Business Espionage - "Corn ain't just chicken feed, Bubb"

Two Chinese agricultural scientists face charges after they were caught trying to smuggle a variety of seeds — stolen from a biopharmaceutical plant in Kansas — into China, Reuters reports.

After a tour of agricultural facilities and universities in the Midwest and Arkansas, the two Chinese nationals were caught with the seeds as they boarded a plane for home, the report says. 

(In a separate, but parallel espionage case, "Investigators found ears of corn stashed in an Illinois self-storage unit, dozens of bags of corn kernels stuffed under the seat of a car, and hundreds of pictures of corn fields and production facilities.")

Don’t be fooled because they’re “just” seeds. The unidentified victim of the theft had invested about $75 million in patented technology to create the seeds, the report says. (more)

...thus bringing back traditional spycraft.

Governments around the world may be compelled to wall off their Internet systems as nations and companies move to protect sensitive data amid increasing cybercrime and espionage, Kaspersky Lab Chief Executive Officer Eugene Kaspersky said.

Cybercrime is increasing and secret documents released by former U.S. National Security Agency contractor Edward Snowden have heightened technology company concern about espionage. Some governments and corporations may even scrap information-technology systems in some cases, moving critical data back to paper, Kaspersky said. (more)

Interpretation

• Hacking is easier than traditional spycraft.  
• Computerization = low-hanging fruit for the business espionage and criminal crowds. 
• Throwing security budgets to the IT folks is not effective enough. 
• Solution... keep your secrets off the web, and out of the computers. 
• Anticipate... Traditional spycraft (bugging, tapping, intrusions, moles, etc.)
• Arm yourself... Put a counterespionage consultant on your team.

The Road to Farewellville

A police department in Battle Creek, Michigan is being sued by one former officer and two currently employed cops who say their superiors secretly installed a surveillance camera in the woman’s locker at a local precinct...

According to the claim, Inspector Maria Alonso of the department’s Internal Affairs Division was told in late 2012 that there had been instances of theft occurring in the women’s’ locker room of the Battle Creek Police Department. Upon approval of her superiors, Alonso installed a surveillance camera in the room sometime the following January and used evidence obtained by it to allegedly implicate a plaintiff in the case of robbing co-workers by rifling through their lockers.

Plaintiff Laurie Gillespie was shown the video shortly after and, according to the complaint, was depicted in the clip “going through at least two open lockers” while in uniform... She was ultimately terminated less than two months later. (more)

Data Security and Breach Notification Act of 2013 & Information Security Tips

American IT departments' decisions could inadvertently put organizations at risk of an information security breach if they don't have sufficient protocols for the disposal of old electronic devices...
Despite the many public wake-up calls, most American organizations continue to be complacent about securing their electronic media and hard drives...

Congress is hoping to hold businesses accountable for the protection of confidential information with the introduction of the Data Security and Breach Notification Act of 2013, which will require organizations that acquire, maintain, store or utilize personal information to protect and secure this data. (q.v.)

Mitigation tips:

• Think prevention, not reaction.
• Put portable policies in place for employees with a laptop, tablet or smartphone to minimize the risk of a security compromise while traveling;
• Protect electronic data. Ensure that obsolete electronic records are protected as well. (Remember, all that data was somewhere else before it became electronic data. Protect that too.)
• Create a culture of security. Train all employees on information security best practices... Explain why it's important, and conduct regular security audits (including TSCM) of your office to assess security performance. (more)

Santa App Lets You Spy Back

A new app is letting family spy on Santa and his friendly elves. The free app, created by two Michigan entrepreneurs, is called Santa Spy Cam.

What do Elves pass, if not gas?

Santa Spy Cam uses magic only found at the North Pole to help parents get video of St. Nick and his friendly elves when they visit your house.

Now, what's fun about the app is it captures these special moments when kids are asleep.
How does it work? Well, the Santa Spy Cam has a built in sensor that flips on in your own home when Santa or his elves are nearby. 

"Fully approved by The North Pole Clandestine Services Bureau (NPCSB) to capture live-action video of Elves as they visit your home during the holiday season. And of course, the big visit, by the big man on Christmas Eve, Santa Claus." (more)

I just tested it. 
Works remarkable well. 
You get three free scenes; others at 99 cents each. 
~Kevin

Hong Kong PI's are Parents Eyes

China - Rich mainland parents are paying thousands of Hong Kong dollars to private investigators to spy on their children studying in Hong Kong, including PhD students and kindergarteners...

Philic Man Hin-nam, founder and director of Global Investigation and Security Consultancy, an all-woman detective agency, said that mainland student cases accounted for about 40 per cent of the more than 100 requests made by parents last summer for information on their children...

"Many mainland students studying in Hong Kong are single children from rich families," Liu of Wan King On Investigations said, "Those parents attach great importance to their children's behavior." (more)

New Android threats could turn some phones into remote bugging devices...

Researchers have recently uncovered two unrelated threats that have the potential to turn some Android devices into remotely controlled bugging and spying devices.

The first risk, according to researchers at antivirus provider Bitdefender, comes in the form of a software framework dubbed Widdit, which developers for more than 1,000 Android apps have used to build revenue-generating advertising capabilities into their wares...

What's more, Widdit uses an unencrypted HTTP channel to download application updates, a design decision that allows attackers on unsecured Wi-Fi networks to replace legitimate updates with malicious files. (more)

'That thing they said they're not doing? They're totally doing" - Jon Stewart

Last week The National Reconnaissance Office launched a new satellite called NROL-39 from Vandenberg Air Force Base in California, and a lot of people noticed a picture of a massive octopus straddling the earth.

"The Daily Show With Jon Stewart" has some fun with the spy logo, the choice of which drew ridicule in light of the many leaks about mass government surveillance from ex-NSA contractor Edward Snowden. 

After playing a game of 'That Thing They Said They're Not Doing? They're Totally Doing" — which involves showing clips of the U.S. government denying spying allegations only to confirm them later — Stewart went after the logo that boasts: "Nothing Is Beyond Our Reach." (more)


In 1955 an octopus taking over Earth was just science fiction. 
Perhaps the logo artist remembered this.

GSM A5/1 Encryption Comes to German Cell phones

Deutsche Telekom is the first network operator in Germany to deploy the A5/3 encryption standard for voice transmission in its mobile phone network. This means conversations are better protected against wiretapping, even in the GSM network... The GSM network previously implemented the A5/1 encryption standard, which experts have cracked... Telekom is not limiting rollout of the A5/3 encryption standard to Germany, either: the new technology has already been implemented in Macedonia, Montenegro, Poland and the Czech Republic. More countries will follow. (more)

$15. Girl Tech IM-ME Pager Turned Into - a Spectrum Analyzer; a Police Radio Jammer...

This isn’t something we’d encourage our readers to do, but it’s pretty fascinating that a seemingly innocuous toy has such power. 

The IM-ME is a small electronic toy made by Girl Tech that’s intended to be used as a sort of imitation cell phone, allowing users to send wireless messages to each other. 

Unfortunately, a hacker named Travis Goodspeed discovered that you can use the hardware to roam frequencies freely and even decode the metadata that prefixes radio communications, allowing a listener to identify both parties on the call. 

You can also use the thing as a spectrum analyzer and many other unintended purposes... such as jamming. (more) (video on P25)

Surveillance Cameras a Weapon in Neighborhood Feud

Scott and Terri Gale, of Kemah, Tex., are seeking a restraining order against Natalie Belk, who lives directly across the street from them, according to media reports.

The Gales say Belk’s surveillance cameras point into their master bedroom and bathroom.

The cameras were installed in September 2012, but the neighbors have been feuding since 2008 court records say. (more)

Without laser. With laser.

I guess taking their case to court is more civil than installing a permanently mounted laser pen aimed at the camera's lens. (snicker) (How to Zap a Camera)

Industrial Espionage Gets Caddy

Michael Kassner via TechRepublic.com...
With all the recent industrial espionage, it was only a matter of time before malware developers would take a look at Computer-Aided Design (CAD) programs as a way to ex-filtrate proprietary documents and drawings from engineering firms...

The first time I read about an AutoCAD malware was last year when ESET.com reported a strange anomaly on their LiveGrid network. It was strange because the malware attacked AutoCAD, but only in Peru of all places.

After some investigation, it was determined the malware ACAD/Medre.A was a worm programmed to send AutoCAD drawings via email to an account (you guessed it) in China. The experts at ESET had this to say:

ACAD/Medre.A is a serious example of suspected industrial espionage. Every new design created by a victim is sent automatically to the authors of this malware...

Something else that ESET pointed out bothered one of my clients when I told them about ACAD/Medre.A: “The attacker may even go so far as to get patents on the product before the inventor has registered it at the patent office. The inventor may not know of the security breach until his patent claim is denied due to prior art.”

...a new trojan popped up on Trend Micro’s radar—ACM_SHENZ.A, and it was targeting AutoCAD programs. But with a twist, the malware was benign. Like most trojans, its job was to gain a foothold on the victim’s computer.

Once safely entrenched, ACM_SHENZ.A obtains administrative rights which make it simple for the malware to create network shares for all drives. The malware also opens ports: 137, 138, 139, and 445. Doing so allows access to files, printers, and serial ports.

Obtaining administrative rights also allows the attacker to plant additional malware. It’s this additional malware, experts at Trend Micro suspect will be used to steal drawings and engineering documents...

CAD drawings are now a valid attack vector. (more)

On "Free" Security Apps...

I came across a new smartphone security app the other day which caught my eye. It promised...

• Free and secure phone calls.
• Send self-destructing messages.
• Recall or remotely wipe sent messages.
• Safely share private photos and videos.
• Photo vault to hide photos and videos.
• Hide text messages, contacts, call logs.
• Private vault for documents, notes and diary.

Just load the app on your phone (and the people you want to communicate with), and you're good to go. It sounded like something which my readers would like to know about. I downloaded it with the thought of giving it a try. But then, I thought again.

In my mind, I could hear my father saying, "there is no free lunch, if it looks too good to be true..." The years have always proven him correct.

The app's web site had a foreign country URL. Not a big issue. Perhaps it was the only place where the site's name was available. A little more digging and I came up with a company address here in the United States; a residential address. Again, not a big issue. The company is just over a year old, they have no other products, and software development from home is common. Both the Chairman and CEO of the company have names normally associated with a foreign country. I am still not phased. The United States is the world's melting pot.

A question on their FAQ page was the first red flag. "Why do you need my cell phone number to activate the service?" The answer, "we need the number so we can send you the activation code." My question is, why does a free encryption product need an activation code? It sounds like a ploy to identify users. Apparently, enough people felt this was an invasion of their privacy. The next part of the company's answer was that the code would no longer be needed after version x.xx.

The next FAQ was, "Why do you upload my contact book to your servers?" The answer smelled like more dung. Apparently, everything the app does goes through their servers.

On to the fine print. 

The product is specifically not guaranteed: not the encryption, not the self-destruction of the messages, photos or videos, nothing. They accept no liability. The are held harmless in the event transmissions are decrypted, deleted, copied, hacked, or intercepted.

Apps cost money to develop. Even allowing for ads, as these folks do, that is not enough money to justify an app this fancy (assuming it fulfills all its claims). There must be another payoff. What's worth money here? 

Information. 

People who use encryption are a select group; easy to target. For whatever reason, they feel their information is valuable. Hummm, a free security app could be great espionage tool. Let's see what information the company admits to collecting...

"We have the right to monitor..." Boom! What!?!? 

And, they collect: IP addresses, email addresses, phone numbers, address books, mobile device ID numbers, device names, OS names and versions. They can know who you are, where you are, and information about everyone you know. Even if you never use this app, if you are in the address book of someone who does, you're now coin of their realm.

"Photos and videos are cashed on servers..." and you can't delete them. They claim they will do this for you after, "a period of time."

Throughout all of this, the user's fire-of-fear is dowsed with, don't worry, it's all encrypted, no one but you can see it, trust me. Right... how about a little trust, but verify. Other security software companies allow vetting. I saw no claims that their code was independently vetted for bugs, back doors, or spyware. And, what about that "We have the right to monitor..." clause? How is that accomplished without a back door?

They, "May collect statistics about the behavior of users and transmit it to employees, contractors and affiliated organizations outside your home country." Yikes. Who are you affiliated with anyway? Please don't tell me, "if I tell you, I will have to kill you."

Here's another kicker. If they sell the company, "user information is one of the assets which would be transferred or acquired by the third party."

This may be a perfectly legitimate app. Maybe I'm paranoid. But, money, power, politics, espionage and blackmail all come to mind. Any government intelligence service, business espionage agent, or organized crime boss could have come up with this as a ruse. 

Which brings me to the moral of this story...

Before you trust any security service, vet it thoroughly. 
If your OTHBD needle starts to tremble, don't rationalize, move on. ~Kevin

Yet Another Step Closer to Eavesdropping on the Brain

Science fiction has long speculated what it would be like to peek inside a person's mind and find out what they are thinking.

Now scientists are one step closer to such technology after forging a new brain monitoring technique that could lead to the development of 'mind-reading' applications.

The breakthrough comes from a Stanford University School of Medicine study that was able to 'eavesdrop' on a person's brain activity as they performed normal functions by utilizing a series of electrodes attached to certain portions of the brain.

The process, called 'intracranial recording', was tested... (more)

How Does Santa Know?