Prolific Spy Camera Man Posts Videos Gets Caught

WI - A 28-year-old man is charged with surreptitiously filming women in various states of undress in three locations, including a Target changing room at the Fox River Mall.

Andrew R. Persen of Appleton was charged Monday with 10 counts of capturing an intimate representation without consent, five counts of invading privacy with a surveillance device and a single charge of posting a sexually explicit image without consent...

Besides Target, locations included his own bathroom and the bathroom and bedroom at a female friend's house, according to the criminal complaint...

According to the criminal complaint:
The friend told police on Oct. 11 that her friend had found a nude video of her on a pornography website and she believed Persen had posted it without her consent. The video was posted around June of this year and the website indicated it had hundreds of public views.

She said the username the video was posted under was one that Persen commonly used on social media...

Typical Bathroom Spycam Enclosures — Look for the pinhole.

Police searched Persen's house on Oct. 20 and found "numerous" electronic storage devices.

He said that he had put hidden cameras in his friend's bedroom and bathroom in the spring and also in a Target dressing room. He also said he put a camera in his own shower to capture another woman.

Police found videos of the friend filmed at her home. Two detailed in the complaint clearly show him installing the cameras.

One video showed a woman using his shower.

Investigators also found 66 video files that appeared to show the inside of a changing room at Target. If the date and time display is correct, it appears the videos were recorded between 3:20 p.m. and 7:15 p.m. on April 6.

One video appears to show him setting up the camera in the changing room at 3:18 p.m. with his face clearly visible. more

Unfortunately, this type of story appears in the news several times per week. And... these are the failures; this is the tip of all video voyeur activity.

You should really learn how to detect spycams, and then teach your family and friends how to do it as well. It's really simple, once you know how.

TSCM News - Professional Spybusters in Demand for Bug-Sweeping

In the trade it is known as TSCM but everyone else calls it bug-sweeping. It is not cockroaches that these pest controllers are hunting but eavesdropping devices that could be hidden anywhere from a mobile phone to the cable in the back of a computer.

Demand for the services of professional technical surveillance countermeasures specialists has grown dramatically along with public awareness of the dangers. Britain’s professional spy catchers have never been busier as businesses and wealthy individuals realise that they are being watched and listened to. 

According to James Williams, director of the TSCM Institute, the only professional body covering the emerging industry, “eavesdropping is on the increase” as the number of devices and ways to bug people have multiplied. more

If you are looking for a reliable firm (many are not), contact me for a referral in your area. ~Kevin

Corporate Espionage Fail - WeWork Staffers Caught

NYC - The battle in the red-hot co-working space business is heating up.

WeWork, the No. 1 player in the sector, allegedly sent two spies to infiltrate rival Knotel — to steal info and some customers, Knotel claimed.

The spies showed up at seven Knotel properties in Manhattan last month in a “systematic attempt to pilfer Knotel’s proprietary information and trade secrets,” according to a cease-and-desist letter the smaller company sent to WeWork...

The corporate espionage rookies might have pulled off the caper — except, in a totally random happening, a Knotel employee recognized one of them as a friend of a friend, according to sources close to Knotel.

While the pair used fake names to gain entry, according to the letter, a call to the Knotel worker’s pal got the spy’s real name — and a couple of social media inquiries turned up the fact that he worked for rival WeWork, sources said. more

SPYSCAPE in NYC is Set to Open in December

A museum dedicated to spycraft is landing soon in possibly the least inconspicuous place on Earth: midtown Manhattan.

The project, known as SPYSCAPE, is set to open in New York City this December — but details are, fittingly, under wraps. Archimedia, the creative and investment company behind the project, has acquired a number of spy artifacts and archival materials, and will use immersive storytelling to explore history’s greatest spy affairs, from the Enigma code crackers to the teenage hacker behind a recent breach of the CIA website.

The museum's website hints at interactive interrogation rooms, laser tunnels, and more. At the end of the tour, visitors will learn what kind of spy work they’re destined for — allegedly based on a proprietary “profiling system” created by the Head of Training for British Intelligence.

The museum space was designed by Ghanaian-British architect David Adjaye’s New York City-based firm, Adjaye Associates, whose many high-profile projects include Washington, D.C.’s new National Museum of African American History and Culture. more

Can't wait? Cuba's Spy Museum in Havana is open. (Optional, but recommended.) ~Kevin

Ransomware Security Infographic - Winning the War

via Trustwave...

Click graphic to enlarge. Click Trustwave for PDF.

Security Report: Kids Smartwatches Found to Act Like Bugs and Worse

The tests done by Mnemonic have uncovered critical security flaws in three of the apps and devices. 

As detailed in Mnemonic's report, two of the devices have flaws which could allow a potential attacker to take control of the apps, thus gaining access to children's real-time and historical location and personal details, as well as even enabling them to contact the children directly, all without the parents’ knowledge.

Additionally, several of the devices transmit personal data to servers located in North America and East Asia, in some cases without any encryption in place.

One of the watches also functions as a listening device, allowing the parent or a stranger with some technical knowledge to audio monitor the surroundings of the child without any clear indication on the physical watch that this is taking place. more

FutureWatch: After 51 Years MasterCard Boots Signatures

Mastercard Inc. is doing away with a rule requiring merchants to get signatures for transactions made with its credit and debit cards in the United States and Canada.

Announced early Thursday, Mastercard’s rule change goes into effect April 13, 2018, allowing issuers, merchants, and processors time to make adjustments, though merchants can adopt the change sooner, Mastercard says. Mastercard also issued a bulletin about the matter Wednesday afternoon. The new rule does not affect interchange, and applies only to point-of-sale transactions.

A majority of consumers believe that it would be easier to pay and that checkout lines would move faster if they didn’t have to sign for purchases, Mastercard says. more

So, why drop a 51 year old signature security requirement?

Mastercard announced that it’s adding fingerprint scanners to its “next generation” cards in order to safely verify the cardholder’s identity whenever they’re making in-store purchases. more

Most of Your Employees are Snoops

A new survey of IT security professionals reveals that 92 percent of respondents say employees at their organizations try to access information that is not necessary for their day-to-day work.

The study from identity management company One Identity also shows that IT security professionals themselves are among the worst offenders for corporate data snooping. One in three respondents admit to having accessed sensitive information that is not necessary for their day-to-day work -- showing an ongoing abuse of elevated rights given to the IT security role.

More than one in three (36 percent) of IT pros admit to looking for or accessing sensitive information about their company’s performance, beyond what is required to do for their job. 71 percent of executives admit seeking out extraneous information, compared to 56 percent of non-manager-level IT security team members. Additionally, 45 percent of executives admit to snooping for or accessing sensitive company performance information specifically, compared to just 17 percent of non-manager team members.

In smaller companies the problem is worse... more

No surprise here. Over half of the eavesdropping and information loss issues crossing my path (over the last four decades) are employee related. ~Kevin

Spybuster Tip #712: How to Vacuum Your Amazon Breadcrumbs

Amazon automatically tracks the products you browse on the site and compiles a visual list on your account’s home page, in case you are inspired to follow through with a purchase on a return visit.

If you find this sort of thing more creepy than helpful — or you share a computer and would rather not have others see your shopping whims — you can disable the tracking.

To do that, go to Amazon.com and log into your account. Click the Browsing History link at the top of the main page (just below the search window) to see the recent items you previously viewed while clicking around on the site. At the top of the page, click Manage History. more

Spike in Spy Camera Sales Online Causes Concern

Over a period of time, a sales engineer in Singapore amassed 280 obscene films, many of which depicted women in various stages of undress in public bathrooms and changing rooms.

The unsuspecting women, including schoolgirls, were filmed with secret cameras, and Joel Chew Weichen, 27, had collected the films for distribution.  

Based on checks by The Straits Times, a worrying trend has emerged - the sale of such cameras is on the rise.

On online shopping platform Lazada, which has more than 600,000 hidden camera products available, sales of such cameras have grown 1.5 times this year compared with last year. The cameras come disguised as clocks, pens and even smoke detectors.

A spokesman said spy pens, which can cost about $12, are the most popular. Spectacles with built-in cameras may cost about $85...

Chew, who was sentenced to six months in jail this month, was the first of five individuals to plead guilty to having the obscene films for distribution.

He was also part of groups that share and download such videos.

The victims were secretly filmed while in bathrooms in cafes, schools, offices, changing rooms of popular fashion outlets, and bathroom showers in private homes. more

Note: An on-line spycam detection training course is available to organizations and individuals.

My Sister Bugged my Teddy Bear

Chicago - Nobody feuds like a rich family with lawyers on the payroll.

But even by the standards of the tony North Shore, the bitter courtroom battles between the children of the late property developer Aaron Israel stands out.

The Israel brothers — Harvey, Alan and David — have been fighting on and off in court with their sister, Diane, and their late father over the family fortune for 25 years.

Now David Israel is suing his sister for more than $1 million, alleging she hired a private eye who bugged his Northbrook office with a recording device hidden inside a teddy bear.

A recently filed federal complaint includes a photo of the scarf-wearing pink bear, which David says he received from a cancer charity. According to the lawsuit, David cut open the bear and found a listening device inside it after he was taunted by an anonymous text-messager who told him about his office being bugged and said there was “a big surprise” inside the bear.

The taunting text and other creepy anonymous messages (including one telling him “A bit hot to be wearing that shirt don’t you think David?”) were sent by a private eye hired by Diane, according to David’s lawsuit, which also alleges that a listening device was installed in a plant pot, and that his Highland Park home and Gold Coast condo were bugged along with his cars.

Though the private eye, Michael Bucon, in April pleaded guilty to planting the bugs, Diane denies the allegations and wants U.S. District Judge Andrea Wood to throw out the lawsuit... more

How the All Blacks Bugging Story Ends

The security consultant who escaped conviction in a bugging case is reportedly back working with the All Blacks in Australia.

Adrian Gard, 52, was placed on a one-year good behaviour bond last month for breaching his security licence when organising a sweep of the Sydney hotel where the All Blacks were staying ahead of a test match against Australia in August of last year. more

Wi-Fi Traffic Open to Eavesdropping

Researchers have disclosed a serious weakness in the WPA2 protocol that allows attackers within range of vulnerable device or access point to intercept passwords, e-mails, and other data presumed to be encrypted, and in some cases, to inject ransomware or other malicious content into a website a client is visiting...

The proof-of-concept exploit is called KRACK, short for Key Reinstallation Attacks. The research has been a closely guarded secret for weeks...

A website disclosing the vulnerability said it affects the core WPA2 protocol itself and is effective against devices running Android, Linux, and OpenBSD, and to a lesser extent macOS and Windows, as well as MediaTek Linksys, and other types of devices.

The site warned that attackers can exploit the flaw to decrypt a wealth of sensitive data that's normally encrypted by the nearly ubiquitous Wi-Fi encryption protocol. "This can be abused to steal sensitive information such as credit card numbers, passwords, chat messages, emails, photos, and so on," more

Google Home Mini Caught 'Spying' on Owner

A flaw has been discovered in the new Google Home Mini that allows the device to secretly record without the user knowing and sending the information to Google.

The flaw was discovered last week by tech blogger Artem Russakovskii and written about on Android Police. Russakovskii, who was given a free sample device before the official launch later this month, first noticed the device continually turned on and off on its own. Later, when he checked the activity logs, he saw that the device was recording without being prompted.

"My Google Home Mini was inadvertently spying on me 24/7 due to a hardware flaw," Russakovskii wrote.

In a letter to Google, he added: "Needless to say, if a listening device records almost every minute of every day and stores it remotely, we're talking about a huge privacy violation." Google then sent out an engineer to pick up and examine the next day. They then said the problem stemmed from a a glitch on the device's touch pad.

FutureWatch - Microphone with an Ear and Brains, or how to stay ahead of the bad guys...

Clients know how quickly technology advances, and they occasionally ask...

"Aren't you always one step behind the bad guys?"

I've heard some colleagues agree, and even mention it themselves as a pre-sweep hedge against failure, along with the idiotic statement, "All bets are off once we leave." Talk about defeatist logic.

The bad guys question is a good one, however, and there are several answers. All depend upon the mindset of the TSCM team...

1. Yes, if you buy a detection gadget and only read the instructions.
2. Yes, if you just surf the Internet for education.
3. Yes, if you're getting your education from an annual TSCM seminar, or occasional training course.
4. No, if you pay attention to research papers, newly developing electronic components and processes, before they are used in surveillance devices.

Here is a Number 4 example I came across this week... a very tiny microphone with an ear, a brain, and almost no need to be fed electricity.

Wake-On Sound - Piezoelectric MEMS Microphone
PUI Audio's ZeroPower Listening™ piezoelectric MEMS microphone designed for ultra-low power always listening solutions. 

PUI Audio’s PMM-3738-VM1010-R is a single-ended analog MEMS microphone with wake-on sound. The wake-on sound mode allows for detection of voice activity while consuming only 5 μA of supply current (9 μW of power). In wake-on sound mode, a sound in the vocal band above the level threshold instantly alerts a processor of an acoustic event. The processor (DSP or voice processor) then switches the PMM-3738-VM1010-R into normal mode, with full audio output within 100 microseconds. Fast enough for the microphone to capture the triggering sound and pass it along for processing. This is the system architecture for ZeroPower Listening. 

Wake-on sound delivers voice activation to battery-powered voice-interface consumer devices, such as smart speakers, smart TV remote controls, smart headphones, and IoT smart home products, while drawing nearly zero power. 

PUI Audio’s PMM-3738-VM1010-R, the first wake-on sound MEMS microphone, brings voice activation to battery-powered devices of all kinds. Drawing a scant 5 μA of current while in listening mode, PUI Audio’s newest piezoelectric MEMS microphone is the only device that uses sound energy itself to wake a system from full power-down. 

The PMM-3738-VM1010-R features a configurable voice zone, allowing voice in a 5 foot to 20 foot radius-zone to trigger the system and increase to a higher-power mode. When the environment is quiet, the system can enter the low-power ”wake-on-sound” mode. 

Imagine the new types of eavesdropping devices this microphone will make possible.

Combine this with a battery powered bug that recharges using ambient radio-frequency signals, and you have a sleeper bug that could (theoretically) last forever. 

The bad guys probably haven't built and deployed this yet, but when they do, it won't be a surprise to us.

The posts tagged FutureWatch you see in the Security Scrapbook are examples of Number 4 attention to detail. Here are some more...
https://spybusters.blogspot.com/2017/03/futurewatch-cheap-difficult-to-detect.html
https://spybusters.blogspot.com/2013/08/solar-powered-smartphones-and-more.html