Is this Web Site Malicious?

Special thanks to Lenny Zeltser...

Several organizations offer free on-line tools for looking up a potentially malicious website. Some of these tools provide historical information; others examine the URL in real time to identify threats:

• AVG LinkScanner Drop Zone: Analyzes the URL in real time for threats
• BrightCloud URL/IP Lookup: Presents historical reputation data about the website
• Cisco IronPort SenderBase Security Network: Presents historical reputation data about the website
• G-Data MonkeyWrench Beta: Analyzes the URL in real time for threats (about)
• F-Secure Browsing Protection: Presents historical reputation data about the website
• Finjan URL Analysis: Analyzes the URL in real time for threats
• KnownSec: Presents historical reputation data about the website; Chinese language only
• Norton Safe Web: Presents historical reputation data about the website
• ParetoLogic URL Clearing House: Looks up malicious sites discovered using a web honeypot; registration required
• PhishTank: Looks up the URL in its database of known phishing websites
• Malware Domain List: Looks up recently-reported malicious websites
• MalwareURL: Looks up the URL in its historical list of malicious websites
• McAfee Site Advisor: Presents historical reputation data about the website
• McAfee TrustedSource: Presents historical reputation data about the website
• Trend Micro Web Reputation: Presents historical reputation data about the website
• Unmask Parasites: Looks up the URL in the Google Safe Browsing database
• URL Blacklist: Looks up the URL in its database of suspicious sites
• URL Query: Looks up the URL in its database of suspicious sites and examines the site's content
• URLVoid: Looks up the URL in several website blacklisting services
• vURL: Retrieves and displays the source code of the page; looks up its status in several blocklists
• Web of Trust: Presents historical reputation data about the website; community-driven
• Wepawet: Analyzes the URL in real time for threats
• Zscaler Zulu URL Risk Analyzer: Examines the URL using real-time and historical techniques

On Corporate Intellectual Fruit ...and how to keep it.

Dodd-Frank related governance issues such as say-on-pay and proxy access have been well known focal points for boardrooms during the 2012 proxy and annual meeting season, but another issue has topped headlines and is of increasing concern to boardrooms: business intelligence gathering activities...

Effective corporate governance principles dictate that those who conduct unethical or, worse, illegal activities on behalf of a company must be brought to heel. 

The phrase “traditional intelligence gathering” has its roots corporate espionage. 

Popular targets include technology related industries such as software, hardware, aerospace, biotechnology, telecommunications and energy, among others... It is clear, however, that no specific industry or sector is immune to these issues. (more)

Intelligence is the fruit of creativity; the food by which companies grow. Fruit that falls and rolls into the road is picked up by competitive intelligence professionals, legally. But when they come on property and pick fresh, ripe fruit off the trees, it's illegal. With a good fence, you can keep all your fruit.

Pursuit Magazine Book Review - "Is My Cell Phone Bugged?"

By Stephanie Mitchell, CompassPoint Investigations / Pursuit Magazine

"'Nearly everyone carries instant access to phone service, and tapping has become a personal concern.' The well documented comprehensive guide Is My Cell Phone Bugged, by Kevin D. Murray, provides well-documented information and research addressing cell phone privacy issues.

I found the book well written and superbly formatted. Even those who are not technologically savvy will find it to be very user-friendly. At no time during my reading did I feel bogged down with complicated technical language! Mr. Murray’s explanation and thorough direction assists the reader in regaining their privacy and the security of their personal information. Mr. Murray’s guidance ensures the reader that cell phone security and privacy can be achieved even if you are not a counterespionage expert.

I was impressed with the wealth of information and knowledge I gained from this book. Topics include: communications technology, purchasing secure cordless devices, how to avoid pre-bugged cell phones, understanding and identifying spyware, preventing tapping and information leaks, caller-ID technology, and identifying when your phone is under surveillance. As an investigator, I was particularly appreciative of the Legal Issues chapter covering privacy laws in a clear and precise manner." (complete review)


Thank you — Kevin

From that wonderful state that brought you the Hatfield–McCoy feud... The Rat App

“If every West Virginia resident that owns a smart phone (and knows how to use it) gets this app . . . you'll literally have 10 (sic) citizen spy's working for you!” – a review at the Google Android app store

Snitching has eventually entered the digital age thanks to a new smartphone app that lets anyone, anywhere tell the police: “Hey! That’s kind of weird!”

Authorities in the state of West Virginia are encouraging residents to install an Android and iPhone application that lets alerting law enforcement of suspicious activity become as easy as a click of a button — or, for some smartphone owners, the touch of a screen.

The official government website for the state of West Virginia now prominently features a product available for download on select mobile devices. It’s the Suspicious Activity Reporting mobile application and it lets users type up notes about any mundane yet worrisome incident they witness and send it straight over to local law enforcement. The app even allows the user to capture and upload a photo of someone they might consider suspicious, only to then provide the police with a detailed visual description of someone who may — or may not — be up to no good...

The device’s manufacturers add that any tips, such as suspicious vehicles or mysterious packages, can be reported anonymously if the user opts for that choice. (more)

FutureWatch - The actual process of filing a report with a live police official filtered out most casual / grudge / unfounded / harassment complaints in the past. With app-happy ease and the promise of anonymity might not the floodgates of neighborly bile open? And, should we really believe that identifying information (phone number, GPS, etc.) won't get transmitted just because you pressed an app's anonymous button? When you call 911, caller ID blocking doesn't block.

Van Eck 2012 - Brain Sucking Cell Phone Spiders

The processors in smart phones and tablets leak radio signals that betray the encryption keys used to protect sensitive data. 

At the RSA computer security conference last week, Gary Kenworthy of Cryptography Research held up an iPod Touch on stage and looked over to a TV antenna three meters away. The signal picked up by the antenna, routed through an amplifier and computer software, revealed the secret key being used by an app running on the device to encrypt data. An attacker with access to this key could use it to perfectly impersonate the device he stole it from—to access e-mail on a company server, for example.

The antenna was detecting radio signals "leaking" from the transistors on the chip inside the phone performing the encryption calculations. Transistors leak those signals when they are active, so the pattern of signals from a chip provides an eavesdropper a representation of the work the chip is doing. When Kenworthy tuned his equipment to look in the right place, a clear, regular pattern of peaks and troughs appeared on his computer screen. They could be seen to come in two varieties, large and small, directly corresponding to the string of digital 1s and 0s that make up the encryption key.

"You could build an antenna into the side of a van to increase your gain—well, now you've gone from 10 feet to 300 feet." (more) (creepy computerized audio version) (Van Eck)

Info Security in 2 Steps - Train Your Humans, Have Your Technical Vulnerabilities Checked and Patched

There’s a famous saying that “amateurs hack systems, while professionals hack people.” The point is that security technology designed to stop hackers, spies, phishers and frauds are always compromised by timeless human weaknesses: inattention, incompetence and complacency.

Click to enlarge.

The only thing standing between your company’s information systems and the people who are out to compromise them is employees. Technical security vulnerabilities can be patched but humans are always vulnerable. (more) (need patching?)

Do Company Execs Know Sensitive Data When They See It? Many in IT Say No

Today’s companies, clearly very good at collecting data, seem “less savvy when it comes to how to classify and manage it.”

That’s the conclusion of a survey among 100 IT executives and others conducted by global consulting firm Protiviti, which finds that there is “limited or no understanding of the difference between sensitive information and other data” at nearly a quarter of the companies participating in its survey.

The report is titled “The Current State of IT Security and Privacy Policies and Practices." Its topics: how organizations classify and manage the data they accumulate; specifically how they ensure customer privacy when they handle sensitive data, and how they comply with federal and state privacy laws and regulations. (more)

Jamming on the Bus, or The Cell Phone Vigilante

PA - A man in Philadelphia decided he'd had enough with listening to his fellow bus passengers blab away on their cellphones. But instead of buying himself some noise-cancelling headphones or politely asking people to pipe down, he chose to fight back with a handheld device that jams their signals.

"I guess I'm taking the law into my own hands," he told NBC10, which caught him red-handed with the illegal jammer, "and quite frankly, I'm proud of it."

Those who ride the bus with the man say he should be ashamed, not proud. (more)

Certified Ethical Hacker (CEH) Course Growing

India - "We started ethical hacking courses in 2009 with five students which has increased to approx 200 students today," said Jyoti Chandolia, assistant manager, corporate education sales at Udyog Vihar-located Mercury Solutions Ltd, the first ethical hacking training centre to come up in the city authorised by the International Council of E-Commerce consultants (EC-Council).

"Hacking is not legal in India and this particular course can distinguish black hat hackers (bad guys) and white hat hackers (good guys) after being certified as a Certified Ethical Hacker (CEH). The main objective behind this is to make people aware that CEH course is not all about how to hack but also to scan and protect IT systems and networks of an organisation," she added.

The EC-Council is a member-based organisation that certifies individuals in various e-business and information security skills. It is the owner and creator of the world-famous CEH, Computer Hacking Forensics Investigator (CHFI) as well as many others programmes, that are offered in over 60 countries through a training network of more than 450 training partners globally. (more)

Former US Marine, Accused CIA Spy, to be Re-tried in Iran

Click to enlarge.

Iran’s Supreme Court has overturned a death sentence for spying handed down to a former U.S. Marine, Amir Mirzai Hekmati, ISNA news agency reported on Monday quoting a top judiciary official.

“The sentence was overturned by the Supreme Court … The case has been sent back” to the court for retrial, prosecutor general Gholam Hossein Mohseni Ejei told a press conference, ISNA reported. (more)

Poison Text Messages and Malicious Mobile Apps on the Rise

Nearly one in five mobile phone users have experienced some type of security threat with their device. That's the finding of a Cloudmark survey of 1,000 cellphone users, scheduled to be released Tuesday.

Poison text messages, nearly non-existent in the U.S. a few years ago, grew 300% in 2010 and 400% in 2011, accounting for about 1% of all text messages. "We've gone from totally clean to a trickle," says Rachel Kinoshito, head of Cloudmark's security operations. "Most people are seeing about one a month."

That foothold is part of a broader concern. Variations of scams that infest the Internet, through PC browsers, have begun spreading on a meaningful scale through mobile devices. And it looks like the bad guys are just getting warmed up. (more)

Business Espionage: Spy Who Stole DuPont's Secrets Pleads Guilty

A former DuPont Corp. scientist has pleaded guilty to conspiring to commit economic espionage for a company controlled by the Chinese government and agreed to testify against others charged with stealing secrets of a manufacturing process sought by China.

Tze Chao, 77, a DuPont employee from 1966 to 2002, admitted Thursday in a San Francisco federal court that he had provided confidential information about DuPont's titanium dioxide process to the Chinese-controlled Pangang Group Co. (more)

Japanese Acoustic Ray Gun Silences Blabbing Godzillas

Tired of listening to a boring talk, a lecture or a colleague rattling in the office? The Japanese have found an answer to your woes. You can now silence the talk with a speech jamming gun.

The device developed by Kazutaka Kurihara at the National Institute of Advanced Industrial Science and Technology and Koji Tsukada at Ochanomizu University can silence any person talking from about 100 feet distance.

When used the gun, an inbuilt microphone picks up the words being said and then plays it back 0.2 seconds later. According to an explanation provided by the two inventors, the human brain interprets this echo effect as silence. (more) (Kazutaka Kurihara's Website) (Speech Jammer Research Paper)

Kazutaka also has a flare for the dramatic. Watch as the jammer comes into view to do its deed. Reminds me of those wonderful Japanese 1950's horror movies.

Computer Mouse with Ears ...and its own Cell Phone

UK - Innocent-looking, regular office equipment are now increasingly being used by employers to monitor staff in Britain.

Employers use tools such as calculators and clocks that come with built-in cameras and listening device, to keep a track of their employees.

Now, even the regular PC mouse is no longer innocent. A variant, spy mouse, that looks the same as the normal mouse, comes with a listening device and a SIM card embedded in it. A phone call is used to activate the device, which then captures sounds and conversations within a 10-metre radius. (more) (many spy mice)

SpyCam Story #656 - This Week in SpyCam News

SpyCam stories have become commonplace and the techniques used, repetitive. While I will continue to keep lose track of the subject for statistical purposes, I won't bore you with the details. Only links to the stories will be supplied unless there is something useful to be learned.

SC - Teen in school Girl's Room with camera.

OR - Man in theater dressing room with camera.
IN - Former Notre Dame assistant registrar - video in bathrooms and dressing rooms.

WA - Missing Susan Powell's husband, and his father, video voyeurism.

SC - Two indictments in Myrtle Beach on voyeurism charges.

NJ - Rutgers spycam trial continues.

IN - Shoecam man sentensed to six months.

ID - Sister-in-law spycam'er appeals.

NC - Middle school teacher spycam'ing bathroom.

WA - High school teacher charged with voyeurism resigns.

ID - Man charged with video voyeurism; no details.

IN - High school custodian spycam's Boy's locker room.

FL - Man charged with through-the-bedroom-window video voyeurism.

UK - Camera in business washroom charged filed.

NY - Man spycam'ing in local tanning salon.

OH - Man videos woman in shower, three times.

IN - New trial date for swim coach accused of locker room filming.

FL - New video voyeur legislation making progress.

NM - Spycam in business bathroom; allegedly installed by owner.