If you have insights about spy sites around the country, H. Keith Melton and Robert Wallace want to talk to you.
They are just about to publish their new book, Spy Sites of New York City, and are planning future editions.
Here's the pitch...
Friday, August 3, 2012
U.S. Spies Probably Won’t Blow Up Our Airplanes, TSA Concludes
For years, America’s spies had to take off their shoes before they got on planes, just like the rest of us.
No more.
The Transportation Security Administration has quietly enrolled government employees at three of the nation’s intelligence agencies in a program that allows them to pass through airport security with less hassle. (more)
No more. The Transportation Security Administration has quietly enrolled government employees at three of the nation’s intelligence agencies in a program that allows them to pass through airport security with less hassle. (more)
CIA Launches New Museum Gallery
The Central Intelligence Agency launched an enhanced and redesigned online gallery to highlight the Agency’s museum and its holdings.
The enhanced museum virtual gallery provides new content and a fresh look at exhibits few members of the public get the chance to see because they are located at our headquarters compound.
The online exhibit shares how some technologies developed for CIA ultimately benefited the public. For example, battery-technology advances led to new and efficient means to power medical devices and consumer goods—like pacemakers and digital cameras—and technology developed to help analyze satellite imagery now aids radiologists in comparing digital x-ray images for the detection of breast cancer. (more)
The enhanced museum virtual gallery provides new content and a fresh look at exhibits few members of the public get the chance to see because they are located at our headquarters compound.
The online exhibit shares how some technologies developed for CIA ultimately benefited the public. For example, battery-technology advances led to new and efficient means to power medical devices and consumer goods—like pacemakers and digital cameras—and technology developed to help analyze satellite imagery now aids radiologists in comparing digital x-ray images for the detection of breast cancer. (more)
Mobile users can see the new museum pages here.
Few CPR Their Firmware Against Printer Hack Attacks
Despite staged malware attack seven months ago, one in four HP laser jet printers still have default password settings.
Using freely available information and a budget of $2,000 (£1,280), professor Salvatore Stolfo and researcher Ang Cui from Columbia University's appropriately named Intrusion Detection System Laboratory used the printer's remote firmware update to install potentially crippling malware that could even be targeted to destroy the device itself.
While HP did challenge what turned out to be aspects of the way the demonstration was reported, the company took the conclusions seriously, acting quickly and with "diligence" to issue more than 56 firmware updates.
However, seven months later... only 1–2% (of printers connected to the Internet) have been updated. Of those, one in four is still using default password settings for printer updates.
...other brands may be just as vulnerable...
The key flaw comes because printers now have capabilities that let them receive documents from the cloud – in effect, emails.
...perhaps the "the safest bet is just not to be connected to the internet in the first place." (more)
Using freely available information and a budget of $2,000 (£1,280), professor Salvatore Stolfo and researcher Ang Cui from Columbia University's appropriately named Intrusion Detection System Laboratory used the printer's remote firmware update to install potentially crippling malware that could even be targeted to destroy the device itself.
However, seven months later... only 1–2% (of printers connected to the Internet) have been updated. Of those, one in four is still using default password settings for printer updates.
...other brands may be just as vulnerable...
The key flaw comes because printers now have capabilities that let them receive documents from the cloud – in effect, emails.
...perhaps the "the safest bet is just not to be connected to the internet in the first place." (more)
The Strange Case of the Bugging Billboard
Australia - Police are investigating rumours that the offices of the Greater Shepparton City Council, in northern Victoria, have been bugged.
Police say they have six recordings in their possession and the council is urging anyone with information to come forward.
An electronic billboard facing Shepparton's busiest intersection is saying information about councillors is about to be publicly leaked. (more)
Can't wait to see how this turns out.
An electronic billboard facing Shepparton's busiest intersection is saying information about councillors is about to be publicly leaked. (more)
Thursday, August 2, 2012
The USB Stick-it-to-ya - Bad Practical Joke or Brilliant Security?
Imagine this...
You come into the possession of a USB memory stick. You think it has valuable information on it. Not your information, but valuable nonetheless.
You come into the possession of a USB memory stick. You think it has valuable information on it. Not your information, but valuable nonetheless.
You're smart enough to know it might contain spyware so you plug it into an isolated computer where spyware can do no harm. Then... Fab-a-dab-a-ZAP! Fizzle. Smoke. WTF?!?!
Your USB port is fried.
You inspect the stick more closely and pop open the cover. Someone has soldered all four of the output pins together! Grrr, a 100% short circuit.
Bad practical joke or brilliant security? You decide.
Did the owner safeguard the information (the solder can be removed quite easily) in case of accidental loss, or did the owner just set you up for a nasty surprise?
Removing the solder and analyzing the information on the stick might yield the answer.
Why do I mention this?
1. It is another reason to avoid USB sticks from untrusted or unknown sources.
2. It's a true story.
~Kevin
The Top Two Things Business Spies Really Hate
The majority of information losses are caused by people, not electronic eavesdropping. Your employees are your weak links. They are tripped up by social engineering attacks, and their own poor security practices. They are also your first line of defense. You need them on your side to fix the problem.
Don't start by accusing them.
What if your loss is a concerted business espionage attack? What if your office is bugged? What if your cell phone is infected with spyware? Think of the damage a false accusation would cause. Morale and law suits top a long list of possible collateral damage.
An electronic surveillance detection sweep (aka TSCM) is the best first step. Work with a specialist who can also identify your other information security loopholes. Eliminate the eavesdropping and espionage possibility first.
Once you have cleared your organization of bugs and wiretaps, and plugged the info-leak vulnerabilities, think ahead. Be proactive. Follow up with security awareness training.
Resources:
Electronic Surveillance Detection and Business Counterespionage Consulting: Contact me for a referral to a competent specialist who suits your needs. ~Kevin
Tuesday, July 31, 2012
Cyber-Spy Malware Eavesdrops on Corporate, Government Targets Worldwide
More than 200 unique families of malware have been used to eavesdrop on corporate and government employees, including attacks on the Japanese government, according to the results of a study of cyber-espionage activities released on July 25.
Unlike the massive botnets used by cyber-criminals to steal cash, such as the "Gameover" Zeus botnet, the espionage botnets typically consist of hundreds of compromised computers rather than tens or hundreds of thousands.
Most of the activity traces back to China, but some spying does not, including espionage carried out by a private security company that advertised “ethical” hacking courses, according to Joe Stewart, director of malware research at managed security provider Dell Secureworks, which carried out the investigation. In total, Stewart identified more than 1,100 domain names used in the attacks and registered by online spies. (more)
 |
| Click to enlarge. |
Most of the activity traces back to China, but some spying does not, including espionage carried out by a private security company that advertised “ethical” hacking courses, according to Joe Stewart, director of malware research at managed security provider Dell Secureworks, which carried out the investigation. In total, Stewart identified more than 1,100 domain names used in the attacks and registered by online spies. (more)
Cell Phones - The Remote Track Hack
A GPS weakness could allow hackers to remotely track smartphone users, or even completely take over mobile devices, University of Luxembourg researcher Ralf-Phillip Weinmann reported last night at Black Hat.
Instead of directly using GPS satellites, most mobile devices receive much faster assisted GPS (A-GPS) signals from cellular networks to determine approximate location. However, Weinmann discovered that these A-GPS messages are transmitted over a non-secure internet link, and could be switched for messages from an attacker. Weinmann demonstrated this vulnerability on several Android devices... (more)
Security Alert: Malware Via Email... From YOUR Printer!
In these high-tech times, scanners and photocopiers aren't just dumb machines sitting in the corner of the office.
They are usually connected to the corporate network, and - in some cases - can even email you at your desk to save you having to wear out your shoe leather.
And it's precisely this functionality that we have seen cybercriminals exploiting today, pretending that their malicious emails in fact come from an HP scanner inside your organization.
If you see a file like this one, beware...
hp_page-1-19_24.07.2012.exe
Clearly that's not a scanned-in image - it's executable code. ...be on your guard.
If you are one of the many people seeing this malware attack in your email today, please do not click on the attachment even if you are waiting for a scanned-in document to be sent to you. Instead, simply delete the email and your computer will be safe. (more)
Saturday, July 28, 2012
SpyCam Story #662 - This Week In SpyCam News
SpyCam stories have become commonplace and the techniques used, repetitive. We continue to keep lose track of the subject for statistical purposes, but won't bore you with too many details. Links supplied.
Upskirters
Oh, did I mention our voyeurism detection services are being requested more and more often?
General
OH - Cop without pants arrested for unspecified voyeurism. Cover up.
NY - Apple store spycam'er gets exposure. Life 'intimates' art.
OH - Mr. Nicely indited on video voyeurism charges. No relation to Mr. Rogers.
Canada - Landlord spycam'ing renters.
Hotels
Showers & Changing Rooms
AR - Old Navy changing room spycam'er nailed at Starbucks. Police checking phone.
Bathrooms
WA - Fish hatchery manager/bathroom spycam'er sentenced. Employees smelled something...
The Tanning Guys...
Off their meds...
OH - Ultrasound tech convicted of spycam'ing females at workplace. Three charges dismissed.
Canada - Female nursing home employee skates on phone voyeurism. Not covert enough.
AR - Medical center cell phone spycam'er pleads guilty.
NV - Hospital worker get 1-year for filming co-workers in bathroom.
NV - Hospital worker get 1-year for filming co-workers in bathroom.
"Trusted Agents"
WA - 14-year old girl stings bathroom phone spycam'er with her phone. He's washed up.
ID - Bottom-shelf shopper arrested for "upskirt" shooting in multiple stores. Think neckbolts.
Oh, did I mention our voyeurism detection services are being requested more and more often?
Due diligence makes sense to businesses like: hotels, gyms, swimming pools, country clubs, educational institutions, clothing retailers, and all businesses offering private areas to their employees and guests.
Security Directors: FREE Security White Paper - "Surreptitious Workplace Recording ...and what you can do about it."
Security Directors: FREE Security White Paper - "Surreptitious Workplace Recording ...and what you can do about it."
We can not guarantee you will never be on the wrong end of a voyeurism law suit. However, we are sure our services will pay for themselves many times over when damages are assessed. These days, if you're in business, you must proactively protect your employees and the visiting public's privacy. ~Kevin
Outdated Law Clouds Wi-Fi Eavesdropping Privacy Rights
If you don’t protect your Wi-Fi connection with a password, does that mean it’s legal to tap your Internet and monitor what you’re doing?
The key part of the federal anti-wiretap law was written in the 1980s, long before anyone contemplated using Wi-Fi networks, so the answer isn’t clear. In fact, legal experts say, it’s possible that how well you’re protected by the law would depend on what channel your Wi-Fi router is set to. (more) (spybusters link)
Apps: Know Your Rights & Protect Your Rights
Reporters Committee FirstAid app
The Reporters Committee FirstAid app was designed to help journalists who need quick answers to legal issues that arise while covering the news. It is meant as a quick solution during an urgent situation, such as when a judge or other official is keeping you from a hearing or a meeting, or a police officer is threatening you with arrest.
FirstAid also provides quick access to their hotline for any media law issues, either by phone or email.
 |
| Click to enlarge. |
The Reporters Committee and this app are available for journalists of all varieties, whether you work for a national news organization or a neighborhood news blog. They never charge for our assistance. (more)
Android app allows citizens to record and store video and audio of police encounters, includes guide to citizens’ rights
The Android “Police Tape” app records video and audio discreetly, disappearing from the screen once the recording begins to prevent any attempt by police to squelch the recording. In addition to keeping a copy on the phone itself, the user can choose to send it to the ACLU-NJ for backup storage and analysis of possible civil liberties violations.
A version awaiting approval from Apple will be available later this summer in the App Store for iOs to audio record encounters with police. (more)
Friday, July 27, 2012
eBlaster Shatters Crystal - $20,000 Loss
The ex-wife of a wealthy businessman must pay him $20,000 for installing spyware on his computers and using it to illegally intercept his emails to try to gain an upper hand in their divorce settlement, a federal judge in Tennessee ruled.
Thursday, July 26, 2012
Happy Birthday CIA
On July 26, 1947, President Truman signed the National Security Act,
creating the Department of Defense, the National Security Council, the
Central Intelligence Agency and the Joint Chiefs of Staff. (more)
Subscribe to:
Posts (Atom)