Bored with classes?
Carnegie Mellon University and one of the government’s top spy agencies want to interest high school students in a game of computer hacking.
Their goal with “Toaster Wars” is to cultivate the nation’s next generation of cyber warriors in offensive and defensive strategies. The free, online “high school hacking competition” is scheduled to run from April 26 to May 6, and any U.S. student or team in grades six through 12 can apply and participate.
David Brumley, professor of computer science at Carnegie Mellon, said the game is designed to be fun and challenging, but he hopes participants come to see computer security as an excellent career choice. (more)
P.S. Registration is now open!
Saturday, March 16, 2013
Casino CCTV Commandeered in $32 Million Sting
Australia - Thieves have infiltrated Crown casino's surveillance system to pull off a $32 million sting.
A foreign high roller who was staying at Crown has been implicated in the rip-off, in which the venue's security cameras were used to spy for him.
(more) (as predicted)
(more) (as predicted)
Thursday, March 14, 2013
Spy Camera Glasses - Austin Powers is Thrilled
Question Mark & the Mysterians may sue...
from the manufacturer...
"Ankaka launches Innovative Spy Camera Glasses Espionage. The high tech spy gadget manufacturer Ankaka is back!
This time they bring people the Spy Camera Glasses espionage-spy-camera-sunglasses; Very stylish and comfortable to use, this latest make of high quality spy gadgets enables people to walk around with no worries as people spy on their subject..." (more) (video)
CUT!
Enough already. This insults the word covert. It's time to stop applying the word "spy" to everything. (grab your glasses and sing-a-long)
from the manufacturer..."Ankaka launches Innovative Spy Camera Glasses Espionage. The high tech spy gadget manufacturer Ankaka is back!
This time they bring people the Spy Camera Glasses espionage-spy-camera-sunglasses; Very stylish and comfortable to use, this latest make of high quality spy gadgets enables people to walk around with no worries as people spy on their subject..." (more) (video)
CUT!
Enough already. This insults the word covert. It's time to stop applying the word "spy" to everything. (grab your glasses and sing-a-long)
Chinese Launch Espionage Investigation Against Coca-Cola
Chinese authorities have opened an espionage investigation against Coca-Cola Co. for allegedly making illegal maps of restricted areas in China, according to a South China Morning Post report Thursday.
"What we can say for now is that many subsidiaries of Coca-Cola are involved and this happens in many provinces," the report quoted an unidentified Chinese official as saying, adding that the Ministry of State Security was involved in the probe.
Among the issues was the use of hand-held GPS devices to collect sensitive geographic information in Yunnan province, the report said.
It quoted a Coca-Cola statement Wednesday as saying the company was "cooperating fully" with the investigation, and that GPS devices involved used "digital map and customer logistic systems commercially available in China." (more)
How to keep dragons at bay... (click)
Among the issues was the use of hand-held GPS devices to collect sensitive geographic information in Yunnan province, the report said.
It quoted a Coca-Cola statement Wednesday as saying the company was "cooperating fully" with the investigation, and that GPS devices involved used "digital map and customer logistic systems commercially available in China." (more)
How to keep dragons at bay... (click)
Pwn Pad - Use it IT, Before it is used against IT
The folks at security tools company Pwnie Express
have built a tablet that can bash the heck out of corporate networks. - Wired Magazine
The Pwn Pad - a commercial grade penetration testing tablet which provides professionals an unprecedented ease of use in evaluating wired and wireless networks.
The sleek form factor of the Pwn Pad makes it an ideal product choice when on the road or conducting a company or agency walk-through. This highspeed, lightweight device, featuring extended battery life and 7” of screen real estate offers pentesters an alternative never known before. (more)
TOOLKIT INCLUDES:
Wireless Tools
Aircrack-ng
Kismet
Wifite-2
Reaver
MDK3
EAPeak
Asleap-2.2
FreeRADIUS-WPE
Hostapd
Bluetooth Tools:
bluez-utils
btscanner
bluelog
Ubertooth tools Web Tools
Nikto
Wa3f Network Tools
NET-SNMP
Nmap
Netcat
Cryptcat
Hping3
Macchanger
Tcpdump
Tshark
Ngrep
Dsniff
Ettercap-ng 7.5.3
SSLstrip v9
Hamster and Ferret
Metasploit 4
SET
Easy-Creds v3.7.3
John (JTR)
Hydra
Medusa 2.1.1
Pyrit
Scapy
The Pwn Pad - a commercial grade penetration testing tablet which provides professionals an unprecedented ease of use in evaluating wired and wireless networks.The sleek form factor of the Pwn Pad makes it an ideal product choice when on the road or conducting a company or agency walk-through. This highspeed, lightweight device, featuring extended battery life and 7” of screen real estate offers pentesters an alternative never known before. (more)
TOOLKIT INCLUDES:
Wireless Tools
Aircrack-ng
Kismet
Wifite-2
Reaver
MDK3
EAPeak
Asleap-2.2
FreeRADIUS-WPE
Hostapd
Bluetooth Tools:
bluez-utils
btscanner
bluelog
Ubertooth tools Web Tools
Nikto
Wa3f Network Tools
NET-SNMP
Nmap
Netcat
Cryptcat
Hping3
Macchanger
Tcpdump
Tshark
Ngrep
Dsniff
Ettercap-ng 7.5.3
SSLstrip v9
Hamster and Ferret
Metasploit 4
SET
Easy-Creds v3.7.3
John (JTR)
Hydra
Medusa 2.1.1
Pyrit
Scapy
The Return of the Invisible Anythings
"We propose a method for removing marked dynamic objects from videos captured with a free-moving camera, so long as the objects occlude parts of the scene with a static background." Max Planck Institute for Informatics (more)
Political propaganda videos will never look the same...
(Supplementary video. Takes time to load.)
Political propaganda videos will never look the same...
(Supplementary video. Takes time to load.)
Wednesday, March 13, 2013
The Ratters - men who spy on women through their webcams
The woman is visible from thousands of miles away on a hacker's computer.
The hacker has infected her machine with a remote administration tool (RAT) that gives him access to the woman's screen, to her webcam, to her files, to her microphone. He watches her and the baby through a small control window open on his Windows PC, then he decides to have a little fun...
Women who have this done to them, especially when the spying escalates into blackmail, report feeling paranoia. One woman targeted by the California "sextortionist" Luis Mijangos wouldn't leave her dorm room for a week after Mijangos turned her laptop into a sophisticated bugging device. Mijangos began taunting her with information gleaned from offline conversations...
For many ratters, though, the spying remains little more than a game. It might be an odd hobby, but it's apparently no big deal to invade someone's machine, rifle through the personal files, and watch them silently from behind their own screens. "Most of my slaves are boring," wrote one aspiring ratter... (more) (sing-a-long)
That's "old news".
The story really begins here...
The hack follows the path of most hacks. It started as a challenge, became video voyeurism, and evolved into blackmail. Hackers eventually smell money in their hacks.
While you read about "ratters" today, today's hacker-criminals are sniffing in deep pockets - businesses. Eavesdropping on corporate meetings and watching executive computer screens makes more sense financially. Next year the media will be printing stories about that. Meanwhile, you have them scooped.
Q. So, why don't we notice?
A. “The more cameras we see in our environment, the less we see them.”
When electronic cameras were new, you noticed them. Now they are everywhere. You pay no attention. The same is true with microphones. The weird logic continues... If one isn't noticing cameras and microphones, one tends to either think they don't exist, or are not being manipulated as surveillance devices.
Many business executives know better. They know the reality of business espionage and electronic surveillance. Their mental Achilles Heel... If you don't see where your stolen conversations, strategies, ideas, etc. are going, well they are probably not going anywhere. Think of that the next time you go car shopping, and they all look like Tesla's... or vice versa. Then, call me.
The hacker has infected her machine with a remote administration tool (RAT) that gives him access to the woman's screen, to her webcam, to her files, to her microphone. He watches her and the baby through a small control window open on his Windows PC, then he decides to have a little fun...Women who have this done to them, especially when the spying escalates into blackmail, report feeling paranoia. One woman targeted by the California "sextortionist" Luis Mijangos wouldn't leave her dorm room for a week after Mijangos turned her laptop into a sophisticated bugging device. Mijangos began taunting her with information gleaned from offline conversations...
For many ratters, though, the spying remains little more than a game. It might be an odd hobby, but it's apparently no big deal to invade someone's machine, rifle through the personal files, and watch them silently from behind their own screens. "Most of my slaves are boring," wrote one aspiring ratter... (more) (sing-a-long)
That's "old news".
The story really begins here...
The hack follows the path of most hacks. It started as a challenge, became video voyeurism, and evolved into blackmail. Hackers eventually smell money in their hacks.
While you read about "ratters" today, today's hacker-criminals are sniffing in deep pockets - businesses. Eavesdropping on corporate meetings and watching executive computer screens makes more sense financially. Next year the media will be printing stories about that. Meanwhile, you have them scooped.
Q. So, why don't we notice?
A. “The more cameras we see in our environment, the less we see them.”
When electronic cameras were new, you noticed them. Now they are everywhere. You pay no attention. The same is true with microphones. The weird logic continues... If one isn't noticing cameras and microphones, one tends to either think they don't exist, or are not being manipulated as surveillance devices.
Many business executives know better. They know the reality of business espionage and electronic surveillance. Their mental Achilles Heel... If you don't see where your stolen conversations, strategies, ideas, etc. are going, well they are probably not going anywhere. Think of that the next time you go car shopping, and they all look like Tesla's... or vice versa. Then, call me.
Wiretapping - Silvio Berlusconi Sentenced to One Year in Prison... or not!
Former Italian Prime Minister Silvio Berlusconi was convicted in a wiretapping case in Milan Thursday and sentenced to a year in jail.
The wiretapping charge — related to the 2006 battle for control of a major Italian bank — is one of three corruption rulings the hard-partying Berlusconi faces this month.
A Milan court is also set to rule on charges he engaged a minor in prostitution, and an appeals tribunal will decide whether to uphold a four-year sentence for tax fraud. (more)
Or nots...
• Berlusconi is unlikely to serve jail time - Italian law doesn’t require prison sentences to be carried out until the appeals process exhausted, which can take several years.
• Berlusconi could become Prime Minister again.
The wiretapping charge — related to the 2006 battle for control of a major Italian bank — is one of three corruption rulings the hard-partying Berlusconi faces this month.
A Milan court is also set to rule on charges he engaged a minor in prostitution, and an appeals tribunal will decide whether to uphold a four-year sentence for tax fraud. (more)Or nots...
• Berlusconi is unlikely to serve jail time - Italian law doesn’t require prison sentences to be carried out until the appeals process exhausted, which can take several years.
• Berlusconi could become Prime Minister again.
Monday, March 11, 2013
Employee Bugs Boss - True Story
"Employee hid a recording device in supervisor's office. In addition, without authorization, Employee made copies of supervisor's negative comments about Employee that Employee located by conducting an unauthorized search of the supervisor's office and briefcase. Employee provided the notes to lawyer in support of lawsuit against supervisor. Finally, Employee lied to investigators during the course of the administrative inquiry."
Think this can't happen to you?
Think again.
This case comes from the files of the FBI.
Why?
It was their employee. (more)
P.S. This report was labeled "NOT FOR PUBLIC DISSEMINATION" (oops, again)
Think this can't happen to you?
Think again.
This case comes from the files of the FBI.
Why?
It was their employee. (more)
P.S. This report was labeled "NOT FOR PUBLIC DISSEMINATION" (oops, again)
 |
| Click to enlarge. |
Vatican Bugs
Last Month - An Italian news magazine, Panorama, claimed that Vatican authorities had conducted, and are still conducting, an extensive covert surveillance programme, tapping the phone calls and intercepting the emails of cardinals and bishops in the Curia, the governing body of the Catholic Church. (more)
This Month - The Vatican has gone high tech to prevent leaks like in 2005 when German media outlets were able to report that Joseph Ratzinger was going to be elected as Pope. A Faraday cage is being put in place to jam any signals. A Faraday cage is a mesh structure used to block outside electrical fields. For the Vatican, the usage of the Faraday cage will cause the Sistine Chapel to become a “dead zone,” preventing any cell phones from getting service. (more)
Prior to the vote, Vatican officials will sweep the chapel and the guesthouse that houses the cardinals with anti-bugging scanners to detect any hidden microphones. (more)
...and what are you doing to protect your business secrets? (more)
This Month - The Vatican has gone high tech to prevent leaks like in 2005 when German media outlets were able to report that Joseph Ratzinger was going to be elected as Pope. A Faraday cage is being put in place to jam any signals. A Faraday cage is a mesh structure used to block outside electrical fields. For the Vatican, the usage of the Faraday cage will cause the Sistine Chapel to become a “dead zone,” preventing any cell phones from getting service. (more)
Prior to the vote, Vatican officials will sweep the chapel and the guesthouse that houses the cardinals with anti-bugging scanners to detect any hidden microphones. (more)
...and what are you doing to protect your business secrets? (more)
Perkele - Android Malware Swipes SMS Messages
via Kreb's on Security...
An explosion in malware targeting Android users is being fueled in part by a budding market for mobile malcode creation kits, as well as a brisk market for hijacked or fraudulent developer accounts at Google Play that can be used to disguise malware as legitimate apps for sale...
Unsurprisingly, this particular entrepreneur also sells an Android SMS malware package that targets customers of Citibank, HSBC and ING, as well as 66 other financial institutions in Australia, France, India, Italy, Germany, New Zealand, Singapore, Spain, Switzerland and Turkey (the complete list is here). The targeted banks offer text messages as a form of multi-factor authentication, and this bot is designed to intercept all incoming SMS messages on infected Android phones.
This bot kit — dubbed “Perkele” by a malcoder who goes by the same nickname (‘perkele’ is a Finnish curse word for “devil” or “damn”) — does not appear to be terribly diabolical or sophisticated as modern mobile malware goes. Still, judging from the number and reputation of forum buyers who endorsed Perkele’s malware, it appears quite popular and to perform as advertised. (more)
Tip: Before downloading an app, check out the name of the app developer. If it's a name you aren't familiar with, do a quick Web search for either the developer's name or the name of the app. Anything questionable about the developer or the application should come up. (more)
An explosion in malware targeting Android users is being fueled in part by a budding market for mobile malcode creation kits, as well as a brisk market for hijacked or fraudulent developer accounts at Google Play that can be used to disguise malware as legitimate apps for sale...
This bot kit — dubbed “Perkele” by a malcoder who goes by the same nickname (‘perkele’ is a Finnish curse word for “devil” or “damn”) — does not appear to be terribly diabolical or sophisticated as modern mobile malware goes. Still, judging from the number and reputation of forum buyers who endorsed Perkele’s malware, it appears quite popular and to perform as advertised. (more)
Tip: Before downloading an app, check out the name of the app developer. If it's a name you aren't familiar with, do a quick Web search for either the developer's name or the name of the app. Anything questionable about the developer or the application should come up. (more)
Super Secure Cell Phone
CryptoPhone 500 is a new configurable secure cell phone. Protection is based on...
• End-to-end voice and message encryption: Secure end-to-end encrypted messaging and voice over IP. Works on any network, including 2G GSM, 3G/UMTS, and Wireless LAN.
• Hardened operating system: It is the first mobile phone featuring GSMK's secure Android operating system, built from source code with granular security management. Permission enforcement module controls access to networks, data and sensors (camera, microphone, etc.).
• Baseband firewall: Protection against over-the-air attacks. Constant monitoring of baseband processor activity, baseband attack detection, and automated initiation of countermeasures.
• Encrypted storage system: Protects data at rest against unauthorized access.
The CryptoPhone 500 becomes commercially available by end of April. (more)
 |
| Click to enlarge. |
• Hardened operating system: It is the first mobile phone featuring GSMK's secure Android operating system, built from source code with granular security management. Permission enforcement module controls access to networks, data and sensors (camera, microphone, etc.).
• Baseband firewall: Protection against over-the-air attacks. Constant monitoring of baseband processor activity, baseband attack detection, and automated initiation of countermeasures.
• Encrypted storage system: Protects data at rest against unauthorized access.
The CryptoPhone 500 becomes commercially available by end of April. (more)
Barney Google 2013
Google Glass is the company's upcoming product that puts a computer on your face. Google is about to release the dorky-looking device and most likely it will be snapped up by the techie crowd. It is an innovative product that pushes live-blogging to the next level, and that will unleash a storm of concern never before seen caused by a mobile gadget. ...
Rightly or wrongly there's already a concern about folks taking photos and videos in certain public locations and situations. Pull out a camera in places like public schools, playgrounds, and airports and you might incur the wrath of authorities and parents, especially where public safety of kids are concerned.
When public awareness of Google Glass reaches a critical mass and it's understood that these devices can record photos, video, and audio of the wearer's surroundings, an outbreak of bans is sure to result. Don't be surprised if within weeks of the Google Glasses general release we start seeing bans of it cropping up all over the place.
These bans are not going to be the result of Google Glass wearers actually using them, they are going to be a result over the concern that they can be used discretely. (more)
When public awareness of Google Glass reaches a critical mass and it's understood that these devices can record photos, video, and audio of the wearer's surroundings, an outbreak of bans is sure to result. Don't be surprised if within weeks of the Google Glasses general release we start seeing bans of it cropping up all over the place.
Friday, February 22, 2013
Security Scrapbook Reader's Question - Spy School
Q. "I really enjoy your articles. Let me ask you: Would a spy school go over here in the U.S.?"
A. It probably would. There are plenty of people - from kiddies to Mitty's - who think spying is cool, albeit illegal. Training is probably not illegal, just implementing the skills.
I educate my clients on spying techniques, just so they know what to look out for. Being aware helps them protect themselves against spying.
Come to think of it, we are one of the very few countries whose government spy agencies do not support the private sector with the business intel they collect. Perhaps there is a spy school niche market, to help us level the international economic playing field. Hummm... Just don't have your Bonds reporting to HR or Facilities, like the security departments I see in some corporations.
Examples of spy schools, games and books...
http://www.jamesbondlifestyle.com/news/bond-experience-launches-november-7th
http://thebondexperience.com
http://www.spymuseum.org/education-programs/
http://www.stilettospyschool.com/newyork.php
http://www.mi6academy.com/newyork.php
http://www.spyschool.com/
http://www.beyondweird.com/survival/sschools.html
http://www.fxnetworks.com/archer/spyschool (game for kids)
Spy School (book for kids)
Another Spy School (book for kids)
So You Want to Be A Spy (book for kids)
So you want to be an industrial spy? (rare, out of print)
The Complete Idiot's Guide to the CIA (book)
Spy's Secret Handbook (Project X Top Secret) (book for kids)
It's True! This Book is Bugged (book for kids)
How to be a Spy: The World War II SOE Training Manual
The Spycraft Manual: The Insider's Guide to Espionage Techniques
The Official CIA Manual of Trickery and Deception
The Spy's Handbook: Learn How To Spy On Anyone At Anytime Without Getting Caught By Using Spy Gadgets And Other...
A. It probably would. There are plenty of people - from kiddies to Mitty's - who think spying is cool, albeit illegal. Training is probably not illegal, just implementing the skills.
I educate my clients on spying techniques, just so they know what to look out for. Being aware helps them protect themselves against spying.
Come to think of it, we are one of the very few countries whose government spy agencies do not support the private sector with the business intel they collect. Perhaps there is a spy school niche market, to help us level the international economic playing field. Hummm... Just don't have your Bonds reporting to HR or Facilities, like the security departments I see in some corporations.
Examples of spy schools, games and books...
http://www.jamesbondlifestyle.com/news/bond-experience-launches-november-7th
http://thebondexperience.com
http://www.spymuseum.org/education-programs/
http://www.stilettospyschool.com/newyork.php
http://www.mi6academy.com/newyork.php
http://www.spyschool.com/
http://www.beyondweird.com/survival/sschools.html
http://www.fxnetworks.com/archer/spyschool (game for kids)
Spy School (book for kids)
Another Spy School (book for kids)
So You Want to Be A Spy (book for kids)
So you want to be an industrial spy? (rare, out of print)
The Complete Idiot's Guide to the CIA (book)
Spy's Secret Handbook (Project X Top Secret) (book for kids)
It's True! This Book is Bugged (book for kids)
How to be a Spy: The World War II SOE Training Manual
The Spycraft Manual: The Insider's Guide to Espionage Techniques
The Official CIA Manual of Trickery and Deception
The Spy's Handbook: Learn How To Spy On Anyone At Anytime Without Getting Caught By Using Spy Gadgets And Other...
Subscribe to:
Posts (Atom)