Security Director Alert: Wireless Key-Logger Hides in USB-C to Lightning Cable

A USB-C to Lightning cable with a hidden wireless key-logger can enable an attacker to capture everything you type from a distance of up to a mile.

Any tech-literate person knows you should never plug a USB key into any of your devices unless you trust the person giving it to you, but fewer know that the same applies to USB cables...

“We tested this out in downtown Oakland and were able to trigger payloads at over 1 mile,” he added...

...the new cables now have geofencing features, where a user can trigger or block the device’s payloads based on the physical location of the cable.  more

These spy cables come in various configurations, including standard USB charging cables. They look exactly like authentic cables. An electronic test can identify a malicious spy cable easily. In fact, you can do it yourself. Click here for instructions.

Last Month in Spycam News

FL - Pembroke Pines Police said Thursday that the owner of Master Franco’s Taekwondo Academy on Pines Boulevard is facing additional video voyeurism charges. Robert Franco, 64 was already facing charges for placing nanny cameras in the bathroom of his Pembroke Pines facility. more

UK - A vile sexual deviant who snooped on a woman as she got changed at a swimming pool was found to possess 30 more videos of people getting changed - including children... unaware victim was getting changed...when she noticed a towel from the cubicle next to her along with a hidden mobile phone. more

WY - A Casper man (Douglas Michael Dickey) facing accusations that he recorded multiple videos of people using the restroom at a restaurant where he used to work has changed his plea in the case... “Dickey’s face [was] also observed when he started the recording of the video,” detectives write in the affidavit. “Setting up his cell phone by placing it next to the toilet and covering the cell phone from his victims. The videos also showed Dickey wearing his [uniform] and his employee name tag. Each of the videos ended with Dickey looking into the cell phone as he recovered the phone and ended the recording.” more

FL - Former Gulf Breeze Mayor Edward “Ed” Merrill Gray III has been sentenced to five years in state prison for secretly recording teen boys in his shower. more 

FL - A 34-year-old Port Orange man is charged with 25 counts of Video Voyeurism for secretly videotaping his child's nanny in his home... A digital clock in that bathroom struck the nanny as "weird." She explained that the clock "faced directly towards the shower and a blank wall. more

UK - Louise was nearly six months' pregnant when she spotted something suspicious after having had a massage - a digital clock wired up to a laptop computer. Immediately afterwards Louise - not her real name - searched online for "digital clock, hidden camera". The first result confirmed her worst fears. more

UK - A GREATER Manchester Police employee has today been sentenced for voyeurism in the workplace after secretly filming colleagues on the toilet. more

NY - According to arrest records from Seneca Police...Andrew Ballenger Johns, age 26 of West Union, was booked into jail on a charge of voyeurism... Judge Susan Harris alleged that Johns “knowingly video recorded the victim, a 26-year old female, without her knowledge or consent while she was in a place that she had reasonable expectation of privacy…and that he did position a cell phone set to record inside a bathroom of a residence.” more

N. Ireland - A Belfast-based private tutor is to stand trial over allegations that he secretly recorded a group of schoolgirls, a judge ordered today. more

UK - Cheshire pervert secretly filmed women and young girls on the toilet in pubs...A search at the scene and his home address...revealed 20 video clips of adults being filmed without their knowledge: 16 of which featured men and women using the toilets at Creamfields - where Smith was working and had set up a covert camera... more

LA - Michael Jackson was convicted of video voyeurism and sentenced to 80 years in prison after he was convicted as a habitual offender from a July 2016 arrest. Jackson got caught at a fast-food restaurant sticking a camera under a bathroom stall to film females. The registered sex offender had multiple other convictions on his record. more

Mauritius - The Mauritius Football Association and local police are investigating a complaint of voyeurism after a female FA employee found a mobile phone in video recording mode in the women's toilets at the FA headquarters. ...the device hidden in a blue basket above the toilet water tank. more

China - The China Cyberspace Administration (CAC) announced on Monday that dozens of people were arrested and 25,000 illegally hacked webcams were seized as part of a crackdown on illegal voyeurism in Asian countries. In a statement, Cyber ​​Security Watchdog announced the detention of 59 suspects allegedly using camera cracking software to illegally control webcams, eavesdrop on individuals and commit illegal acts. more

UK - For months voyeur Christopher Adam Robinson, 35, secretly put his mobile phone in the shop’s changing room where it could film others without them knowing, said Howard Shaw, prosecuting... Robinson said he needed to “set up” the changing room and went briefly into it before letting people use it. As they tried the clothes on, they spotted the phone half hidden behind curtains and realised they were being filmed. more

FL - A girl’s discovery of hidden cameras in a Pembroke Pines martial arts studio’s restroom led to the arrest of the 64-year-old head instructor, Pembroke Pines police announced Saturday... a student noticed two cameras “discretely placed within picture frames on a shelf located in the academy’s restroom.” more

UK - Doctor Metwally also pleaded guilty to two offences of voyeurism which took place between 2013 and 2014 after he covertly filmed two patients who were in a state of undress whilst attending medical appointments. more

NY - Philip Close, the former owner of the Close School of Music, was sentenced Tuesday to 50 years in prison for child pornography, according to federal officials... He admitted to hiding spy cameras to secretly record students, parents and teachers in the building... Close also put hidden cameras in the music school’s only bathroom, one under the toilet and one in front of the toilet. These cameras were used to record young girls using the bathroom. more

Canada - A trial has been scheduled for Moose Jaw businesswoman Kyra Klassen, who is facing two charges of voyeurism...Klassen is facing allegations that she secretly photographed two nude women last year and posted the images to an online chat group without their permission. more

TN - Police said a man has been charged with three counts of video voyeurism after they found a phone under a bathroom sink in a Middlesboro hospital, with a motion-activated app that police said would take live footage. more

Japan - Tokyo Metropolitan Police have arrested a 42-year-old man over the alleged sale on the internet of illicit footage of female sex workers...allegedly sold footage of several sex workers on the pay-to-view site... (He had) mounted a hidden camera on the frame of his glasses to take tosatsu (voyeur) footage during encounters with them... Upon his arrest (he) admitted to the allegations. “I thought that if I made money, I could visit more sex shops,” the suspect told police. more

These stories are presented to raise awareness.

Spycam Facts:

• Only the failed video voyeurs make the news.
• Most spycam attacks go undetected.
• A few are discovered... almost all by accident.
• Only a few of these are reported to the police.
• Only a few of these cases are solved.
• Only few of these make it to my desk.
• I only share just a few of them with you.

Any organization with expectation of privacy areas needs this to protect their employees, visitors and customers... and themselves, from forseeability law suits.

A Spy, a Botanist, and a Strawberry

The year was 1712. An engineer in the French Army Intelligence Corps named Amédée-François Frézier was sent by King Louis XIV on a reconnaissance mission to Chile. Between covert visits to Chilean military fortifications where he posed as a tourist in order to gain access, Frézier was also charged with documenting the local flora and fauna. One day he came upon a familiar sight: a berry that looked similar to one he knew from Europe, but significantly larger...

Frézier packed up some of these plants and took them back to France where they were planted among other species. The crossing of Fragaria chilenosis with another species from the new world, Fragaria virginiana, resulted in a hybrid that would eventually become the strawberry we know today... Eventually the hybrid made its way back across the Atlantic and took hold in North and South America.

Did you happen to notice our French spy's name, Frézier? That might sound familiar because the French word for strawberry is fraise. An ancestor of Frézier’s was knighted and bestowed the name by the king of France in the year 916 after offering his highness a gift of ripe strawberries. Seems it was Amédée’s destiny to become intertwined with this noble berry. more

Weird Files: Somewhat Covert Microphone is a Blast & Bugged Bugs

The GREEN12 is a cardioid directional, small diaphragm electret condenser microphone that is a great choice for users that are looking for a slim profile, high-quality microphone which is perfect for most professional, semi-professional, and home-recording applications. 

Its cardioid capsule and machined vents allow for high off-axis rejection and a focused recording, great for stringed acoustic instruments. 

The GREEN12 is handmade from an actual discharged 12Ga shell. more

---

The first Asian giant hornet nest of 2021 was found Thursday morning, Aug. 19, in a rural area east of Blaine, about one-quarter mile from where a resident reported a sighting of a live Asian giant hornet on Wednesday, Aug. 11.

The state agriculture staff netted, tagged with a tracker and released three of hornets Aug. 11, to Tuesday, Aug. 17, according to a news release from the Washington State Department of Agriculture. One of the so-called “murder hornets” slipped out of the tracking device, another hornet was never located and one eventually led the team to the nest. more

Read more here: https://www.bellinghamherald.com/news/local/article253621598.html#storylink=cp

Controversial Tool That Lets Kids Spy on Their Parents

A new tool that may give one or two parents -- and many, many kids -- pause for thought.

It's called Parent Track and it's the mindchild of environmentally caring soap brand Gelo.

The idea is that kids can install the Parent Track ad tracker onto their parents' devices. This will, well, guilt them into not buying environmentally questionable products and drive them to eco-positive awareness tools...

Not everyone will be positively moved by the message Gelo sends when a parent's device is signed up. 

It reads: "You just signed up this device, allowing us to follow your parents around the internet, reminding them to quit single-use plastics for good. By doing so, you set them on a more sustainable path and may very well have saved the planet. Our thanks just don't feel like enough."

Perhaps more parents buying Gelo products -- so that Gelo would make more money -- would feel like enough. more

Spies for Hire: New Breed of Hackers Blends Espionage and Entrepreneurship

China’s buzzy high-tech companies don’t usually recruit Cambodian speakers, so the job ads for three well-paid positions with those language skills stood out. The ad, seeking writers of research reports, was placed by an internet security start-up in China’s tropical island-province of Hainan.

That start-up was more than it seemed, according to American law enforcement. Hainan Xiandun Technology was part of a web of front companies controlled by China’s secretive state security ministry, according to a federal indictment...

The accusations appear to reflect an increasingly aggressive campaign by Chinese government hackers and a pronounced shift in their tactics: China’s premier spy agency is increasingly reaching beyond its own ranks to recruit from a vast pool of private-sector talent.

This new group of hackers has made China’s state cyberspying machine stronger, more sophisticated and — for its growing array of government and private-sector targets — more dangerously unpredictable. more

Personal Security: Remove Your House from Apple Maps, Google Maps & Bing Maps

If you’d like to opt out of a property you own or rent appearing in one of these street-level views, you can use a reporting or request method in each service:

• Apple: Apple requires that you email them “to request that a face, license plate, or your own house be censored.” The address is MapsImageCollection@apple.com.
• Google: Visit maps.google.com and go to the address of concern. Expand the side panel on the left, then click the photo in the side panel to have it enlarge in your browser. Look for an info box in the upper left of the photo and click on the icon of the three vertical dots. In the pop-up that appears, click “Report a problem” and select what you would like to have blurred from the “Request blurring” list of options. You can also submit via the Google Maps app.
• Microsoft: Visit Bing Maps, click “Report a privacy concern with this image” at the lower-left corner of the page, and select House (or another option) from “What kind of concern do you have?” You can describe in the text box below that you want to have your house blurred. more

Cyber Attacks Are Making Work-From-Home Expensive for Businesses

Working from home during the pandemic cost German companies some 53 billion euros ($62 billion) worth of damages from cyber attacks, according to estimates by the Cologne Institute for Economic Research.

Overall damages hit a record 224 billion euros last year, more than double the value reported in a 2019 survey. Increased remote work accounted for about a quarter of the increase, according to researcher Barbara Engels, whose calculations are based on a Bitkom survey. more

IoT News: Data from Over 116.5 million Smart Devices Go Here

From rooftop to basement and the bedrooms in between, much of the technology making consumer products smart comes from a little-known Chinese firm, Tuya Inc. of Hangzhou. More than 5,000 brands have incorporated Tuya’s technology in their products... Smart home thermostats. Smart home security cameras. Smart refrigerators. Smart TVs. Smart pet feeders. Smart breast pumps...

Tuya says as of 2020, its services cover more than 1,100 categories, such as healthcare, agriculture and apartment management, and are sold in more than 220 countries and regions globally in over 116.5 million smart devices... including Dutch multinational Philips, and TCL, the Chinese electronics company that makes Roku TV, according to the company. Global retailers Amazon, Target and Walmart sell consumer products that use Tuya’s technology.

Some cybersecurity experts worry about the lack of protection for the consumer data collected by Tuya tech in household items and in products used in health care and hospitality. more

Fax Security Alert: One Picture Worth 1000 Hacks

Security researchers have found a way to remotely execute code on a fax machine by sending a specially crafted document to it. So… who cares about fax? Well apparently a lot of persons are still using it in many institutions, governments and industries, including the healthcare industry, legal, banking and commercial. Bureaucracy and old procedures tend to die hard.

"Our research set out to ask what would happen if an attacker, with merely a phone line at his disposal and equipped with nothing more than his target`s fax number, was able to attack an all-in-one printer by sending a malicious fax to it.

In fact, we found several critical vulnerabilities in all-in-one printers which allowed us to ‘faxploit’ the all-in-one printer and take complete control over it by sending a maliciously crafted fax." more

 

Wanted: Disgruntled Employees to Deploy Ransomware

 via krebsonsecurity.com
Criminal hackers will try almost anything to get inside a profitable enterprise and secure a million-dollar payday from a ransomware infection. Apparently now that includes emailing employees directly and asking them to unleash the malware inside their employer’s network in exchange for a percentage of any ransom amount paid by the victim company.

 

Image: Abnormal Security.

Crane Hassold, director of threat intelligence at Abnormal Security, described what happened after he adopted a fake persona and responded to the proposal in the screenshot above. It offered to pay him 40 percent of a million-dollar ransom demand if he agreed to launch their malware inside his employer’s network.

This particular scammer was fairly chatty, and over the course of five days it emerged that Hassold’s correspondent was forced to change up his initial approach in planning to deploy the DemonWare ransomware strain, which is freely available on GitHub. more

IoT Bug Impacts Millions of Devices - Allows Hackers to Spy on You

Security researchers have discovered a critical vulnerability affecting millions of IoT devices which could allow attackers to spy on you by tapping into real-time camera feeds.

The security issue impacts products from various manufacturers that provide video and surveillance solutions, as well as home automation IoT systems, which are all connected via ThroughTek’s Kalay IoT cloud platform.

American cybersecurity firm Mandiant revealed the CVE-2021-28372 bug after reporting it to the Cybersecurity and Infrastructure Security Agency (CISA).

Because the Kalay platform is used by devices from a large number of manufacturers, it is difficult to create a list with the affected brands. Mandiant were unable to determine how many devices are affected, but they warned that more than 83 million users are currently using Kalay. more

An adversary would be able to remotely compromise an IoT device by exploiting the flaw and could compromise device credentials, watch real-time video data, and listen to live audio. more

Russian Spy Ship Loitering Near Trans-Atlantic Internet Cables

The Russian Navy related ship Yantar has turned up off the Atlantic coast of Ireland. An Irish Defence Forces spokesperson said that the Irish Navy is aware of the ship.

The ship carries a range of deep-diving submersibles and sonar systems and has been suspected of operating on undersea cables before.

Yantar took up a stationary position between two undersea internet cables on Tuesday morning. According to AIS (automated identification system) positions collected by MarineTraffic.com, the ship moved into a position between the cables around 4am local time. She has remained there for most of Wednesday before resuming her journey southwest. more

Apple's Double Agent Spy Blows Cover Over Pay

An active member of the Apple jailbreak and leaking community reportedly served as a "double agent" and spied for the Cupertino tech giant's security team.

Andrey Shumeyko, who goes by handles JVHResearch and YRH04E, advertised leaked Apple apps, internal company documents, and stolen devices to a community that traded in such commodities. However, unbeknownst to others in the community, he also shared a wealth of details about its inner workings to Apple.

According to Motherboard, Shumeyko reportedly provided Apple with the personal information of people who sold stolen prototype devices and Apple employees who leaked information online...

Shumeyko said he is sharing his story because he felt like Apple took advantage of him and didn't compensate him for the information that he provided to the company's Global Security team. more

Your Own Personal License Plate Reader

via Theodore Claypoole, Womble Bond Dickinson (US) LLP 

Somewhere along the path between doorbell cameras and anti-tank weapons lies the newest home protection equipment – privately-owned license plate readers. A new company straight out of Y Combinator is offering machine-learning license plate capture technology for your home and office. Flock Safety, a start-up that describes itself in press releases as a crime-solving company, offers for sale TALON, a national network of automatic license plate readers. Anyone can own a node in this network.

Until recently, license plate readers had been the province of law enforcement... more

OK, how much?

The Flock Safety Falcon camera is $2,500 per camera per year, with a one-time $250 installation cost. This price includes everything — installation, maintenance, footage hosting, cellular service, and software updates. The Sparrow camera (a lighter and smaller version of our Falcon camera) costs slightly less with the same basic subscription model. more

Two U.S. Officials in Germany Treated for Havana Syndrome

At least two U.S. officials stationed in Germany sought medical treatment after developing symptoms of the mysterious health complaint known as Havana Syndrome, U.S. diplomats said.

The symptoms, which included nausea, severe headaches, ear pain, fatigue, insomnia and sluggishness, began to emerge in recent months and some victims were left unable to work, the diplomats said. They are the first cases to be reported in a NATO country that hosts U.S. troops and nuclear weapons. more

“Glowworm” Can Eavesdrop via Devices’ Power LEDs

Researchers at Ben-Gurion University of the Negev have demonstrated a novel way to spy on electronic conversations. A new paper released today outlines a novel passive form of the TEMPEST attack called Glowworm, which converts minute fluctuations in the intensity of power LEDs on speakers and USB hubs back into the audio signals that caused those fluctuations.

The Cyber@BGU team—consisting of Ben Nassi, Yaron Pirutin, Tomer Gator, Boris Zadov, and Professor Yuval Elovici—analyzed a broad array of widely used consumer devices including smart speakers, simple PC speakers, and USB hubs. The team found that the devices' power indicator LEDs were generally influenced perceptibly by audio signals fed through the attached speakers.

Although the fluctuations in LED signal strength generally aren't perceptible to the naked eye, they're strong enough to be read with a photodiode coupled to a simple optical telescope... more 

Check out the other eavesdropping hits that have come out of Ben-Gurion University... here

The Philadelphia Experiment Isn't the Only Thing Missing

When one thinks of spy stories, one usually thinks of foreign cites such as Hong Kong or Berlin, but espionage is being committed right here in Philadelphia. Economic espionage occurs in Philadelphia as the city and surrounding suburbs are home to major corporations, major universities, and major defense contractors. Technologically advanced firms, small innovative companies, as well as chemical, critical manufacturing, energy, and public health organizations, are also targeted. more

This Week in Spy News

Germany Arrests British Embassy Worker Suspected of Spying for Russia
Prosecutors accuse the British man of handing over documents to Russian agents for cash, amid growing concerns that Germany is increasingly caught in the cross hairs of international spying. more

A Chinese court has sentenced Canadian businessman Michael Spavor to 11 years in prison for espionage, more than two years after he was first detained. Spavor, a Beijing-based businessman who regularly traveled to North Korea, was sentenced after being found guilty of spying and illegally providing state secrets to foreign countries, the Dandong Intermediate People's Court said in a statement Wednesday. more

Despite a lack of evidence, the National Security Agency will investigate whether the Fox host was illegally targeted. The National Security Agency’s Inspector General Robert Storch has announced a review of whether the agency illegally conducted cyber-espionage and collected the electronic communications of Fox News opinion-show host Tucker Carlson, who has accused the NSA of trying to capture embarrassing information that might lead to him being taken off the air. more

China Sighted by CIA

The Central Intelligence Agency is weighing proposals to create an independent “Mission Center for China” in an escalation of its efforts to gain greater insight into the U.S.’s top strategic rival, according to people familiar with the deliberations.

The proposal, part of a broader review of the agency’s China capabilities by CIA Director William Burns, would elevate the focus on China within the agency, where China has long been part of a broader “Mission Center for East Asia and Pacific.” more

Tips for Closing Hard-to-Delete Online Accounts

 via Consumer Reports

Tips for Deleting Old Accounts

Deleting your old accounts can be a time-consuming and sometimes frustrating process. Some guidelines to speed things along...

• Check to see if anyone has figured out the steps. Google “how to delete [company name] account” and you’ll often find instructions. (A step-by-step guide to deleting two dozen common accounts.)
  
• Go to the Settings page first. Companies sometimes put the delete button in settings, account menus, or pages to edit your profile; it varies by company.
• Try the privacy policy. Privacy policies often include instructions, and you can search for words like “account,” “delete,” “close,” or “deletion.”
• Explore the Help menus. If there’s a Help menu or an FAQ section on a website, you can often find deletion instructions there.
• Try customer service. When available, text chats are usually faster than phone calls in my experience.
• Take advantage of privacy laws. California’s privacy law, the CCPA, requires most businesses to let state residents delete data collected from them. Companies don’t have to fulfill a deletion request if you’re not a resident, but some honor requests from anyone. Look for “California” or “CCPA” in privacy policies for details.
• Don’t forget the accounts you’ve forgotten. You may have registered for accounts years ago that have slipped your mind. A whole article with detailed instructions on how to find them. Some tips to get started: Google your email address and old usernames; check for saved log-ins in your web browser or password manager; search your email inbox for old “welcome” messages. Try variations on phrases like “welcome to,” “new account,” “password,” or “confirm your email.” more
  

The NSA's Wireless Device Best Practices

Telework has become an essential component of business, and many people are teleworking from home or during travel. While the owners of home networks can take steps to secure those networks, it can be difficult to ensure public networks (e.g., conference or hotel Wi-Fi®) are secure. Protecting personal and corporate data is essential at all times, but especially when teleworking in public settings.

This infosheet gives National Security System (NSS), Department of Defense (DoD), and Defense Industrial Base (DIB) users the best practices for securing devices when conducting business in public settings. It describes how to identify potentially vulnerable connections and protect common wireless technologies, and lists steps users can take to help secure their devices and data. 

While these best practices cannot ensure data and devices are fully protected, they do provide protective measures users can employ to improve their cybersecurity and reduce their risks. more

Florida Surveillance Techs Charged With Video Voyeurism

Palm Beach, FL
Police have arrested video surveillance technician Jeremy Dale Lewis for video voyeurism after a nearly year-long investigation... 

A second suspect, Michael Reilly, is also facing a charge of video voyeurism. Police said Reilly, who also worked for Ask the Advisors, watched more than 600 live and archived videos over a five-day period in July 2020 of a woman undressing in her dressing room, and of a couple having sex...

This incident follows a high-profile case that saw an ADT technician receive a 52-month jail sentence for doing essentially the same thing. more

3 in 10 Home Sellers Use Spycams During House Tours

Spycams are reportedly being used by home sellers who want to ink a deal sooner rather than later.

According to a recent LendingTree survey, 3 in 10 home sellers admit to using hidden cameras when they host an open house.

The survey, which was commissioned from the experience management firm Qualtrics, notably had a small sample size of home sellers – 346 – compared to home buyers – 1,160 – for a total sample size of 2,050. 

Of those sellers who admit to using cameras without notifying buyers, 49% claim they do so to find out what buyers "do and don’t like about their home." more

Learn how to spot spycams.

Better Not Lose Your Laptop - A Cautionary Tale

via Dolos Group, LLC 
What can you do with a stolen laptop? 
Can you get access to our internal network?

That was the question a client wanted answered recently. Spoiler alert: Yes, yes you can. This post will walk you through how we took a “stolen” corporate laptop and chained several exploits together to get inside the client’s corporate network.

We received a Lenovo laptop preconfigured with the standard security stack for this organization. We didn’t get any information about this laptop, no test credentials, no configuration details, no nothing, it was a 100% blackbox test. Once the laptop came in, we opened the shipping box and got to work. After we did our reconnaissance of the laptop (BIOS settings, normal boot operation, hardware details, etc) we noted a lot of best practices were being followed, negating many common attacks. For example... more

From the Man Who Brought Us Every Kid's First Spy Toy - Ron Popel (RIP)

How many Mr. Microphones wound up behind the couch when the younger brother's older sister brought her date home?

There’s Almost Certainly a Spy in Your Office

Espionage is a very real threat for businesses.

A recent paper from the US Senate suggests advanced actors now regularly plant individuals in large organizations, with a view to stealing data and research that can be used for economic, scientific or military gain.

China, for example, is said to operate more than 200 different recruitment programs, the most elaborate of which is the Thousand Talents Plan, which is estimated to have recruited 7,000 operatives or more. And China is by no means the only country to engage in these behaviors...

In rare instances, when recruiters fail to gain access to an employee, they have been known to train up an individual specifically for the task. Known as “embeds”, these imposters are much closer to traditional spies and have a full understanding of the ambitions of their handlers.

“Sometimes, these embeds are quiet for a long time, even years. Then all of a sudden they gain access to the information they were recruited to hunt down, before disappearing into thin air. There is another level of tradecraft on display here.” more

Note: Embeds are in the best position to plant eavesdropping devices (disguised voice recorders, Wi-Fi data leaches, USB spy cables, GPS trackers, GSM cellular bugs, etc.) Periodic searches for these devices thwarts their efforts. Sometimes just by them knowing the organization conducts searches. And, of course, by discovering the devices before they can do long-term harm.

Corporate Espionage: Things are Tough All Over

Korea's tech industries are increasingly becoming the target of technology and intellectual property theft that has been growing in sophistication and harmfulness...

With industrial espionage, competitors' poaching of skilled employees, cyberattacks and other forms of theft being rampant, the world has been introducing stricter rules to ban theft of competitors' technologies across borders...

Industrial espionage and cyberattacks are still favored forms of theft, with the targets changing from conglomerates to their subcontractors, many of them small- and medium-sized enterprises (SMEs) that are often ill-equipped in terms of security and management. more

Deadly Corporate Espionage Case Settled

Credit Suisse has reached an out-of-court settlement with former star banker Iqbal Khan over allegations of spying that led to the resignation of the Chief Executive Tidjane Thiam, a spokesperson for the Swiss bank said...

The affair became public when Khan, after defecting to UBS, confronted a private detective who was following him and his wife through Zurich.

What Credit Suisse initially described as a rogue spying case run by then-Chief Operating Officer Pierre-Olivier Bouee widened as details emerged of other instances of surveillance.

As well as the departures of Bouee and Thiam, a private investigator who organized the surveillance committed suicide after the affair came to light. more

Pegasus v. iPhone Update - iOS 14.7.1 Plugs the Loophole

Apple has reportedly fixed the vulnerability in iOS 14.7.1. The security notes don’t specifically mention Pegasus, but they refer to “a memory corruption issue” that “may have been actively exploited.” more

Pegasus Spyware Update: How to Check Your iPhone

If you’re concerned about recent reports of the Pegasus spyware reportedly installed by the Israeli NSO Group to hack journalists and world leaders, there’s a tool to check if it’s hidden on your iPhone. But you probably have nothing to worry about...

But if you’re concerned, there’s a way to test whether your iPhone has been targeted. It’s not an easy test, mind you, but if you’re using a Mac or Linux PC and have backed up your iPhone using it, Amnesty International’s the Mobile Verification Toolkit will be able to detect whether your phone has the Pegasus spyware installed on it. The tool, which TechCrunch tested, works using the macOS Terminal app and searches your latest iPhone backup on your Mac, “is not a refined and polished user experience and requires some basic knowledge of how to navigate the terminal.” You’ll need to install libusb as well as Python 3 using Homebrew. (You can learn more about the installation here.) TechCrunch says the check only takes “about a minute or two to run” once it’s been set up. more

Private Espionage Is Booming - The US Needs a Spy Registry

via Wired Magazine...
Years ago, while stationed in Moscow as the bureau chief for a major news magazine, I was approached by a representative of a multinational company and presented with a tantalizing offer. He said he had highly sensitive materials exposing possible criminal activity by a Russian competitor. The documents were mine with one condition: advance notice so he could be out of the country when any story was published.

I had every reason to think the materials came from a private intelligence operative hired by the company—there were many such operatives in Moscow—but I didn’t ask my source for his source. Instead I embarked on a somewhat harrowing investigation of my own, and on corroborating the materials, I was able to publish a splashy story.

This episode came back to me while reading Barry Meier’s new book, Spooked: The Trump Dossier, Black Cube, and the Rise of Private Spies. A former New York Times investigative reporter, Meier casts a harsh light on both “private spies” and journalists who make frequent use of nuggets unearthed by these operatives. In the book’s afterword, he revives an idea for “a kind of ‘spy registry’ in which operatives for hire would have to disclose the names of their clients and assignments,” just as Congress now requires of lobbyists hired to influence legislators.

Is this truly a problem in need of a solution? Or would a spy registry create worse problems?

It’s tempting to conclude that there is really nothing new here and that private spies may even supply a public service. In the original, late-19th-century Gilded Age, the Pinkerton Detective Agency devoted itself to the art of subterfuge. In 1890, a Pinkerton man went undercover on behalf of his client, the governor of North Dakota, and confirmed from rigorous barroom investigation that a fair amount of “boodle,” bribe money, was being dispensed by advocates of a state lottery opposed by the governor. The governor revealed the dirty dealings to the public, and the lottery scheme failed—all perhaps to the civic good.

Today’s circumstances are far different. Inexpensive, off-the-shelf technologies for surveillance, hacking, and spoofing make the spy game easier to play than ever before. What hired sleuth doesn’t now travel with one of those metallic-fabric bags that blocks cellphone GPS signals, like the GoDark Faraday model that sells online for $49.97? It’s an insignificant item on the expense report.  more

US Warns Businesses in Hong Kong About Electronic Surveillance

The advisory, which was nine pages long, was issued by the Departments of State, Treasury, Commerce and Homeland Security. It alerted businesses to the possible risks associated with doing business in Hong Kong. According to the advisory, businesses are at risk from electronic surveillance without warrants and the disclosure of customer and corporate data to authorities. more

 

Pegasus Spyware Back in the News

Washington Post... NSO Group’s Pegasus spyware, licensed to governments around the globe, can infect phones without a click... Military-grade spyware licensed by an Israeli firm to governments for tracking terrorists and criminals was used in attempted and successful hacks of 37 smartphones belonging to journalists, human rights activists, business executives and two women close to murdered Saudi journalist Jamal Khashoggi, according to an investigation by The Washington Post and 16 media partners. more

India Today... Pegasus spying: how Pegasus is installed on phone, what it does, and how to get rid of it...

• Pegasus can be installed on vulnerable phones through a web link or a missed call.
• The spyware can steal passwords, contacts, text messages, and photos.
• The only way to avoid Pegasus after it has infected a phone is by getting rid of the phone.

Pegasus, developed by Israeli cybersecurity firm NSO Group, is a highly sophisticated spyware that has been referred to as the "most sophisticated smartphone attack ever". It was first noticed in 2016 but created a lot of buzz in late 2019 when it was revealed that the spyware was used for snooping on journalists and human rights activists across the globe, including in India. more

Tech Xplore... Pegasus spyware: how does it work?

More recent versions of Pegasus, developed by the Israeli firm the NSO Group, have exploited weak spots in software commonly installed on mobiles.

In 2019 the messaging service WhatsApp sued NSO, saying it used one of these so-called "zero-day vulnerabilities" in its operating system to install the spyware on some 1,400 phones.

By simply calling the target through WhatsApp, Pegasus could secretly download itself onto their phone—even if they never answered the call.

More recently, Pegasus is reported to have exploited weaknesses in Apple's iMessage software.

That would potentially give it access to the one billion Apple iPhones currently in use—all without the owners needing to even click a button. more

Why You Can't Get James Bond's Custom Martini These Days

 via Futility Closet... (worth subscribing)

In the first James Bond novel, 1953’s Casino Royale, Bond orders a drink of his own invention:

‘A dry martini,’ he said. ‘One. In a deep champagne goblet.’

‘Oui, monsieur.’

‘Just a moment. Three measures of Gordon’s, one of vodka, half a measure of Kina Lillet. Shake it very well until it’s ice-cold, then add a large thin slice of lemon peel. Got it?’

‘Certainly monsieur.’ The barman seemed pleased with the idea.

‘Gosh, that’s certainly a drink,’ said Leiter.

Bond laughed. ‘When I’m … er … concentrating,’ he explained, ‘I never have more than one drink before dinner. But I do like that one to be large and very strong and very cold, and very well-made. I hate small portions of anything, particularly when they taste bad. This drink’s my own invention. I’m going to patent it when I think of a good name.’

The name he thinks of is the Vesper, ostensibly inspired by the character Vesper Lynd. But in fact the recipe wasn’t original to Bond — Fleming had first received the drink from the butler of an elderly couple in Jamaica — it was named after vespers, a service of evening prayer. Bond says, “It sounds perfect and it’s very appropriate to the violet hour when my cocktail will now be drunk all over the world.” He’d have trouble getting one today — Kina Lillet was discontinued in 1986, and the strength of Gordon’s Gin was reduced in 1992.

The "Encrypted" Cell Phones Had One Flaw: The FBI Controlled Them

The criminals texted each other about drug deals and money laundering, confident in special encrypted devices using a platform dubbed Anom. There was just one problem for the crime rings: The FBI was being copied on every message — millions of them worldwide. In fact, the agency had sent the Anom devices into the black market in the first place.

Those are the details and allegations that are now emerging about Operation Trojan Shield, an international effort coordinated by the FBI that has resulted in more than 800 arrests.

With the help of Europol, the FBI identified "over 300 distinct TCOs [transnational criminal organizations] using Anom, including Italian organized crime, Outlaw Motorcycle Gangs, and various international narcotics source, transportation, and distribution cells," according to a search warrant affidavit filed in court by Nicholas Cheviron*, an FBI special agent in San Diego. The document was unsealed Monday.

In addition to heading the investigation, FBI Special Agent, Nic Cheviron (son of the best corporate security director ever), wrote the search warrant. It is a fascinating read.

Quantum Disappointment to Quantum Reserection

In theory, quantum cryptography enables two or more people to communicate with one another in complete secrecy. In practice, eavesdroppers can exploit weaknesses in the equipment used to send and receive secret keys.

Researchers in Singapore have now shown how practice can be brought closer to theory—by inserting a fairly simple passive device to prevent eavesdropping attacks involving bright light (Phys. Rev. X, doi: 10.1103/PRXQuantum.2.030304). They reckon their solution could be widely adopted in future, having shown that it can be applied to a number of popular cryptographic schemes...

Here is how it works.
Don't worry if you don't get it.
Just pretend Dr. Emilio Lizardo is doing the explaining.

Their device exploits an acrylic prism with a negative thermo-optical coefficient. Incoming light generates a gradient in temperature, and therefore in refractive-index, inside the prism that turns the acrylic into a concave lens. A small aperture placed behind the prism blocks most of the resulting diverged light beam, diminishing the beam power. more

Weird Science - Windows that Prevent and Facilitate Eavesdropping (you decide)

C-Bond Systems (the “Company” or “C-Bond”) (OTC: CBNT), a nanotechnology solutions company, announced today that it has received a purchase order for $220,000 to install specialty defense window film for a government customer.

Radio frequency defense film, also known as RF attenuation window film or anti-eavesdropping film, protects homes or workplaces against radio frequencies and electromagnetic radiation. The RF film that the customer requires meets strict security requirements for facilities handling classified or other sensitive information. The government customer has requested to remain anonymous for security reasons. more 

We've been down this road before, in 2007 and 2009.

•••

Listening & Anti-Eavesdropping Device
(18 years ago this month)
Abstract
A method and apparatus for transmitting information from a conversation in a room to a remote listener comprising selecting a structure (101) in the room which is capable of supporting vibration, selecting an electromechanical force transducer (90) which has an intended operative frequency range and comprises a resonant element (84, 86) having a frequency distribution of modes in the operative frequency range, mounting the transducer (90) to the structure (101) using coupling means (68) whereby the transducer excites vibration in the structure, positioning a sensor to detect vibration in the structure (101), determining information from the detected vibration and transmitting said information to a remote listener. There is also provided an anti-eavesdropping system which is the reverse of the method and apparatus according to the first and second aspects of the invention. (self-licking ice cream cone) more

Nervy Doctor Arrested - Spy Cameras Found in Woman Doctor's Bedroom & Bath

India - A 42-year-old neurologist was arrested in Maharashtra's Pune for allegedly installing spy cameras in the bathroom and bedroom of a trainee doctor's residential quarters, police said on Tuesday.

"The accused doctor is a neurologist lecturer at a city-based medical college," said Jagannath Kalaskar, senior police inspector, Bharti Vidyapeeth police station.

Last week, the trainee doctor had tried to switch on the bulb in her bathroom, however, it did not work. She then called an electrician who spotted a spy camera installed in the bulb. The doctor found another spy camera in her bedroom too, following which she lodged a police complaint. more

Facebook Reportedly Fired 52 Employees Caught Spying on Users

Facebook fired 52 employees for abusing their access to the social network’s user data — including creepy men who obtained location data on women they were romantically interested in, according to a new report. 

Using their access to troves of user data through Facebook’s internal systems, male engineers were able to view women’s locations, private messages, deleted photos and more, according to a bombshell report in the Telegraph...

While 52 employees were fired for such transgressions in 2014 and 2015, Facebook’s then-chief security officer Alex Stamos reportedly warned that hundreds of others may have slipped by unnoticed. more