Spying is Turning Us into a Stalking Society

Bugging and GPS-tracking used to be so expensive that they were only used by governments and private investigators, but a quick Amazon search offers up a hidden car-tracking device for US$27 (£19).

In the related items: a spy cam disguised as a USB charger, $52. These items are marketed as a “real-time teen-driving coach”, nanny cams or parental control software, but there is nothing to stop them being used for nefarious purposes.

Meanwhile, law enforcement struggles to keep up: victims of stalking or online harassment are frequently told simply to stop going online, which for a 19-year-old in 2018 is like being told not to breathe air.

As the National Stalking Helpline’s manager, Clare Elcombe Webber, points out, it feels like there are near-infinite technologies to help stalkers but few to help victims. more

Quote of the Week

“If you're a company doing business with other countries, you can expect that you're being hacked – because they want to know your negotiating position,” Charles Widdis, Security Strategy and Planning Manager at CitiPower and Powercor

Number Stations, Spies... and The Sultans of Swing (?!?!)

Numbers stations: The 'spy radio' that anyone can hear...

For decades, people around the globe have been able to listen in to mysterious spy broadcasts from all over the world with just a radio.

Gordon Corera has been investigating the strange world of number stations. more

The Next Generation of Corporate Spies Begins Training in May

The trailer for a career in spying used to come from movies and TV shows. In May 2018, it will come from gaming. The new game is called Assault Spy.

"The self-proclaimed elite corporate spy Asaru and his deadweight partner Kanoko are hired for a new job in a dreary world dominated by corporations. Their mission? Infiltrate the mega corporation, Negabot. Dash, evade, and smash your way to the truth in this fast paced action game. No secret is safe from THIS bombastic spy duo!"

Well, Some Young Spies Still Learn From TV

Bart purchases a mini spy camera and manages to take a picture of Homer dancing next to stripper named Princess Kashmir at a co-worker's strip club party.

He gives copies of the picture to his friends, and eventually the picture starts to circulate around until eventually Marge sees it. She kicks Homer out of the house, but the next day explains that she is not upset about him dancing next to a woman, but rather that Bart saw it.

She demands that he take Bart and go apologize to Princess Kashmir. Homer agrees and says that he is ready to start respecting women.

Book Review - Loose Ends - David B. Watts, PI (really)

Ever read a really good book that you wish would become a feature-length Hollywood movie? Or, a television series, because you wanted to see the main characters in more of their adventures?

Loose Ends, by David B. Watts, is that book. I read it today in one sitting. It left me full of time well spent, yet hungry for more.

Loosely based on an actual case, solved by a real-life private investigator, it’s a multiple murder mystery set in New Jersey.

Geographically, it’s all true. You can almost smell the exhaust coming from the trucks on Route 22, in Union County; see the plushness of a wealthy defense lawyer’s conference room; hear the gasps in the courtroom as the surprise ending unfolds. This read creates a mental movie as the eyes pull the words off the pages.

Total verisimilitude, especially when it comes to private investigations, attorneys, police, prosecutors, and the courtroom.

If you are at loose ends for a great read, yes, tie up with Loose Ends.

The Doctor is In - Twelve Ways Dr. Guri can get into your air-gapped computer.

Faraday rooms or “cages” designed to prevent electromagnetic signals from escaping can nevertheless be compromised and leak highly sensitive data, according to new studies...

In two newly released reports (the other ten are there as well), the team demonstrated how attackers can bypass Faraday enclosures and air gaps to leak data from the most highly secured computers. The Odini method, named after the escape artist Harry Houdini, exploits the magnetic field generated by a computer’s central processing unit (CPU) to circumvent even the most securely equipped room. Click here to watch the demonstration.

“While Faraday rooms may successfully block electromagnetic signals that emanate from computers, low frequency magnetic radiation disseminates through the air, penetrating metal shields within the rooms,” explains Dr. Guri. “That’s why a compass still works inside of a Faraday room. Attackers can use this covert magnetic channel to intercept sensitive data from virtually any desktop PCs, servers, laptops, embedded systems, and other devices.”

In another documented cyberattack dubbed Magneto, researchers utilized malware keystrokes and passwords on an air-gapped computer to transfer data to a nearby smartphone via its magnetic sensor. Attackers can intercept this leaked data even when a smartphone is sealed in a Faraday bag or set on “airplane mode” to prevent incoming and outgoing communications. more

Facial Recognition Glasses Used by Police to Identify Suspects

Chinese police are using dark sunglasses equipped with facial recognition technology to spot criminal suspects.

The glasses, which are being worn by police at a busy train station ahead of the Chinese New Year travel rush, are linked to a central database which contains details of criminal records.

Wearing the technology, police can almost instantly view an individual's personal details, including name, ethnicity, gender and address.

The scene would not look out of place in an episode of science fiction television drama Black Mirror, which often depicts dark scenarios of humans being overcome by technology.

China is deploying new technologies to monitor people in ways that would unnerve many in the West. more

Drama Begins in Waymo v. Uber Trade Secrets Trial

The first day of the Waymo v. Uber trial over self-driving car trade secrets had it all: a packed courtroom, comical technical glitches and the creation of a fake Twitter account in the judge's name.

And that's aside from the testimony.

The high-profile Silicon Valley case pits Waymo -- the self-driving car unit of Google's parent company, Alphabet -- against Uber, the world's most highly valued startup. Waymo claims Uber's former star engineer stole 14,000 "highly confidential" files to develop its own technology. Uber calls the claim "baseless."

Monday was the first day of the trial, which is expected to last at least three weeks. Lawyers for the two companies presented their opening statements, aiming to toss barbs into each other's cases. more

Your Cell Phone Sings "Every Step You Take..."

by Guevara Noubir, Professor of Computer and Information Science, Northeastern University

"My group’s recent research has shown how mobile phones can also track their users through stores and cities and around the world – even when users turn off their phones’ location-tracking services.
The vulnerability comes from the wide range of sensors phones are equipped with – not just GPS and communications interfaces, but gyroscopes and accelerometers that can tell whether a phone is being held upright or on its side and can measure other movements too. Apps on the phone can use those sensors to perform tasks users aren’t expecting – like following a user’s movements turn by turn along city streets.

Most people expect that turning their phone’s location services off disables this sort of mobile surveillance. But the research I conduct with my colleagues Sashank Narain, Triet Vo-Huu, Ken Block and Amirali Sanatinia at Northeastern University, in a field called “side-channel attacks,” uncovers ways that apps can avoid or escape those restrictions. We have revealed how a phone can listen in on a user’s finger-typing to discover a secret password – and how simply carrying a phone in your pocket can tell data companies where you are and where you’re going..." more

TSCM, or This Smells Characteristicly Moronic

Pakistan’s security agencies have not found anything suspicious in Chetna Jadhav’s shoes that were confiscated by the Pakistani agencies...

Sources said that Pakistan’s agencies minutely examined her shoes, searching for spying devices.

However, nothing could be found and Pakistan is now likely to attribute this “incident” to an over-enthusiastic security official...

Sources said that the Pakistan Foreign Office was having a hard time dealing with the “concocted” tale of Jadhav’s wife carrying a spying device in her shoe, as it was not being able to answer the questions of local journalists who were asking about the nature of the “spying device” allegedly recovered and why details of the same were not being shared with them. more

Give them a break. Perhaps they misinterpreted the acronym written inside the shoe. TSCM and TGIF look somewhat similar, but TGIF stands for Toes Go In First.

Switzerland - Spy Magnet - Not Welcome Sign

Switzerland has always been a favorite by writers of spy novels as a place where foreign agents from across the world meet and exchange secret information.

But it’s true – and the country is being used more and more by international spies to meet.

It’s a trend the intelligence service wants to stop.

The NZZ newspaper quotes an anonymous source says there’s a rising demand for information and agents are increasingly choosing Switzerland to meet – especially Geneva.
The international city makes it easy for people throughout the world meet without attracting attention due to all the international organizations and a low level of street surveillance.

But Swiss authorities are not happy about living up to the stereotype. The intelligence agency says it’s not in the country’s interest to be a place where information damaging to allies could be swapped and they hope friendly countries would also do the same for Switzerland. more

Derailed CEO Accused of Spying on Board Members

South Africa - Railway Safety Regulator board members had their movements monitored and their cars fitted with tracking devices - and their boss allegedly orchestrated the whole thing.

Times Select can reveal that embattled Railway Safety Regulator CEO Nkululeko Poya allegedly spied on board members. She is currently on precautionary suspension after being charged for a string of alleged irregularities, including irregular staff appointments...

The new allegations facing Poya stem from a whistle blower who revealed how he had been engaging in clandestine activities on Poya’s behalf... He that said he worked on Poya’s instructions to spy on board members and find dirt against them. more

As Seen on TV - Spycams for Moms

Here's the pitch...

Introducing Smart Spy™

"The USB Wall Charger that is also a Secret Spy Camera! Smart Spy™ has a Micro SD card with 32 GB of memory that can record up to 8 hours of footage! It allows you to capture 1080P HD video footage discretely. Chargers are commonly plugged into walls, so it will never look like it is out of place! It even works as a universal USB wall charger. Now you can see what is going on when you’re not there!

Whether you need to keep an eye out on your kids, pets, hired help, intruders or any suspicious activity! It's so compact, you can even take it with you on the go! Smart Spy™ also has a motion activation feature so you don’t waste recording time when nobody is in the room. It’s so easy to use – just plug it in! When you want to review your recordings, simply plug it into your computer to play back." more

The TV commercial on the site says it all.

One Blue Blaze Irregular quipped, "If these get any cheaper, they will be giving them away in cereal boxes."

The Allentown Wiretap Tapes

If you have never listened to a wiretap, you might find this interesting...

Wiretaps from the Allentown City Hall corruption case.

TSCM: African Union Headquarters China Built Found To Be Bugged

China has again been accused of state-sponsored espionage after several information backdoors were discovered in the African Union (AU) headquarters it built in the Addis Ababa, the capital of Ethiopia.

The AU is a bloc of the 55 countries in Africa, where China has been trying to spread it’s influence in quest of the natural resources the continent holds. As part of it’s African outreach, China had financed and built the AU headquarters at a cost of $200 million in 2012. The building was inaugurated with much fanfare as a symbol and was meant to be a symbol of Chinese-African partnership.

However, an investigation by the French newspaper Le Monde has revealed that data from the servers in the AU headquarters was being transferred to Shanghai every night since the last five years, starting 2012. A followup sweep of the building led to the discovery of microphones embedded in desks and walls of the building revealing major cracks in the building’s security.

The AU has since replaced the Chinese machines with it’s own servers and is moving to encrypt it’s data and communications. more

Secret Surveillance Of Fox News Women Changing Clothes Alleged

Former Fox News star Andrea Tantaros is alleging that the network's former chair and CEO, Roger Ailes, secretly watched female hosts changing clothes on company surveillance equipment and that the conservative channel spied on employees' electronic devices.

Tantaros made the claims in a proposed amended complaint she filed in US District Court on Monday as part of a nine-month lawsuit against her former employer.

Tantaros, who is now representing herself in the legal matter, said Ailes had a CCTV system that allowed him to see inside Fox News offices: "Fox offices are where most Fox female talent, including Ms. Tantaros, disrobed daily from their regular clothing into their on-air attire, sometimes multiple times a day... Upon information and belief Ailes was surreptitiously recording, both through audio and with hidden cameras, Tantaros (and others)." more

Corporate Alert...
If you do not have a Recording in the Workplace Policy and conduct periodic inspections of Expectation of Privacy areas, you are at risk. Get these two elements into your security program. Start here.

Dutch Treat, or Watching the Spies Spy

According to a report in the Dutch newspaper de Volkskrant, the General Intelligence and Security Service of the Netherlands (AIVD)—the Netherlands' domestic intelligence service—had hacked into the network of a building at a Russian university in Moscow some time in the summer of 2014. The building housed a group running a hacking campaign now known as "Cozy Bear," one of the "threat groups" that would later target the Democratic National Committee.

AIVD's intrusion into the network gave them access to computers used by the group behind Cozy Bear and to the closed-circuit television cameras that watched over them, allowing them to literally witness everything that took place in the building near Red Square, according to the report. Access to the video cameras in a hallway outside the space where the Russian hacking team worked allowed the AIVD to get images of every person who entered the room and match them against known Russian intelligence agents and officials.

Based on the images, analysts at AIVD later determined that the group working in the room was operated by Russia’s Foreign Intelligence Service (SVR). An information and technology sharing arrangement with the National Security Agency and other US intelligence agencies resulted in the determination that Cozy Bear’s efforts were at least in part being driven by the Russian Federation’s leadership—including Russian President Vladimir Putin. more

So, how do you feel about the security of your security cameras now?

Austria - Bugging, break-in at far-right leader's office.

The office of Austrian far-right leader and vice chancellor Heinz-Christian Strache was broken into this week, shortly after bugging devices were discovered there, and a criminal inquiry has been launched, prosecutors said on Thursday...

The spokesman said the electronic surveillance devices had been discovered last week behind a mirrored wall by intelligence service specialists. “This was a routine check after moving into a new office,” he said.  more

Routine checks can pay off big-time.

Better Secure Voice over Internet - Novel Solution

Researchers at the University of Alabama at Birmingham have developed a novel method to better protect Crypto Phones from eavesdropping and other forms of man-in-the-middle attacks.
Crypto Phones consist of smartphone apps, mobile devices, personal computer or web-based Voice over Internet Protocol applications that use end-to-end encryption to ensure that only the user and the person they are communicating with can read what is sent. In order to secure what is being communicated, Crypto Phones require users to perform authentication tasks.

Research has shown that these tasks are prone to human errors, making these VoIP applications and devices highly vulnerable to man-in-the-middle and eavesdropping attacks... more

A long, technical, interesting read.

Extra Credit... The 4 Best Phones for Privacy & Security

Tinder Hackers May Find Out How Desperate You Are

Eavesdroppers could be able to peek in on mobile flirts.

A lack of security protections in Tinder's mobile app is leaving lonely hearts vulnerable to eavesdropping.

That's according to security biz Checkmarx this week, which claimed Android and iOS builds of the dating app fail to properly encrypt network traffic, meaning the basic actions of peeps looking to hookup – such as swipes on profiles – could be collected by anyone on the same Wi-Fi or carrying out similar snooping. more

"I'm sorry, Dave. I'm afraid I can't do that."

Logitech's $180 Circle 2 wired security camera is easy to set up and works with Amazon Alexa, Apple HomeKit and Google Assistant for a wide variety of smart home/voice control applications.

 

White Marsh Mall Spycam Man Suspect Charged - Day job... runs business that installs security cameras.

Baltimore County police say they are analyzing electronic items seized from the Abingdon home of a man charged with secretly recording people in a bathroom at White Marsh Mall.

The suspect, 40-year-old Mussawwir Sterrett, is general manager of a company that provides technology services including security camera installation, police said.

Sterrett is accused of placing a small camera, pointed toward a toilet, in the family bathroom near the mall’s food court on Dec. 23. The camera recorded 11 people, both children and adults, according to police spokeswoman Officer Jennifer Peach.

Sterrett faces charges of “peeping Tom” and visual surveillance with prurient intent. more

Vineyard Owners Arrested for Eavesdropping... didn't hear it through the grapevine.

The owners of a Monroe County winery accused of recording customers and employees without their knowledge say they were surprised by their arrests and subsequent criminal charges.

Randy and Linda Rice, who own and operate Mountain View Vineyards in Hamilton and Jackson Townships, were arrested Thursday and charged with interception of oral communications and possession of devices utilized to surreptitiously record oral communications.

The Monroe County District Attorney's Office said it was tipped off in December that there was illegal wiretapping at the winery part of the business at 2332 Walters Road in Hamilton Township.

Detectives on Thursday found wireless surveillance cameras in the new winery, but no signs indicating the cameras were recording video and audio. Prosecutors say only two employees knew audio was being recorded and monitored. more sing-a-long

Economic Espionage, Theft of Trade Secrets - 5 Year Sentence

A former software engineer for IBM in China has been sentenced to five years in prison for stealing the source code for highly valuable software developed by the tech company, the U.S. Justice Department announced Friday.

Xu Jiaqiang, 31, was sentenced Thursday by a federal judge in White Plains, New York, months after he pleaded guilty to three counts of economic espionage and three counts of theft, possession and distribution of trade secrets. 

Prosecutors said Xu stole the source code for computer performance-enhancing software while working for IBM from 2010 and 2014, with the intent to benefit China's National Health and Family Planning Commission.

Acting Assistant Attorney General Dana J. Boente of the Justice Department's national security division said the agency “will not hesitate to pursue and prosecute those who steal from American businesses.” Xu, a Chinese national, “is being held accountable for engaging in economic espionage against an American company,” Boente said in a statement. more

PI Sued for Planting Tracking Device... on a politician's pick-up truck.

An Oklahoma lawmaker who found a tracking device attached to his pickup truck last month is suing a private investigation company and an investigator who works for the company over the device.

Click to enlarge.

 Discovery of the tracking device has shocked Oklahoma politicians, who are wondering who was spying.

Rep. Mark McBride, a Republican from the Oklahoma City suburb of Moore, is suing Eastridge Investigations and Asset Protection and Eastridge investigator H.L. Christensen for unspecified damages of more than $10,000, according to an attorney for Eastridge. more

Hawaiian Emergency Management - Passwords on Post-it Notes on Computer Screens

The Hawaii Emergency Management false alarm mess was not caused by pressing the wrong button. It was caused by poor design.

Ever select the wrong thing from a drop-down menu? Sure, it happens all the time.

The Washington Post reports...

The menu, which triggers alerts, contains a jumble of options, ranging from Amber alerts to Tsunami warnings to road closures. Some of them, such as “High Surf Warning North Shores,” are in plain English.

Others, including the one for a missile attack, “PACOM (CDW)-STATE ONLY,” use shorthand initials. (PACOM refers to the United States Pacific Command based in Hawaii.)

And the menu contained no ballistic missile defense false alarm option — which has now been added at the top of the image, marked up by officials for explanatory purposes. more

 Suggestions: 
1. Separate the messages into smaller groups: Routine Tests | Advisories | Life Threatening
2. Drop the jargon. Say what you mean, clearly.
3. Do not use instant-select dropdown menus.
4. Use radio buttons to select the message, plus a CONFIRMATION and CANCEL button to activate the selected alert, or not. Two extra seconds of thought can prevent a lot of mistakes.

If you need help with design, call on the master, John McWade. He can teach you.

And, what's with posting the passwords to an emergency management computer screen?!?!
If the personnel can't memorize a password as lame as this, they shouldn't be allowed anywhere near a keyboard. more

Password: Warningpoint2

Spy Drone Filming - Detection Method Developed

The first technique to detect a drone camera illicitly capturing video is revealed in a new study published by Ben-Gurion University of the Negev (BGU) and Weizmann Institute of Science cyber security researchers.

The study addresses increasing concerns about the proliferation of drone use for personal and business applications and how it is impinging on privacy and safety.

In a new paper, "Game of Drones - Detecting Captured Target from an Encrypted Video Stream," the researchers demonstrate techniques for detecting if a targeted subject or house is being recorded by a drone camera. "The beauty of this research is that someone using only a laptop and an object that flickers can detect if someone is using a drone to spy on them," says Ben Nassi... more video

"Listening In: Cybersecurity in an Insecure Age" (book)

A cybersecurity expert and former Google privacy analyst’s urgent call to protect devices and networks against malicious hackers​.

New technologies have provided both incredible convenience and new threats. The same kinds of digital networks that allow you to hail a ride using your smartphone let power grid operators control a country’s electricity—and these personal, corporate, and government systems are all vulnerable.

In Ukraine, unknown hackers shut off electricity to nearly 230,000 people for six hours. North Korean hackers destroyed networks at Sony Pictures in retaliation for a film that mocked Kim Jong-un. And Russian cyberattackers leaked Democratic National Committee emails in an attempt to sway a U.S. presidential election.

And yet despite such documented risks, government agencies, whose investigations and surveillance are stymied by encryption, push for a weakening of protections. In this accessible and riveting read, Susan Landau makes a compelling case for the need to secure our data, explaining how we must maintain cybersecurity in an insecure age. more