Cuba's Sonic Attacks - Possibly a Side-Effect of Spying

Its surveillance tools may have transmitted ultrasonic sounds by mistake...

Remember those 'sonic attacks' against the American and Canadian embassies last summer, making staff queasy and raising all kinds of questions as to what happened? There might have an answer. University of Michigan researchers have theorized that the incidents were really the result of ultrasonic signals from poorly functioning surveillance equipment. While individual ultrasonic signals can't harm people outside of extreme circumstances, multiple signals can clash with each other and produce a sound that's just low enough to be audible.

The scientists tested their hypothesis by replicating the "chirping" from an AP video using two ultrasonic emitters that combined tones, one at 25kHz and another at 180Hz. That produced a similar-sounding 7kHz frequency with ripples of sound at an even 180Hz spacing. The team even built a device that would simulate eavesdropping by playing a song instead of the 180Hz tone. more

Security Scrapbook fans knew this might be a botched spying attempt, and how it worked, last August. ~Kevin

Sounds Like Spying - Ultrasonic Sounds

Your smartphone may have some apps that are continuously listening inaudible, high-frequency ultrasonic sounds from your surroundings and they know where you go, what you like and dislike — all without your knowledge.

Click to enlarge.

Ultrasonic Cross-Device Tracking is a new technology that some marketers and advertising companies are currently using to track users across multiple devices and have access to more information than ever before for ad targeting.

For example, retail stores you visit, a commercial on TV or an advertisement on a web page can emit a unique "ultrasonic audio beacon" that can be picked up by your device’s mobile application containing a receiver. more

I plan to run some tests on this. ~Kevin

World's First Ultrasound 'Firewall' for Smartphones

Scientists have developed the first ultrasound-firewall that can prevent hackers from eavesdropping on hidden data transmission between smartphones and other mobile devices.

The permanent networking of mobile devices can endanger the privacy of users and lead to new forms of monitoring. New technologies such as Google Nearby and Silverpush use ultrasonic sounds to exchange information between devices via loudspeakers and microphones.

More and more of our devices communicate via this inaudible communication channel. Ultrasonic communication allows devices to be paired and information to be exchanged. It also makes it possible to track users and their behavior over a number of devices, much like cookies on the Web. Almost every device with a microphone and a loudspeaker can send and receive ultrasonic sounds. Users are usually unaware of this inaudible and hidden data transmission.

Researchers from the St Polten University of Applied Sciences in Austria has developed a mobile application that detects acoustic cookies, brings them to the attention of users and if desired, blocks the tracking. The app is, in a sense, the first available ultrasound-firewall for smartphones and tablets... more

Ultrasonic Bracelet Claims to Jam Eavesdropping Microphones

Spying isn’t the same as it was in the old days. Today, an inconspicuous smart speaker could be recording every word you say in your own home. That threat of invaded privacy will only continue to grow as more microphone-enabled devices are released in the years to come.

That’s why a team of researchers from the University of Chicago has invented a device
to combat it. They created a bracelet that uses ultrasonic signals to jam nearby microphones. Though it isn’t something that most people would need to use on a daily basis it could represent a picture of what jewelry will need to be in the future—both stylish and functional.

The experimental version is quite clunky, looking more like a piece of audio equipment than jewelry. However, that design has a purpose. The bracelet’s array of 24 speakers emit imperceptible ultrasonic signals. To nearby microphones, these signals come across as loud static that effectively drowns out any speech in the vicinity. more

This eavesdropping countermeasure has been around forever. We experimented with it back in the 80's. It's effectiveness can be very iffy, its downsides serious. Read more about it here.

The Cuban "Acoustic Attack" - Eavesdropping, TSCM, or Other?

The FBI is reportedly investigating who was behind an “acoustic attack” that inflicted at least two staffers of the U.S. Embassy in Havana with sudden hearing loss. Washington expelled two Cuban diplomats earlier this year in response to the incident, the U.S. State Department said on Wednesday.

The Cuban foreign ministry said it was investigating the allegations.

Citing officials familiar with the investigation, The Associated Press reported on Wednesday that embassy staff in Havana began suffering from hearing loss in the fall of 2016. U.S. officials later concluded that a device operating outside the range of audible sound has been installed inside or near diplomatic residences in Havana. more

Media speculation as to what and who is rampant. 

Some what theories, which the media has missed, include: 
• An ultrasonic bugging device (an eavesdropping attack).
• An ultrasonic room flooding device (an eavesdropping countermeasure). 

If either of these were incompetently programmed–thus producing a higher than safe level of audio power output–people would experience hearing loss and other sickness symptoms (headache, nausea, disorientation, etc.).

As to who... A bugging device could be planted by anyone, not just the Cubans. An ultrasonic room flooding device would be placed by whoever has control of the room, in an effort to deter electronic eavesdropping attempts — mixing differing frequencies of ultrasound has a detrimental effect on microphones. This is a rarely used Technical Surveillance Countermeasures (TSCM) tactic due to the fine balance between effectiveness and dangerousness. It zaps hearing aids, too.

An "acoustic attack" just to cause intentional harm seems unlikely. The results of the investigation should be interesting, if they see the light of day. Ultra-unlikely. ~Kevin

Visit us at counterespionage.com to learn how business and governments protect themselves against electronic eavesdropping attacks.

Ultrasonic Microphone Jammers — Do They Really Work?

It’s a question I get asked occasionally when one of our clients sees one of these devices being advertised on the internet.

Who can blame them for asking? The ads claim they can stop microphones from working properly. Instant privacy from electronic eavesdroppers, and anyone who is attempting to record your conversations.

Finally, Kryptonite for microphones!?!? Wow, how does that work?

The ultrasonic microphone jammer explanation is really simple... more

Ads Go from Subliminal to Ultrasonic - "PSSST... Any devices nearby?"

Privacy advocates are warning federal authorities of a new threat that uses inaudible, high-frequency sounds to surreptitiously track a person's online behavior across a range of devices, including phones, TVs, tablets, and computers.

The ultrasonic pitches are embedded into TV commercials or are played when a user encounters an ad displayed in a computer browser. While the sound can't be heard by the human ear, nearby tablets and smartphones can detect it. When they do, browser cookies can now pair a single user to multiple devices and keep track of what TV commercials the person sees, how long the person watches the ads, and whether the person acts on the ads by doing a Web search or buying a product.

Cross-device tracking raises important privacy concerns, the Center for Democracy and Technology wrote in recently filed comments to the Federal Trade Commission. The FTC has scheduled a workshop on Monday to discuss the technology. Often, people use as many as five connected devices throughout a given day—a phone, computer, tablet, wearable health device, and an RFID-enabled access fob. Until now, there hasn't been an easy way to track activity on one and tie it to another.

"As a person goes about her business, her activity on each device generates different data streams about her preferences and behavior that are siloed in these devices and services that mediate them," CDT officials wrote. "Cross-device tracking allows marketers to combine these streams by linking them to the same individual, enhancing the granularity of what they know about that person." more

The Sounds in Your Head That Nobody Else Hears May Come From...

...an ultrasound Audio Spotlight invented by Dr. F. Joseph Pompei.

The ultrasound, which contains frequencies far outside our range of hearing, is completely inaudible. But as the ultrasonic beam travels through the air, the inherent properties of the air cause the ultrasound to change shape in a predictable way. This gives rise to frequency components in the audible band, which can be accurately predicted, and therefore precisely controlled. By generating the correct ultrasonic signal, we can create, within the air itself, any sound desired.

Sound is literally made from thin air.

Note that the source of sound is not the physical device you see, but the invisible beam of ultrasound, which can be many meters long. This new sound source, while invisible, is very large compared to the audio wavelengths it's generating. So the resulting audio is now extremely directional, just like a beam of light. more

From Those Wonderful Folks Who Killed Air-Gap Security - This Bud Screws You

A research team from Israel’s Ben-Gurion University of the Negev's cybersecurity research center has discovered a new way of data extraction from air-gapped computers via using passive devices like earbuds, earphones, headphones, and speakers.

Now, the same research center has claimed to be able to use computer speakers and headphones to act as microphones and receive data. The devices can be used to send back the signals and make the otherwise safe practice of air-gapping less secure.

As per the new technique [PDF], data is extracted in the form of inaudible ultrasonic sound waves and transmission occurs between two computers installed in the same room while data is shared without using microphones. more

TSCM Questions We Get - "How small is a bug's microphone?"

A. Very small.
You probably carry the one shown in the photo, in your cell phone.


In some cases, microphones are invisible. Before you say impossible, hear me out...

You are surrounded by items which can be commandeered for surveillance eavesdropping wherever you go. Solids and liquids conduct sound even better than air. Vibrations through these items may be picked up and amplified at some distance using: a piezoelectric contact microphone, a hydrophone, or light / sound beams (laser / ultrasonic).

Optimic1140 fiber optical microphone

There is also one esoteric microphone to consider—the fiber optic microphone. No wires. No electricity. Just connected to a clear glass thread.

It is so unusual, many people who claim to be technical surveillance countermeasures (TSCM) technicians don't know it exists.

So, when you add Technical Information Security Surveys to your organization's security program, ask the vendor what they know about fiber optic microphones. Good ones will tell you all about it, and how it works. They will also be impressed with you for asking.

Click here for more questions we get.

U.S. Embassy in China Sends Alert About Mystery Health Issue

The U.S. Embassy in China sent its second alert in two weeks Friday to its citizens over unexplained health issues that have prompted the evacuation of a number of U.S. government employees working at a consulate in a southern city...

The incidents have raised fears the unexplained issues that started in Cuba in 2016 have expanded to other countries. China says it has uncovered no information that could point to a cause...

Friday's alert called for people to be attentive of symptoms including "dizziness, headaches, tinnitus, fatigue, cognitive issues, visual problems, ear complaints and hearing loss, and difficulty sleeping." It urged them "not to attempt to locate the source of any unidentified auditory sensation. Instead, move to a different location." more

Two theories. One solution.

A new theory.
Attackers can cause potentially harmful hard drive and operating system crashes by playing sounds...

The attacks use sonic and ultrasonic sounds to disrupt magnetic HDDs as they read or write data. The researchers showed how the technique could stop some video-surveillance systems from recording live streams. Just 12 seconds of specially designed acoustic interference was all it took to cause video loss in a 720p system made by Ezviz. Sounds that lasted for 105 seconds or more caused the stock Western Digital 3.5 HDD in the device to stop recording altogether until it was rebooted.

The Latest Spy Trick - Infecting Computers... using sound!

Abstract of the Abstract—No network, no wireless, no access, no problem. If the computer has a microphone and speaker, you can sweet talk it into letting you have your way with it.

Abstract—Covert channels can be used to circumvent system and network policies by establishing communications that have not been considered in the design of the computing system. We construct a covert channel between different computing systems that utilizes audio modulation/demodulation to exchange data between the computing systems over the air medium. The underlying network stack is based on a communication system that was originally designed for robust underwater communication. We adapt the communication system to implement covert and stealthy communications by utilizing the near ultrasonic frequency range. We further demonstrate how the scenario of covert acoustical communication over the air medium can be extended to multi-hop communications and even to wireless mesh networks. A covert acoustical mesh network can be conceived as a botnet or malnet that is accessible via nearfield audio communications. Different applications of covert acoustical mesh networks are presented, including the use for remote keylogging over multiple hops. It is shown that the concept of a covert acoustical mesh network renders many conventional security concepts useless, as acoustical communications are usually not considered. Finally, countermeasures against covert acoustical mesh networks are discussed, including the use of lowpass filtering in computing systems and a host-based intrusion detection system for analyzing audio input and output in order to detect any irregularities. (the full paper)

The K5 Security Robot - aka Robopanopticop, or R-2 D-brief

Knightscope officials envision its K5 system playing a role in community policing...

“Knightscope’s autonomous technology platform is a fusion of robotics, predictive analytics and collaborative social engagement utilized to predict and prevent crime,” the company states on its website. That means that in addition to sophisticated intelligence, surveillance and reconnaissance capabilities, the K5 is equipped with analytics enabling it to detect threats to people or property and summon police.

• Able to scan an area in 270-degree sweeps to photographically map it. 
• Four mid-mounted cameras can scan up to 1,500 license plates per minute
• 5-foot high, 300-lb.
• Equipped with optical character recognition, omnidirectional imaging, thermal imaging, microphones, air quality sensors, ultrasonic and infrared sensors, radar for determining the range, altitude, direction or speed of objects and lidar technology for measuring distance to an object. (more)

Book Review: “Cell Phone Investigations” by Aaron Edens

Until now, if you wanted to learn all about cell phone investigations you would be cobbling together knowledge in scavenger hunt fashion. Your trek might include:

• seminars, given by a few universities and forensic software vendors; 
• technical law enforcement newsgroups where tips are swapped; 
• articles and white papers ferreted out on a topic by topic basis;
• and a lot of personal trial and error.

Times have changed.

All the basics one needs to know is clearly laid out in this book. Each chapter is packed with many interesting sub-chapters like: caller ID spoofing, cell site dumps, storing and preserving evidence. The Table of Contents shows the important bases covered…

• Chapter 1: Search Warrants
• Chapter 2: Phone Records
• Chapter 3: Tools for Examining Records
• Chapter 4: Cell Towers and Cell Sites
• Chapter 5: Cell Phone Forensics
• Chapter 6: Digital Evidence
• Chapter 7: Types of Examinations
• Chapter 8: Using Cell Phone Forensics
• Chapter 9: Locked Devices
• Chapter 10: iPhone Backup Files
• Chapter 11: Sample Search Warrants
• Templates
• Appendix

Law enforcement investigators will particularly appreciate Mr. Edens’ street tips. 

Example 1: Arresting officers need training when it comes to electronic evidence collection. If 12 gang members are arrested you are likely to get a bag o’ phones without knowing which suspect owns what phone. “Without a doubt if they had seized 12 firearms the process would have been completely different. The firearms would have been photographed in place to precisely document the location at which they were found, and to establish dominion and control.”

Example 2: The five errors law enforcement officers make when using cell site information. Most of these apply to private investigators and attorneys as well. “Investigators will commonly refer to the cell phone and the target of the investigation interchangeably. I strongly recommend you avoid this dangerous habit,” and goes on to explain the important reason why.

Strip away the some of the law enforcement only information and you have an excellent book for the private sector with fascinating CSI tidbits tossed in. Say the phone you want to examine is soaked in blood or some other yuck biohazard. What can / should you do? Hint, don’t try cleaning it with soap, water and your electric toothbrush. Nah, I’m sure you knew better about the toothbrush. Try alcohol in an ultrasonic tub instead.

New devices like smart watches, and breadcrumbs from the Internet-of-things, are bringing new opportunities and challenges continually. Updates and revised editions of this book are to be expected, and a companion web page with late breaking news would be a welcome addition.

Having all the information in one place has been accomplished very well. Transferring the knowledge to the reader – easily – will take a little more finesse.

In its current form, Cell Phone Investigations is a tiring read. Some basic visual communications tenets were overlooked. Lines of type stretch across 6.5 inches of an 8.5 inch page, averaging about 113 characters per line. This makes focusing difficult. To compound the visual felony the text is entirely sans-serif type, making reading even more challenging. The solution for future editions is simple. Use two columns per page, with no more than 55-65 characters (including spaces) per line. Use serif type for the text. Save the sans-serif type for titles and headlines. These typographical shortcomings should not deter you from this edition, however. Just expect you won’t be reading this cover to cover in one sitting.

“Cell Phone Investigations” (238 pages) is perfect for law enforcement, attorneys, and students entering either field. If it was written only for private investigators, security directors and people who deal with the public answering questions about cell phones, it would just be fewer pages. In the end, all groups get the education they need in an accurate, well written, well organized manner, with illustrations and charts appropriately sprinkled throughout. ~Kevin

FutureWatch: Preventing Microphones from Capturing a Target Speaker’s Voice

Over the decades, there have been many attempts at preventing electronic eavesdropping. The most popular methods employ "white noise" sound masking and ultrasonic jamming. These techniques are aimed at nullifying microphones. While these techniques have their pros and cons, they all share one trait. They target all sounds to all microphones in the area. Not helpful if only one person desires privacy while allowing others to continue communicating using their smartphones, Internet-of Things devices, or hearing aids.

The Department of Computer Science and Engineering, Michigan State University is working on a solution...

We propose NEC (Neural Enhanced Cancellation), a defense mechanism, which prevents unauthorized microphones from capturing a target speaker’s voice. Compared with the existing scrambling-based audio cancellation approaches, NEC can selectively remove a target speaker’s voice from a mixed speech without causing interference to others. ...The results show that NEC effectively mutes the target speaker at a microphone without interfering with other users’ normal conversations. more

TSCM Nerd Corner News

• U.S. Army scientists at the CCDC Army Research Laboratory (ARL) have developed a first-of-its kind antenna that could change how ground vehicles and airborne systems communicate, transmit and receive radio frequency signals. The Army used a manufacturing process based on a special class of engineered materials known as metaferrites to make an ultra-thin wideband antenna. The antenna conforms to curved surfaces, making it ideal to integrate into unmanned aircraft systems, rotary wing aircrafts and ground vehicles. more
  
  
• Of ever-increasing concern for operating a tactical communications network is the possibility that a sophisticated adversary may detect friendly transmissions. Army researchers developed an analysis framework that enables the rigorous study of the detectability of ultraviolet communication systems... In particular, ultraviolet communication has unique propagation characteristics that not only allow for a novel non-line-of-sight optical link, but also imply that the transmissions may be harder for an adversary to detect. more
  
  
• Covert Ultrasonic Transmissions between Two Air-Gapped Computers using Speaker-to-Speaker Communication more
  
  
• Groundbreaking new material 'could allow artificial intelligence to merge with the human brain' more

Eavesdropping & Anti-Eavesdropping Apps

Two new apps to be aware of…

The iEavesdrop app redirects internal microphone, external wired microphone or line input input audio to any Bluetooth audio device such as AirPods so that you can use your phone as a stealth listening device.

Using the correct line input cables, audio from any device such as an external microphone, in-flight entertainment or portable gaming device can be routed to your AirPods or other Bluetooth device. iEavesdrop will work with all iOS devices.

THIS APP CAN ALSO BE USED FOR MANY OTHER PURPOSES SUCH AS A BABY MONITOR, HEARING AID OR ANY OTHER APPLICATION THAT REQUIRES YOU TO LISTEN IN OR ROUTE MICROPHONE AUDIO TO A BLUETOOTH DEVICE.
(iOS)

———


(ANDROID)

About this app...
Ever thought someone might eavesdrop through your smart phone? Skewy is a privacy protection method, which is more than just a software setting. With Skewy you can mask your conversation with a simple – yet effective method. Simply making the audio data picked up by your phone unusable. Additionally, Skewy can detect ultrasonic signals to indicate the presence of device tracking technologies.