, computer back-ups, or even computer-stored cell phone address books and back-ups).

12. Bring as few of these electronics as possible. If everything can be accomplished with a smartphone, just bring that.

13. Keep the amount of information on these electronics as small as possible.

14. Password protect your electronics. Encrypt the contents. A password alone will not prevent the theft of unencrypted information.

15. Do not purchase electronics while in a closed society country.

16. Keep electronic communications short, dull, boring and devoid of critical information.

17. Create alternate wording for sensitive or confidential information to use when communicating with the home office. Practice using the wording before leaving on the trip. You want to be low-key, but not sneaky.

18. Conduct TSCM inspections which are specially modified to conform with local restrictions. (The common mistake is giving up and deleting inspections from the security strategy.) There is still much that can be done. People other than the government also want your company's information. You can thwart them. Contract with an experienced specialist to accomplish this portion of your information security strategy.

19. Upon returning home, have the IT department check all electronics for spyware, wipe-erase all storage, and store the electronics for use on the next trip. Keep them isolated. Do not connect them to anything.

20. Upon returning home, have a Technical Surveillance Countermeasures (TSCM) inspection conducted of corporate aircraft, and all items brought back: gifts, meeting materials, audio-visual equipment, luggage, etc.

~Kevin

"Try this one on. It broadcasts you!" -R.F. Burns, Haberdasher

Antenna clothes help phone signal

Radio antennas that can be sewn directly onto clothes have been developed by US researchers. The team from Ohio State University created a prototype using plastic film and metallic thread.

The scientists reported in an IEEE journal that the system's range is four times greater than that of a conventional antenna worn on the body.

The technology could potentially be applied in a number of fields, but is primarily designed for military use. (more)

In Honor (and awe) of Hurricane Andrew Day...

"Be prepared." 

Hurricanes
http://www.nhc.noaa.gov/

Earthquakes
http://earthquake.usgs.gov/earthquakes/ 

 

FREE FEMA Publications

• Are You Ready? Guide
• Best Practices and Case Studies
• Dam Safety
• Earthquake
• Emergency Management Guide for Business & Industry
• Flood Hazard Mapping
• Flood Insurance (for Consumers)
• Flood Insurance (National Flood Insurance Program)
• Flood Mitigation Assistance Program
• Floodplain Management Publications
• Hurricane
• Mitigation Planning
• National Incident Management System (NIMS)
• Preparedness
• Rebuilding Resources for Homeowners and Communities
• Recovery Times
• Risk Management Series (Security)
• Safe Rooms
• Tornado
• Tsunami 

On Aug. 24, 1992, Hurricane Andrew smashed into Florida, causing record damage; 55 deaths in Florida, Louisiana and the Bahamas were blamed on the storm.

Google v. Facebook - Parry for Privacy

The rivalry between Google Inc. and Facebook Inc. has a new front: privacy.

Facebook said it would roll out new controls for sharing personal information on the social network on Thursday, giving its more than 750 million users new tools to manage who can see information about them. The company plans to move a number of privacy controls—which previously required navigating to a separate settings page—to users' homes pages and profile pages, next to where they view and post content.

Facebook and other social networks have at times been criticized for designs that lead users to inadvertently share information with a wider audience than they intended. Many Facebook users have hundreds or thousands of friends, and some have have urged the company to make it easier to target smaller groups when posting information. (more)

Your Life is an Open Book - Opt Out

advice from Violet Blue...

So-called “people search” sites like PeopleFinders, WhitePages and many more all buy, sell and trade your private information for profit. Few people are happy to know how any stranger - or marketing company - can obtain their home address for a few dollars, and that it’s challenging to stop.

But not impossible.

As we learned in How To Remove Yourself from People Search Websites, “peoplefinder” sites are giant databases that make money by selling your profile to anyone with a credit card. See also: our gallery: How people search sites get your information - and what you can do about it...

What You Can Do To Protect Yourself

There isn’t much we can do to stop people finder sites from getting public record information about us and making a profit off of it. Opting out of people finder sites will get your private life off the public market.

After you opt-out, there are a number of things you can do to prevent your info from being re-populated to people search sites:
• Only give out your information when you have to. If it’s optional, don’t do it. Facebook continually prompts me to give them my phone number for “better security” but I’m not falling for it.
• Look at your privacy settings on all your social networks; change them or lock them down if you can.
• When you do have to give info out for a profile or signup, consider giving the minimum of information, and be strategic about whether or not you give them your actual information. Only give them what’s absolutely necessary for site membership.
• Be wary of sites that make you register to use them. They’re not “free” to use if you give them something of yours they can - and will - sell.
• Don’t make it easy for sites to make an accurate profile about you, and know that your email address is in the hands of anyone you give it to. Use an alias or a pseudonym, and consider using an anonymous email that forwards to your real inbox to avoid getting spammed.
• Think twice before putting content on sites that want you to make a profile, like dating sites.
• Know that your likes, check-ins and and +1’s are public - not just public, but also profitable for the companies that made the buttons. Think twice about “liking,” “digging,” “upvoting,” and especially “checking in” using Foursquare and other location-based check-in services.
• Do what you can to block online tracking; it won’t hurt to use browser add-ons that block targeted advertising cookies and trackers.
• When you see a people search site being deceptive or feel you’ve been tricked by them, use this form to report them to the Federal Trade Commission. (more)

"Helloooo..." says Google++ Android Cell Phone Spyware App

A malicious Android app that disguises itself as Google's new social networking platform, Google+, is capable of stealing data, and answering and recording incoming phone calls, researchers said this week.

The spyware app disguises itself as Google+ by installing itself with the name “Google ++,” Jamz Yaneza, threat research manager at Trend Micro, told SCMagazineUS.com on Monday.

The malware contained in the app shares the same code structure as previously discovered Android spyware that also can steal information and record phone calls made from infected devices. Unlike the older variants, however, the new variant can automatically answer incoming phone calls on versions 2.2 and earlier.

“Once it is installed you won't know it is doing anything malicious,” Yaneza said. (more)

NSA Field Station Teufelsberg - a late post mortem

The NSA Field Station Berlin Teufelsberg was one of the premier listening posts of the cold war. Situated on top of the highest elevation in West Berlin - the Teufelsberg, the station had unobstructed reception of signals from all directions. And viewed from West Berlin, in all directions was "East". Situated on an artificial hill near a string of lakes, the Teufelsberg enjoyed excellent reception in most radio bands that were otherwise difficult to receive at long distances. The NSA got so far in their search for better reception, that they prolonged the operation of a flywheel that was accidentally found to be a excellent resonator for certain radar installations deep in the east. (more)

TSCM Employment - Rare Private Sector Opportunity

via LinkedIn...
Honeywell (Kansas City, MO facility) has a great opportunity for a Technical Security Specialist with a specialty in TSCM. Salary is up to $109K.

A BS degree, 7 years experience in Technical Security and 1 year of project leadership experience is required. If you are interested in this position please send your resume to: EddieMorris@SourceRight.com. SourceRight Solutions is Honeywell's Staffing Partner.

This is a rare corporate opportunity. Go for it, and let us know how you make out. Good luck. ~Kevin

Taps Up in a Down Economy

Nearly 4,000 federal and state wiretaps were authorized last year, an increase of 34 percent from the previous year, according to an annual government report.

The administrative office of the United States Courts released a report last month that found an all-time high of 3,194 wiretaps were reported as authorized in 2010 – 1,207 by federal judges and 1,987 by state judges – and only one application was denied...

Wiretap applications in California, New York and New Jersey accounted for 68 percent of all applications authorized by state judges, the study found... Drug offenses were cited most often for using wiretaps in investigations -- 84 percent of all applications were drug-related. Homicides came next, followed by racketeering.

The Electronic Privacy Information Center noted that the report does not include “interceptions regulated by the Foreign Intelligence Surveillance Act (FISA) or interceptions approved by the president outside the exclusive authority of the federal wiretap law and the FISA." (more)

SpyCam Story #617 - Bed & Breakfast, and a show

Australia - A landlord has pleaded guilty to indecently filming his tenants at bed and breakfast premises in Adelaide.

A court heard the man set up hidden cameras in smoke detectors and had been watching his victims for months.

Frederick Payne pleaded guilty to 18 counts of indecent filming. ...Payne, who is an electrician, installed cameras in smoke detectors in the master bedroom, and a bedroom used by the victim's daughter. ...the victim's boyfriend had discovered the cameras and they moved out of the Maslin Beach premises immediately.

Wires from the hidden cameras led to a television and DVD player in Payne's bedroom in the house he lived in next door. Police found hours of footage... (more)

Media Wiretapping did not start with News of the World

How far would the media of the time go for a story or some inside information? 

The FBI of the 1930s was concerned about newspapers and magazine personnel tapping the telephones of FBI Offices, especially the Chicago Division. 

In this 1935 memo from E. A. Tamm, these fears are set out with efforts of the Bureau to code their conversations to thwart the Chicago American, and also to purposely "test" the system.

According to the Encyclopedia Of Chicago website, "In 1900, Chicago had nine general circulation newspapers when William Randolph Hearst's sensationalistic evening Chicago American appeared, followed by his morning Chicago Examiner (1902). The American upheld the raucous Hearstian/Chicago tradition of “The Front Page,” even after it was sold to the Chicago Tribune in 1956, renamed Chicago Today, and turned into a tabloid. Today died in 1974. The morning Examiner became the Herald-Examiner in 1918 and died in 1939, never able to overtake the Tribune." (more)

The FBI 1935 Tamm memo – taken from the Dillinger file.

Caller ID Spoofing and Your Privacy

via The New York Times...

For all of the palace intrigue recently about who in Rupert Murdoch’s News Corporation kingdom knew what about phone hacking when, one fundamental question about the scandal has gone mostly unanswered: Just how vulnerable are everyday United States residents to similarly determined snoops?

The answer is, more than you might think.

AT&T, Sprint and T-Mobile do not require cellphone customers to use a password on their voice mail boxes, and plenty of people never bother to set one up. But if you don’t, people using a service colloquially known as caller ID spoofing could disguise their phone as yours and get access to your messages. This is possible because voice mail systems often grant access to callers who appear to be phoning from their own number.

Meanwhile, as Edgar Dworsky, a consumer advocate who founded ConsumerWorld.org, discovered recently, someone armed with just a bit of personal information about a target can also gain access to the automated phone systems for Bank of America and Chase credit card holders. (more)

So, what are your "friends" saying about you?

The real Banjo

Six-week old mobile application Banjo has been updated with a new feature that lets users virtually stalk locations, and the people there, in real-time. 

Banjo, for those unaware, is a new social discovery service which reveals the social network present at any given location at a particular time. To be clear, it’s not another social network, it’s a layer on top of social networks. With Banjo, you don’t have to create a profile, add friends or collect followers, or perform any of the other typical social networking behaviors.

Instead, to use Banjo, you simply launch the app to see what the people around you are saying and doing right now. The app pulls its data from social networking services like Facebook, Twitter, Foursquare, Gowalla, TwitPic and Instagram, accessing both the publicly available check-ins and the geotags that accompany status updates and posts. (more) sing-a-long

From our no free lunch department - Smartphone Juice Jacking

It certainly seems innocent enough at first glance: a free charging kiosk at an airport, hotel or shopping mall.

Most people wouldn't hesitate to charge their dying smartphones - even though the kiosk could theoretically be configured to read most of the data on a device and upload malware. 



To demonstrate the potential threat, Brian Markus, president of Aires Security, along with fellow researchers Joseph Mlodzianowski and Robert Rowley, built a juice jacking kiosk at Defcon 2011 to educate the masses about the risks associated with blindly plugging in mobile devices. (more)


Tip: This trick will not work on most devices if they are powered down entirely before charging.