More UC Warnings

...from The Financial Express...
"Virtually, every company seems to be in a rush to merge email, fax and voice communications. IT, BPO, media, telecom, banking and retail enterprises are embracing Unified Communications (UC).

However, the risks associated with UC security are now beginning to surface as companies start merging their various channels of communications.

Eavesdropping, unauthorised access of messages, unauthorised handsets connecting to the network and disruption of phone network are some of the threats, faced by enterprises.

"According to Jayesh Kotak, vice-president, product management, D-Link India, denial of service, spoofing, eavesdropping, signaling and media manipulation are few security threats to the UC. (more)

Ebay Your Plasma. Laser Is Coming!

Laser televisions have an image produced by three lasers that are each less than one cubic centimeter in size and that are a million times brighter than current state-of-the-art light-emitting diodes (LEDs). They provide sharper, crisper, more brilliant pictures than you have ever seen. And this new television costs less to produce than the television you own now.

Novalux of Sunnyvale, CA has developed the Novalux extended-cavity surface-emitting laser (NECSEL™) for use in high-definition (HD) rear-projection televisions (RPTVs).

Laser televisions will provide speckle-free images that have more contrast and better color coverage than their unwieldy, expensive counterparts. They also use 60% less power and have a lifespan more than 10 times as long as lamp televisions. And unlike LED televisions, laser televisions have incredible longevity without giving way to distracting color shifts over time.
Projection and illumination optics for laser televisions will cost less than those of either lamps or LEDs, resulting in a lower price for the entire system. Novalux estimates that a 50" laser television will cost significantly less than $1,000. (more) (follow the action)

SpyCam Story #458 - CCTV Tee

From artist Ross Robinson...
"Your government is watching you. All. The. Time."
...now buy my tee-shirt.

Water Manager's Wiretap Leaked

TX - Bexar County District Attorney Susan Reed announced Friday that Gilbert Olivares, General Manager of Bexar Metropolitan Water District, has been indicted for wiretapping, misapplication of funds, and sexual harassment.

The indictment includes 12 counts of Illegally Intercepting Oral Communications, 1 count of Misapplication of Fiduciary Property, 1 count Abuse of Official Capacity, and two counts of Official Oppression.

...the indictment alleges Olivares ordered the monitoring and recording of phone conversations of four Bexar Met employees' who were viewed as critics of his leadership. The recordings allegedly took place over a 8-month period and without the knowledge or consent of any of the parties to the conversations. (more) (video)

Confessions of a Corporate Spy

Ira Winkler offers chilling accounts of espionage...
A former National Security Agency analyst who is now an expert on corporate espionage offered chilling accounts yesterday of his easy penetration into a variety of U.S. companies. In one case, in just a few hours he was able to make off with product plans and specifications worth billions of dollars.

Ira Winkler, global security strategist at CSC Consulting, spoke at Computerworld's Premier 100 IT Leaders Conference here and punctured several popular misconceptions about information security...

At one large company, for example, he persuaded a guard to admit him by saying he had lost his badge and presenting a business card as a substitute. He'd stolen the card -- which belonged to an employee who worked at the plant -- from a local restaurant that collected business cards in a jar for prize awards. Winkler went on to exploit a number of security weaknesses, from doors he found unlocked to using forged signatures to using simple computer hacks. The result: Designs for nuclear reactors and other technologies were compromised, possibly with national security implications.

"Never measure security budgets by IT," said Winkler, author of Spies Among Us: How to Stop the Spies, Terrorists, Hackers and Criminals You Don't Even Know You Encounter Every Day. (more)

Someone finally asked, "Dude, doesn't spying precede attacking?"

Homeland Security setting up counterspy unit...
Concerns about foreign spies and terrorists have prompted the Homeland Security Department to set up its own counterintelligence division and require strict reporting from employees about foreign travel, according to a memo obtained by The Associated Press. (more)

SpyCam Story #457 - Kite Flight Sight

...from the seller's web site...
"Now here's a nifty way of popping your head over the fence to ogle the chapess next door without being spotted or otherwise denounced as a pervy interloper. Instead of popping your head over the fence from a height of 1.8 metres, pop it over the fence in the virtual sense, from a height of up to 25 metres.

Permit us to explain and expound. In all our years of deconstructing fiendishly complex gadgetry here in the lab, deep underground at gadgetshop HQ, we've never before come across a fusion of technologies so inspired as a high performance kite with a remotely-controlled digital camera slung underneath it." (more)

SpyCam Story #456 - "Save Money. Live Better"

FL - A mysterious box with an antenna found hidden inside a Wal-Mart was a planted spy camera set up to beam customer credit card numbers to thieves in the parking lot, police said. (more) (video)

Industrial Espionage, Reverse Engineering or Just A Crappy Cheap Knockoff? You decide.

Over the years the Security Scrapbook has brought several blatant examples of industrial espionage to your attention. Take, for example, the...
• Space Shuttle (USA, Russia)
• iPhone
• Nokia phones
• Pocket cameras (pick any of them)
• Twin Magazine Covers

And remember?
• 9/30/02 - Nokia, the world's largest cell phone maker, on Thursday unveiled its first "third-generation" handset, which has a camera so users can view and edit video clips and send them to another phone or an e-mail address. ... Minutes after Nokia's announcement Thursday, rival manufacturer Motorola unveiled new details about its own equivalent handset.

• "The World's Smallest Camcorder." Sony DCR-IP1 MICROMV released. Tuesday, September 02 @ 11:15:00 PDT. Panasonic SV-AV100 camcorder debuted. Friday, September 05 @ 15:30:00 PDT

• 12/2/01 - Two major rivals announce look-alike products. Same size ad, same magazine - 4 pages away from each other - products offered the same benefits... "drug and explosive" detection, in one instrument.

What is the difference between espionage and a rip-off? Industrial espionage products hit the market at approximately the same time. There is a time-lag with reverse engineering and knockoffs.

See more! See more! See more!
Visit The Plagiarius Competitions and the Museum Plagiarius.

ID Theft News - 8% ?!?! (seems high, or are high)

...and this is just in the past two weeks...

• Eleven people from at least five different countries are facing charges for their involvement in a wide-ranging scheme to hack into nine US companies and steal and sell more than 40 million credit and debit card numbers. "As far as we know, this is the single largest and most complex identity theft case that's ever been charged in this country," Attorney General Michael Mukasey said. Officials said the ring had stolen hundreds of millions of dollars. (more) ...when federal prosecutors disclosed that computer hackers swiped more than 40 million credit-card numbers from nine retailers in the biggest such heist ever, it was the first time that many shoppers had heard about it. That's because only four of the chains clearly alerted their customers to breaches. (more)

• About 150,000 people in the US have been affected by the theft of laptops with personal information about current and former employees of brewing giant Anheuser-Busch. (more)

• A new report from the California Department of Public Health discovered that 127 UCLA Medical Center employees viewed celebrities' medical records without permission between January 2004 and June 2006, which is nearly double the number first reported earlier this year. (more)

• UK - Data protection experts have called for hospitals to use more effective encryption techniques after a laptop containing the personal data of thousands of patients was stolen. An unnamed manager at Colchester Hospital in Essex has been sacked as a result of the theft... (more)

• Security researcher Joe Stewart has identified a Russian gang that infected 378,000 computers with malware over a 16-month period in an effort to steal passwords and other information. (more)

• Ireland - The loss of a laptop containing 380,000 records of social welfare and pension recipients is a wake-up call for the Government and public and private sector bodies to ensure all staff are trained properly in data protection and use of encryption. (more)

• The Transportation Security Administration suspended Verified Identity Pass from enrolling travelers in its pre-screening program after a laptop computer containing the records of 33,000 people went missing.

The company, based in New York, lost possession of the laptop at San Francisco International Airport. The laptop contained unencrypted pre-enrollment records of individuals... (more) UPDATES: ...unencrypted laptop was found in the same office from which it was reported missing. (more) The U.S. Transportation Security Administration has cleared Verified Identity Pass to resume enrollments in its Registered Traveler program... (more) The laptop had been stolen, but was returned, according to the Sheriff's Department.

• The University of Michigan Credit Union in Ann Arbor confirmed that a data theft has resulted in some of its members becoming identity theft victims. The credit union said that so far, "less than 100" people have had their identities stolen -- mostly to open fraudulent credit card accounts. The theft, involving documents that were supposed to have been shredded... (more)

• Greece - Hundreds of bank clients in Greece and other European countries have turned into hostages because of actions of groups that steal data from bankcards and do uncontrolled drawings, the Greek To Bhma daily reports. (more)

UK - The BBC has apologised after a memory stick containing details of hundreds of children who applied to take part in a TV show was stolen. (more)

• Wells Fargo & Co. is notifying some 5,000 people that their personal information might have been seen by someone using a bank access code illegally. (more)

Only an average of eight percent of Americans say they are very confident in the ability of U.S. retailers, government and banks to protect their personal information, according to a national survey commissioned by CA, Inc. (more)

Wiretap Act - The Loco Motion Law?

"Everybody's doin' a brand-new dance, now"
A federal appeals court in California is reviewing a lower court's definition of "interception" in the digital age... The case, Bunnell v. Motion Picture Association of America, involves a hacker who broke into TorrentSpy's company server and obtained copies of company e-mails as they were being transmitted. He then e-mailed 34 pages of the documents to an MPAA executive, who paid the hacker $15,000 for the job, according to court docuWiretapments.

"I know you'll get to like it if you give it a chance now"
The issue boils down to the judicial definition of an intercept in the electronic age, in which packets of data move from server to server, alighting for milliseconds before speeding onward. The ruling applies only to the 9th District, which includes California and other Western states, but could influence other courts around the country.

"Jump up. Jump back. Well, now, I think you've got the knack."
In August 2007, Judge Florence-Marie Cooper, in the Central District of California, ruled that the alleged hacker, Rob Anderson, had not intercepted the e-mails in violation of the 1968 Wiretap Act because they were technically in storage, if only for a few instants, instead of in transmission.

"Now that you can do it, let's make a chain, now."
"The case is alarming because its implications will reach far beyond a single civil case," wrote Kevin Bankston, a senior attorney for the Electronic Frontier Foundation in a friend-of-the-court brief filed Friday. If upheld, the foundation argued, "law enforcement officers could engage in the contemporaneous acquisition of e-mails just as Anderson did, without having to comply with the Wiretap Act's requirements."

"Do it nice and easy, now, don't lose control"
Cooper's ruling also has implications for non-government access to e-mail, wrote Bankston and University of Colorado law professor Paul Ohm in EFF's brief. "Without the threat of liability under the Wiretap Act," they wrote, "Internet service providers could intercept and use the private communications of their customers, with no concern about liability" under the Stored Communications Act, which grants blanket immunity to communications service providers where they authorize the access.

"Move around the floor in a Loco-motion"
Individuals could monitor others' e-mail for criminal or corporate espionage "without running afoul of the Wiretap Act," they wrote.

"There's never been a dance that's so easy to do."
"It could really gut the wiretapping laws," said Orin S. Kerr, a George Washington University law professor and expert on surveillance law. "The government could go to your Internet service provider and say, 'Copy all of your e-mail, but make the copy a millisecond after the email arrives,' and it would not be a wiretap." (more)

...It even makes you legal when they're feeling screwed,
So come on, come on, do the Loco Motion with me.

"Next stop!
Voicemails, ISPs, and bucket brigading of phone calls.
All aboard!"

WiFi / WLAN / 802.11 Spying Instructions

The following information is available to the public at blackhatlibrary.com. Excerpts reprinted below highlight the need for adding WLAN Security Audits to corporate TSCM inspection programs.


"Wireless Network Hacking and Spying Made Simple"

Here’s a quick and simple guide on how to get on to so called “secure” networks as well as a few things you can do to amuse yourself after you are in. Enjoy!

Finding the network
Most wireless networks are configured to broadcast their SSID (Service Set Identifier), when looking for a network to have some fun with I like to start with these if they are available.... If you know that a network exists but you don’t see a SSID in your available networks, or are just curious to see if any are out there, there are a few tools that will get this job done for you.

For Linux users I recommend:
AirJack- A lightweight program.
Kismet- Unquestionably the most powerful wireless program.

For Windows users I recommend:
AirSnort
AirMagnet

Bypassing WEP or WPA
Let me start this section by saying that WEP encryption is a joke. The only thing turning on WEP does is add some extra information to the packets. Aircrack is a free Windows/Linux tool that can break both WEP and WPA-PSK.

Modifying the network
It never fails to surprise me how many routers are left configured to the default admin password and username- if this is the case you can easily hijack an entire network. If the default credentials work, you can easily change the passphrase, SSID or completely turn off the router.

Spying on Connected Users
On a wireless network, the router effectively screams out requested information from any computer to the whole broadcast radius. This means that you can use a program to eavesdrop on other users on the network. (more)

sixteen-love

LA - Tai Shen Kuo, 58, long-time restaurateur and former tennis pro who pleaded guilty three months ago to spying for China was sentenced Friday to nearly 16 years in prison by a federal judge. “We had hoped to do a little bit better,” said John Hundley, of the Washington, D.C., law firm Trout-Cacheris. (more)

The Geek Chorus Wails Again...

Hackers at the DefCon conference were demonstrating these and other novel techniques for infiltrating facilities...
Want to break into the computer network in an ultra-secure building? Ship a hacked iPhone there to a nonexistent employee and hope the device sits in the mailroom, scanning for nearby wireless connections. (which makes our 24/7 rogue cellphone and wifi location service all the more valuable to you)
How about stealing someone's computer passwords? Forget trying to fool the person into downloading a malicious program that logs keystrokes. A tiny microphone hidden near the keyboard could do the same thing, since each keystroke emits slightly different sounds that can be used to reconstruct the words the target is typing.

As technology gets cheaper and more powerful, from cellphones that act as personal computers to minuscule digital bugging devices, it's enabling a new wave of clever attacks that, if pulled off properly, can be as effective and less risky for thieves than traditional computer-intrusion tactics. (more)

Cool Idea - Eavesdrop On Your Car Being Stolen

Morris Mbetsa, an 18 year old self-taught inventor with no formal electronics training from the coastal tourist town of Mombasa on the Indian Ocean in Kenya has invented the "Block & Track", a mobile phone-based anti-theft device and vehicle tracking system.

The real-time system uses a combination of voice, DTMF and SMS text messages over cell-based phone service that allows control of some of a vehicles' electrical systems including the ignition.

Another feature of the system is the capacity to poll the vehicle owner by mobile phone for permission to start, as well as eavesdrop on conversation in the vehicle. Mbetsa is now looking for funding to commercially develop his proof of concept and bring it to the market (video)
Good work, Morris. I hope you get your funding.

SpyCam Story #455 - The IT Boy

FL - A Gainesville man has been arrested for allegedly installing software on a woman’s computer, then using the software to remotely control the camera on her computer to take videos of the woman and her friends while they were clothed and while they were naked.

The alleged victim is a Hialeah woman who told police she had a man perform some maintenance on her computer in early July. The woman told police she discovered the program on Monday along with about 20,000 photos of herself and her friends that had been made from the videos taken with the camera.

The man arrested in the case was identified as Craig Matthew Feigin, 23, who was charged with modifying computer data and disrupting or denying computer system services.

Once he was taken into custody, he quickly admitted to this crime, but also admitted to installing these programs on other computers as well. The Gainesville Florida Police believe there are eight or nine other victims. (more) (more)

Bug Bites... with Bluetooth

Smart spies can build their own bugs; ones which average TSCM detection equipment can't see.

One example of this are bugs which use off-the-shelf Bluetooth technology, like Bluegiga. Short range, but very effective.

Another example is second generation Zigbee which can transmit audio a much greater distance.

Both signals are digital. Both blend their transmissions into the sea of legitimate WiFi signals which surround us.

The cost for building these advanced bugging devices is less than $100. per bug.

Discovery requires the most advanced TSCM instrumentation... like what you will find only here.

Bugs don't grill people. People grill people.

Philadelphia - A gun-control activist who championed the cause for more than a decade and served on the boards of two anti-violence groups is suspected of working as a paid spy for the National Rifle Association, and now those organizations are expelling her and sweeping their offices for bugs.

The suggestion that Mary Lou McFate was a double agent is contained in a deposition filed as part of a contract dispute involving a security firm. (more)
The employee double-cross is an old and highly successful trick. Aside from the obvious, undercover employees also have the time and opportunity to plant bugs and wiretaps. If an employee-spy is discovered be sure to conduct a thorough bug sweep after they are fired. Better... Conducting thorough bug sweeps on a regular basis is a good way to uncover the undercover spy.

SpyCam Story #454 - "Baby let me be..."

Your lovin teddy bear
Put a chain around my neck,
And lead me anywhere
Oh let me be
Your teddy bear.

Australia - A Rivervale man has admitted to secretly filming his female housemate with a camera concealed in a teddy bear in her bedroom.

Russell Christopher Hounslow, 22, pleaded guilty to one count each of using an optical device to record a private activity and possessing an obscene article in the Perth Magistrate's Court today.

Magistrate Steven Heath heard how on April 22 this year, Hounslow's flatmate found a covert camera in the toy, linked to a transmitter under her bed.

Police prosecutor Steve Mayne said the woman then found a similar transmitter on top of a video recorder in the house. (more)

"You talkin' to me?" - India

India - Telephone booth operators, taxi drivers and guesthouse owners in the national capital have been asked to keep an eye and eavesdrop on people calling Pakistan, Bangladesh, Nepal, Jammu and Srinagar as Independence Day approaches. Cyber cafes and guesthouses have been told to install closed circuit television (CCTV) cameras. (more)

"You talkin' to me!" - China

China - Tens of thousands of taxi drivers in Beijing have a tool that could become part of China's all-out security campaign for the Olympic Games. Their vehicles have microphones -- installed ostensibly for driver safety -- that can be used to listen to passengers remotely.

The tiny listening devices, which are connected to a global positioning system able to track a cab's location by satellite, have been installed in almost all of the city's 70,000 taxis over the past three years, taxi drivers and industry officials say.

...those devices in Beijing taxis can be remotely activated without the driver's knowledge to eavesdrop on passengers, according to drivers and Yaxon Networks Co., a Chinese company that makes some of the systems used in Beijing. The machines can even remotely shut off engines. (more)

"No, I wasn't talkin' to you!" - New Zealand

New Zealand - National leader John Key has hit back at suggestions his party has a hidden agenda after a second set of secret recordings were leaked to 3 News.

Key says the latest recordings are not significant and he has accused Young Labour activists of bugging National's party conference. (more)

Yawn, and your laptop goes to sleep

What if you could simply think about an action, and the computer would respond?

Emotiv is currently fine-tuning a mind-reading headset called the Epoc, which should ship late this year. The $299 device purports to eavesdrop on your thoughts and translate them into computer instructions, so you can play a game or arrange photos without using your hands or speaking words.

Epoc "neuroheadset" has 16 sensors embedded in its crossbars that communicate wirelessly with your PC. There are no messy smears or tangles of wires. But in order to get correct readings, the sensors must make just the right contact with your scalp, which can take a fair amount of fiddling. And once the headset is in place, you have to be careful not to move around too much or the sensors will slip, preventing the computer from getting a clear signal. (more)
...and you were self-conscious about wearing your Bluetooth earpiece.
Seriously, you are witnessing the future of eavesdropping. Near-term... physical motion replacement, a boon to the seriously handicapped. Mid-term... Doors that auto-lock if the person approaching is of the wrong frame of mind. Far-term... TiVO your life whenever you want. I can't wait.

PI Toolkit Item #141 - Pocket Phone Bud-dy

Need to record a cell phone call, or any telephone call?

Call on your Pocket Phone Bud-dy! An Olympus TP-7 headset.

Plug it into the ‘MIC’ jack of a recorder. Pop the bud in your ear and you are good-to-go.

Captures both sides of the conversation. Frequency range is 50 - 20,000 Hz. Plugs into a 3.5mm monaural jack and comes with two plug adaptors to convert either to a 3.5mm stereo plug or a 2.5mm monaural plug. (more)

Deep Packet Inspection - Computer Santa Claws

Imagine a Santa who receives bags of mail every second, reads and sorts each request, knows everybody's naughty or nice quotient and dispenses the correct 'just deserts' as fast as each request arrives.
Creep'ed out yet?
If so, stop reading now.

"Anyone who uses the Internet needs to be aware of Deep Packet Inspection (DPI), its uses, and potential misuses... DPI is next-generation technology that’s capable of inspecting every byte of every packet that passes through the DPI device, that means packet headers, types of applications, and actual packet content... DPI allows people controlling the device to know everything, including the payload of each packet in the data stream. For example, if an unencrypted e-mail is scanned, the actual body of the e-mail can be reassembled and read.

What makes DPI all the more impressive is that the packet analysis happens in real time, with data stream throughput approaching 20-30 Gb. See where I’m going with this? With no loss of throughput, ISPs are able to insert these devices directly in their data streams, forcing all traffic to pass through the devices. Procera, Narus, and Ellacoya are front-runners in development of this technology, having placed equipment throughout the world.

DPI developers are adamant that the technology is benign and will create a better Internet. experience. However, privacy groups have two major concerns: little or no oversight and the potential for losing still more individual privacy.

An optimist would say that DPI will help enhance the experience, even producing ads that are relevant to each individual user. Whereas a pessimist would say it’s “big brother” technology that only benefits ISPs." (more)
A realist would say: "history tends to repeat" "mission creep" "if a technology can be abused..."

"Nailing bronze in the Tap-athlon...

...Sweden." Swedes may cherish openness and transparency, but not enough to accept a new law giving the government the right to snoop on all e-mails and phone calls crossing the country's borders. Outrage over the statute has led to 2 million protests — filed by e-mail... Swedish telecommunications group TeliaSonera AB and U.S.-based Google Inc. have called the law passed June 18 the most far-reaching eavesdropping plan in Europe, comparable to snooping powers authorized in the United States. The law narrowly passed Parliament in a 142-138 vote two weeks ago, despite protests that included demonstrators handing out copies of George Orwell's novel "1984" about a fictional futuristic police state. It gives Sweden's National Defense Radio Establishment, or FRA, the right to scan all international phone calls, e-mails and faxes without a court order as of January. (more)

 

"Nailing silver in the Tap-athlon...

...USA."

The FBI has quietly built a sophisticated, point-and-click surveillance system that performs instant wiretaps on almost any communications device, according to nearly a thousand pages of restricted documents newly released under the Freedom of Information Act.

The surveillance system, called DCSNet, for Digital Collection System Network, connects FBI wiretapping rooms to switches controlled by traditional land-line operators, internet-telephony providers and cellular companies. It is far more intricately woven into the nation's telecom infrastructure than observers suspected...

DCS-3000 client, also known as Red Hook, handles pen-registers and trap-and-traces, a type of surveillance that collects signaling information...

DCS-6000, known as Digital Storm, captures and collects the content of phone calls and text messages for full wiretap orders.

A third, classified system, called DCS-5000, is used for wiretaps targeting spies or terrorists. (more)

"Nailing gold in the Tap-athlon...

...China."

"The Chinese Government has put in place a system to spy on and gather information about every guest at hotels where Olympic visitors are staying," Senator Sam Brownback said.

The conservative Republican from Kansas, citing hotel documents he received, added that journalists, athletes' families and others attending the Olympics next month "will be subjected to invasive intelligence-gathering" by China's Public Security Bureau.

He said the agency will be monitoring internet communications at the hotels.

The US senator made a similar charge a few months ago but said that since then, hotels have come forward with detailed information on the monitoring systems that have been required by Beijing.

Senator Brownback refused to identify the hotels, but said "several international hotel chains have confirmed the existence of this order".

Spokesmen at the Chinese Embassy in Washington were not available for comment. (more)

Builders uncover 'bugging device'

Northern Ireland, UK - A suspected bugging device has been found at a house in Coalisland.

It is believed that Sean O'Farrell, an IRA member shot by the SAS in 1992, may have had some connection with the house.

Builders working at the house on Monday found a 60cm box-like object with batteries in a roof space. It is believed the device had been there since the early 1990s. (more)

Wi-Fi Wall to Block Outsiders

Meru Networks announced RF Barrier, the next salvo in the industry's on-going battle against piggybackers and hackers who access networks from parking lots or other areas within range of a corporate WLAN’s signal. Unlike counter-measures that use encryption to scramble sensitive data, RF Barrier fights fire with fire by transmitting over Wi-Fi signals that would otherwise propagate farther than intended.

"Wireless security has largely been about applying wired techniques [like encryption and IPS]," said Joe Epstein, Meru's senior director of technology. "But most really damaging attacks have taken advantage of wireless signal bleed into areas like parking lots. Those [passive eavesdropping attacks] are the worst because they cannot be detected electronically. This is where RF Barrier comes in, to stop signals from reaching perimeter attackers." (more)

How RF Barrier Works
from their press release...
"RF Barrier (patent pending) is installed by mounting a Meru Networks wireless access point along the inside perimeter of a building, and an advanced external antenna outside the perimeter. RF Barrier technology inspects the traffic in real time to determine which part belongs to the WLAN (and is therefore designated as sensitive) and uses the external antenna to block outbound traffic at the RF layer. Would-be attackers are limited in their ability to see useful packet information about the internal network.

Because RF Barrier uses directional antennas and selective enforcement technology, it has no impact on signals within the building or from other networks. Internal clients connect normally, with enterprise access points serving them at full speed. RF Barrier can be turned on and off as needed, giving enterprises the flexibility to allow access at certain times of day while restricting it at others." In short, it drowns out the real signal."
The fine print... "Available beginning in September 2008 for networks using any Meru 802.11a/b/g access points."

Eavesdropping on Skype, "...not a problem..."

There’s growing speculation coming out of Europe that there’s a backdoor in Skype that allows remote eavesdropping of telephone conversations.

A report in the reputable Heise Online says the issue was discussed at a meeting with ISPs last month where high-ranking officials at the Austrian interior ministry claims “it is not a problem for them to listen in on Skype conversations.”

The report said a number of others at the meeting confirmed that claim. (more)
The public believes Skype phone calls are encrypted; eavesdropping is not possible. This may yet be true. But, what if there is a back door? Why would a government official admit it? The bigger story here may be this is a serious intelligence leak, or an intelligence red herring. Stay tuned.
In the meantime, a little history...
Oct 15, 2003 - (See FutureWatch heading)
June 9, 2008 - Expect negative 'feedback' from FBI

Grade "A" Hack Attack with VoIP Crack

GA - A college student was behind bars Friday night, accused of stealing his professor's identity to change his grades. Police called 19-year-old Christopher Fowler a computer hacker.

Investigators said the student also, "Hacked into their Voice/Internet Protocol system where it uses internet to make phone calls and intercepted phone conversations."

Fowler could get five years for an unlawful eavesdropping charge. (more) (video)

Crypt Your Stick - USB Vaults to Go

Remember?
• Nato Secrets USB Stick Lost
• Airport Laptop Searches - No Probable Cause Needed
• Lax USB stick security causing havoc
• More than 100 USB memory sticks lost admits Ministry of Defence

Don't want to be next?
Get a cryptstick.
There is no excuse not to.
Many models to choose from...
• Ironkey
• Kingston DataTraveler Secure
• Kingston DataTraveler Secure - Privacy Edition
• Kingston DataTraveler Vault
• Kingston DataTraveler Vault - Privacy Edition
• Kingston DataTraveler BlackBox (government version)
• SanDisk Cruzer® Titanium Plus
• SanDisk Cruzer® Professional
• SanDisk Cruzer® Enterprise FIPS Edition
• SanDisk CMC (Central Management and Control) for IT Departments

Spy vs. Spy Display at State Department

Spy technology is now on display now in the lobby of the State Department Annex at 1400 Wilson Blvd. in Rosslyn, Va.

“Listening In: Electronic Eavesdropping in the Cold War Era” is an exhibit that pulls together spy technology circa 1955 through 1985. Produced by the Countermeasures Directorate’s Office of Security Technology in the Bureau of Diplomatic Security, the show displays a large array of Cold War era surveillance technology, including wired microphones and radio transmitters.

The U.S. Embassy in Moscow seems like it was one big recording booth in the 1960s. One photo shows Ambassador Henry Cabot Lodge Jr. in 1960 holding a listening device that had been discovered inside a large wooden carving of the Great Seal of the United States, a gift from the Soviet Union in 1945. Hidden magnetic microphones were especially popular in U.S. embassies in Eastern Europe. These were small microphones attached to long wooden tubes that could be deeply recessed into embassy walls.

Even Cold War era typewriters had countersurveillance mechanisms built into them. Included in the exhibit is an IBM Selectric typewriter. It coupled a motor to a mechanical assembly, so pressing different keys caused the motor to draw different amounts of current that were specific for each key. Close measurements of the current could reveal what was being typed on the machine. To prevent these measurements, State Selectric typewriters were equipped with “inertia” motors connected to a large flywheel. The spinning flywheel absorbed the stress of the mechanical assembly and masked the keys being typed. (more)
For more on the exhibit, click here.

SpyCam Story #453 - Spy'er Education

Tucked away in a 1,200-page bill now in Congress is a small paragraph that could lead distance-education institutions to require spy cameras in their students' homes.

It sounds Orwellian, but the paragraph — part of legislation renewing the Higher Education Act — is all but assured of becoming law by the fall. No one in Congress objects to it.

The paragraph is actually about clamping down on cheating. It says that an institution that offers an online program must prove that an enrolled student is the same person who does the work. (more)

SpyCam Sunglasses

from the seller's web site...
"Sunglasses DVR Camera is the newest and most advanced spy camera with built in Video Recorder in the world. Unlike other device of this type, This sunglasses records everything you see and hear, without connecting to MP4 or other Recording source.

Cool hands free video recording any time any where. These quality Polarized lens sunglasses have a built-in 1.3 mega pixel self recording color camera and real time (30 fps) digital video recorder. Internal 2GB memory and li-polymer rechargeable battery records for 5 hours continuously.

Up to 2GB Micro SD card (not Included) offers even more recoding time and easy storage of Audio and video. Stereo recording insures great sound quality to go along with the action. Ideal for outdoor activities such as bike riding, sporting events, snow skiing, tennis, and other events and SURE for SPY and INVESTIGATION." (more)
Why do I mention it?
So you know what you are up against!

VoIP Eavesdropping - How Difficult Is It?

by Stephan Varty, Vulnerability Analyst, in Nortel's Voice Security Blog...
Many people assume a certain level of confidentiality is assured when they use their phone. Concerns have been raised about the increased risk of someone eavesdropping on a VoIP call compared to a traditional PSTN call. Although the concern applies similarly to other VoIP protocols such as UNIStim, H.323, or SCCP as well, what follows is an opinion on the susceptibility of a SIP call to remote eavesdropping...

...due to common vulnerabilities such as missing or outdated patches, misconfiguration, and undetected software defects, it is likely that in many cases a determined sophisticated attacker would be capable of eavesdropping on unencrypted SIP calls. (more)

Lessons:
• Employ encryption.
• Install all software patches and updates.
• Double check your configurations.

Extra Credit:
Eavesdropping an IP Telephony Call

Tapped Out Friends Tap Friendship

IL - Two friends of former police officer Drew Peterson told a newspaper he made incriminating statements during secretly taped conversations following the disappearance of his fourth wife — claims that Peterson denies... Peterson said the couple had asked him for money and became angry when he would not lend it to them. (more)

Email Sinks Two Anchors - Keystroke Logger Helped

Philadelphia, PA - A longtime television newscaster was charged Monday with illegally accessing the e-mail of his glamorous former co-anchor, who suspected details of her social life were being leaked to gossip columnists.

Federal prosecutors say fired KYW-TV anchor Larry Mendte accessed Alycia Lane's and leaked her personal information to a Philadelphia Daily News reporter. Lane's personal life had routinely become tabloid fodder and eventually led to her own dismissal from the station.

"The mere accessing and reading of privileged information is criminal," acting U.S. Attorney Laurie Magid said. "This case, however, went well beyond just reading someone's e-mail." (more)

How Alycia Lane's passwords were tapped...
According to sources close to the case, former CBS anchor Larry Mendte used a hardware keylogger system to obtain Alycia Lane's e-mail passwords. Keylogger systems secretly capture every keystroke made on a targeted computer.

Keyloggers come in two forms: software, which is installed on a computer, and hardware, which is a battery-sized recording device that is secretly attached to the cord between the keyboard and a computer. The precise type and brand of keylogger used in the Mendte case could not be determined, but sources said it was the hardware version. (more)

My all-time favorite newscasters. ~ KDM
(John Hart, Jon Stewart, Paul Harvey, Jim Hartz, Walter Cronkite, Susan Stamberg, Charles Osgood, Charles Kuralt, Lloyd Dobbins, Linda Ellerbee, Tom Snyder and you know who.)

Rogue Lid Shuts Grid

Rogue laptops aren't the only rogues out there...
A disgruntled city computer engineer has virtually commandeered San Francisco's new multimillion-dollar computer network, altering it to deny access to top administrators even as he sits in jail on $5 million bail, authorities said Monday.

Terry Childs, a 43-year-old computer network administrator who lives in Pittsburg, has been charged with four counts of computer tampering and is scheduled to be arraigned today.

Prosecutors say Childs, who works in the Department of Technology at a base salary of just over $126,000, tampered with the city's new FiberWAN (Wide Area Network), where records such as officials' e-mails, city payroll files, confidential law enforcement documents and jail inmates' bookings are stored.

Childs created a password that granted him exclusive access to the system, authorities said. He initially gave pass codes to police, but they didn't work. When pressed, Childs refused to divulge the real code even when threatened with arrest, they said. He was taken into custody Sunday. (more)

So, how do you protect yourself against insider hijacking?
One way to start...
• Don't give the keys to the kingdom to only one person.
• "Checks and Balance" "Checks and Balance" "Checks..."
• Establish an admin / root password emergency reset plan.
• Bell your cat(5). Get notified when it hits the fan: Tripwire
• Keep my number handy. Rogues are know for their bug and wiretap tricks, too.

We think the Hamburglar is behind this one...

For the three weeks between July 25 and Aug. 14, 2008, kids can collect official Spy Gear gadgets with the purchase of a Happy Meal or Mighty Kids Meal at participating McDonald's restaurants.

Kids can embark on imaginative spy missions using six new Spy Gear toys offered exclusively at McDonald's: Secret Wrist Beam, Spy Guard Motion Alarm, Spy Disc Defender, Invisible Message Pen, Rear View Spy Scope and Mobile Message Bot.

The Spy Gear Happy Meal is timed with Wild Planet's 10th anniversary of making spy toys, and precedes the release of the company's first Spy Gear board games, Spy Trackdown and Spy Wire. (more)

"In becoming accustomed to such toys and the pleasures they bring, the seeds of an amoral and suspicious adulthood are unwittingly being cultivated." (more)

Whatta fun couple! "It's party time!" (fabadabaZap)

Lisa Cohen, 28, garnered media attention when she released tapes in March of her former fiance, Lee County Sheriff's Cpl. Michael DeTar, using a Taser on party guests.

Cohen pleaded guilty to three misdemeanor charges lessened from two felony charges against DeTar — eavesdropping and disrupting computer services for an authorized user. She pleaded guilty to stalking, making a false report and criminal mischief above $200.

Today...
...the Cape Coral woman who allegedly brought a gun into the Lee County Justice Center in March, pleaded no contest today to a misdemeanor charge of possession of a firearm in a restricted area. (more)
Extra Credit...
Tired of Tupperware?
Taser Parties - A Shocking Success (more)

SpyCam Story #452 - "What goes around...eh, Rod"

Alex Rodriguez's wife wants to know if he hired private detectives or had wiretaps installed to spy on her. Cynthia Rodriguez's lawyers demanded any surveillance information as part of a records request in the Miami divorce case.

The document asks for any tape recordings, photographs, reports from investigators or results from possible wiretaps. (more)

According to British tabloid The Daily Star, an unidentified man has come forward claiming that he secretly filmed Yankee star Alex Rodriguez and Madonna having sex, by use of a hidden camera installed in one of Madonna’s Kabbalah practicing friends’ home, who is also friends with him. (more)

Wikileaks Strikes - Canadian Wiretapping

from Wikileaks...
"In a dramatic turn of events, it has been revealed that a wiretap was issued on several protesters of the Mohawk tribe in Canada who were protesting poverty. The news story was leaked yesterday on Wikileaks in part because of a media ban on the subject.

According to the discussion page prosecutors were trying to ban the entire story from the media, but ultimately failed to do so...

In short, the law enforcement in charge of keeping the situation calm ordered a wiretap on the protesters without a court order. It's unlikely that the public will treat this aspect lightly because it puts into serious question just how far law enforcement is willing to go. In a country where privacy is of greater concern then in other countries, one might expect some form of outrage at some point in the near future." (more)
Wikileaks.org and "malignant activism" (Security Scrapbook, 2/17/03) are old alert topics for my security director clients. Today's leak is a good example of these warnings. Organizational attacks like these can be mitigated if an information security program - which includes counterespionage elements - is in place. ~ Kevin

Dark Knight Wiretapping Thoughts from The Web

"Did anybody else notice the strong anti-wiretapping note that Morgan Freeman’s character hits in Dark Knight?" (more)

"Normally, I’m not prone to political analysis of blockbuster movies, but “The Dark Knight” seems to beg for it with its consistent references to current events, most spectacularly in the wiretapping sequence." (more)

"Like Bush, Batman has his own warantless wiretapping program, but Nolan is kind enough to assure us that, once his goal is accomplished, the superhero will blow it up. Is he suggesting that we can count on the Dark President to do the same?" (more)

"Batman is truly trying to do the right thing for the citizens of Gotham even if he steps into gray (or black) areas. Did the wiretapping save dozens of lives? Yes. Did he use it for any other purpose? No. Was it destroyed after it was used to capture the most dangerous criminal in Gotham? Yes." (more)

...and from The New York Times...
Lucius Fox — Batman’s aide de camp and weapon-supplier — makes a brief civil liberties speech, and says he will only go along with the spying project once. ... Societies get the heroes they deserve. Seven years after Sept. 11, the United States is caught up in a misbegotten war in Iraq, is granting immunity to telecommunications companies that helped the Bush administration illegally spy on the public, and is unwilling to unequivocally renounce torture as a tactic. (more)

"Keep your berries in your pants 'ol chap."

UK - Concerns have been raised about the security of British secrets after a top political aide lost his BlackBerry device to a suspected Chinese spy, sources say.

The Sunday Times newspaper says one of Prime Minister Gordon Brown's most senior aides was the victim of a "honeytrap" scheme in which the man was lured to a hotel room by a woman he met in a disco in Shanghai, China, only to find the next morning that his BlackBerry device had been stolen. (more)