Saturday, July 25, 2020

DHS Gives Federal Agencies 24 hours to Patch Critical Microsoft Windows Vulnerability

Our friend in cold country has a hot tip for you!
Thanks, Mike.

--------------------
If you’re running an externally facing Windows DNS server, it should be patched as soon as possible.  It’s probably a good idea to work this patch into your internal patch management cycle as well.

CVE-2020-1350

If your DNS is managed by an external IT firm, please feel free to forward this to them.
If you’re not sure, drop me an email or give me a call at (907) 354-4879 (cell).

Thanks,
-Mike.
---
Mike Messick
President, Deep Forest Security Consulting
PO Box 242334
Anchorage, AK. 99524-2334
(907) 334-9090 Office

Thursday, July 23, 2020

The World’s Smallest Voice Recorder?

Is this The World’s Smallest Voice Recorder?



Specifications
TileRec by ATTO Digital 
Ultra-small: ≈1.53”x1.53”x.02” (≈39 x 39 x 5 mm)
Record modes: Voice activated or continuous.
Storage capacity: 145 hours.
Format: 128 kbps CD Quality MP3.
Playback: Download files to any computer.
Battery “on time”: Up to 24 hours.
Battery charge time: 2 hours.
Housing: Sturdy aluminum case.
Operates with one on/off switch.
Cost: $59.80 Amazon

Voice recorders keep getting smaller and smaller. 

However, If smallest means thin to you, yes there is a thinner one, the Edic-mini Tiny16+ A75…
 1 mm thinner, 12 mm less wide, but double the length. And, at $345, six times the price. They also make one card-key sized (2.7 mm thin).

Edic-mini Tiny16+ Flat voice recorder 

If by smallest you mean really, really thin… You might want to consider the NAGRA Dollar Bill recorder that’s being marketed to law enforcement instead. Thirty-one times as expensive as the TileRec.
There are many slightly larger voice recorders that are still considered to be mini in size. Our search on eBay returned 1,809 results and over 2,000 on Amazon.

eBay Search Box for voice recorder 
The prices on eBay ranged from $1.45 (with free shipping from China!) to $2,000. for the Edic-mini Tiny+ B76-150HQ. The Edic-mini Tiny+ being closest in size to the TileRec.

A Voice Recorder Manufacturer Speaks

Jang Sung-Churl, chief executive of electronics firm Auto Jungbo Co. Ltd., told Reuters that covert recording devices “have been selling like hotcakes” …sales of voice recorders so far this year (2019) have doubled to 80 devices per day, Jang said as he forecast sales to also double this calendar year to 1.4 billion won ($1,172,289).

Think about it. That's almost 30,000 devices sold per year... before the expected doubling of sales. And, he is only one manufacturer. An educated guess is that there are thousands of manufacturers around the world.

Accessibility + Affordability = Big Concerns.

 

Who Cares About Voice Recorder Size?

Lots of folks, for many and varied reasons…
  • Sneaky people who want to eavesdrop.
  • Sneaky people who want to entrap others.
  • Anyone worried about covert surveillance.
  • Local law enforcement detectives and Private Investigators. They might not have the budget necessary for a covert NAGRA Dollar Bill Recorder, but have the smarts to slap a TileRec between two one-dollar bills.
  • Technical Surveillance Countermeasures (TSCM) Technicians whose job it is to find illegal, electronic surveillance devices.
It all boils down to these two things:
People hiding voice recorders, and… thwarting the people doing it.

 

Discovering Voice Recorders 

Since the offense has the advantage let’s concentrate on the defense.

The average covert voice recorder will either be carried by a person to record face to face conversations or it will be hidden within conversations-of-interest areas.

 

In-Person Recording Detection Tips

  • Since frisking is probably out of the question, assume you are being recorded.
 Even if you could frisk, results would be iffy; these voice recorders are tiny.
  • At the outset of a conversation ask the other person if they are recording you. Watch their reaction. Do they overly protest, or fake anger? 

If they say no but record anyway, the recording’s value can be challenged. They lied, so maybe they also faked, edited or doctored the recording.
  • Also… Be professional. If you would not say it in a courtroom, don’t say it.
Big Red Flag – When someone tries to recreate a previous conversation with you.

 

Covert Recording Detection Tips

  • Pay attention to your surroundings. Who has access and when? Voice recorders need to be retrieved: to review recordings and to recharge batteries.
  • Avoid using the same area for all your sensitive conversations. Use various and unpredictable locations if possible.
  • Conducting your own search for surveillance devices is futile. An experienced eavesdropper will plant one easy-to-find device. They know the search will stop at that point. The harder-to-find device and it’s back-up will still be on the job. Without proper training and instrumentation your success is unlikely.
  • 

For office and home office situations an independent Technical Surveillance Countermeasures (TSCM) sweep team should be employed. Have them conduct periodic due diligence debugging inspections. In addition to searching for room audio and video surveillance devices have them check your vehicles. Vehicle inspections also include a search for GPS tracking devices.

 

TileRec Voice Recorder Detection Test

 

Voice Recorder Detection Test 50% & 100% PowerTesting Our Defenses

Murray Associates conducted tests to determine the effectiveness of their detection techniques on mini voice recorders. 

TileRec was difficult–but not impossible–to detect compared to other recorders tested.

During a professional TSCM inspection the technician’s physical search is aided by an instrument called a Non-Linear Junction Detector (NLJD). This instrument can detect electronic surveillance devices, including mini voice recorders, active or dormant.

A distance of 3 to 4 inches was chosen to test the NLJD detection technique. This simulates the recorder being secreted within another object. Green shows the power output. Red shows the level of detection.

With the NLJD set at 50% power output the TileRec was barely detectable. When the power was increased to 90-100%, success. Even at this higher power operator skill in using the NLJD was critical.

Conclusions

  • The TileRec is (probably)
    The World’s Smallest (affordable)
    Voice Recorder (as of now).
  • Size doesn’t matter. Any mini recorder can be easily secreted and threaten privacy.
  • The market for mini recorders is huge. There are a lot of them out there. Some of the very good ones are very inexpensive.
  • Detection is difficult, but not impossible.
  • The best self-protection tactic is watching what you say and situational awareness. Critical situations require the assistance of a professional TSCM / counterespionage firm.
* * *

Kevin D. Murray CPP, CISM, CFE is a business counterespionage consultant and TSCM specialist with over four decades of experience.

Murray Associates is an independent counterespionage consulting firm, providing eavesdropping detection (TSCM) and counterespionage services to business, government and the at-risk individual.
 
Headquartered in the New York metropolitan area, a Murray Associates team can assist you quickly, anywhere in the United States, and internationally.

If you have any questions, or would like to schedule TSCM / information security audits, please let us know.

Friday, July 17, 2020

Quote of the Week — Espionage Truths

"... a key way to detecting espionage is to follow your instincts and protocols."
~ /

International Conferences on Business Espionage and Cyber Security

August 23-24, 2021 in Budapest, Hungary
ICBECS 2021: 15. International Conference on Business Espionage and Cyber Security aims to bring together leading academic scientists, researchers and research scholars to exchange and share their experiences and research results on all aspects of Business Espionage and Cyber Security. It also provides a premier interdisciplinary platform for researchers, practitioners and educators to present and discuss the most recent innovations, trends, and concerns as well as practical challenges encountered and solutions adopted in the fields of Business Espionage and Cyber Security. more

ICBECS 2020: 14. International Conference on Business Espionage and Cyber Security, August 19-20, 2020 in Budapest, Hungary (to be held digitally) more

From The Dot Connection Files - CIA & Iran - Just Coincidence? You Decide

Three stories.
Same day.
Makes one wonder...

The Central Intelligence Agency, using new powers, carried out aggressive covert cyber operations against countries including Iran, North Korea, China and Russia, a new report says... The new powers gave the CIA more latitude to “damage adversaries’ critical infrastructure, such as petrochemical plants, and to engage in the kind of hack-and-dump operations that Russian hackers and WikiLeaks popularized,” the report explained. more

Iranian cyberspies leave training videos exposed online — One of Iran's top hacking groups has left a server exposed online where security researchers say they found a trove of screen recordings showing the hackers in action. more

The US has "several" intelligence indications that Iran has put portions of its air defense system on "high alert" in recent days, following unexplained explosions at key facilities tied to the country's military and nuclear programs, according to a US official who is closely tracking developments. more   sing-a-long (nsfw use headphones)

Thursday, July 16, 2020

Is James Bond an Idol with Feet of Clay? — You decide.

James Bond has long been the most famous "secret agent" out there. Everyone knows James Bond, and it is rare to meet someone who hasn't seen at least one of the films.

Like with most films of that kind, there are a lot of issues with the character and story lines in general. Take for instance the fact that they call him a "secret agent" when he is in fact an Intelligence Officer. Add to that he doesn't have a line manager, he somehow reports directly to the head of MI-6.

Then there is the reality that a "license to kill" doesn't really exist. Despite these tiny issues with details, the films are actually quite good.

However, there are many reasons that James Bond truly is the worst spy ever, even if he is a fictional character. Here are the top 007 reasons:
  1. He carries a gun on airplanes
  2. He constantly destroys or loses his equipment
  3. He is always being captured and/or beaten up
  4. He never follows orders
  5. He travels under his own name
  6. He always draws attention to himself
  7. Everyone knows who he is 
To top it off they all know his 00 code number … His secret code number. The number of times an adversary uses 007 is absolutely astounding. This alone is enough to make James Bond the worst spy ever. more

Wednesday, July 15, 2020

Android: Camera Can Remain Active When Phone is Locked

Mozilla says it will fix the bug later this year, in October.

Mozilla says it's working on fixing a bug in Firefox for Android that keeps the smartphone camera active even after users have moved the browser in the background or the phone screen was locked.

The bug was first spotted and reported to Mozilla a year ago, in July 2019, by an employee of video delivery platform Appear TV.

The bug manifests when users chose to video stream from a website loaded in Firefox instead of a native app. more

Santa and Cuebiq Know if You've Been Naughty or Nice

After Memorial Day, as the United States began to reopen, coronavirus cases began to rise...

For the Fourth of July weekend, a new analysis of cell phone data suggests even more people hit the road among 10 coronavirus hotspots, despite warnings from health experts.

The analysis comes from data shared with CNN by Cuebiq, one of the private companies that the US Centers for Disease Control and Prevention uses to track general movement in the United States. 

Cuebiq gets its data when people download apps on their phones and opt into anonymous location data tracking. The company's full data set includes 15 million phones nationwide. more

The Atlas of Surveillance

Documenting Police Tech in Our Communities. 

Explore 5,300 datapoints in the U.S. collected by hundreds of researchers.

TOGGLE the Legend to reveal how each technology is spreading. ZOOM into any region to see the technologies in greater detail. If an area has no markers, it means it hasn't been researched yet.
Click to enlarge. Go to website to explore. Wired article here.

Monday, July 13, 2020

Google to Restrict Ads for Spycams and More

Google is set to announce a major overhaul of its ad policy starting next month.

In a blog post, Google has said that the changes specifically framed to put restrictions on advertisements promoting surveillance technologies that let people secretly spy on their intimate partners will be made into the Enabling Dishonest Behavior policy on August 11.

“The updated policy will prohibit the promotion of products or services that are marketed or targeted with the express purpose of tracking or monitoring another person or their activities without their authorization.”, the Alphabet-owned company said in its blog. Google said the updated policies will be applicable globally as soon as it will be brought into effect starting August 11. more

Tuesday, July 7, 2020

Digital Assistant Speakers Know More Than Just Their Names

As voice assistants like Google Assistant and Alexa increasingly make their way into internet of things devices, it’s becoming harder to track when audio recordings are sent to the cloud and who might gain access to them.

To spot transgressions, researchers at the University of Darmstadt, North Carolina State University, and the University of Paris Saclay developed LeakyPick, a platform that periodically probes microphone-equipped devices and monitors subsequent network traffic for patterns indicating audio transmission. 

They say LeakyPick identified “dozens” of words that accidentally trigger Amazon Echo speakers. more

More stories about Digital Assistant Speakers.

After B&E for Bugging Home Inmate Charged Again

NY - A Gansevoort inmate was arrested Friday following an altercation at the Saratoga County Jail.

Todd D. Derush, 39, of Wilton-Gansevoort Road, was charged with felony second-degree assault.

He was arrested on Jan. 30 for allegedly illegally entering an acquaintance’s home and hiding equipment to record conversations. The victim had an order of protection against him. He was charged with felony second-degree burglary, first-degree criminal contempt, eavesdropping, unlawful surveillance and misdemeanor possession of eavesdropping devices. more

New Spy Movie: My Grandfather The Spy

EXCLUSIVE: Dave Evans’ feature doc My Grandfather The Spy, which chronicles the director’s exploration of his own family’s long-buried secrets, has been boarded by SMP Distribution for international sales... It follows how director Evans uncovers that his grandfather Eric, seemingly a quiet unassuming shopkeeper, actually had a connection to Cold War espionage... Shooting took place in Bulgaria, England and Wales. SMP is now looking into festival screenings. more

Don't Click on Links Like This... but click on this one to learn why. (blahaha)

A subset of Three UK users have received an SMS message warning them about text message-based spam – complete with a shortlink and textual urgings to click it and learn more.

The definitely-not-smishing-honest message was received by Reg reader Chris, and he was not very chuffed with it. He told us:

"They send an unsolicited out-of-the-blue SMS which asks you to 'click' (not tap) on a link. When checked out in a sandboxed environment this goes to an insecure http-only page which warns of suspicious text messages and a video telling recipients not to tap on any links. Awesome!" more

The offending message is reproduced in all its glory below:

Privacy Advocates Alert: Make Orwell Fiction Again

Make Orwell Fiction Again https://amzn.to/2O591aq