Wednesday, August 5, 2020

NSA Tells Mobile Users Beware of Find-My-Phone

Beware of find-my-phone, Wi-Fi, and Bluetooth, NSA tells mobile users

And don't forget to limit ad tracking. Advisory contains a host of recommendations.

The National Security Agency is recommending that some government workers and people generally concerned about privacy turn off find-my-phone, Wi-Fi, and Bluetooth whenever those services are not needed, as well as limit location data usage by apps.

“Location data can be extremely valuable and must be protected,” an advisory published on Tuesday stated. “It can reveal details about the number of users in a location, user and supply movements, daily routines (user and organizational), and can expose otherwise unknown associations between users and locations.” more

Tuesday, August 4, 2020

How to Hide from Drones in the Age of Surveillance

Drones of all sizes are being used by environmental advocates to monitor deforestation, by conservationists to track poachers, and by journalists and activists to document large protests. As a political sociologist who studies social movements and drones, I document a wide range of nonviolent and pro-social drone uses in my new book, “The Good Drone.” I show that these efforts have the potential to democratize surveillance...

...it’s time to think about how many eyes are in the sky and how to avoid unwanted aerial surveillance. One way that’s within reach of nearly everyone is learning how to simply disappear from view.

How to disappear
The first thing you can do to hide from a drone is to take advantage of the natural and built environment.  more tips 



Monday, August 3, 2020

Staffing Firm Alleges Corporate Espionage by Former Employees

NY - Two Southern Tier staffing agencies are locked in a bitter dispute alleging corporate espionage, payroll sabotage, the breaching of non-compete and non-disclosure agreements, and the hijacking of a company Facebook page.

In a 54-page filing with the Federal District Court in Northern District earlier this month, Adecco accuses the upstart Staffworks of raiding its Corning, Elmira, Utica and Syracuse staff to steal proprietary account information and using it to steal long-established business...
  • Former employees commandeered a Adecco Corning office Facebook page for their own use, renaming it and taking control of posts.
  • A former Adecco employee broke into locked office filing cabinets, drilling through locks, "to remove colleague personnel files and other Adecco documents containing confidential information." The employee contends she was only trying to obtain personal items from the locked cabinet.
  • Proprietary pricing information and profit margin details was emailed from internal email accounts to personnel accounts before Adecco cut off access.
  • Those named in the suit refused to return company laptops and mobile devices with critical and confidential client and company details.
  • In their last weeks of employment , three defendants sabotaged client relationships by failing to enter information into a payroll system, later using the foul-up as evidence that Adecco was "going downhill," in an attempt to land new clients. more
Note to Adecco: Time for a thorough TSCM inspection. (search for eavesdropping devices)

The Vatican Hack

State-sponsored hackers have reportedly targeted Vatican computer networks in an attempt to give China an advantage in negotiations to renew a provisional deal with the Holy See.

A report, released July 28, said that hackers may have used a counterfeit condolence message from Cardinal Pietro Parolin, the Vatican Secretary of State, to gain access to Vatican communications. more

Block TikTok, or Microsoft to the Rescue

U.S. Secretary of State, Mike Pompeo, claimed that TikTok sends user data to China, exerting pressure on the video-sharing social networking service. Pompeo brought attention to the fact that if personal information flows across a Chinese server, it will eventually end up in the hands of the Chinese Communist Party which he calls an “Evil Empire”.

TikTok has denied U.S. allegations but a report by cyber experts at ProtonMail says otherwise. The report is more a warning as it states – “Beware, the social media giant not only collects troves of personal data on you, but also cooperates with the CCP, extending China’s surveillance and censorship reach beyond its borders.” more

In other news...
Microsoft said Sunday it will continue talks to buy short-form video app, TikTok after its chief executive spoke with President Trump, following a weekend of uncertainty clouding the future of the Chinese-owned app. more

Connect the Dots...
When Microsoft bought Skype, Wired Magazine noted, "The Skype client itself is written almost as if it were a piece of malware, using complex obfuscation and anti-reverse engineering techniques, and it would be disquieting for Microsoft to release something that behaved in such a shady way; at the very least, the client would surely have to be rewritten to avoid the obfuscation and outright hostility to managed networks that Skype currently has... Ultimately, it's hard to see how the Skype purchase is worthwhile from a technology or user-access perspective. The technology isn't good enough and the users aren't lucrative enough or plentiful enough to justify it. more

Pure Conjecture Disguised as Analysis...
Microsoft already had Windows Live Messenger. Did it really need Skype? Skype you might recall was a predominately Estonian-based encrypted platform. It was giving governments fits worldwide. Then, in 2011, Microsoft bought it. Guess what happened.

TikTok, it appears, is also giving government fits. Who ya gonna call?

FutureWatch: Early (1930) Facetime Smartphone Calls

"This technology was predicted by many authors, futurists, and illustrators in the past. This one is one of the earliest illustrations on this subject; it was made in 1930. Again, the resemblance with a modern gadget that we all know as “smartphone” is uncanny." more

Friday, July 31, 2020

"The Name's Richard, not Roger"

Britain on Wednesday named its former ambassador to Turkey as the new director of the MI6 Secret Intelligence Service.

Richard Moore succeeds Alex Younger, who was a career intelligence officer and became Britain's top spy in 2014. moore

Thursday, July 30, 2020

The Little Bugger Spycam or Beetleloose


Scientists developed a teensy-tiny black-and-white camera that can comfortably be mounted on a live beetle—specifically a death-feigning beetle and a Pinacate beetle.

The device streamed photos and videos straight to an iPhone, depicting exactly what the beetle was staring at: from squirrels that look like hulking grizzly bears to a truck that looms like a mountain. They published their findings in Science Robotics last week.

The entire system weighs around a tenth of a playing card, uses minimal power, and keeps the frame pointed at where the bug looks by mimicking its steering mechanisms. more

GPS Tracker – World’s Smallest and More

A GPS tracker can be incredibly small. Once the size of bricks some can now fit on your finger.

New features have arrived, too. Some have…
  • SOS buttons
  • Audio eavesdropping capability
  • Integration with Google Maps
  • Speed reporting
  • Geo-fencing with automatic alerts
  • Disable vehicle
  • Updates every five seconds
  • Wireless recharging
  • Worldwide coverage
  • Bluetooth – for tracking the last few feet

Saturday, July 25, 2020

DHS Gives Federal Agencies 24 hours to Patch Critical Microsoft Windows Vulnerability

Our friend in cold country has a hot tip for you!
Thanks, Mike.

--------------------
If you’re running an externally facing Windows DNS server, it should be patched as soon as possible.  It’s probably a good idea to work this patch into your internal patch management cycle as well.

CVE-2020-1350

If your DNS is managed by an external IT firm, please feel free to forward this to them.
If you’re not sure, drop me an email or give me a call at (907) 354-4879 (cell).

Thanks,
-Mike.
---
Mike Messick
President, Deep Forest Security Consulting
PO Box 242334
Anchorage, AK. 99524-2334
(907) 334-9090 Office

Thursday, July 23, 2020

The World’s Smallest Voice Recorder?

Is this The World’s Smallest Voice Recorder?



Specifications
TileRec by ATTO Digital 
Ultra-small: ≈1.53”x1.53”x.02” (≈39 x 39 x 5 mm)
Record modes: Voice activated or continuous.
Storage capacity: 145 hours.
Format: 128 kbps CD Quality MP3.
Playback: Download files to any computer.
Battery “on time”: Up to 24 hours.
Battery charge time: 2 hours.
Housing: Sturdy aluminum case.
Operates with one on/off switch.
Cost: $59.80 Amazon

Voice recorders keep getting smaller and smaller. 

However, If smallest means thin to you, yes there is a thinner one, the Edic-mini Tiny16+ A75…
 1 mm thinner, 12 mm less wide, but double the length. And, at $345, six times the price. They also make one card-key sized (2.7 mm thin).

Edic-mini Tiny16+ Flat voice recorder 

If by smallest you mean really, really thin… You might want to consider the NAGRA Dollar Bill recorder that’s being marketed to law enforcement instead. Thirty-one times as expensive as the TileRec.
There are many slightly larger voice recorders that are still considered to be mini in size. Our search on eBay returned 1,809 results and over 2,000 on Amazon.

eBay Search Box for voice recorder 
The prices on eBay ranged from $1.45 (with free shipping from China!) to $2,000. for the Edic-mini Tiny+ B76-150HQ. The Edic-mini Tiny+ being closest in size to the TileRec.

A Voice Recorder Manufacturer Speaks

Jang Sung-Churl, chief executive of electronics firm Auto Jungbo Co. Ltd., told Reuters that covert recording devices “have been selling like hotcakes” …sales of voice recorders so far this year (2019) have doubled to 80 devices per day, Jang said as he forecast sales to also double this calendar year to 1.4 billion won ($1,172,289).

Think about it. That's almost 30,000 devices sold per year... before the expected doubling of sales. And, he is only one manufacturer. An educated guess is that there are thousands of manufacturers around the world.

Accessibility + Affordability = Big Concerns.

 

Who Cares About Voice Recorder Size?

Lots of folks, for many and varied reasons…
  • Sneaky people who want to eavesdrop.
  • Sneaky people who want to entrap others.
  • Anyone worried about covert surveillance.
  • Local law enforcement detectives and Private Investigators. They might not have the budget necessary for a covert NAGRA Dollar Bill Recorder, but have the smarts to slap a TileRec between two one-dollar bills.
  • Technical Surveillance Countermeasures (TSCM) Technicians whose job it is to find illegal, electronic surveillance devices.
It all boils down to these two things:
People hiding voice recorders, and… thwarting the people doing it.

 

Discovering Voice Recorders 

Since the offense has the advantage let’s concentrate on the defense.

The average covert voice recorder will either be carried by a person to record face to face conversations or it will be hidden within conversations-of-interest areas.

 

In-Person Recording Detection Tips

  • Since frisking is probably out of the question, assume you are being recorded.
 Even if you could frisk, results would be iffy; these voice recorders are tiny.
  • At the outset of a conversation ask the other person if they are recording you. Watch their reaction. Do they overly protest, or fake anger? 

If they say no but record anyway, the recording’s value can be challenged. They lied, so maybe they also faked, edited or doctored the recording.
  • Also… Be professional. If you would not say it in a courtroom, don’t say it.
Big Red Flag – When someone tries to recreate a previous conversation with you.

 

Covert Recording Detection Tips

  • Pay attention to your surroundings. Who has access and when? Voice recorders need to be retrieved: to review recordings and to recharge batteries.
  • Avoid using the same area for all your sensitive conversations. Use various and unpredictable locations if possible.
  • Conducting your own search for surveillance devices is futile. An experienced eavesdropper will plant one easy-to-find device. They know the search will stop at that point. The harder-to-find device and it’s back-up will still be on the job. Without proper training and instrumentation your success is unlikely.
  • 

For office and home office situations an independent Technical Surveillance Countermeasures (TSCM) sweep team should be employed. Have them conduct periodic due diligence debugging inspections. In addition to searching for room audio and video surveillance devices have them check your vehicles. Vehicle inspections also include a search for GPS tracking devices.

 

TileRec Voice Recorder Detection Test

 

Voice Recorder Detection Test 50% & 100% PowerTesting Our Defenses

Murray Associates conducted tests to determine the effectiveness of their detection techniques on mini voice recorders. 

TileRec was difficult–but not impossible–to detect compared to other recorders tested.

During a professional TSCM inspection the technician’s physical search is aided by an instrument called a Non-Linear Junction Detector (NLJD). This instrument can detect electronic surveillance devices, including mini voice recorders, active or dormant.

A distance of 3 to 4 inches was chosen to test the NLJD detection technique. This simulates the recorder being secreted within another object. Green shows the power output. Red shows the level of detection.

With the NLJD set at 50% power output the TileRec was barely detectable. When the power was increased to 90-100%, success. Even at this higher power operator skill in using the NLJD was critical.

Conclusions

  • The TileRec is (probably)
    The World’s Smallest (affordable)
    Voice Recorder (as of now).
  • Size doesn’t matter. Any mini recorder can be easily secreted and threaten privacy.
  • The market for mini recorders is huge. There are a lot of them out there. Some of the very good ones are very inexpensive.
  • Detection is difficult, but not impossible.
  • The best self-protection tactic is watching what you say and situational awareness. Critical situations require the assistance of a professional TSCM / counterespionage firm.
* * *

Kevin D. Murray CPP, CISM, CFE is a business counterespionage consultant and TSCM specialist with over four decades of experience.

Murray Associates is an independent counterespionage consulting firm, providing eavesdropping detection (TSCM) and counterespionage services to business, government and the at-risk individual.
 
Headquartered in the New York metropolitan area, a Murray Associates team can assist you quickly, anywhere in the United States, and internationally.

If you have any questions, or would like to schedule TSCM / information security audits, please let us know.

Friday, July 17, 2020

Quote of the Week — Espionage Truths

"... a key way to detecting espionage is to follow your instincts and protocols."
~ /

International Conferences on Business Espionage and Cyber Security

August 23-24, 2021 in Budapest, Hungary
ICBECS 2021: 15. International Conference on Business Espionage and Cyber Security aims to bring together leading academic scientists, researchers and research scholars to exchange and share their experiences and research results on all aspects of Business Espionage and Cyber Security. It also provides a premier interdisciplinary platform for researchers, practitioners and educators to present and discuss the most recent innovations, trends, and concerns as well as practical challenges encountered and solutions adopted in the fields of Business Espionage and Cyber Security. more

ICBECS 2020: 14. International Conference on Business Espionage and Cyber Security, August 19-20, 2020 in Budapest, Hungary (to be held digitally) more

From The Dot Connection Files - CIA & Iran - Just Coincidence? You Decide

Three stories.
Same day.
Makes one wonder...

The Central Intelligence Agency, using new powers, carried out aggressive covert cyber operations against countries including Iran, North Korea, China and Russia, a new report says... The new powers gave the CIA more latitude to “damage adversaries’ critical infrastructure, such as petrochemical plants, and to engage in the kind of hack-and-dump operations that Russian hackers and WikiLeaks popularized,” the report explained. more

Iranian cyberspies leave training videos exposed online — One of Iran's top hacking groups has left a server exposed online where security researchers say they found a trove of screen recordings showing the hackers in action. more

The US has "several" intelligence indications that Iran has put portions of its air defense system on "high alert" in recent days, following unexplained explosions at key facilities tied to the country's military and nuclear programs, according to a US official who is closely tracking developments. more   sing-a-long (nsfw use headphones)