Spy Tech Talk - How to Stop ISPs From Spying on Your IoTs

Botnets are not the only threat to your Internet of Things (IoT) devices: Your internet service provider (ISP) can also detect and track your in-home activities by analyzing internet traffic from smart devices, even when those devices use encryption, according to a paper from Princeton University researchers.

However, the researchers found a simple way to block ISPs from spying on your smart devices: Traffic shaping. more

When Spies Screw Up

Botched surveillance job may have led to strange injuries at US embassy in Cuba.

At first thought to be a deliberate attack, the outbreak of mysterious symptoms may be the result of shoddy espionage equipment, experts say...

The state department said it was investigating the outbreak, and that some of the worst affected diplomats had been evacuated to Miami for examination and treatment. more

But you already knew this, remember.

When Mars Attacks, We May Already be Dead

Some of the most popular industrial and consumer robots are dangerously easy to hack and could be turned into bugging devices or weapons, IOActive Inc. said...

These vulnerabilities could allow the robots to be turned into surveillance devices, surreptitiously spying on their owners, or let them to be hijacked and used to physically harm people or damage property...
                    ...or, do the Dobi Boogie!
more

Google 500+ Spy Apps - Update

Google has removed over 500 apps that included mobile games for teenagers from its Play Store on account of a spyware threat.

The decision came after US-based cyber-security firm Lookout discovered more than 500 apps that could spread spyware on mobile phones, Fortune reported late on Wednesday.

According to Lookout, the apps used certain software that had the ability to covertly siphon people's personal data on their devices without alerting the app makers.  more

Shoulder Surfers Get Faked Out with IllusionPIN App

Researchers have created a smartphone application to combat “shoulder-surfing”—when someone else looks over your shoulder as you enter your phone’s password or other private digits, potentially even gleaning vital financial or personal information...

Nasir Memon, a professor of computer science and engineering at New York University’s Tandon School of Engineering, explains that the technology, called “IllusionPIN,” deploys a hybrid-image keyboard that appears one way to the close-up user and differently to an observer at a distance of three feet or greater.

The research team simulated a series of shoulder-surfing attacks on smartphone devices to test the effectiveness of IllusionPIN at various distances.

In total, they performed 84 attempted shoulder-surfing attacks on 21 participants, none of which was successful. For contrast, they also mounted 21 shoulder-surfing attacks on unprotected phones using the same distance parameters; all 21 attacks were successful. more much more

Eavesdropping Device Found in State Gaming Office

NY - The Erie County District Attorney’s Office confirmed Monday afternoon it is investigating allegations made by the New York State Gaming Commission that its employees were eavesdropped on by the Seneca Gaming Authority. A source close to the investigation said gaming officials found a listening device last year in a casino space that was leased to state officials. more

Spying Using Acoustic Imaging Via Smart Devices

A team of student hackers have demonstrated a method for using music to turn smart devices into tools for spying. The system is based on sonar, and embeds an inaudible signal into songs played on a smartphone or TV. The system can then use the device’s microphone to listen to how the signal bounces, and track the movements of anyone near the audio source.

The University of Washington research team behind the technology, known as CovertBand, tested it using a 42-inch Sharp TV in five different Seattle homes.

They found that the method is able to track the physical movements of multiple people to within 18 centimeters of accuracy, and even differentiate between particular gestures and motions. The tech can also track people, though less accurately, through walls.

They also demonstrated that listeners couldn’t distinguish between songs containing the hidden sonar signals, and those without it. ...and all CovertBand needs to work is a speaker and a microphone. more

Smartphone Replacement Parts as Spies

If cracking your smartphone’s touchscreen wasn’t bad enough, researchers have found out a new security threat that might emerge out following the replacement of your touch screen as it has been found out that the replaced units might contain hardware that could hijack a device. 

A paper presented by researchers at Ben-Gurion University of Negev, Israel, at the 2017 Usenix Workshop on Offensive Technologies, shows how smartphone replacement units can be a security risk for the user.

Click to enlarge.

According to the researchers, devices with cracked touchscreens or even other damaged components are prone to security risks as the replaced parts installed by a repair shop might contain additional hardware that can hijack the device and track usage, log keystrokes, install other malicious apps, access files and more. more

Dude, No Kid Uses a Landline Phone Anymore

MI - A heads up for parents! 

Cue theme music.

You might not know it, but you could end up in jail for eavesdropping on your child's conversations from a landline phone.

So many parents might pick up another line in the house to see who their child is talking to, but listening in on a call is a felony punishable by up to two years behind bars and a $2,000 fine.

However, a Republican lawmaker wants to change that. State Representative Peter Lucido (R-Shelby Township), introduced a bill last week that would give parents exemption from the eavesdropping law. more 

Idea! How about a law against loitering in phone booths.

So You Named Your Robot Bedmate, Mata Hari. Cute.

At the Hack in the Box security conference later this week in Singapore,

Argentinian security researchers Lucas Apa and Cesar Cerrudo plan to demonstrate hacker attacks they developed against three popular robots: the humanoid domestic robots known as the Alpha2 and NAO, as well as a larger, industrial-focused robotic arm sold by Universal Robots.

The duo plan to show that they can hack those machines to either change critical safety settings or, in the case of the two smaller bots, send them whatever commands they choose, turning them into surveillance devices that silently transmit audio and video to a remote spy.

"They can move, they can hear, they can see," says Cesar Cerrudo, the chief technology officer of IOActive, where both of the researchers work. Those features could soon make robots at least as tempting a target for spies and saboteurs as traditional computers or smartphones, he argues. "If you hack one of these things, the threat is bigger."...

Privacy invasion presents a more realistic worry... domestic robots contain mobile cameras and microphones whose data a spy could not only intercept, but manipulate and move at will around a target's house.  more

Do Bug Detecting Gadgets Work? Let's Ask an Ex-Police Chief

CA - A judge set bond at $100,000 on Friday for former La Joya police Chief Geovani Hernandez, who’s accused of accepting cash to provide security for drug shipments... When agents arrested Hernandez, they found a “bug detector” designed to reveal hidden recording devices and prevent electronic surveillance. more

TSCM News: All Blacks Bugging Case Settled

Australia - Adrian Gard, the security consultant at the centre of the All Blacks bugging case, had his public mischief charge dismissed by a Sydney court on Friday.

Gard was accused of making a false statement to police about a listening device found in the All Blacks’ hotel meeting room before the August 2016 match against Australia in Sydney.

The magistrate was unable to rule out that someone else could have planted the bug.

Gard was found guilty of a second charge relating to carrying out a security operation without a license.

The matter, dubbed “bug-gate”, caused much friction between the Australian and New Zealand Rugby unions when it was revealed last year. more

Moral of the story... This all could have been avoided if the All Blacks spent the money to hire a real, reputable (and licensed) technical security consultant. ~Kevin

PI Alert: New NY Law Reduces Surveillance Opportunities

Spying on your neighbor's backyard barbecue with video surveillance is now illegal in New York.

Gov. Andrew Cuomo has signed a bill cracking down on the unauthorized invasion of privacy by video surveillance in the backyard... Unlawful surveillance was made a crime in 2003, but it only applied to places where there's an expectation of privacy like bathrooms and dressing rooms. more


PS - Law enforcement surveillance is exempted under the new law.

Spycam Darwin Award of the Week - The Creepy Kid

Jeremy Gabrysch put up a camera in their living room because his kid kept getting up in the middle of the night to watch TV.


The kid was not to be deterred, even if he didn't quite understand how a wide-angle lens works. more

Good Spy News - Mom Bugs Kids... but not the way our moms did it.

California law makes it a crime to record someone’s conversation secretly, with a few exceptions — and one of them, a state appeals court says, allows a parent to use a hidden cell phone to record her child’s talks with a babysitter suspected of abuse.

A mother’s recording led to the conviction of a 12-year-old babysitter for molesting his 4-year-old cousin. The defense lawyer argued that the recording was illegal because neither of the speakers had consented.

But the Fifth District Court of Appeal in Fresno said Monday that a parent who reasonably fears harm to her child, particularly a young child, can consent to a secret recording on the child’s behalf. State law normally requires the consent of both parties to a conversation, but allows consent by one person who reasonably suspects the other of a serious crime. more