Thursday, July 9, 2009

"Passwords? We don't need no stinkin'..."

Kon-Boot for Windows enables logging in to any password protected machine profile without without any knowledge of the password. There is also a version for Linux. Sounds dangerous. Stay tuned. Freeware download.

Security Director Recommendation - One possible corporate environment solution; lock out USB ports and CD drives.

Spy Cheap... at The International Spy Museum

The International Spy Museum Store is having a great summer sale! Up to 50% Off + Free Ground Shipping on Orders Over $50.

Very Practical...
Metrosafe Anti-Theft Computer Bag
Product Facts: When you have top-secret data to deliver, there may be spies lurking around the dead drop, waiting to lift your laptop. That’s where the Metrosafe delivers. It looks like a regular laptop case, but its security features elevate it to an effective anti-theft device. It has tamper-proof, lockable zippers and a wire-reinforced, slash-proof shoulder strap with a built-in combination lock. (You can anchor the strap around a secure object like a table leg.) Its front and bottom panels are also slash-proof to protect against knife-wielding spies. Designed with a fully padded laptop compartment with two organizer pockets, a front zippered organizer pocket and two padded pockets to hold a cell phone, PDA, camera, or MP3 player. Fits most 13” laptops. Technical Data: 840-denier ballistic nylon/high-tensile steel wire. Black. 12” x 13-1/2” x 4”. 2 lbs., 3 oz. (33% off)

Tuesday, July 7, 2009

Why Business Espionage is Epidemic

Business espionage has kept me in business for over 30 years now. I help organizations uncover it and stop it - before they suffer expensive losses. Eavesdropping and wiretap detection is a key component to corporate counterespionage efforts because they are the easiest espionage red flags to spot.

This is what I have learned over the years.
Business espionage is rampant due to...
1. Low cost of entry.

2. High rate of return.
3. Low probability of detection.
4. Lower probability of prosecution.
5. Even lower probability of meaningful punishment.

Example...
David A. Goldenberg, ex vice president of AMX, was arrested following a six week investigation and was charged with Unlawful Access of a Computer System/Network, Unlawful Access of Computer Data/Theft of Data and Conducting an Illegal Wiretap. On May 11 he entered a plea of guilty to felony wiretapping.

The investigation revealed that, while an employee of AMX, Goldenberg had infiltrated the email accounts of Sapphire Marketing, a sales representative for Crestron. He was intercepting emails related to potential contracts, which afforded him advanced knowledge of Sapphire's customers and bid prices affording him an opportunity to underbid them. He then established a free email account and created an automatic forward of the victim's email to that address.

He has been sentenced to three years probation, including psychological counseling, and will have to pay an undisclosed fine. The maximum sentence for the crime is five years in prison but Goldenberg has managed to avoid any jail time. (more)

In this case, damage was done. Their information and strategies were taken and used against them. The loss was expensive.

Call me if your company would like to know how to detect espionage problems before they get to this stage. ~ Kevin

Monday, July 6, 2009

Spy Trick #325 - Lost Laptops from Airports

A new study sponsored by the Dell computer company estimates that more than 12,000 laptop computers are lost or stolen each week at U.S. airports, and only 33% of those that turn up in "lost and found" are reclaimed.

The other 67% remain in the airport awhile before being disposed of, meaning there are "potentially millions of files containing sensitive or confidential data that may be accessible to a large number of airport employees and contractors," the study reports.

More than 53% of business travelers say their laptops contain confidential or sensitive information, but 65% of these people admit they don't take steps to protect it. Yet the average business cost when confidential personal information is lost or stolen is $197 per record, according to another Ponemon study.
(more)

A full copy of the report can be found here. (pdf)


What do you think happens to laptops left at the airport?
Could they fall into the hands of professional snoops?


"The TSA turns it over to state surplus property agencies, which tend to sell it online or at retail stores."

Let's dig further. We'll pick Texas, a big state with several major airports (7 to be exact). They have several method of disposal...
• Online auctions at www.lonestarauctioneers.com and www.bandiauctions.com
• 3 live on-line auctions a year.

• eBay under seller name texasstatesurplus.
• At their walk-in stores.
(Texas Surplus Brochure)

It would not be difficult for business spies to track property disposal auctions from every airport.

Solutions... Crypt your disk. Install theft reporting software. Engrave "Reward if found and returned..." on the bottom.

The Case of the Tattle-Tell Cell

NY - Mikhail Mallayev, who was convicted in March of murdering an orthodontist whose wife wanted him killed during a bitter custody battle, stayed off his cellphone the morning of the shooting in Queens. But afterward, he chatted away, unaware that his phone was acting like a tracking device and would disprove his alibi — that he was not in New York the day of the killing.

Darryl Littlejohn, a nightclub bouncer, made call after call on his cellphone as he drove from his home in Queens to a desolate Brooklyn street to dump the body of Imette St. Guillen, the graduate student he was convicted this month of murdering.


The pivotal role that cellphone records played
in these two prominent New York murder trials this year highlights the surge in law enforcement’s use of increasingly sophisticated cellular tracking techniques to keep tabs on suspects before they are arrested and build criminal cases against them by mapping their past movements. (
more)

Sunday, July 5, 2009

Bugs Found - Georgia on my Mind

Georgia - The discovery of bugging equipment in opposition party offices indicates that the country is under a repressive regime, Georgian Public Defender Sozar Subari said on Tuesday. His statement followed claims by the Conservative Party and the Way of Georgia leaders that they found bugging equipment in their offices on Monday.

...the bugging equipment was discovered by one of the opposition leader’s security guards by using special equipment.

Later on Monday Conservative Party leaders also claimed they had found bugging devices in their office.

On Tuesday it also became known that similar devices had been found in the Alliance for Georgia’s office in Isani. One of the members of the Alliance, New Rights activist Mamuka Katsitadze, said that the New Rights is now checking its own offices. “I am also planning to examine my house...

The Interior Ministry has denied any links with the bugging devices found in opposition party offices. Spokesperson Grigol Beselia said that the Ministry’s special agencies do not use these devices any more. “A criminal case has been launched concerning the bugging equipment found in the Conservative Party and Way of Georgia offices. No special license is needed to buy these kind of devices. Anyone can buy them... (more)

"Love the giver more than the gift." - B.Y.

Psst: The super-secretive National Security Agency is about to build a huge, $1.9 billion data center at Camp Williams, Utah, to help spy on communications worldwide. (more)

SpyCam Story #540 - The Covert Cruiser

OH - Why did that police cruiser camera start recording?

That’s an unanswered question in the wake of the tape that showed Police Chief Tim Escola kissing and caressing a part-time officer under his command.

An attorney for the former chief suggested the cruiser camera may have been rigged, a claim township officials dispute.


POSSIBLE ANSWERS

Law Director Charles Hall said Escola or officer Janine England accidentally may have switched the camera system into a “covert mode,” which recorded their behavior June 2 as they drove a burglary suspect back from the Cincinnati area.

Those familiar with the equipment in Perry Township didn’t know the feature existed until Thursday after a review of the owner’s manual, Hall said. The system is less than a year old.
“If you go to turn the device off and hold the power button, the camera goes into covert mode,” Hall said. In covert mode, the camera continues to record but the display screen and all lighting turns dark, he said.

Escola abruptly retired Tuesday night. England remains on the force and faces no discipline. (more with interesting comments) (video)

"So, SIS stands for SECRET Intelligence Service?"

The wife of the new head of Britain's spy agency has posted pictures of her husband, family and friends on Internet networking site Facebook, details which could compromise security, a newspaper said on Sunday.

Sir John Sawers is due to take over as head of the Secret Intelligence Service in November. The SIS, popularly known as MI6, is Britain's global intelligence-gathering organisation.


In what the Mail on Sunday called an "extraordinary lapse", the new spy chief's wife, Lady Shelley Sawers, posted family pictures and exposed details of where the couple live and take their holidays and who their friends and relatives are. (more) (sing-along)

Saturday, July 4, 2009

Business Espionage - Frankincar

Tong Jian S11
China’s first "self-designed" hybrid sports car...

Part Prius
Part Audi R8

Part Ferrari F430


via China Car Times...
The S11 was first unveiled at the Shanghai Auto show earlier this year to an impressed crowd. The car was designed by Shanghai based TJ Innova, the S11 looks fantastic, with Audi and Ferrari design tones slipped into its sleak body, under the platform there is an AWD drivechain pushing power to each corner of the car. (more)

Just coincidence?
You decide.

Friday, July 3, 2009

IvUkenReDizUmstBeeMstrPrzadnt

For more than 200 years, buried deep within Thomas Jefferson's correspondence and papers, there lay a mysterious cipher -- a coded message that appears to have remained unsolved. Until now.

The cryptic message was sent to President Jefferson in December 1801 by his friend and frequent correspondent, Robert Patterson, a mathematics professor at the University of Pennsylvania. President Jefferson and Mr. Patterson were both officials at the American Philosophical Society -- a group that promoted scholarly research in the sciences and humanities -- and were enthusiasts of ciphers and other codes, regularly exchanging letters about them. (more)

What's in a spy suspect's bedroom?

The latest revelation in the curious case of accused Cuban spies: They kept a copy of The Spy's Bedside Book in their apartment.

A peek inside the apartment of husband-and-wife spy suspects reveals a shortwave radio, a sailing guide to Cuban waters -- and now a copy of The Spy's Bedside Book, according to new court documents in the case. (more)

Blind Justice Swats Blind Swatter

MA - A blind teenager was sentenced to 11 years in prison on Friday for hacking into the Verizon telephone network and using fake 911 calls to harass an investigator who was building a case against him...

Matthew Weigman, 19, from Revere, Mass., was part of a group of sophisticated and notorious telephone hackers who engaged in “swatting” calls. (Calls prompting police SWAT team dispatch.)

Swatters use spoofing technology to mask their real location when placing fake 911 calls. This makes it seem as though the call is legitimate, and coming from a potential victim’s home. Police are sometimes dispatched to the homes of these “victims,” allowing swatters to effectively harass their targets from a distance.

Weigman, known as “Little Hacker,” has been involved in telephone hacking since the age of 14. (more)

Trend - Phone Encryption

During Sweden’s EU Presidency (started July 1), Swedish government authorities and the defense forces will use Sectra’s Tiger XS personal voice encryptor for eavesdrop-secure communications. Sweden is the fifth country in Europe to use Tiger XS to protect telephone conversations from eavesdropping during its EU Presidency. (more)
from the web site...
One encryption device for all
Tiger XS is a personal encryptor that protects mobile and fixed communications. Use one encryption device to secure your voice, data, fax and SMS communications. Tiger XS is connected to your mobile phone via Bluetooth®. This enables a high level of security on communications networks such as GSM, PSTN, ISDN, IP networks as well as satellite systems. With Tiger XS you are safe to exchange classified information over GSM networks or ordinary telephone lines – from your office desk, at home or on the road. (more)

Thursday, July 2, 2009

Watergate. Bailout. They just sound right together.

According to a July 2 broadcast on National Public Radio, the famed Watergate Hotel in Washington, DC is likely to face foreclosure because the owners have defaulted on a $69.9 million loan on the property.

Watergate is well-known to many Americans because of the events of June, 17, 1972, when DC police arrested five men trying to break in and wiretap the offices of the Democratic Party located in the building. Along with two others, they were tried and convicted in January 1973.

All seven were connected with President Richard M. Nixon's reelection committee
, suggesting that what appeared to be a simple burglary/wiretap might involve high-level government officials. (
more)

FutureWatch - Watergate is purchased (bailed out) by the National Park Service. Tours daily. Most popular stop... The Frank Wills Memorial Door, with tape over the lock.

iOpener

If you own an iPhone, security researcher Charlie Miller can take control of it, and short of turning off the device, it appears there isn't much you can do to stop him. Not until Apple fixes the flaw, anyway.

Exploiting a bug in the way iPhones parse SMS messages, the principal analyst at Independent Security Evaluators has demonstrated how to send malicious commands to monitor the phone's location, turn on its microphone, or cause it to join a DDoS, or distributed denial of service attack, according to this report from IDG News.

The vulnerability is significant because there are few measures iPhone users can take to prevent an attack... (more)

Dumpster Diver Surfaces with New Identities

CA - Police have arrested a man who allegedly admitted to stealing the identities of more than 500 people by going through the trash of local banks and businesses.

The criminal complaint filed against 30-year-old suspect Jonah Nelson claims that he made more than 1,000 fake ID cards that he used to rip off people, stores and banks. Nelson also allegedly admitted to stealing the identities of more than 500 people all acro
ss Northern California, ranging from the Bay Area to the Central Valley.

Federal agents say Nelson said it was easy to find new victims: All he needed to do was visit a local bank and search their dumpsters. (
more)

My amazing bank shredder story...
I received a package cushioned with strips of shredded paper filler...
made from bank records!

Names, addresses, deposit amounts, account numbers, phone numbers, Social Security numbers. It was all there. Easily reconstructed.

This was worth looking into.

My secretary wrote to the company who sent us the box...
“Your packing material was most interesting (the recycled paper). Is there a company that supplies it? Is there a charge for it? If you have a company name I would appreciate your sharing it with me. Thanks!”

Their reply...

“Check with any local bank - they shred 6-10 bags per week - you can get it for free for the asking!”

Fortunately, this was an honest person. They could just as easily have been and investigator or spy... and, the bank could have been any business or government agency.

Were their hearts in the right place for recycling?
Probably.

Is this a good practice.
No.

Buy and use a good crosscut shredder. ~Kevin

Wednesday, July 1, 2009

The Search Engine That Didn't Snitch... and other disasters

Hey gang, it's almost Independence Day here in America. Yup, July 4th is just around the corner.

Fireworks are in America's bloodstream... but, did you know your on-line curiosity could get you in trouble with the terrorist chasers? Your fireworks search engine enquires might start popping red flags...

"Ludlow Kissel and the Dago Bomb That Struck Back"
"What is a Dago Bomb?"
"How can I build a Dago Bomb?"
"Dago Bomb ingredients"
"What was blown up by the Dago Bomb?"

(Knock, Knock)
"We're from Homeland Security..."


"Excelsior, you fathead!" Next time, don't use a search engine that captures your IP address. Search privately. Go to https://www.ixquick.com
ixquick is the only search engine which gives you anonymity.

Oh, and Ludlow... he had his 15 minutes of fame... about 2:17 into this Great American Fourth of July video. ~Kevin

UPDATE - NEW URL. Startpage.com

Monday, June 29, 2009

Security Director Alert - Fake Tweets

Twitter users have caused an uproar by impersonating celebrities on the popular micro-blogging service. Businesses, too, are targets of fake Twitter profiles -- sometimes from competitors.

Exxon Mobil Corp. has found at least two unauthorized Twitter accounts under variations of its name. Twitter -- a networking service where users create profiles and send out short messages, or "tweets" to their followers -- terminated one of the profiles last summer. An Exxon spokesman says the oil company is considering what to do about the second profile, which it discovered several weeks ago.

In a defensive move, AMR Corp.'s American Airlines in April "registered every possible Twitter name that could be associated with us," a spokesman says. The move came after airline employees last summer found a rogue profile in the name AmericanAir, which was shut down four weeks later.

At Elevation Burger, a seven-outlet chain owned by Elevation Franchise Ventures LLC, a vendor in March found an unauthorized Twitter profile with tweets promoting rival Z Burger. Hans Hess, Elevation's founder and chief executive, complained to Z Burger and Twitter, which later suspended the profile after a letter from Mr. Hess's lawyer.

Amusement-park operator Cedar Fair LP, of Sandusky, Ohio, received an email from a marketing consultant who had created a Twitter profile in the name of its Cedar Point amusement park. The consultant, David Goebel, president of Goebel Group Inc., offered to relinquish control of the account in exchange for season passes to the Cedar Fair park and suggested that the company hire his firm to oversee its Twitter account. (more)

Recommendation: Get to know Twitter. Monitor it for malicious content about your company, the same way you monitor the Web and chat groups.

You do monitor, don't you?


Ok, I'll give you this tip for free...
Plug yourself into Addictomatic.com. It's free too.

Bugs found in Georgian Opposition Party's office

In the office of Georgian opposition party “Way of Georgia” eavesdropping bugs were discovered to have been installed in the office’s electrical sockets.

The leader of the party, ex-minister of foreign affairs Salome Zurabishvili, said that the devices were found where meetings take place among leaders of the party, which is demanding the resignation of current Georgian President Mikhail Saakashvili.

“They were found by employees of the party in the electrical sockets of the room,” said Zurabishvili, who showed the devices to journalists. (more)

SpyCam Story #539 - The Watchful Neighbor

CA- Police in Newbury Park say they've found evidence that a man arrested for allegedly spying on his female neighbors with a hidden camera may have taped other people as well.

Police say Michael Farge, 38, recorded the daily activities of his neighbors, including them changing, for more than two years.

Residents of the community of condos near Wheelwright Lane told KTLA that Farge was good friends with the women he is accused of watching, a woman and her 19-year-old daughter.


They said Farge had a key to the victims' house and watched their house and pets when they were out of town. (more) (video)

Technical director of new product development... charged with 5 counts of spying

A federal grand jury indicted former Arlington Heights resident David Yen Lee on charges he stole trade secrets to divulge to a competitor.

The indictment, which U.S. attorney Patrick Fitzgerald announced Friday, charges Lee with five counts of economic espionage.

According to the indictment, the 52-year-old Lee worked as technical director of new product development for the Wheeling branch of Valspar Corp., a Minneapolis-based paint company, from 2006 to March 2009.

According to the indictment, Lee downloaded documents and data from Valspar and its China subsidiary, Huarun Ltd., to an external thumb drive... (more)

Building Spy Bats

Researchers are studying creatures that fly through the night in hopes of making tiny flying spies.

(right) AeroVironment's DARPA-funded prototype drone made a successful test flight, lifting itself and its energy source.

The most popular of these drones are called Ravens, built by the Monrovia, Calif., company AeroVironment. They are about 4.5 feet across, weigh six pounds and can stay aloft for about an hour and a half. (More, with two cool clips of a bat flying in slow motion.)

Friday, June 26, 2009

FutureWatch - Amazing MagLev

Is this cool, or what?!?!
Enjoy your weekend.
See you Monday.

Japan discovers 1970's 'Broken Window Theory'

A Tokyo district plagued with burglaries has turned to planting flowers to beautify its streets and help stamp out crime.

"'Operation Flower' began about three years ago. By planting flowers facing the street, more people will be keeping an eye out while taking care of the flowers or watering them," said Kiyotaka Ohyagi, a Suginami City official...

Suginami, with a population of 528,800, saw a record 1,710 break-ins in 2002... Suginami says its efforts have paid off, with the number of burglaries falling to 390 in 2008, down almost 80 percent from 2002.

Oh, by the way...
The flowers are part of a wider crime prevention campaign. The district also has 9,600 volunteer patrollers and 200 security cameras set up in areas where there are frequent break-ins. It also emails crime information daily to residents. (more)

Broken Window Theory... (via The Atlantic - March 1982)
...at the community level, disorder and crime are usually inextricably linked, in a kind of developmental sequence. Social psychologists and police officers tend to agree that if a window in a building is broken and is left unrepaired, all the rest of the windows will soon be broken. This is as true in nice neighborhoods as in rundown ones. Window-breaking does not necessarily occur on a large scale because some areas are inhabited by determined window-breakers whereas others are populated by window-lovers; rather, one unrepaired broken window is a signal that no one cares, and so breaking more windows costs nothing. (It has always been fun.)

Philip Zimbardo, a Stanford psychologist, reported in 1969 on some experiments testing the broken-window theory. He arranged to have an automobile without license plates parked with its hood up on a street in the Bronx and a comparable automobile on a street in Palo Alto, California. The car in the Bronx was attacked by "vandals" within ten minutes of its "abandonment." The first to arrive were a family—father, mother, and young son—who removed the radiator and battery. Within twenty-four hours, virtually everything of value had been removed. Then random destruction began—windows were smashed, parts torn off, upholstery ripped. Children began to use the car as a playground. Most of the adult "vandals" were well-dressed, apparently clean-cut whites. The car in Palo Alto sat untouched for more than a week. Then Zimbardo smashed part of it with a sledgehammer. Soon, passersby were joining in. Within a few hours, the car had been turned upside down and utterly destroyed. Again, the "vandals" appeared to be primarily respectable whites. (more)

"How does this apply to information security?"
If management doesn't care, employees won't care. When employees don't care, your company is easy pickings for info-vultures. Patch all the holes. ~Kevin