Eavesdropping App Lawsuit Allowed to Proceed

A federal judge denied the Golden State Warriors’ motion to dismiss an amended lawsuit 
alleging that the NBA champions recorded private conversations through their mobile app.

Jeffrey White, a judge for the Northern District of California, originally dismissed the class action complaint, which was filed by New York resident LaTisha Satchell last year, but ruled recently that the revised suit can proceed against the Warriors and beacon-technology company Signal360 for a possible violation of the Wiretap Act. more

DIY PI - What could possibly go wrong?

PI - Two school employees in Monroe County could face wiretapping charges.

A grand jury is recommending charges against Joshua Krebs and Alex Sterenchok.

Krebs is the supervisor of support staff and Sterenchok is the technology supervisor for the Pleasant Valley School District.

Both are accused of setting up a camera in April of 2016 in a break room at Pleasant Valley Elementary School to see if they could catch a janitor not doing his job.
Teachers and other staff members argue their privacy was being violated. more

After Seven Years of Hacking an Indictment - Will it Make a Difference?

Federal prosecutors indicted three Chinese nationals last week. It accusing them of hacking over the past seven years into at least three multinational corporations.

Taylor Armerding reported this is for nakedsecurity.sophos.com last week and was kind enough to ask my opinion for background.

---

China warned it would retaliate if the US pressed the issue. And that was pretty much that.

Which is the way Kevin Murray, director at Murray Associates, a counter espionage consultancy, sees this case playing out. Does the indictment mean anything significant will happen? “No,” he said, offering a brief history lesson.

Go back 1,000 years, remembering that the Chinese invented things like silk, gunpowder, paper. All this intellectual property was stolen from them. At that time, the law in China was that if you engaged in it, that was your life. But it still got stolen. So now they’re getting back at us. And we’re trying to replicate what they did by punishing the criminal. Is it going to help? No.

Murray said if those responsible for protecting IP faced charges, “then you’d see some changes.” more

When Do People Use Keystroke Loggers Legally

According to PInow.com...

• Employers monitoring of company computers used by employees to ensure they are working as required and to prevent fraud and other criminal activities.

• Parents monitoring the use of computers for children below 18 years.

• Companies monitoring use of company resources like internet.

• Collection of forensic evidence from the computers being monitored for security reasons with a legitimate investigation cause. more

Intelligence Bureau to Soldiers – Delete These Apps

India - In a fresh advisory issued to the troops posted at the international border, the Intelligence Bureau (IB) has warned that China could be collecting vital information about the Indian security installations through its popular mobile phone apps and devices...

The IB advisory contains a list of about 42 popular Chinese apps, including: WeChat, Truecaller, Weibo, UC Browser and UC News, which pose a grave threat to India's security. more

Serious Mac Security Flaw - Simple Temporary Fix

A serious security flaw in mac OS High Sierra has been discovered.

It allows anyone to access high level security areas on an iMac or MacBook without the need for a password.

Apple has warned Mac users after a serious macOS High Sierra root bug was discovered and ahead of a fix being released you can take these steps to protect your iMac and MacBook immediately.

Apple said: “We are working on a software update to address this issue." In the meantime, setting a root password prevents unauthorized access to your Mac.

• To enable the Root User and set a password, please follow the instructions here. 

If a Root User is already enabled, to ensure a blank password is not set, please follow the instructions from the ‘Change the root password’ section. more

UPDATE — THE FIX IS IN
Apple issues the software update. more

Industrial Espionage – Uber Spy Team – Former CIA Agents

A former Uber security manager says an espionage team inside the ride-hailing service used former CIA agents to help the company spy on its rivals overseas.

The testimony in a San Francisco courtroom Tuesday comes amid revelations that federal prosecutors are investigating allegations that Uber deployed an espionage team to plunder trade secrets from its rivals. That has triggered a delay in a high-profile federal trial over whether the beleaguered ride-hailing service stole self-driving car technology from a Google spinoff.

Under questioning, Richard Jacobs, Uber's manager of global intelligence, said that Uber hired several contractors that employed former CIA agents to help the ride-hailing service infiltrate its rivals' computers. Jacobs said the surveillance occurred overseas. more

Netflix Documentary - The Motel Owner Who Spied on Guests

 But first... A bit of history.

A pair of filmmakers thought they’d be capturing celebrated writer Gay Talese taking a literary victory lap in their new documentary. Instead, they got something more like a journalistic car crash.

In the intriguing and thoughtful “Voyeur,” Myles Kane and Josh Koury explore the 30-year relationship between Gerald Foos, a former Colorado motel owner who spied on his guests, and Talese, known for his novelistic profiles and bespoke suits.

The Netflix film, which debuts Friday, follows Talese as he reports and writes about his creepy friend for the 2016 book, “The Voyeur’s Motel,” only to see the story fall apart after publication when Foos’ account unravels...

Talese and Foos first connected in 1980 when the motel owner sent the journalist a letter hoping he would share his story of secretly watching guests for years through ceiling vents — in the interest of science, of course. more

Artifical Intelligence for Smartphones Catches Shoulder Surfers

Video Google researchers claim to have developed an "electronic screen protector" that can alert you when nosy parkers are looking over your shoulder at your phone.

Essentially, it's machine-learning-powered software that can use the front-facing camera on a smartphone to pick out faces, identify anyone who isn't the owner, and if they are gazing at the screen, alert the user that there's someone behind them snooping on their texts or web browsing, and so on, all in real time.

The Googlers' work on this technique – which appears to be just an academic project at this stage rather than an upcoming feature – will be presented at the Neural Information Processing Systems (NIPS) conference next week in California. more

Sony and a few other companies were working on this about seven years ago. (see the patent)

KRACK Attack Leaves WPA2 WiFi Encryption Hacked - Do this...

The video below explains Key Reinstallation Attacks (aka KRACK), for the technically curious. 

The short story is your communications privacy over WiFi is at risk. This includes your:

• emails, 
• texts,
• photos,
• log-in ID's and passwords, 
• credit card numbers, 
• and even your communications to websites which normally use https:// encryption. 

In short, anything you assume is encrypted is up for grabs.

Solutions

• Update your system software to the latest version. This includes all your devices which use WiFi.)
• Update software on WiFi appearance points (APs) which implement the standard 802.11r (a.k.a. Fast-BSS Transition). This affects business WiFi more than residential WiFi.
•  Upon connecting to a website make sure you see https:// and the locked symbol. 

Check here for additional information about KRACK solutions.

Risk Levels
Your risk of being a victim is highest whenever you use a public WiFi system. Risk is also high in densely populated areas.

Spy Plants, or Mr. Potato Head Goes to Washington

DARPA’s Biological Technologies Office (BTO) is hosting a Proposers Day to provide information to potential proposers on the objectives of the upcoming Advanced Plant Technologies program.

The program aims to control and direct plant physiology to detect chemical, biological, radiological, and/or nuclear threats, as well as electromagnetic signals.

Plant sensors developed under the program will sense specific stimuli and report these signals with a remotely recognized phenotype detectable by existing hardware platforms. more

The Proposers Day will be held on Tuesday, December 12, 2017, from 8:00 AM – 4:30 PM ET at the Westin Arlington Gateway Hotel, Arlington, VA 22203; potential proposers also have the option of participating via webcast. Advance registration is required. The registration deadline to attend in person is Wednesday, December 6, 2017, at 12:00 PM ET, and the deadline for the webcast is Monday, December 11, 2017, at 12:00 PM ET. Please register at: https://events.sa-meetings.com/APTProposersDay. There will be no on-site registration.

Extra Credit: Robot-Plant Biohybrids Growing in European Laboratories

Buy an App - Bug a Phone

Commercial spying apps for Android devices are being openly advertised on Google and – upon installation – can be used to snoop on text messages, calls and Facebook chats.

While they are advertised as a way for parents to keep track of their children, or businesses to watch employees, experts warn they could be used for more nefarious – potentially illegal – purposes. According to security firm Kaspersky Lab, the popularity of such services is spiking.

Now, there is often no need for the dark web or sophisticated hacking attacks – surveillance software can be quickly discovered with a simple Google search and purchased online for well under £100 ($133.00)...

One company, FlexiSpy, was even advertising 20% off its services for 2017's Black Friday. more

There is also an app to detect this.

EU: Spying Technology Export Control

EU lawmakers overwhelmingly backed plans on Thursday to control exports of devices to intercept mobile phone calls, hack computers or circumvent passwords that could be used by foreign states to suppress political opponents or activists...

The EU has felt that spyware or malware and telecom of Internet surveillance technologies are increasingly threatening security and human rights and proposed a modernization of its export control system to cover cyber-surveillance. more

Meanwhile, on Alibaba.

Netflix Spy Movies for the Holiday Weekend

Click for the trailers...

1. Spy Hard
2. The Spy Who Went Into the Cold
3. Tinker Tailor Soldier Spy
4. Inglourious Basterds
5. Burn After Reading
6. The Debt
7. XXX
8. and elsewhere for a few cents more one of my favorites... Top Secret. 

For some interesting real-life business espionage shorts, visit counterespionage.com/resources/movies.

Check Your Local Laws Before Recording

PA - A Franklin County jury took just seven minutes to return a guilty verdict against Chambersburg man William Alexander Himchak III on felony counts of illegal wiretapping. Himchak, 50, recorded two phone calls with tax officials, then posted them online, violating the wiretap act laws that require both people to consent to a recording before the recording has started. more

Spybuster Tip #105: In the United States, federal law requires that only one party to a conversation has to consent to the recording of the conversation. Some states, however, require two parties (meaning ALL parties) need to consent. Pennsylvania is a two party state. You can discover what the legal requirements are in your state here. 

If you are concerned your office is bugged visit counterespionage.com.