Digital Assistant Speakers Know More Than Just Their Names

As voice assistants like Google Assistant and Alexa increasingly make their way into internet of things devices, it’s becoming harder to track when audio recordings are sent to the cloud and who might gain access to them.

To spot transgressions, researchers at the University of Darmstadt, North Carolina State University, and the University of Paris Saclay developed LeakyPick, a platform that periodically probes microphone-equipped devices and monitors subsequent network traffic for patterns indicating audio transmission. 

They say LeakyPick identified “dozens” of words that accidentally trigger Amazon Echo speakers. more

More stories about Digital Assistant Speakers.

After B&E for Bugging Home Inmate Charged Again

NY - A Gansevoort inmate was arrested Friday following an altercation at the Saratoga County Jail.

Todd D. Derush, 39, of Wilton-Gansevoort Road, was charged with felony second-degree assault.

He was arrested on Jan. 30 for allegedly illegally entering an acquaintance’s home and hiding equipment to record conversations. The victim had an order of protection against him. He was charged with felony second-degree burglary, first-degree criminal contempt, eavesdropping, unlawful surveillance and misdemeanor possession of eavesdropping devices. more

New Spy Movie: My Grandfather The Spy

EXCLUSIVE: Dave Evans’ feature doc My Grandfather The Spy, which chronicles the director’s exploration of his own family’s long-buried secrets, has been boarded by SMP Distribution for international sales... It follows how director Evans uncovers that his grandfather Eric, seemingly a quiet unassuming shopkeeper, actually had a connection to Cold War espionage... Shooting took place in Bulgaria, England and Wales. SMP is now looking into festival screenings. more

Don't Click on Links Like This... but click on this one to learn why. (blahaha)

A subset of Three UK users have received an SMS message warning them about text message-based spam – complete with a shortlink and textual urgings to click it and learn more.

The definitely-not-smishing-honest message was received by Reg reader Chris, and he was not very chuffed with it. He told us:

"They send an unsolicited out-of-the-blue SMS which asks you to 'click' (not tap) on a link. When checked out in a sandboxed environment this goes to an insecure http-only page which warns of suspicious text messages and a video telling recipients not to tap on any links. Awesome!" more

The offending message is reproduced in all its glory below:

Privacy Advocates Alert: Make Orwell Fiction Again

more

America’s Cup Buffeted by Fraud and Spying Allegations

New Zealand’s plans to host the 2021 America’s Cup are in disarray amid allegations of fraud, spying and a government decision to suspend funding for the world’s most famous yachting event.

Grant Dalton, managing director of Team New Zealand, has denied claims of fraud and financial mismanagement. He said the team and organisers were the victims of spying and intentional reputational damage by people with questionable motives.

“It is a deliberate, sinister, and highly orchestrated attack which includes anonymous tip-offs, recordings and document leaks. ‘Informants’ orchestrate unfair accusations, bypassing normal processes, and going straight to external authorities,” he said.

Mr Dalton revealed this week the team had sacked a number of employees for leaking confidential information. He said his organisation had been infiltrated by spies. more

US Court Rules Facebook Widgets can be Considered Wiretaps

After a nine-year-long legal battle, a federal appeals court has ruled that Facebook’s practice of collecting data through its widgets could be considered a violation of anti-wiretapping laws.

The social media firm has long defended its actions by quoting the part of the federal Wiretap Act that defines wiretapping as interception of communications. According to a Gizmodo report, in Facebook’s logic, gathering user data isn’t the same as wiretapping without that active interception.

However, a panel of judges on the 9th Circuit Court of Appeals in the US has dismissed this technicality as it was found that the Facebook widget was collecting information from people who didn’t click on it. Such actions, they ruled, count as interception. more

How attackers hack mobile networks...

...and get access to free data, locations, wiretap calls and more.  

A fairly detailed and interesting article for the technically curious. more

TikTok - Times Up

This has been a week that TikTok—the Chinese viral video giant that has soared under lockdown—will want to put quickly behind it...

Whether India had always planned to announce its ban on TikTok, along with 58 other Chinese apps, on June 29, or was prompted by the viral response to the iOS security issue is not known. But, as things stand, TikTok has been pulled from the App Store and Play Store in India, its largest market, and has seen similar protests from users in other major markets around the world, including the U.S.

One of the more unusual groups campaigning against TikTok is the newly awakened Anonymous hactivist group... “Delete TikTok now,” the account tweeted, “if you know someone that is using it, explain to them that it is essentially malware operated by the Chinese government running a massive spying operation.” more
Calls for Tik Tok to be banned in Australia over Chinese spying fears

LinkedIn 'caught' spying on Apple iPhone users the way TikTok did on iOS 14
Pompeo says the U.S. is ‘certainly looking at’ banning TikTok and other Chinese appTikTok to exit Hong Kong 'within days'

Security Director Alert: Why Home Offices Also Need TSCM

Since the coronavirus hit the U.S. in full force in March, spam emails are up 6,000%. This data from the head of IBM’s X-Force Threat Intelligence, Wendi Whitmore... The surge is, in part, connected to the high numbers of people working from home...

Since the lockdowns began, cybersecurity experts began to worry that it would be easier for attackers to compromise security systems. The fear of the pandemic, financial stress, and other distractions at home turned workers into ripe targets for scammers, as stress lowers people’s guard to tactics like phishing.

In the case of workers using VPNs, some experts see them as the perfect way to get a bad actor into a company’s network, likening it to a hypodermic needle. All an attacker needs is a few employees to click on some malware, perhaps from an email or a fake resume and they could be in — and some cyber experts even speculated that attackers might target unsecured Wi-Fi networks. more

Former Police Officer Accused of Spying on Neighbors

MO - A man told police he found a mini video recorder on an outside window ledge of his St. Charles County home... The camera allegedly was pointed into a closet and bathroom inside his home.

When St. Charles County police analyzed the camera and SD card, they found multiple clips showing the man and his wife, both clothed and nude, inside of their home...

According to court documents, more recordings led authorities to believe the camera was resting on John Zlatic’s back porch at one point in time. When police attempted to talk Zlatic, the suspect did not answer his doorbell...

Officers were able to get DNA profiles from a plastic clamp that was used to prop the camera on the window ledge. They then used Zlatic’s former police uniform, which had been given back to the department upon his resignation, to confirm the DNA on the clamp was his, court documents state. more 
Learn how to detect spycams.

Reports: Cybercrimes Surge 400%, Teleworkers Need to Tighten Security

...in another new analysis, IBM warns that teleworkers are especially vulnerable to attack.

“There is a level of apathy and a lack of awareness when it comes to securing the home office environment....they’re seeing double the failure rates on their security tests than they saw pre-COVID,” warns Mathew Newfield, Chief Information Security Officer at Unisys...

“This unprecedented remote working explosion amounts to a dramatic game changer for corporate security officers and cyber attackers,” says Patrick Barry, Chief Information Officer at Rebyc Security.”

“Corporate cyber security strategies, policies, penetration testing procedures, and technologies need to be reconsidered and reevaluated and, in many cases, revamped.” more

This Month in Wiretapping History

 1977 - S. Korea - The foreign ministry delivers a letter of protest to Washington over the wiretapping of the office of President Park Chung-hee by the U.S. Central Intelligence Agency. The agency was investigating an allegation that a South Korean lobbyist paid bribes of up to US$1 million to high-level U.S. politicians at the behest of the South Korean president, who did not get along with his U.S. counterpart, Jimmy Carter. more

Questions We Get... Are 5G Cell Phone Signals Dangerous?

A. Being a licensed amateur radio operator, the topic hits close to home. Basically, any high strength RF emission can cause damage. Leukemia is the top one for transmitter engineers in the broadcast biz. 

Fortunately... "The intensity of radio waves over distance obeys the inverse-square law, which states that intensity is inversely proportional to the square of the distance from a source. Think of it this way: double the distance, and you get four times less power."

Given the distance cell antennas are away from people the effect is negligible. However, if your office chair sits next to a wall with a cell antenna mounted just on the other side, you might want to change offices. ~Kevin  more

How to Detect Hacked Charging Cables

Click to enlarge.

• They Appear Normal
• They Blend In
• They Suck Up Your Data

They are Alien Cables from Hacker Space.

Imagine a charging cable which looks exactly, and I mean exactly, like any stock charging cable. Oh, just one difference. This charging cable has built-in Wi-Fi and can run penetration programs on whatever it is plugged into.

Hacked charging cables exist, in four versions and two colors, white and black, and they sell for $119.99.

Ostensibly, they are, “built for covert field-use by Red Teams.” However, anyone can buy one. We did. 

Determining if the following claims are true is important to protecting our clients.

“It looks like the real thing. It feels like the real thing, down to the millimeter.” Has “features that enhance remote execution, stealth, and forensics evasion.”
Our tests revealed... more