NYC - Spycam Found in Bathroom Used by Top Corporations

The New York City Police Department reported today that a pinhole camera was found in a unisex bathroom at Johnson & Johnson (JNJ)’s corporate offices in NYC last week. A designer with the company discovered the camera, located above the light switch.

Johnson & Johnson ’s building maintenance supervisor reported the camera to the New York Police Department after it was discovered on Jan. 16, 2015. After examination, the camera was found to contain an SD card used for video storage. Johnson & Johnson’s Carol Goodrich said the company had immediately contacted the NYPD after the camera’s discovery...

Spycams are disguised as many things. This one is a USB stick.

“The device was hidden above a light switch in the bathroom next to offices that include Ralph Lauren and Haynes Roberts...” reported the New York Post. “The bathroom with the hidden device is open and accessible to all tenants and guests on the floor. It wasn’t clear whether the potty perv who put it there captured customers or models who do photo shoots nearby in RR Donnelley’s Studio W26. Investigators had yet to review the storage drive recovered with the camera.”...

Today’s story about the pinhole camera is part of what appears to be a trend. * NBC ran a story on March 27, 2014 about numerous reports of cameras being found in public bathrooms...

The NYPD indicates they are investigating the J&J camera as a sex crime and unlawful surveillance, with the added possibility of obscene material involving people under the age of 17.
(more)

*More like pandemic based on news reports and sweep requests received here.
• That USB stick spycam... only $8.76 here.

Economic Espionage - NYC Russian Banker Arrested by FBI

Federal prosecutors arrested a Russian banker in New York on Monday and charged him as a spy, accusing him and two others of secretly gathering information about the New York Stock Exchange, U.S. energy resources and sanctions against Moscow.

Prosecutors described clandestine meetings and coded communications between the banker and his handlers, one of whom worked as a trade representative of the Russian Federation in New York, the other as an attaché to the Permanent Mission of the Russian Federation to the United Nations.

The spycraft alleged in the complaint reads like a throwback to the Cold War. Yet the alleged operatives’ target was more modern: economic intelligence... 

The most interesting part...
Mr. Buryakov suggested they ask about the NYSE’s use of exchange-traded funds, potential limits on the use of automated high-frequency trading systems... NYSE spokesman declined to comment.
(more)

• The movie Blackhat illustrates market manipulation, and why it would interest them.
• Classic spycraft is alive and well. It ain't all IT-based.
• Nice job, FBI!

Can You Be Insecure Playing for the NFL? Sure, if you're an app.

The National Football League's official app for both iOS and Android puts users at risk by leaking their usernames, passwords, and e-mail addresses in plaintext to anyone who may be monitoring the traffic, according to a report published just five days before Superbowl XLIX, traditionally one of the world's most popular sporting events. 

(You can stop reading here. Trust me, it just gets worse.)

As Ars has chronicled in the past, large numbers of people use the same password and e-mail address to log into multiple accounts. That means that people who have used the NFL app on public Wi-Fi hotspots or other insecure networks are at risk of account hijackings. The threat doesn't stop there: the exposed credentials allow snoops to log in to users' accounts on http://www.nfl.com, where still more personal data can be accessed, researchers from mobile data gateway Wandera warned. Profile pages, for instance, prompt users to enter their first and last names, full postal address, phone number, occupation, TV provider, date of birth, favorite team, greatest NFL Memory, sex, and links to Facebook, Twitter, and other social networks. Combined with "about me" data, the personal information could prove invaluable to spear phishers, who send e-mails purporting to come from friends or employers in hopes of tricking targets into clicking on malicious links or turning over financial data. Adding to the risk, profile pages are transmitted in unencrypted HTTP, making the data susceptible to still more monitoring over unsecured networks, the researchers reported.

"Wandera's scanning technologies have discovered that after the user securely signs into the app with their NFL.com account, the app leaks their username and password in a secondary, insecure (unencrypted) API call," a report published Tuesday warned. "The app also leaks the user’s username and e-mail address in an unencrypted cookie immediately following login and on subsequent calls by the app to nfl.com domains." The app allows users to make a variety of in-app purchases.
(more)

Corporate Espionage Cartoon

U.S. Spies on Millions of Cars

DEA Uses License-Plate Readers to Build Database for Federal, Local Authorities

The Justice Department has been building a national database to track in real time the movement of vehicles around the U.S., a secret domestic intelligence-gathering program that scans and stores hundreds of millions of records about motorists, according to current and former officials and government documents.

The primary goal of the license-plate tracking program, run by the Drug Enforcement Administration, is to seize cars, cash and other assets to combat drug trafficking, according to one government document. But the database’s use has expanded to hunt for vehicles associated with numerous other potential crimes, from kidnappings to killings to rape suspects, say people familiar with the matter.
(more)

EP Team Alert - Dating Apps Let Snoopers Track Users

Snoopers have spied on massive numbers of amorous singletons by exploiting security flaws in dating apps.

Luckily, the spies were not creepy stalkers or violent perverts, but a group of cybersecurity experts on a mission to make life safer for daters.

They were able to track volunteers' every move in a discovery which should send chills down the spine of anyone using apps to find love...

This weekend, Colby Moore (security researcher at Synack) will present a talk at the tech conference ShmooCon, where he will discuss how he managed to track "tens of thousands" of amorous app users at the same time.

He suggested dating app security holes could even be used to spy on celebs.

"We [will] show just how easy it might be to reveal the identity of and track your favorite athlete, politician, or movie star," Moore wrote.
(more)

Snow Day Project - Make a Sneaky Snake Spycam for <$20.

It's snowing here in the Northeast United States. Tomorrow will be a down day. Need a spy project to combat cabin fever? This guy shows you how...

Tom Cruise Bugged Nicole Kidman's Phone, says Scientology movie

Church of Scientology leaders ordered the wiretapping of Nicole Kidman's telephones

...during her marriage to Tom Cruise as part of a campaign to break up the couple, according to an explosive new documentary.

Marty Rathbun, formerly the religion's second highest-ranking official, told Oscar-winning film-maker Alex Gibney, that his role was to "facilitate the break-up" for church leader David Miscavige.

The church on Monday said that the "accusations made in the film" were "entirely false".
(more) (more)

SpyCam News - Internal Affairs Agent Overly Into His Job

CA - A camera found in the women's bathroom at the Border Patrol compound in San Ysidro has one agent in a lot of trouble. San Diego police told Team 10 that a ranking agent hid the camera and someone found it.

Officers confronted the agent at the Border Patrol administrative offices on West Ash Street in downtown San Diego.

Two separate Team 10 sources confirmed the agent works with internal affairs.
(more with video)

Countering Light Bulb Eavesdropping

Q. "How to prevent light bulbs from being used as pickups for speech?" (meaning, being used as part of an eavesdropping system)

A. The easiest way, of course, is to keep the bulb turned off, however, I know that's not what you mean.

The second best way is to make sure there is no way for the bad guy to see the light bulb. Most attacks require accessing the bulb's variations in light so they can be remotely demodulated. (See Leon Theremin's invention.)

Some bulb attacks are made possible because additional electronics are placed inside the bulb (cameras, transmitters, microphones, etc.). The easiest countermeasure to this is to replace the bulbs with bulbs you purchased from a local Home Depot / Lowe's type store. Mark the bulbs when you install them, then check periodically to make sure they haven't been switched out.

Also, be sure to check the fixtures and wiring paths for attached microphones and modulation circuitry. Cut the power while doing these things.

These are not high-tech countermeasures, but they are effective.

Hope that helps,
Kevin

Industrial Design Theft is No Joke

As I was marched over to an unfamiliar bank of elevators towards the back of the building, I realized I was the prime suspect.

An unreleased design that I had access to, and had done dozens of renderings of, had suddenly appeared on the market—produced by a prime competitor of ours. I was in the elevator with my boss, who was the Head of Global Industrial Design at this particular corporation, where I'd been working as a CAD and rendering jockey for many years.

But I was still a contract employee, not staff. And I had access to this design that few people in the design group had even seen.

The elevator doors opened at a high floor I'd never been to, and I got my first glimpse of the Legal Department...
(more)

Business Espionage - The South Africa Report

SA - As the current Sony-North Korea tit-for-tat game attests, industrial espionage has now been brought to an open space, and its debilitating consequences are evident – including in South Africa...

Click to enlarge.

Industrial espionage is the least-known concept within the intelligence compendium, although many agencies are now involved in this activity... Several private businesses have been mentioned in cases involving illegal theft of commercial information. This attests to the fact that in modern societies, as was the case in earlier centuries, economic intelligence is an integral aspect of business, albeit as a business risk.

Studies conducted under the auspices of the University of the Witwatersrand and the University of South Africa for several years have found that industrial espionage in SA is on the rise...

SA-specific accounts of industrial espionage are mostly contained in business publications...

For example, in 2003, The Star reported that British American Tobacco SA (BATSA) conducted spying activities on its rival, Apollo Tobacco; and Finsettle, a subsidiary of Barnard Jacobs Mellet, stole business information secrets of CST Outsourcing. In March 2014, Business Day reported on a suspected case of industrial espionage practices of BATSA involving spy networks and payment of agents by the JSE-listed company. The inference is that industrial espionage is a burgeoning business strategy in SA.
(more)

Hacking Wi-Fi is Child's Play - Now run out and find me a child.

The great Groucho Marx, in character, was reading a report and remarked that a 4-year-old child could understand it. So, he said, "run out and find me a 4-year-old child."

Betsy Davis isn't 4. She's 7, but it's still pretty impressive that a computer-savvy 7 year old could Google the information she needed in order to hack into a public Wi-Fi system in a little under 11 minutes. Fortunately, Betsy is not a criminal hacker, but was enlisted as a part of a security experiment to show how easy it is to hack into such network and steal information from unwary people.

Many people assume that the Wi-Fi that they're using is secure, but this isn't always the case.
 (more)

The actual quote as reported by NPR...
In the Marx Brothers classic Duck Soup, there's a scene in which Groucho's Rufus T. Firefly, the newly installed leader of Freedonia, receives a report from the Treasury Department. "I hope you'll find it clear," says the minister of finance. "Clear?" replies Firefly incredulously. "Why, a 4-year-old child could understand this report." Then he pauses for a beat: "Now run out and find me a 4-year-old child. I can't make head or tail of it."

Did Meanwell Mean Well, or... She Wanted the Cash, Man

New York Yankees general manager Brian Cashman has more than just on-the-field problems... his alleged former mistress, Louise Meanwell, is filing a lawsuit against the Yanks' front office man. 

The suit says that Cashman not only hacked and spied on Meanwell's e-mails, but he also contacted the woman's mother in an attempt to have Meanwell committed in order to cover-up his affair... 


Cashman's mistress is currently in court going through her own legal battles after she was arrested for attempting to extort Cashman for $15,000, and she allegedly stalked him as well after what is believed to be a 10-month fling occurred with Cashman.

It was only after Meanwell found out Cashman had another mistress and had no intention of getting a divorce from his wife that she threatened to blow the lid off their relationship.

This one just keeps getting weirder and weirder by the day.
(more)

Email Encryption Options

Q.  I have a client who wants us to use encryption for emails and attachments (not voice). Do you have a solution?

A. Thanks for asking. Your client has a number of fairly easy and low cost options.

• If they use Microsoft Office Outlook have them read this.
• Mac Mail. Read this.
• Thunderbird. Read this.
• Google Apps. Read this.
• Here are the 2015 reviews for the "Top Ten" 3rd-party email encryption programs.
• This is a good article on how to implement email encryption.

Not knowing the client, their needs, IT expertise, etc. I can't point them to anything specific, but the above links will certainly get them started.

Hope this helps,
Kevin