Joe Finder asks, "Who's Listening In?"

via Joe Finder - author who introduced the “private spy” — who finds out things powerful people want to keep hidden — in the New York Times bestselling novel VANISHED. 

Now, in BURIED SECRETS, Nick Heller returns, finding himself in the middle of a life-or-death situation that’s both high-profile and intensely personal.

"I found Kevin Murray’s website, Counterespionage.com, while doing research for VANISHED about surveillance techniques. Kevin’s spent more than 30 years helping corporations and individuals protect themselves from eavesdropping and information theft, and has even written a book on the subject: Is My Cell Phone Bugged? 

He’s answered a lot of questions for Nick Heller, and was kind enough to answer a few more for the newsletter." Read the interview with Kevin Murray.

'Cheaters' Spy Shop: TV Show Opens Online Store

via the Huffington Post... 
"Cheaters," a syndicated reality series that investigates cheating spouses and records the often-violent confrontations that ensue...now series creator Bobby Goldstein thinks he's found a better product for his corporate brand: A website that sells spy goods.

It's called Cheaters Spy Shop, and sells all sorts of surveillance gear for suspicious minds, including recovery sticks that can pull up anything currently on the iPhone and even recover deleted information; mobile software that will send a person all texts and pictures being sent, web history, call logs, and GPS location every 30 minutes; and even motion-activated hidden cameras that record any movement and activity in high resolution. "We also sell audio recorders that look like pens," Allen Watson, president of the Cheaters Spy Shop, told HuffPost Weird News... 

Meanwhile, Kevin D. Murray, who does eavesdropping audits and counterespionage consulting, says that the idea of doing your own investigation of a suspected cheat may sound appealing, but often causes more problems than it's worth.

"Private electronic eavesdropping and stalking is illegal on both a federal and state level," he told HuffPost Weird News. "Conducting electronic surveillance oneself can create far more problems than it solves. A person with a legitimate concern should hire a licensed private investigator to collect the facts. Do-it-yourselfers lack the experience and emotional detachment to conduct successful investigations."

Murray also thinks that, even if the Cheaters Spy Shop offers its share of disclaimers on the use of the product, they could still be risking legal problems.

"Any person who assists another with illegal electronic surveillance is equally guilty," said Murray, author of the e-book, Is My Cell Phone Bugged?. "For example, a guy might ask the guy at Radio Shack, 'How can I secretly record my wife?' and that guy might say, 'Just buy this voice-activated recorder and hide it under the dashboard of her car.'"

"When it hits the fan, guess who the lawyers come looking for? Big-pockets Radio Shack," he said. "There have also been similar cases where private investigators just dispense advice like this. They get prosecuted, and the spouse who actually did the bugging gets off due to 'matrimonial immunity.'"

Murray says modern electronic surveillance has been regulated by law since 1968, but due to benign neglect and more pressing crimes, enforcement is rare. However, he said that on a few occasions, when the marketplace has become a little too hot, there is enforcement.

"From what I see, the pot is about to boil over again. Look for laws about spyware on cell phones, and raids on 'spy shops' in 2012," he warned.

But while he thinks the Cheaters Spy Shop could be putting itself at risk, Murray doesn't seem that concerned. At the end of the interview, he hinted he may contact the shop about carrying his book.

"It's a yin-yang thing," he explained. (more)

Dilbert vs. The Recycling Bin

...which can lead to some crafty employee solutions to sensitive wastepaper security. 

This blue bin was discovered recently by Murray Associates information security consultants...

It's enough to straighten Dilbert's tie.

Spybusters Security Tip # 512: Never store confidential materials awaiting shredding in an unlocked container. If there is an on-going need to shred small amounts of materials daily, buy a deskside crosscut shredder... and be sure to use it.

Make "I'm taking back my privacy!" a News Years Resolution

Suppliers of the best-known anti-tracking tools — Ghostery, Adblock Plus and TrackerBlock — all reported big jumps in usage in the second half of 2011. Ghostery, for instance, is being downloaded by 140,000 new users each month, with total downloads doubling to 4.5 million in the past 12 months, says Scott Meyer, CEO of parent company Evidon. 

Meanwhile, the goal of newcomer Abine, supplier of Do Not Track Plus, is to make anti-tracking as common as anti-virus for personal computing devices, says CEO Bill Kerrigan, who formerly headed anti-virus giant McAfee's global consumer business.

Abine projects the number of Internet users in North America using anti-tracking tools and services will be 28.1 million by the end of 2012, up from 17.2 million today. "We want to drive the next level of adoption," Kerrigan says. "No one is suggesting don't use Facebook or Google. At the same time, we are suggesting there is a better way for consumers to experience those type of products without necessarily being tracked at every step they take in their digital life." (more)

Hacker Justifies Exposing Wireless Security Weakness. Wait... in 1903!

A century ago, one of the world’s first hackers used Morse code insults to disrupt a public demo of Marconi's wireless telegraph

LATE one June afternoon in 1903 a hush fell across an expectant audience in the Royal Institution's celebrated lecture theatre in London. Before the crowd, the physicist John Ambrose Fleming was adjusting arcane apparatus as he prepared to demonstrate an emerging technological wonder: a long-range wireless communication system developed by his boss, the Italian radio pioneer Guglielmo Marconi. The aim was to showcase publicly for the first time that Morse code messages could be sent wirelessly over long distances. Around 300 miles away, Marconi was preparing to send a signal to London from a clifftop station in Poldhu, Cornwall, UK.

Yet before the demonstration could begin, the apparatus in the lecture theatre began to tap out a message. At first, it spelled out just one word repeated over and over. Then it changed into a facetious poem accusing Marconi of "diddling the public". Their demonstration had been hacked...

The stream of invective ceased moments before Marconi's signals from Poldhu arrived. The demo continued, but the damage was done: if somebody could intrude on the wireless frequency in such a way, it was clearly nowhere near as secure as Marconi claimed. And it was likely that they could eavesdrop on supposedly private messages too. 

Fleming, fired off a fuming letter to The Times of London. He dubbed the hack "scientific hooliganism", and "an outrage against the traditions of the Royal Institution". He asked the newspaper's readers to help him find the culprit. 

He didn't have to wait long. Four days later a gleeful letter confessing to the hack was printed by The Times. The writer justified his actions on the grounds of the security holes it revealed for the public good. Its author was Nevil Maskelyne, a mustachioed 39-year-old British music hall magician. (more)

VoIP Phone Eavesdropping Prevention Tips

via Mike Chapple, Network Security

Every organization considering a Voice over Internet Protocol (VoIP) telephone system deployment hears the same dire warnings: “Routing voice calls over a data network exposes calls to eavesdropping.” 

While it’s certainly true that any telephone call carries a certain degree of eavesdropping risk, is it true that VoIP calls have an inherently higher degree of risk? In this tip, we explore the ins and outs of VoIP eavesdropping.

VoIP eavesdropping is possible
First, it’s important to be clear about one thing: It is absolutely possible to eavesdrop on a VoIP telephone call. It’s also possible to eavesdrop on a telephone call placed using the traditional public switched telephone network (PSTN). The difference lies in the tools and skill set needed to conduct the eavesdropping. (more)

Is encryption alone, the answer?

Eavesdrop on the boss to aid promotion chances? Probably not a good idea, especially if your boss is the police commissioner.

 S. Korea - On Wednesday a Cyber investigation team at Daejeon Metropolitan Police Agency sought a warrant for the arrest of “Jeong,” a 47-year-old superintendent at the same agency, on suspicion of secretly installing a recording program on the agency commissioner’s computer and recording his conversations and telephone calls.

Jeong is suspected of entering the commissioner’s office, on the seventh floor of the DMPA headquarters building, in the evening of December 14, installing recording and remote control software on a computer connected to an outside network and setting it up to automatically create recorded files, then using the computer in his own office to connect to that of the commissioner and downloading 320 files recorded up to December 17. “It appears that Jeong, who was promoted to the position of superintendent in 2006, did this in order to learn of the newly-appointed commissioner’s tendencies and personal relationships when Jeong became a candidate for promotion to senior superintendent next year.”

Police stated that, on December 16, the commissioner found it strange that his computer ran slower. He gave an order to his secretary’s office to inspect it. The main body of the computer was replaced, but Jeong entered the commissioner’s office again on the same evening and installed the remote control and other software again. (more)

Security Quote of the Day - Smartphones, the Next Target

“We’ve gotten to that perfect crossing point where all of the things which have prevented criminals from leaping into the wireless space have been eroded,” —Gareth Maclachlan, COO of security firm AdaptiveMobile

The bottom line: It’s now easier than ever for spammers to make money off wireless devices. 

Why the concern?

 “If I can infect your device by getting you to download an app, or push you to a link that cracks your phone and infects your OS, I can get your phone to make extra calls to a premium rate number which I own, or send an premium SMS or short code I’m renting through a shell company, and start taking money out of your pocket,” he says.

Criminal groups release malicious apps that get devices to send out calls and texts to premium numbers without the user’s knowledge. The charges may go unnoticed or a customer may contest the fees and the operator has to eat the charge, leaving the spammers with a neat profit. (more)

Security Tips from the book: Is My Cell Phone Bugged?

• Don't jailbreak your smartphone.

• Password protect your smartphone.

• Don't click on links sent by email spammers.

• Never loan your phone.

• Don't load an app unless you appsolutely need it, and know it is safe.

VoIP Phone Tap Taps

Tapping a VoIP phone line isn't difficult... via Janitha

Here's a quick background on what's going on. In 10/100 twisted pair ethernet networks, only two of the four pairs of wires are actually used for data transmission. From a computer's perspective, the orange pair is for RX and the green pair is for TX. The passive splice tap works by connecting a sniffer's RX to either the RX or TX of the wire being sniffed. By having two RX interfaces on the sniffer, you can capture full duplex traffic on the wire.

Recipe
Before starting, you will need the ingredients for a passive splice tap. Two punch down type 8P8C (aka RJ45) IDC connector jacks, A punch-down tool, Two regular pass-though ethernet cables, a sharp knife, clear tape, and an alibi. You also need a laptop to log the data with two ethernet interfaces (two usb to ethernet adapters will do the job). Now for the instructions.

First take the cable you want to tap and cut the casing long ways a few inches to expose the 4 pairs of wires inside. Isolate the green and the orange pair of twisted wires.



Next, take one of the jacks and find the orange and orange-white connectors (will look like two blades with a gap between). Put the jack perpendicular to the orange pair of wires. Now punch down the orange wire in to the orange connector, and the orange-white wire in to the orange-white connector. Take the another jack and repeat the process, but this time punch the green wire in to the orange connector, and the green-white in to the orange-white connector.



At this point, the tap it physically done. Yes, It's that simple. Now connect each of the jacks to the ethernet interfaces on the laptop using the two regular ethernet cables. The sniffer laptop will be like 'wtf mate' and fail at auto negotiating a link since only the RX wires are hooked up. So bring the two interfaces up manually in promiscuous mode (if in *nix, use ifconfig with the promisc switch).

Finally fire up wireshark or your favorite packet sniffer. If you are using wireshark, select capturing on the 'Any' interface as we want to capture data on both ethernet adapters at the same time. If the sniffer app does not have an 'any' interface, simply start two instances and capture the two interfaces separately. Further more, you can bond the two interfaces so you can treat the full-duplex as a single interface if you have that much free time.

Or, you can make one of these.

Why do I mention it?

Because I too often hear, "Can they really tap a digital phone?"

A Merry Christmas, Valentine - Good Work

UK - A Norfolk animal rights campaigner is taking turkey producer Bernard Matthews to court claiming she was harassed and intimidated by the company.

Wendy Valentine of Hillside Animal Sanctuary, Frettenham, also claims her car was "bugged" by security firm Richmond Day and Wilson Limited (RDW), which was working for the firm.

Bernard Matthews has confirmed its use of RDW but "emphatically denies" Ms Valentine's allegations.

Hillside Animal Sanctuary investigators went undercover at one of Bernard Matthews' turkey farms in 2006 and filmed two poultry workers using a bat to play baseball with the birds. Two people were later prosecuted...The following year, staff were again videoed abusing turkeys at Bernard Matthews, by undercover workers from Hillside.

A spokesperson for Hillside said: "We felt we had no option but to resort to legal proceedings after Hillside's founder, Wendy Valentine, had her car bugged with an electronic tracking device earlier this year." (more)

Business Espionage: 7 Million Dollar Man Sentenced for 7 Years

IN - An ex-Dow AgroSciences LLC researcher who stole trade secrets from his former employer to benefit a Chinese university was sentenced to seven years and three months in prison, prosecutors said.

Kexue Huang, 46, was sentenced yesterday by U.S. District Judge William T. Lawrence in Indianapolis, according to an e- mailed statement from U.S. Attorney Joseph Hogsett’s office.

Huang, a Chinese national, pleaded guilty in October to economic espionage. He also admitted to stealing trade secrets from the Minneapolis-based grain distributor Cargill Inc., the U.S. Justice Department said in October. Financial losses from his conduct exceed $7 million, the U.S. said. (more)

Walkie Talkie Law

The Honduran Congress has passed bills allowing authorities to wiretap the telephone conversations, emails and bank accounts of suspected criminals, and temporarily banning motorcycles from carrying passengers. (more)

"Whaaaadt?!... Hey, why don't you go see where you gotta go."

The CIA said Friday its internal watchdog found nothing wrong with the spy agency’s close partnership with the New York Police Department.

The agency’s inspector general concluded that no laws were broken and there was “no evidence that any part of the agency’s support to the NYPD constituted ‘domestic spying’,” CIA spokesperson Preston Golson said. (more)

"Al, we hardly knew you."

Russian Spy Chief Resigns

The chief of Russia’s military intelligence (GRU), Col. Gen. Alexander Shlyakhturov, resigned from his post on Saturday, the Kommersant business daily reported... Shlyakhturov has led the GRU since April 2009. The public knows nothing about General Shlyakhturov's biography and service record. Such tight secrecy implies that he is a career intelligence operative... The name of the future chief of Russia’s military intelligence is not known yet. (more)

"So, how often do journalists hack voicemail?"

Phone hacking appeared to be a "bog-standard tool" for information gathering, a former journalist for the Daily Mirror tabloid told the UK inquiry into media ethics overnight.

James Hipwell, who was jailed in 2006 for writing stories about companies in which he owned shares, told the Leveson Inquiry that phone hacking had taken place on a daily basis during his time at the paper.

He also threw doubt on former Mirror editor Piers Morgan's claim in evidence on Tuesday that he had no knowledge that hacking went on there.

"I would go as far as to say that it happened every day and that it became apparent that a great number of the Mirror's show business stories would come from that source. That is my clear memory," Hipwell said. (more)