Detective Science: Fingerprinting Text to Discover Data Leakers

Fingerprinting text; the ability to encode hidden data within a string of characters opens up a large number of opportunities.

Spybuster Tip: For example, someone within your team is leaking confidential information but you don’t know who. Simply send each team member some classified text with their name encoded in it. Wait for it to be leaked, then extract the name from the text — the classic canary trap.

Here’s a method that hides data in text using zero-width characters. Unlike various other ways of text fingerprinting, zero width characters are not removed if the formatting is stripped, making them nearly impossible to get rid of without re-typing the text or using a special tool. In fact you’ll have a hard time detecting them at all – even terminals and code editors won’t display them. more

Denny Hatch is Pissed at 451 Privacy Sucking Companies... under one roof!

Denny Hatch* warns... Verizon's OATH is a consortium of 451 "marketing partners" engaged in massive snoop operations to steal every scintilla of data about you, your family, your children, friends, business associates, enemies, even your pets.

Click to enlarge.

Up for grabs: your most intimate secrets, correspondence, searches, downloads, purchases, trysts, travels, travails and browsing.

Any and all Internet intercourse by and about you is captured and spread...

For 27,679 words describing the details of Oath, click here.
Be sure to click on all permutations. more

* Denny's Note to Readers: May I send you an alert when each new blog is being published? If so, kindly give me the okay by sending your First Name, Last Name and e-mail to me. I guarantee your personal information will not be shared with anyone at any time for any reason. I look forward to being in touch! Cheers!

Butt Dialing Causes a Stink

Former state employee James Stephens, from Cedartown, Georgia, accidentally butt-dialed his boss and now he has a new job and is suing his ex-boss...

"His boss called my client's private cell phone from his own private cell phone," Guldenschuh said. "They were both at home when the conversation took place, which tangentially was work related. When the conversation ended, my client walked into the kitchen and, after a time, touched his phone and pocket-dialed his boss.

"The boss determined my client was not talking to him but listened for about 12 and a half minutes," Guldenschuh said. "James and his wife spoke about the phone call he just had with his boss. Mrs. Stevens made some unflattering comments about his boss which the boss took negatively. So the boss ended up firing my client."...

It was shortly after that that Stephens decided to sue his ex-boss for eavesdropping and invading his privacy. more

School Super Suspended over Eavesdropping on Testimony Against Him

MI - The superintendent of Hale Area Schools (HAS) is facing one felony count of eavesdropping, which is punishable by up to two years of incarceration and/or fines of $2,000...

...the HAS Board of Education placed Vannest on paid administrative leave, following allegations that he had recorded a closed session meeting of the board in a manner contrary to Michigan law.

...a formal complaint had been filed against Vannest by the parent of a student.

...the recording begins as the meeting is called into a closed session. None of the recording takes place during the “open” portion of the meeting.

Vannest’s phone was allegedly left in the room, recording the testimony of witnesses and board members’ questions to those witnesses.

The statement in support reads that it is believed that Vannest intentionally left the device in the room to record/eavesdrop on the conversation and testimony of the witnesses and teachers who were called in for the complaint filed against him.

When police interviewed Vannest, he allegedly stated that he felt the recording was gathered by himself in error. more

Senators Demand More Information About DC Mobile Snooping Devices

A bipartisan group of four Senate privacy hawks are demanding the Department of Homeland Security publish more information about the evidence of mobile snooping devices in Washington and surrounding areas.

"The American people have a legitimate interest in understanding the extent to which US telephone networks are vulnerable to surveillance and are being actively exploited by hostile actors," Sens. Ron Wyden, D-Oregon, Cory Gardner, R-Colorado, Ed Markey, D-Massachusetts, and Rand Paul, R-Kentucky, wrote in a letter Wednesday to Christopher Krebs, the top infrastructure and cybersecurity official at the Department of Homeland Security...

"These things have the capability of tracking. So, if you want to pick a person and say, let's see where they go and who they talk to during the day, that might give you just enough intelligence to make some decisions without even doing the eavesdropping," Kevin D. Murray, a counter espionage expert, told CNN in an interview. more

"Did." "Did not."

U.S. and U.K. intelligence agencies said Russian cyberattackers are targeting critical internet infrastructure to spy on Western companies and governments, the latest salvo in a diplomatic crisis that has brought relations between Moscow and the West to their lowest level in decades.

In a rare joint alert, the U.S. Department of Homeland Security, the Federal Bureau of Investigation and the U.K.’s National Cyber Security Centre said Russian state-sponsored hackers had penetrated devices and software programs world-wide, ranging from routers to switches to firewalls, in order to steal corporate secrets and conduct espionage. more

---

NZ - There are signs New Zealand organisations have been directly threatened by Russian state-sponsored hacking, GCSB director-general Andrew Hampton says.

"Attributing cyber incidents to particular countries is something that is carefully considered and is a step not taken lightly," he added. more

Russia denied accusations from the United States and Britain that its agents have planted malware on key components of the internet to spy on rivals, steal trade and potentially launch cyberattacks.

A Kremlin spokesman on Tuesday called the claim unfounded and "feeble." more

A Snitch on the Foreign Spy Website ...what could possibly go wrong?

China has launched a new website that allows citizens to report people they suspect of being foreign spies or separatists.

The Ministry of State Security reporting platform even offers rewards to citizens who report those who are trying to “overthrow the socialist system,” the South China Morning Post reported.

Accessible in both English and Mandarin, the website (www.12339.gov.cn) was launched on April 15 as part of China's National Security Education Day.

The new website details an exhaustive list of offenses that can be reported, including collusion with foreign countries, plotting to “dismember the state” and “fomenting subversion of state power” through “rumor, libel or other ways.” more

USS Pueblo & Crew Remembered 50 Years Later

1968
USS Pueblo (AGER-2) is a Banner-class environmental research ship, attached to Navy intelligence as a spy ship, which was attacked and captured by North Korean forces on 23 January 1968, in what is known today as the "Pueblo incident" or alternatively, as the "Pueblo crisis".

The seizure of the U.S. Navy ship and her 83 crew members, one of whom was killed in the attack, came less than a week after President Lyndon B. Johnson's State of the Union address... The taking of Pueblo and the abuse and torture of her crew during the subsequent 11-month prisoner drama became a major Cold War incident...

Pueblo, still held by North Korea today, officially remains a commissioned vessel of the United States Navy. Since early 2013, the ship has been moored along the Potong River in Pyongyang, and used there as a museum ship at the Pyongyang Victorious War Museum. Pueblo is the only ship of the U.S. Navy still on the commissioned roster currently being held captive. more

2018
PA - Fifty years ago, Frank Ginther of Bethlehem was one of scores of American sailors held captive for nearly a year after their ship, the USS Pueblo, was attacked and seized by North Korea. 

Ginther and 81 shipmates — one other in the crew of 83 died in the attack — survived months of interrogations and beatings. They were finally released after the U.S. agreed to sign a false statement saying the ship had illegally entered North Korean waters...

Today, Ginther, 74, is struggling to recover from brain surgery he underwent shortly before Thanksgiving. He is unable to speak, is being fed through a tube and requires around-the-clock care, according to a friend who is trying to raise money to help Ginther’s wife with expenses. more 

A Law to Allow Parents to Eavesdrop on their Kids

"Next bill on the floor, MI-342, The School Days Hickory Switch Act."

MI - In a 105-3 vote, lawmakers passed the bill that adds parental exemptions to Michigan’s eavesdropping prohibition. Eavesdropping is defined as overhearing, recording, amplifying or transmitting conversations intended to be private.

Under current Michigan law, snooping on a child’s phone could lead to a felony sentencing of up to two years of imprisonment.

Supporters say parents should be allowed to monitor their children’s conversations until they turn 18 to best protect them. The bill would not allow parents to monitor such conversations with the child’s attorney, a custody investigator or, if there’s a reasonable fear of danger, the other parent.

The bill now heads to the Senate. more

Business Espionage: RadRAT Hid Behind Windows... for 3 years!

Bucharest-headquartered cybersecurity company Bitdefender has flushed out "RadRAT", a powerful all-in-one toolkit for complex espionage ops that was apparently unnoticed since 2015.

This advanced remote access tool -- which offers full control over seized computers was operating since at least 2015, the company said in a statement.

The tool has been used in targeted attacks aimed at exfiltrating information, or monitoring victims in enterprises or large businesses running Windows. more

Listening In: Cybersecurity in an Insecure Age (book)

A compelling case for the need to secure our data, explaining how we must maintain cybersecurity in an insecure age.

Tufts University professor Susan Landau has a long and distinguished background in computer security and policy that includes several books on wiretapping and surveillance...

In Listening In: Cybersecurity in an Insecure Age, Landau considers the changing world in which law enforcement must operate with exceptional clarity. She begins with a brief history of cybersecurity. The first known cyberattack was in 1986, when Clifford Stoll began trying to understand a 75-cent discrepancy in computer time; he told the story in detail in his book The Cuckoo's Egg.

The next, and the first proper internet attack -- although it wasn't really intended as such -- was the 1988 Internet Worm. Despite these early warnings, Landau writes, quoting from a US government report, "security lost to convenience in the 1980s. And then it kept on losing". It wasn't until 2008 that cyber-threats began to be taken seriously. more

The Latest Office Surveillance Devices ...with 2-digit price tags

Three good reasons 
for periodic professional 
bug sweeps of your offices.

This spy recorder boasts one of the highest bit rates on the market today; crystal clear CD quality recording.

VOICE ACTIVATED - Set the device where you want it, and then forget it. It'll turn on the next time it hears sound thanks to it's voice-activation feature. When the sound stops, the covert audio recorder goes into a sleep mode to save battery life and disk space - A Complete Audio Listening / Recording Device.

PROFESSIONAL GRADE FEATURES - Date and Time Stamp | 94 Hours Recording Capacity | Long Lasting Listening "Bugging" Device / "Spy Bug" | 15 Hour Battery | Capable of recording while plugged in for charging provides unlimited covert recording of rooms offices etc.


Spy Mini USB Cable Digital Voice Recorder looks just like a USB Cable.

Also works as a regular USB Charge Cable for Android or Apple.

The spy voice recorder offers a long play recording mode.

Memory: Support Up to 32GB (Micro SD Card not Included)

Recording time:
4GB Recording up to 48 hours
8GB Recording up to 96 hours
16GB Recording up to 192 hours
32GB Recording up to 384 hours


Micro hidden camera records video in exceptional 1920X1080P HD at 30 frames per second!

✔ [SUPER MINI METAL COMPACT SMALL CAMERA] - The portable hidden nanny cam is (only) 25*25*20mm／1.0*1.0*0.8in, Finger size! It's great for recording sneaky pictures and videos without attracting attention.

✔ [EASY TO USE - Just insert the T-Flash card] (free 8GB Sandisk Included) and start recording. Use at the office, home surveillance, store, trolley, baby monitor, your pocket or on your collar with the clip provided.

✔ [MOTION DETECTION SPY CAMERA] - When motion detector mode is activated, it will record any moving objects within 3 meters of its sight. Enhanced night vision with 4pcs IR led lights for crisp display in low light conditions.

more

A Tale of Corporate Espionage in Silicon Valley

...The computer that was funneling information, therefore, didn’t register on the roster of machines controlled and owned by the I.T. department. This left the security team with one definitively old-school option: they literally followed the wire that ran from the server to the rogue computer.

One by one, they plucked up the tiles in the server room, followed the Cat-5 cable as it swam alongside hundreds of other cables, inside the walls, past yellow and white power wires, and through the labyrinthine office, until they found themselves at the end of the cord, which terminated inside a small closet. There, seated behind a laptop, was a young Chinese woman.

The security specialists searched her personal computer and immediately discovered more than 30 pieces of malware that were funneling information out of the servers and back to dozens of computers in China....

Spies and corporate espionage are a fixture of Silicon Valley. Employees at companies from Twitter to SpaceX have privately told me they suspect spooks work within their walls, stealing corporate secrets, plans for new technologies, or entire servers full of code to replicate back home...

The C.E.O. of one of the big tech companies in Silicon Valley once confided in me that not only was there “no question” that Russian and Chinese agents worked at the company, but that it was impossible to know who they were or prove that they were indeed foreign agents. more

Thumbs Down, or How to Delete Your Facebook Account Permanently

Presented as a service to our privacy conscious readers and clients...

If you are looking for how to delete your Facebook account permanently or deleting anything from your Facebook account here is a 2018 guide.

Facebook has remained the primary and most commonly used social networking platform for users across the world. At the same time, the social network giant has been in the news lately amid Cambridge Analytica scandal and for archiving personal data of users including call and text logs of its Android app users.

But, the fact is that unauthorized use of user content like posts, messages, pictures, and videos by Facebook is nothing new. However, it is a relatively new revelation that even the content that we believe is removed is actually not permanently deleted. So, what can be done in this situation? more

Dutch Treat Espionage Seriously - You Should Too

The Netherlands - The foreign affairs ministry has advised travelers to China to take ’empty’ laptops and mobile phones with them to avoid their data being compromised by the government. 

The advice was contained in a letter circulated to 165 businesses and knowledge institutions accompanying prime minister Mark Rutte on a trade mission this week.

The letter says: ‘The Chinese government will want to know everything about you and your business or organisation. You should presume that all computers and phones that enter China are constantly being monitored to obtain this information.’ 

Sources told the Volkskrant that the cabinet is taking similar precautions for trips to Russia, Iran and Turkey. The last is particularly sensitive because the country is a NATO ally. more

Spies Target US Colleges, Universities

via VOA...
Colleges and universities are not the first places most people would think to find government spies. But reporter Dan Golden said that is not the case.

“There’s an awful lot more international students, international professors at American universities. Some of them are here to gather information for their countries."

Golden recently spoke with VOA about his book “Spy Schools.” In the book, he gives examples of spying at U.S. colleges and universities. He says the free exchange of ideas and mix of cultures at universities increase the chances for spying to take place.

Charlie McGonigal leads the counterintelligence division at the Federal Bureau of Investigation in New York. He said spying at universities is a big problem.

“There’s a lot of research and development at major universities in the United States that a foreign government would look to exploit by sending students to study at these universities.” more

HACK NYC 2018 - May 8-10

May 8th - 10th Time Square, New York City BRIEFINGS | WORKSHOPS | KNOWLEDGE

Join other information security decision makers, developers, penetration testers, cryptographers, analysts, engineers, and risk professionals. Influence the conversation and sharpen your technical skills. Bring your laptop and get your hands dirty with the latest tools and techniques.

Each training session and presentation offers attendees real-world skill building on technical topics ranging from the latest hunting strategies to malware analysis and reverse engineering processes. Visit the conference website for a full list of briefings, workshops and training sessions.   Content in support of The NIST Cyber Security Framework is aligned to five functional areas; Identify - "Develop the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities." Protect - "Develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services." Detect - "Develop and implement the appropriate activities to identify the occurrence of a cybersecurity event." Respond -"Develop and implement the appropriate activities to take action regarding a detected cybersecurity event." Recover - "Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity event." Because the difference between a hard target and a soft target … is everything.

Women Prompted Early Surveillance Photography

Click to enlarge.

Modern day surveillance photography started in Britain in 1913 with an unassuming prison van parked in the exercise yard of Holloway Prison.

We only know the occupant of the van as Mr. Barrett, a professional photographer who had been employed by Scotland Yard to snap paparazzi-style shots of the women in the yard.

His long-lens photography equipment — the purchase of which was authorized by the then Home Secretary — was rudimentary, but effective.

And who were these women Barrett was photographing? 

Members of the Women’s Social and Political Union (WSPU), also, and perhaps better, known as the suffragettes. Suffrage campaigns were ongoing in both Europe and the United States in the early part of the 20th century, with Finland being the first country to grant women the right to vote and stand for office in 1906. more

Saudi Arabia's New Cell Phone Spying Line in the Sand

Saudi law has criminalized the act of spying on your spouse’s mobile phone illegally and has listed this act under cybercrimes. 

Husbands or wives who are caught spying on their spouse’s mobile phone in order to prove dishonest behavior can be imprisoned for up to a year, receive a SR 500,000 ($133,000) fine or receive both forms of punishment.

According to legal sources, the penalty is imposed on people who access their spouse’s mobile phone without their permission. Accessing your spouse’s mobile phone becomes illegal when you crack their mobile phone’s password, according to the law. more

Spycam Detection Training Tip: Be Aware of Holes in Odd Places

Click to enlarge.

This case, which happened last night, is a good example of this detection tip paying off...

MA - A custodian at Northampton High School is facing charges after police say he "modified" a girls' bathroom at the school, creating holes in the ceiling so he could take pictures of students.

Michael Kremensky, 22, of Florence, is facing four charges of photographing an unsuspecting nude person, said Police Chief Jody Kasper, in a statement.

Police were called to the school Thursday for a report of suspicious activity involving holes in the ceiling of a girls' bathroom on the first floor.

No other bathrooms or rooms were affected, Kasper said. The activity was "localized to the one bathroom," she said. more
Learn more about spycam detection.

Is Facebook Eavesdropping? A "Scientific" Test & A Possible Explanation

(no spoilers, just teasers)
 
+++++

Testing the long-held belief that Facebook listens to your conversations to advertise stuff...

For years, people have speculated that Facebook and Facebook Messenger use your phone’s microphone to listen to your conversations and send you targeted adverts based on your IRL chats...

To put the rumor to rest, we at the New Statesman engaged in a very scientific test. Each employee had a scripted conversation in front of their phone with Facebook or Messenger open (after changing their settings to ensure that Facebook and Facebook Messenger had access to their microphones)...

Here's what went down... more

+++++

Facebook Really Is Spying on You...

A conspiracy theory has spread among Facebook and Instagram users: The company is tapping our microphones to target ads...

“Facebook does not use your phone’s microphone to inform ads or to change what you see in News Feed,” says Facebook.

Yeah, sure, and the government swears it isn’t keeping any pet aliens at Area 51. So I contacted former Facebook employees and various advertising technology experts, who all cited technical and legal reasons audio snooping isn’t possible... more

Drones - China's Self-Licking Ice Cream Cone Industry

Brief Profile Dà-Ji?ng Innovations Science and Technology Co., Ltd, marketed and popularly known as DJI, was established in 2006 by Frank Wang. It has its specialization in aerial photography and videography equipment (unmanned aerial vehicles), gimbals, cameras, and propulsion systems among others. They are one of the market leaders in their segment and continue to gain popularity, especially since the 2010s. In 2015, the Economist named them as being at the forefront of civilian-drone industry. more

Brief Profile
SZMID was established in 2006 by intelligence, security and  telecom professionals with extensive backgrounds in the security sector providing a wide range of high quality security devices & solutions to customers around the world. Our business is mainly focus on detection and jamming areas. more

A lot of folks are gunning for drones...

Peeps - The New Fake Surveillance Cameras

via Boing Boing...
As if the Elf on a Shelf wasn't creepy enough, now they've put Peeps in the faux-surveillance game.

A new book and plush Peep sold together as Peep on a Perch is encouraging parents to start a new "Easter family tradition":

The soft plush Easter Peep included in the set can be perched anywhere throughout the home. Children will be proud to have the Easter Peep watch them being good all day as they get ready for bed without making a fuss, help out around the house, and use good manners. And the more kindness the Easter Peep sees, the happier the Easter Peep gets! PEEPS® fans of all ages will love to make this a new Easter family tradition.

One Amazon reviewer (who gave the product five stars) writes, "The book encourages children to help, share and be kind as the Peep reports directly to the Easter Bunny." No, just no. more

Yet Another World's Smallest Color Video Camera

These folks have been cranking out tiny cameras since 1997. 

Truly amazing...

more

Scientists Develop Tiny Tooth-Mounted Sensors That Can Track...

...what you eat!

Monitoring in real time what happens in and around our bodies can be invaluable in the context of health care or clinical studies, but not so easy to do. That could soon change thanks to new, miniaturized sensors developed by researchers at the Tufts University School of Engineering that, when mounted directly on a tooth and communicating wirelessly with a mobile device, can transmit information on glucose, salt and alcohol intake...

Tufts engineers sought a more adoptable technology and developed a sensor with a mere 2mm x 2mm footprint that can flexibly conform and bond to the irregular surface of a tooth. In a similar fashion to the way a toll is collected on a highway, the sensors transmit their data wirelessly in response to an incoming radio-frequency signal. more

Just in case you were disappointed that this was not a story about a mysterious tooth implant...

Caught on Surveillance Camera: Homeless Dog Nips Book...

...about abandonment, and gets adopted.
We've all seen some pretty weird surveillance camera footage. This one should make your holiday weekend. more

Extortionography: Group Planted an Intern to Take Covert Video

The American Phoenix Foundation — a now-defunct conservative activist group known for attempting undercover stings of lawmakers and lobbyists — planted an intern in a Texas state lawmaker’s office during the 2013 legislative session in an effort to expose misdeeds, testimony in federal court revealed Thursday.

Shaughn Adeleye, testifying in Houston in the federal fraud case against former U.S. Rep. Steve Stockman, said in court Thursday that he was planted in the office of state Rep. James White to obtain footage of the Hillister Republican engaged in “fraud and abuse” and also in more mundane activities like cursing or failing to tidy his messy car... more

What is Extortionography?

Building Maintenence Man Accused of Hiding Spycams in Office Building Bathrooms

FL - A Largo man has been accused of using video cameras to record multiple women and two men while using the women’s restrooms in an office building, the Pinellas Park Police Department said.

John Phillip Gibbs, 49, of Largo, was charged with 14 counts of video voyeurism, a felony. The investigation is ongoing as police officers continue to identify others who were video recorded. Additional charges are expected, officers said.

The investigation began March 2 when Pinellas Park Police were called to an office building at 12360 66th St. N to investigate a suspicious incident in one of the women’s restrooms inside the building. During the initial investigation officers said they found two separate video recording devices above the ceiling tiles inside two different women’s restrooms...

Detectives said they were able to identify Gibbs from images on the video as being a maintenance worker for the office building.

The building management has notified the 60 different small businesses inside the building where the common restrooms are located. more

Don't become a lawsuit defendant, or a spy camera victim.
Learn how to protect your guests, customers, employees and yourself.

FutureWatch: Eavesdropping... telepathically

Mary Lou Jepsen believes her technology will be 99.9% cheaper than MRIs (that’s an actual estimate, not a euphemism); radically smaller (the size of a ski cap, not a bedroom); and that its resolution will exceed that of MRIs by a factor of a billion. Yes, that’s an actual “b,” not a typo. And the really cool thing? Her creation might also enable telepathy.

If your mind rebels at the scale of these claims, reread Mary Lou’s credentials, then give an interview with her a listen. You can hear it by searching “After On” in your favorite podcast app...

Here’s where telepathy comes in...

Neurons range from 4 to 100 microns in diameter. This makes them invisible to MRIs, CAT scans, PET scans – pretty much anything other than a scalpel and a microscope. But Mary Lou’s technology could monitor them, if it delivers on its maximum promise. Add some clever machine learning, and the system could closely infer what those neurons are contemplating.

Might all this raise an ethical issue or two? To quote a one-time would-be VP, yooooou betcha! more

Spycam: John E. Lola kinks aim him to The Clink

MA - A former Framingham supermarket employee installed a spy camera in an employee ladies room last year, recording unsuspecting co-workers as they used the toilet, authorities said.

John E. Lola Jr., 47, of Holliston, pleaded not guilty to the charges at his Framingham District Court arraignment on Tuesday.

Lola was a longtime employee at the Stop and Shop on Temple Street. On Nov. 18 of last year, a female employee discovered the camera in a unisex employees-only restroom...

The camera was disguised as an electrical outlet. According to the report, the female employee was suspicious when she saw a new outlet in a stall. When she touched it, the outlet fell to the floor and revealed the camera, which was aimed at the level of someone sitting on a toilet, police wrote.

The small video camera had a disc attached to it. Police got a warrant to view the contents of the disc, which contained 34 videos, mostly about one-minute long each.

"Most were of females using the bathroom, primarily of the private parts are visible," police wrote in the report.



The videos did not show any of the people's faces. However, the video did catch a closeup of the person installing the camera. It appeared the camera was turned on as the man attached the camera to the stall's wall, police wrote in the video. more  The Clink

Note to businesses: This spy camera was found by chance. Lawsuits often follow this type of embarrassing discovery. Periodic inspections for hidden cameras in expectation of privacy areas by trained staff is a nice defense to have.

From Those Wonderful Folks Who Killed Air-Gap Security - This Bud Screws You

A research team from Israel’s Ben-Gurion University of the Negev's cybersecurity research center has discovered a new way of data extraction from air-gapped computers via using passive devices like earbuds, earphones, headphones, and speakers.

Now, the same research center has claimed to be able to use computer speakers and headphones to act as microphones and receive data. The devices can be used to send back the signals and make the otherwise safe practice of air-gapping less secure.

As per the new technique [PDF], data is extracted in the form of inaudible ultrasonic sound waves and transmission occurs between two computers installed in the same room while data is shared without using microphones. more

Off-the-shelf Smart Devices Easy to Hack

Off-the-shelf devices that include baby monitors, home security cameras, doorbells, and thermostats were easily co-opted by cyber researchers at Ben-Gurion University of the Negev (BGU). As part of their ongoing research into detecting vulnerabilities of devices and networks expanding in the smart home and Internet of Things (IoT), the researchers disassembled and reverse engineered many common devices and quickly uncovered serious security issues.

"It is truly frightening how easily a criminal, voyeur or pedophile can take over these devices," says Dr. Yossi Oren, a senior lecturer in BGU's Department of Software and Information Systems Engineering and head of the Implementation Security and Side-Channel Attacks Lab at Cyber@BGU. "Using these devices in our lab, we were able to play loud music through a baby monitor, turn off a thermostat and turn on a camera remotely, much to the concern of our researchers who themselves use these products."

"It only took 30 minutes to find passwords for most of the devices and some of them were found only through a Google search of the brand," says Omer Shwartz, a Ph.D. student and member of Dr. Oren's lab. "Once hackers can access an IoT device, like a camera, they can create an entire network of these camera models controlled remotely." more

Combatting Corporate Espionage -- Warning Signs

by Adam Brown
In the modern age of relatively cheap and ever-evolving technology, corporate espionage is a real threat that could be perpetrated by any employee or other insider at any time. 

The term “corporate espionage” covers many different types of behavior, ordinarily taking the form of a malicious company insider secretly stealing confidential company information, usually for use in a competing business. The insider may be planning on joining an existing competitor, or may be planning on founding a new competing business of their own.

Hiding a bug in a book binding.

In essence, however, the term refers to any act of spying that is carried out for commercial purposes. Regardless of the form it takes, the wrongdoer will be looking to exploit the time, money, and hard work you have put in to make your business successful for their own malicious purposes.

Corporate espionage comes in many forms, some more sophisticated than others. While there is no foolproof way to spot all transgressions before it is too late, here are some general warning signs to watch for:

• The employee begins working from home or out of the office more often;
• You see an increase in after-hours work or unusual office or remote computer access;
• The employee begins meeting with customers without recording meetings in company systems;
• The employee knows about business matters they are not directly involved in;*
• The employee becomes disgruntled or has a sudden change in attitude;
• Files or other materials are missing from the office with no explanation;
• The employee unexpectedly resigns without advance notice; and
• The employee refuses an exit interview or does not want to discuss post-resignation employment plans. While not necessarily indicative of any improper actions, any of these behaviors should be considered “red flags” that merit further investigation or research. more

* Electronic eavesdropping.
Time for a technical surveillance countermeasures (TSCM) inspection.

You may also want to read... Business Espionage: The Employee Competitor… and what to do about it.

What is the Salary for a Female Spy in Australia?

Australia - The anti-corruption watchdog sought special exemption from the Anti-Discrimination Board of NSW to advertise for the $127,627 ($100,440.71 USD) job which requires women to be sent into the field in “covert” spying operations.

“The exemption is required to ensure operational effectiveness and flexibility,”... more ($)

Cameras at Women’s Apparel Shop Hacked

A viral Peeping Tom who hacked into the closed-circuit TV surveillance camera at a women’s bathing suit shop has led to a warning from the Israel Police Cybercrimes Unit that similar systems may be compromised and violate the privacy of unsuspecting persons.

According to police, an unidentified 41-year-old man was arrested on Wednesday after he allegedly used his computer to hack into the CCTV system at a high-end boutique in northern Tel Aviv and recorded customers as they undressed and tried on bathing suits.

While details of the incident remain unclear due to a gag order, police said the suspect subsequently posted the videos to a social media page. more

So, uh, why were there cameras in the changing areas in the first place? Better learn how to spot the cam.

Has Your Information Been Compromised? Check Here to See

via peerlyst.com
"We build NoSecrets to inform the public that their information is being traded and sold not just on the dark web, but between data brokering companies."

Do data brokers hold information about you that they should not hold, thus putting you at risk?

You can check here.

Pruitt Do It In a SCIF

African Union Bugged by China: Cyber Espionage as Evidence of Strategic Shifts
A number of African leaders have turned to Chinese investment as a viable alternative to Western development aid. The recent allegations of Chinese cyberespionage of the African Union's headquarters might prompt them to reconsider... Although this sort of spycraft is fairly routine, it signals Africa’s growing strategic importance to China. In a world of finite resources, states spy on states that matter to them. more

Russia has found yet another way surreptitiously to influence U.S. public policy: Stealing the identities of real Americans and then using these identities to file fake comments during the comment submission period preceding the formulation of public policies... Researchers, journalists, and public servants have found a wide range of fake comments and stolen identities in the public proceedings of the Labor Department, Consumer Financial Protection Bureau, Federal Energy Regulatory Commission, and Securities and Exchange Commission. more

The impact of a data breach should not be underestimated. A breach can lead to regulatory investigations by a number of agencies, including the Federal Bureau of Investigation, Secret Service, Immigration and Customs Enforcement as well as through enforcement actions by regulators including State Attorneys General, the Federal Trade Commission (FTC) and the Securities and Exchange Commission (SEC), among many others. more

So, is it any wonder paranoia is forcing SCIF spending...

The Environmental Protection Agency is spending nearly $25,000 to build a soundproof communications booth in Administrator Scott Pruitt’s office, according to media reports.

The Washington Post first reported details of the contract on Tuesday evening, which will cost the government $24,570.

The “privacy booth” will be installed by Oct. 9, so Pruitt can have “a secured communication area in the administrator’s office so secured calls can be received and made,” EPA spokeswoman Liz Bowman told the Post in a statement.

“Federal agencies need to have one of these so that secured communications, not subject to hacking from the outside, can be held,” Bowman continued. “This is something which a number, if not all, cabinet offices have and EPA needs to have updated.” more sing-a-long (for what it's worth)

A Very Weird Tale of Corporate Espionage and Murder and More Corporate Espionage

Apotex claims longtime chemist went rogue and stole drug secrets...

Apotex Inc., the generic-drug giant founded by murdered billionaire Barry Sherman, has been waging a year-long court battle against an ex-employee who was fired for allegedly stealing millions of dollars’ worth of pharmaceutical trade secrets from a laboratory computer—in the hopes of launching a rival company in his native Pakistan...

Barry Sherman, 75, and his wife, Honey Sherman, 70, were discovered strangled inside their North York mansion nearly three months ago, the victims of what police have labeled a “targeted” double homicide. Since then, detectives have said little else about the high-profile murders...

News of the lawsuit comes at the same time as Apotex tries to defend itself against similar allegations of corporate espionage. In a court action launched last July in the United States, Sherman’s company is accused of using sex, lies and USB drives to illegally obtain valuable trade secrets from the world’s largest generic drug-maker, Israel’s Teva Pharmaceutical Industries Ltd. As Maclean’s reported last month, a Pennsylvania judge denied Apotex’s attempt to throw out the sensational lawsuit, which accuses a former Teva executive of leaking confidential information to her boyfriend—then-Apotex CEO Jeremy Desai. Desai abruptly resigned in January, six weeks after the Shermans were killed, “to pursue other opportunities.” more

Further insights... Business Espionage: The Employee Competitor… and what to do about it.

Australian Spy Who Revealed Bugging Under 'Effective House Arrest'

The spy who blew the whistle on Australia’s bugging of Timor-Leste’s cabinet room during sensitive oil and gas negotiations is still under “effective house arrest” and has been treated disgracefully by Australia in retaliation for his actions, his lawyer says.

The Australian secret intelligence service agent, known only as Witness K, had his passport seized in 2013 as he prepared to give evidence in The Hague on an Australian bugging operation.

In 2004, Witness K was involved in a covert mission to listen in on the Timor-Leste cabinet aimed at giving Australia the upper hand during negotiations to carve up oil and gas reserves in the Timor Sea, estimated to be worth about $53bn. more

Secret Agent Man & Daughter

Intrigue continues to swirl as the “poisoned spy”, Sergei Skripal, and his daughter, Yulia, remain in intensive care. Counter-terrorism police have taken over the investigation. Boris Johnson has said the possibility of a Russian assassination attempt means UK officials might boycott the World Cup.

This morning, Shaun Walker examines how the Skripal case looks like a warning about the fate awaiting those who collaborate with western intelligence agencies.

And more details are emerging about the life of the former double agent, known in his Salisbury neighborhood as a genial man with a penchant for Polish sausage and lottery scratch cards. more video sing-a-long

Court Admits Husband's Illegal Bugging into Evidence

Turkey - A top appeals court decided that evidence collected through illegal bugging could not be used by itself to prove guilt but could be used in conjunction with other evidence in a 2015 case where a man in the Aegean province of Aydın believed his wife was cheating on him and installed a bugging application onto her cell phone.

The application turned the cell phone into a recording device. The recordings showed the woman really was cheating on him with a colleague from work. The man immediately filed for divorce, demanding compensation from his wife and the custody of their child. more


An app that can help determine if an Android phone is infected with spyware.

10 New Attacks on 4G LTE Discovered

A group of researchers has uncovered ten new attacks against the 4G LTE wireless data communications technology for mobile devices and data terminals.

The attacks exploit design flaws in the communications protocol and unsafe practices employed by the stakeholders and can be used to achieve things like impersonating existing users, spoofing the location of the victim device, delivering fake emergency and warning messages, eavesdropping on SMS communications, and more.

Among the uncovered attacks they consider one particularly worrying: an authentication relay attack that allows an adversary to impersonate an existing user (mobile phone) without possessing any legitimate credentials.

“Through this attack the adversary can poison the location of the victim device in the core networks, thus allowing setting up a false alibi or planting fake evidence during a criminal investigation,” they pointed out. more