Security Director IT Alert: New Corporate Network Attack Vulnerability

Called BleedingBit, this vulnerability impacts wireless networks used in a large percentage of enterprise companies. 

Two zero-day vulnerabilities in Bluetooth Low-Energy chips made by Texas Instruments (and used in millions of wireless access points) open corporate networks to crippling stealth attacks.

Adversaries can exploit the bugs by simply being approximately 100 to 300 feet from the vulnerable devices. A compromised access point can then lead to an attacker taking control of the access point, capturing all traffic, and then using the compromised device as a springboard for further internal attacks.

The issue impacts Wi-Fi access points made by Cisco, Cisco Meraki and Hewlett-Packard Enterprise’s Aruba, accounting for a large percentage of hardware used in corporations, according to researchers at Israeli security firm Armis. The firm discovered the two bugs earlier this year and publicly disclosed them on Thursday.

“Attacks can be devastating and carried out by unauthenticated users who can exploit these bugs and break into enterprise networks undetected while sitting in the company’s lobby,” said Ben Seri, head of research at Armis.

...there is concern that the BleedingBit vulnerabilities could impact a larger universe of BLE devices, such as smart locks used in hotel chains and point-of-sale hardware.

Last year, Armis discovered a nine zero-day Bluetooth-related vulnerabilities, dubbed BlueBorne, in Bluetooth chips used in smartphones, TVs, laptops and car audio systems. The scale of affected devices was massive, estimated to impact billions of Bluetooth devices. more

Recommendation: If your company uses devices made by the manufacturers mentioned, contact them for software patches. ~Kevin

Spy Shop Bat Man Shows No Brotherly Love

NJ/PA - The superintendent of a Cumberland County school district is facing criminal charges after allegedly attacking a Philadelphia surveillance equipment store employee with a baseball bat.
Michael Knox, the superintendent of the Fairfield Township School District, faces charges of aggravated assault, possessing an instrument of crime, making terroristic threats and simple assault, court records show.

According to NBC 10 Philadelphia, Knox allegedly had a business arrangement with the shop to spy on his wife for an unknown matter. He thought the store was doing a bad job with the surveillance, NBC reported, leading him to attack an employee inside the store. more

Apple's New T2 Chip - An Eavesdropper Stopper

At a recent event in New York, Apple finally refreshed its MacBook Air lineup, and the new laptops come with a refreshing new capability — warding off hackers or spies from eavesdropping on your microphone.

According to Apple’s new T2 security guide, both, the new MacBook Air, and the MacBook Pro use the new T2 chip, which helps protect the device’s encryption keys, storage, fingerprint data, and secure boot features.

Per the guide, the T2 chip comes with a hardware microphone disconnect feature, which physically cuts the device’s microphone from the rest of the hardware whenever the lid is closed. more

Is Your Boss Spying on You?

(Modern workplace "spying" began with the time clock back in 1888.)

New numbers show almost every single employer is spying on employees.

From keeping an eye on your internet usage to tracking your car, NBC Charlotte found out how they're doing it and if it's legal.

"It's getting to a point people are realizing they don’t have much privacy in the workplace," said Kevin Murray. more

P.S. Make sure your employees are not spying on you.

Business Espionage: "A Sellout and a Spy"

Delaware's Incyte Corp. is in court this week seeking hundreds of millions of dollars from a former-Silicon Valley competitor.

The Wilmington pharmaceutical company argues in a lawsuit that its rival, Flexus Biosciences, in 2014 stole trade secrets for a drug that at the time was thought to have enormous potential for the treatment of tumors. 

During opening statements on Tuesday, Incyte attorney Steve Wood told jurors that Flexus employed the services of "a spy and a sellout" to steal information about blood tests and about how the drug metabolizes in a patient's body. more

Ex-employee Accuses Huawei of 'Corporate Espionage'

A former employee of Huawei Technologies Co has accused the company of using a lawsuit against his Silicon Valley startup as part of a strategy to steal intellectual property and help China achieve technological dominance over the US. more

M, I, See... see you real soon...

The park around Lake Eola offers a great view of the downtown skyline, but Orlando police said someone's been peeping into some of the apartments closer than the naked eye can see with either a super high-powered camera or a drone.

"I don't even think about people watching me or anything like that. So, to me, that's just mind-blowing, honestly,” said downtown resident Mary Pericles.

Women who live in The Waverly and Post Parkside apartments say they've seen a drone flying outside their windows at least three times. more

File Under: You Can't Do That in the Private Sector

UK - A former Royal Marine carried out body searches on his girlfriend, placed bugging devices in her bedroom and installed a tracking device on her mobile phone due to his paranoia over her alleged infidelity.

In the first conviction of coercive and controlling behaviour offences secured at Grimsby Crown Court, Lee Jensen received a 12-month suspended sentence.

The prosecutor said bugging devices were concealed under cushions in her bedroom by Jensen, so he could listen to her. He subjected her to body checks. He prevented her from visiting her own GP.

After the relationship ended he made "futile threats to burn her house down". more sing-a-long

Making Security Grate Again - Part II

China has jokingly suggested that US President Donald Trump should swap his Apple iPhone for a Chinese model, as it denied a report claiming Beijing was bugging his private calls. more

Making Security Grate Again

When President Trump calls old friends on one of his iPhones to gossip, gripe or solicit their latest take on how he is doing, American intelligence reports indicate that Chinese spies are often listening — and putting to use invaluable insights into how to best work the president and affect administration policy, current and former American officials said.

Mr. Trump’s aides have repeatedly warned him that his cellphone calls are not secure, and they have told him that Russian spies are routinely eavesdropping on the calls, as well. But aides say the voluble president, who has been pressured into using his secure White House landline more often these days, has still refused to give up his iPhones. White House officials say they can only hope he refrains from discussing classified information when he is on them. more

Print Centers Leak Information

These behemoth systems do far more than just make copies,
confusing their users, and opening up vulnerabilities to the company. Although copying may be the main business of the machines, they can also scan, fax, send and receive vital company information — all in one place. Essentially, these machines have become a networking hub within the workplace, where each new action or service provides a new opportunity for exploitation wirelessly, by ethernet cable, or by both.

Researchers have recently been investigating access on printer/copiers as a potential opportunity for information leakage or industrial espionage, or even sabotage. In a January 2017 Quocira survey of 200 US and European businesses, more than half reported some data loss through intercepted print jobs (50%), access and loss or theft of printer hard disk data (48%), documents emailed externally (44%), or outright hacking of the printer system to gain company network access (18%). Some hackers have been very clever in attacking these systems. more

Tech-Head Alert: Smartphone Anti-Spyware & Anti-IMSI Catcher Development

We are looking for recommendations of top tier stealthy Spyware Command and Control APKs to place on a testbed of Windows, iOS, Android, Ubuntu handsets and handsets carrying a modded version of the Google Android 7.0 Nougat OS for a test that we wish to conduct to measure the capture rate and automated counter measure response of a mobile adaptive threat defence suite.

We are also looking for a list of non-LE "StingRay" type cellphone-surveillance and cell-site simulators available publicly as part of our testing of our MITM detection, automated counter measures response, and triangulation software suite. more

Resources for Investigators

The Reporters Committee for Freedom of the Press serves the nation’s leading news organizations; thousands of reporters, editors, and media lawyers; and many more who use their online and mobile resources. Private and corporate investigators will find the resources below especially useful.

• General The First Amendment Handbook The News Media & The Law

• Libel and Privacy SLAPP Stick Can We Tape? Photographers Guide to Privacy

• Reporter's Privilege Privilege Compendium Agents of Discovery

• Freedom of Information A Reporter's Guide to Medical Privacy Law Access to Electronic Communications Access to Police Records Federal FOIA Appeals Guide Federal Open Government Guide Open Government Guide Private Eyes Privatization v. The Public's Right to Know Sunshine, Inc. The Lost Stories

• Court access Open Courts Compendium A Reporter's Guide to Military Justice Access to Juror Questionnaires Access to Juvenile Justice Access to Terrorism Proceedings Alternative Dispute Resolution Anonymous Juries Gag Orders Grand Juries Judicial Speech Jury Records and Proceedings Off Base: Military Court Dockets Online Access to Plea Agreements Secret Dockets Secret Juries Warrants & Wiretaps White Paper: Military Dockets

• Newsgathering A Reporter's Field Guide A Reporter's Guide to American Indian Law Homefront Confidential Police, Protesters and the Press

More Than 200 Companies Making Counter-Drone Systems

The ability of unmanned aerial vehicles to fly legally over fences, walls and property lines is disrupting more than just the few industries that use drones commercially. 

As the drone market grows, so does the anti-drone market. The market for products that track, trap or break unmanned aerial vehicles (UAV) is growing alongside the market for drones, much of it driven by fear that UAVs could be weaponized by terrorists or used as platforms for corporate espionage.

This is less far-fetched than it sounds. One tech industry executive told Semiconductor Engineering that he recently found a drone hovering outside his 45th-floor hotel room in Shanghai. He immediately closed his laptop computer.

“There is a laundry list, more than 200 companies, making counter-drone systems of one kind or another, and they do market mitigation capabilities that most people can’t use,” Michael Blades said. “But drones are cheap to get, easy to fly, and are not always easy to see. So if a company is concerned about trade secrets, or even just about the security to know if there’s anyone around taking pictures, they might look into countermeasures.” more

Carvercon 2018 - Washington, DC - November 16

Security Management International (SMI) is pleased to host the inaugural CARVER Target Analysis and Vulnerability Assessment Convention in Washington, D.C. on Friday, November 16th, 2018 from 8am – 5pm. The event will be in Washington D.C. at the Washington Marriott Metro Center with a continental breakfast, lunch, and light fare in the afternoon.

This one-day event will cover a range of topics related to protecting critical infrastructure and key resources, utilizing the CARVER Target Analysis and Vulnerability Assessment Methodology as a foundation for discussion. The latest innovations in assessment technology, recent case studies, and best practices for identifying and minimizing security threats will all be addressed.

Featured speakers include retired CIA officer and the “Godfather of CARVER,” Leo Labaj, former Deputy Director of the FBI, William Esposito, former US National Security Advisor and Supreme Allied Commander, General James Jones, plus many more. more