SpyCam Story #561 - The New Miranda Warning

FL - A woman who is suing her former landlord over allegations he secretly set up a spy camera in her bedroom is asking a judge to add punitive damages to her claim.

Miranda Goldston, 26, filed her lawsuit seeking compensatory damages against Kenneth Ryals, 59, in December 2007, three months after she discovered the spy camera hidden inside a DVD player in her bedroom. (more)

Illegal Wireless Phone Tap Found

Israel - Knesset security officials are concerned over what may be a case of illegal wiretapping of phones of the Ravitz family of Beitar Illit.

It appears the concerns began with “strange noises” heard on the phone by members of the family. A routine inspection into the cause of the noise revealed a wireless eavesdropping device.

According to the Chareidim report, those involved are more than a bit curious as to who is eavesdropping on the phone of Yitzchak Ravitz, who heads Degel HaTorah in the community, or perhaps the eavesdropping is intended to listen in on the conversations of his daughter Rivke, who is Knesset Speaker Reuven Rivlin’s bureau chief. She has been an employee of Speaker Rivlin for over a decade. (more) (Update: Rivke is his wife; not his daughter.)

The Eves Drop a Dime

India - Wiretaps, hidden listening devices and binoculars may be the usual paraphernalia to maintain surveillance over Commonwealth Games delegates, participants and spectators. But there may be more. Games authorities have devised a novel method to eavesdrop: Use thousands of eves.

An estimated 5,000 trained private security girls are likely to provide intelligence cover to the 2010 Commonwealth Games, one of the biggest sporting events that India will host after the 1982 Asiad Games...

“They will comprise women from all linguistic backgrounds, and with suave and comely personalities who will be responsible for a dual preemptive and protective role,” said Singh, a former Intelligence Bureau officer who was appointed a security consultant for the 1982 Asiad by Indira Gandhi.

While CCTVs will keep a watch on the movements of people entering stadia, the security girls will play an undercover role to snoop on conversations around them. They have been instructed to pick up interesting nuggets of conversations that will help the authorities nip any mischevious activity in the bud. (more)

Compliance departments on red alert for insider trading

In the wake of the alleged insider-trading ring involving hedge fund manager Galleon Group, compliance departments at asset management firms and broker-dealers are stepping up their vigilance.

As regulators increase their scrutiny of insider trading, firms are actively reviewing their compliance policies, making sure that employees understand them and conducting more audits of their trading patterns to make certain that nothing is potentially amiss...

The main worry at firms is that employees could be sharing information and unwittingly contributing to an insider-trading scheme...

Compliance departments also are making sure employees are careful with how they use other forms of media, such as voice-over-Internet, social-networking websites such as Twitter, and blogs.

“People need to understand that the law is the law, no matter what communication medium they are using,” said Ralph “Chip” MacDonald, a partner at Jones Day. (more)

An unpublicized element of this due diligence are Eavesdropping Detection Audits (TSCM).

Mobile Phone Bug Allows Wiretapping

Fact or Netmyth?
You decide.
Report back.

Summary
Erricson's WAP, Wireless Application Protocol, suffers from a security flaw that allows attackers to listen into other WAP sessions traveling on the cellular carrier wave.

Details
Erricson Mobile Phone allows attackers to wiretap other lines. This attack is limited, since you cannot choose which number to wiretap on, and you cannot talk at the same time that you are wiretapping a line. This vulnerability shows the lack of security of WAP as it is offered in today's cellular networks.

IMPORTANT NOTE: Wiretapping is illegal. The following information is just a proof of concept that shows a potential vulnerability in Erricson's WAP implementation.

How to wiretap from an Erricson Cell Phone:
1) Type 904059
2) Menu
3) Yes
4) 1
5) RCL
6) Yes
7) 8300**
8) Yes
9) 86
(Instead of the ** you can write any number you wish, except for the number 00)

To stop the wiretapping:
1) Type RCL
2) 3
3) Yes
(via)

Our spies report back...
"I am with cellular operator and today I asked my technical staff about this method. They replied
this is very old news, about year 2001. This bug was on very old Ericsson (before Sony Ericsson) phones and modern phones do not respond to this code sequence."
Thank you!

Eat Like a Spy

Next time your mission brings you to The Big Apple (aka New York City), and you need a little comfort food, come in from the cold.

Shake your tail (a quick double-back through Stuyvesant Town should do it) and head to The Village (you can leave this one). Duck into the Northern Spy Food Co.

They know spies need to stay fit. Northern Spy co-owner Chris Ronis calls his seasonal menu, "very homey but not heavy—not the fat-fried explosion that gets all the attention."

Psst... Chris, ixnay onway ethay explosionway alktay. It makes the patrons nervous.

New - GSM Audio Video Bug

from the manufacturer's advertising...
Specifications
• See your monitoring place anywhere, anytime by your mobile phone
• Wire tap your monitoring place by your mobile
• Know the urgent things in first time by your mobile
• Wireless installation, can move freely
• Can control the camera with your mobile to get the monitoring place image by MMS anywhere
• Successfully combine moving detect technology and GSM wireless network transmission technology apply in defense and security area, it break the distance and electrical wire restriction compare with normal defense and security products
• Any changes or dangerous in the monitoring place, camera will notify you by calling, SMS, or MMS
• Can dial the preset emergency number once the sensor active
• With cute appearance, practical functions, and bright design
• Applicable in family, office, factory, store etc place, especially for garage, stock house, and more where fixed lines are hard to reach
• With monitor, can see your home any time, know your child arrive home in first time, and know your office is safe during holiday

Functions:
• Mobile alarm: capture images and send to your mobile phone by MMS
• SMS remote control: control the camera by sending SMS commands
• Real time audio: call the camera and listen in
• Motion detection: detect any motion within the monitoring area and send alarm
• External connection: connect wireless sensors (maximum of 15), such as door magnet, PIR sensor, smoke sensor, gas sensor, and more
• Camera can report alarm from all sensors connected
• Infrared light: built-in IR light enables the camera to capture images in dark environment
• Resolution: 300 pixels CMOS camera
• Watch images directly
(more)

Why do I mention it?
So you will know what you are up against.

Warning: industrial espionage on the rise

Denmark - Companies are being warned by both an industry organisation and the national intelligence agency that industrial spies are ever present.

Jakob Scharf, head of the Danish Security and Intelligence Service (PET), recently warned that industrial espionage has been growing steadily in the last number of years and Danish companies are not impervious to it. (more)

UK - Universal Knowledge?

UK - The British government has decided to go ahead with its plans under what it calls the Intercept Modernisation Programme to force every telecommunication company and Internet service provider to keep a record of all of its customers' personal communications, showing who they have contacted, when and where, as well as the web sites they have visited, according to the London Telegraph and various other British papers.

The information gathered, the Telegraph says, will be able to be accessed by 653 public bodies, "including police, local councils, the Financial Services Authority, the ambulance service, fire authorities and even prison governors."

"They will not require the permission of a judge or a magistrate to obtain the information, but simply the authorisation of a senior police officer or the equivalent of a deputy head of department at a local authority," the Telegraph says. (more)

Number Six, Number Two & Rover are back

The 1960s sci-fi phenomenon, The Prisoner TV series, is back. AMC and British network ITV re-made the cult show into a six-part mini-series that will begin airing this Sunday.

Patrick McGoohan co-created the original Prisoner series, directed it, and starred in it as well. The show centers on the imprisonment of a resigned British secret agent (McGoohan) in a seemingly serene and beautiful village of unknown location.

The captive agent, renamed Number Six (all prisoners in the village are numbered), is constantly interrogated, manipulated and tormented by sinister figures known only as Number Two.

In addition to being a psychological thriller that was way ahead of its time, The Prisoner demonstrated a number of political metaphors for the corruption of power, struggles for freedom, and the enslavement of the masses by commercial/political interests.

Sir Ian McKellen will take on the role of the evil Number Two and James Caviezel will play persecuted Number Six. It’s rumored that McGoohan (who died January 13, 2009) may have a cameo in the remake as well. (AMC)

Charity President Fired for Bugging

Feed The Children President Larry Jones was fired Friday from the charity he founded 30 years ago. ... He and his wife, Frances, were the main fundraisers, making repeated, often heart-wrenching televised pleas for money to help starving children in Africa and elsewhere.

The firing came after Jones admitted to the charity’s investigator and to police that he authorized the installation of hidden microphones in three executives’ offices last April. "I did nothing wrong there. … I knew what the law was… They used wiretapping as the excuse,” Jones said Friday.

Jones in April had hidden microphones installed in the offices of his daughter, the chief financial officer and the chief operating officer before they returned to their jobs, according to two of his attorneys.

Oklahoma City police became involved Aug. 19 after a private investigator found "remnants of wiretapping devices” in the ceilings of the three offices. The owner of the company that installed the microphones told police his employees never could get a recorder to work.

Jones has been the face of the Oklahoma City-based Christian relief organization. It reports collecting more than $1 billion in donations a year. (more)

PTL deja vu.

iPhone Bug Directions Published on Net

As if we didn't have enough evesdropping and wiretap problems to worry about, now this headline...

Turn your iPhone into a bugging device!
7 Steps to turn your iPhone into a bugging device and then listen in over Wi-Fi.

Step 1) Open the free Blue FiRe iPhone app...
...
Step 6) Set your iPhone down and leave the area to start gathering intel.

Step 7) Via any computer on the same Wi-Fi network as your iPhone go to the url you noted from the Browser Access window and download the audio file! TA DA!

For extra credit use your iPhone to record in STEREO with Mikey. (more)

Tech gadgets help corporate spying surge in tough times

via USA Today...
Corporate espionage using very simple tactics — much of it carried out by trusted insiders, familiar business acquaintances, even janitors — is surging. That's because businesses large and small are collecting and storing more data than ever before. What's more, companies are blithely allowing broad access to this data via nifty Internet services and cool digital devices. (more)

New Pocket Eavesdropping Device

Product Notes...
"Works on wooden walls, doors, windows, steel plates, etc. Highly Sensitive, carefully adjust audio slowly, as not to cause discomfort to your ear-buds. This product is being sold as an investigative tools for law enforcement or licensed investigators. Anyone else ordering this device should only be ordering it as a simple toy since MANY COUNTRIES STRICTLY PROHIBIT OWNERSHIP OF SPY DEVICES." (more)
Why do I mention it?
So you will know what you are up against.

Want to build one yourself? (start here)

Hedge fund insider-trading scandal expands

One man snapped his cellphone in half and bit the memory card to conceal his actions, complaints allege. Fourteen more are charged in the continuing investigation.

Reporting from New York - As an eavesdropping-detection specialist, Kevin D. Murray normally works for companies concerned about possible spying by competitors.

But since a blockbuster insider-trading prosecution built on wiretaps and microphone-wearing informants became public last month, frantic hedge fund managers have raced to hire him.

"The nature of the question is 'Can you tell me if the government's bugging me?' " Murray said, adding that he turned down the three firms that approached him. (more)

All businesses need a counterespionage strategy and should inspect their premises periodically for illegal electronic surveillance. Illegal eavesdropping is a serious problem with costly consequences.

If you are the target of a government investigation, however, you are on your own. There isn't anybody who can tell you if your phones are tapped (even if they are willing to take your money to do so). Modern government electronic surveillance methods do not change the electrical characteristics of your phone. There is nothing to detect.

USB Sticks that Stick it to You

Short Story: Beware the "free" USB memory stick.
Long Geeky Story:
From: David Lesher
Subject: AMEX sends USB trojan keyboards in ads

A fellow user group member reported getting a USB-fob from American Express. When he plugged in to a port, it attempted to send his xterm command line to {the dots were hex digits, it appears.... [and PGN changed x to dot to avoid filtering]} but didn't succeed. [It may be Windows and Mac compatible, but not Linux...]

That address redirects to an Amex URL:

It identified itself on the USB chain as: Bus 003 Device 003: ID 05ac:020b Apple, Inc. Pro Keyboard [Mitsumi, A1048/US layout]

Since it's clearly NOT an Apple Pro Keyboard; one wonders why the manufacturer chose that false identity. The masquerade as a keyboard might also have been to penetrate those machines that do not blindly mount USB storage devices.

Risks: While we now look for incoming malware on the TCP/IP connections, clearly we need to similarly monitor the other ports as well; you can do just as much damage (or more) with a insider keyboard attack, given some social engineering. Is the power line next?

Cautionary Tale: The administrator who didn't administrate.

Federal authorities on Wednesday filed intrusion charges against two men accused of accessing the computer systems of their former employer.

Scott R. Burgess, 45, of Jasper, Indiana, and Walter D. Puckett, 39, of Williamstown, Kentucky, both worked as managers for Indiana-based Stens Corporation until taking jobs with a competing company in Ohio, according to an indictment filed in federal court. On at least 12 occasions, they used old passwords to access their former employer's computer and access proprietary information, prosecutors allege.

Although the men left their jobs in 2004 and early 2005, they were able to use the outdated passwords successfully as late as September of 2006. On at least two occasions, administrators at Stens grew suspicious and terminated old passwords. The men simply tried different login credentials - and succeeded several times. (more)

Details of an Attorney's Tactics Revealed

"For years, Broward County's socially and politically connected marveled at the astonishing success of Fort Lauderdale lawyer Scott Rothstein and wondered: How does he do it?...

...Sakowitz said Rothstein boasted of having sophisticated eavesdropping equipment and that former cops would sift through potential defendants' garbage. With compromising evidence in hand, the firm urged the targets of the claims to pay a settlement without a public lawsuit." (more)

Oculis Labs Stops Computer Shoulder Surfers

Until now, there were few ways to stop shoulder surfers from reading your computer screen: place a polarizing screen over your computer screen (not very practical for laptops), or mount a mirror on the side of your screen so you could see someone sneaking a peek from behind.

This way sends peepers to the eye doctor...
Oculis Labs has a product called PrivateEye, a simple, low-cost (from $19.95), easy-to-deploy software application for enterprise and consumer use. It requires no special hardware, just a standard embedded webcam.

PrivateEye significantly improves on older technologies such as 3M privacy filters, and screen savers by performing active user-centric protection of all content displayed on the screen.

PrivateEye uses a webcam sensor to continuously assess the user’s area of interest, and uses this information to control what is displayed.

In the simplest mode, when PrivateEye determines that the user is looking at the display, the contents are presented normally. When the user looks away, the display is quickly blurred to protect the contents and when the user looks back, display is instantly cleared again. The effect is that contents are displayed only as needed by the authorized user. This feature alone significantly reduces the opportunities for eavesdroppers.

In addition to protecting the display when the user is not attending to it, the system will reduce susceptibility to eavesdropping when the user is actively reading the screen. PrivateEye can identify when unauthorized viewers are looking at the display, and take action to reduce potential eavesdropping. (Video demonstration)

Oculis Labs also sells a higher-priced version, Chameleon, which lets the user see clearly, and scrambles the view for others... all at the same time. Cool, eh?

The NSA may be looking for you...

Where Intelligence Goes to Work

Intelligence. It's the ability to think abstractly. Challenge the unknown. Solve the impossible. And at NSA, it's about protecting the Nation.

A career at NSA offers the opportunity to work with the best, shape the course of the world, and secure your own future. Isn't it time to put your intelligence to work? (more)

Spy vs. Spy - Finally, one of them wins...

US - The government has agreed to pay $3 million to a former agent of the Drug Enforcement Administration who sued CIA officers for illegal eavesdropping.

The proposed settlement followed a ruling by U.S. District Judge Royce Lamberth in July that CIA officials committed fraud to protect a former covert agent against the eavesdropping allegations.

The lawsuit was brought by former DEA agent Richard Horn, who says his home in Rangoon, Burma, was illegally wiretapped by the CIA in 1993. He says Arthur Brown, the former CIA station chief in Burma, and Franklin Huddle Jr., the chief of mission at the U.S. Embassy in Burma, were trying to get him transferred because they disagreed with his work with Burmese officials on the country's drug trade.

Horn sued Brown and Huddle in 1994, seeking monetary damages for violating his civil rights. The CIA itself was a defendant in the lawsuit until early this year. (more)

The Video Backlash Begins

UK - Councils have been criticised for using surveillance powers designed to combat serious crime and protect national security to spy on the public for minor crimes such as littering or unlawfully selling pot plants.

They were also found to be using them to investigate parents accused of lying about where they live to get their children in to better schools.

But Alan Johnson, the Home Secretary, will today announce plans to change the law to ensure authorities only use the intrusive techniques, under the Regulation of Investigatory Powers Act (Ripa), for serious offences. (more)

Spokesman Resigns Over Secret Phone Recordings

CA - Scott Gerber, the communications director for Attorney General Jerry Brown who admitted recording phone conversations with reporters without their permission --- including Chronicle senior political writer Carla Marinucci -- resigned Monday. (more)

You're not crazy... "The thought would not have occurred to you if everything were fine."

People are often ashamed, scared or afraid of being called paranoid when they suspect eavesdropping or wiretapping. In most cases, something is wrong. The information leaks and subsequent feedback may not always be caused by a bug or wiretap, but something is wrong.

Take the case of Courtney Love...

Courtney Love's Paranoid Sounding Claims Backed Up By Other Sources

...the New York Daily News quotes not only Love, but also a few corroborating sources who back up her story...investigator hired by Love not only co-signs her story, but states that there's proof! From the News:

Adam DelMonte and Michael Kenworthy of AC Digital Services...say they recorded the "blitz" on security cameras they installed in Love's house. "These impostors then flipped the situation on Mrs. Cobain and tried to strong-arm her and scare her into feeling she needed to hire them for protection," DelMonte and Kenworthy assert in a letter. "Fortunately, we were able...to get them out of her life."

They go on to say that Love's former staffers installed "numerous types of spyware on her computers and her phone. Both her camera and microphone on her cell phone were bugged at one point."

...she says she's called law enforcement to look into her case, she's gotten no response. She chalks the disinterest in her claims, rightfully, to a less-than-stellar reputation, saying, "My biggest problem is that I'm Courtney Love."

That doesn't mean, however, that she has a lesser right to privacy than anyone else.

You can begin to solve your own spying problems without: buying spy detection gadgets, hiring a private investigator or sweep team, or even admitting your suspicions to anyone. Read Quit Bugging Me.

Alert - Free Blackberry Spying App Released

The US-CERT has issued a warning about a new, free BlackBerry application that transforms the phone into a bugging device.

PhoneSnoop, which runs on the victim's phone, lets an attacker stealthily call the targeted BlackBerry, answer the call, turn on the speakerphone, and let the attacker listen in on the victim. The app has to be configured to recognize the attacker's phone number, and it automatically and quickly answers it to evade detection.

Sheran Gunasekera, the developer of PhoneSnoop, says he was surprised US-CERT identified his app in an advisory. "I am happy that they did, though, because it's one step further in getting the word out," says Gunasekera, who is director of IT security at Hermis Consulting in Jakarta, Indonesia.

"I think the reason my app was flagged was because it's free and more easily accessible" than more expensive commercial spy tools. (more) (video)

Side note: The attacker either needs to have physical access to your Blackberry to load the spyware program, or in some way, trick you into doing it.

Police Chief Charged in Bugging Scheme

MN - The police chief of Gaylord is now charged with two gross misdemeanors in an alleged "bugging" scheme.

Police Chief Dale Lee Roiger is accused of having one of his officers secretly plant a digital recorder to see if City Council members were meeting illegally at the Chamber of Commerce office. (more)

Oddly, the article mentions a digital recorder, which stores the recording in a solid-state memory, yet shows a photo of analog cassette tapes.

Example photo of a digital recorder...

This one is high quality, voice activated and stores up to 300 hours of conversation; about $375. on ebay. Lower fidelity digital recorders are also being sold in the $10.-$40. price range. Be careful what you say, and have your office swept periodically.

Data Loss Almost Doubles

UK - An article this week at The Register states that between November 2008 and September 2009, there were 356 self-reported data losses this year by UK companies and government departments. In the same time frame a year before, there were 190 such incidents reported.

The information was compiled by Software AG, which used a Freedom of Information Act request to get the data from the UK Information Commissioner's Office. (more)

Spyware fine, $476. Getting X's e-mails, priceless.

WI - An Appleton man charged with installing spyware on his ex-wife's computer was fined after he entered into a plea agreement on a lesser charge.

Brent J. Walbrun, 47, W3291 Hartland Court, originally was charged with interception of an electronic communication under the state's electronic eavesdropping law for installing the spyware on the computer.

In October, Walbrun's ex-wife discovered the spyware program when she realized Walbrun was intercepting her e-mails. Walbrun entered a no-contest plea Oct. 19 to a misdemeanor charge of disorderly conduct and was fined $476. (more)

Spyware Goes Legit

Australia - Distributors for new software that allows parents to spy on their children's text messages say they are still hopeful, as they try to get approval for their product.

The software, which allows parents to see every text message their child sends and receives, was due to be on sale in August, but the earliest it will now be available is early next year.

Civil libertarians and technology experts have deep concerns about the privacy implications of the product. (more)

Ice Pick is New Car Key for Burglars

(Reports coming in from GA, MA, and IL)
...The unknown sharp object penetrates the door metal, hits the lock mechanism and disengages it. The burglar or burglars slip inside the vehicle without having to break a window or otherwise heavily damage the car, which would call attention to themselves.

Because the damage is minor, the owners may not realize they are victims until they notice items missing from the car or items that were moved. The puncture hole that the intruders leave under the lock, usually on the driver's-side door, is only up to about a half-inch in diameter.

The thieves prefer to hit General Motors cars, Golike said.

"Most were GM vehicles," he said. "Many of the GM cars have a lock mechanism that somebody's familiar with."

He said some of the cars were Dodges.

The thieves target just about anything of value, including cash, wallets, purses and guns left in the cars.

The first such "punch" car burglary reported in the greater Alton area happened to a vehicle owned by Telegraph Photo Editor John Badman. That burglary happened Sept. 23 while his Chevrolet Impala was parked in the parking lot of Fast Eddie's Bon-Air tavern along East Broadway. The tavern is at 1530 E. Broadway.

Once inside the car, the burglar popped the lid of the trunk, making off with $14,000 in camera equipment - after first relocking the car door. (more) (more) (more)

The Chevron Secret Recordings Case Continues

An American whose secret recordings have placed him at the center of a $27 billion lawsuit against Chevron in Ecuador is a convicted drug trafficker, records show, throwing another complication into a case already tainted by accusations of bribery and espionage.

The lawsuit pits Ecuadorean peasants against Chevron over oil pollution in the Amazon and has been a major headache for the company for nearly a decade, producing a saga that underscores many of the hazards and ethical challenges of oil companies working in the developing world.

The company appeared to gain the upper hand in August when it revealed video recordings — captured on watches and pens implanted with bugging devices — that suggested a bribery scheme involving Ecuadorean officials, and possibly even the judge hearing the case.

But the company was put on the defensive again on Thursday, after lawyers for the peasants revealed that one of two men who made the tapes was a convicted felon. Court and other records provided by the plaintiffs show that Wayne Hansen, the American who helped make the recordings, was convicted of conspiring to traffic 275,000 pounds of marijuana from Colombia to the United States in 1986. He also was sued successfully in 2005 by a woman who accused him of unleashing his two pit bulls to attack her and her dog...

“It’s another blockbuster development in a case that never runs short of them,” said Ralph G. Steinhardt, a professor at George Washington University Law School...

Chevron has said it had no involvement in the videotaping, and company spokesmen have said Mr. Hansen was never their point of contact. “We’ve had no association with this guy,” said Donald Campbell, a Chevron spokesman. (more) (the videos)

Eavesdropping on Smartphone Secrets

As cell phones become more like pocket computers, many people are calling for closer scrutiny of their security...

"The phone is a very stripped-down environment," says Benjamin Jun, vice president of technology at Cryptography Research, a security research company based in San Francisco, CA. "Which means that someone who's trying to attack the device generally has an easier time, because it's not as complicated as a desktop system."

Jun believes attacks on mobile devices are particularly serious because these devices are being used to access high-value corporate data. (more)

Australia - The Heat is On

The Australian Security Intelligence Organisation (ASIO), says it has had its most intense period of operational activity since 2005. ASIO's annual report says in the last financial year it detected and responded to a new alleged terrorist cell...

It also picked up internet espionage as a rapidly growing threat to Government and business information. (more)

LA DA Bugged

Los Angeles - ROBERT H. PHILIBOSIAN, as one of his first acts as district attorney, had a “bug”—the electronic sort—removed from the DA’s executive office.

Philibosian says that when he walked through the executive office after he was appointed at the end of 1982, he asked Clayton Anderson, chief of the Bureau of Investigation: “Is this office bugged?”

He recites that Anderson responded: “Yes it is,” and pointed to an electrical outlet.

The former district attorney says he told Anderson: “I want it out of here now.” (more)

Quote of the Day - The Off-Site Meeting

"And, if you're into taxes...the American Institute of Certified Public Accountants kicks off its National Tax Conference at the J.W. Marriott in Washington. Hanging around the hotel and eavesdropping between now and Friday, when the conference closes, could save you thousands of dollars." ~ Marc Ambinder, The Atlantic (more)

This is an off-handed, humorous comment.
It is also deadly accurate.

I handle counterespionage strategy for my client's off-site meetings. Hotels and conference centers are the worst. It is not at all unusual to catch the competition (and unidentified others) hanging around, eavesdropping, crashing meetings and banquets, picking up unsecured papers and engaging meeting participants – one indiscretion can blackmail a loyal employee into becoming a million dollar problem.

The technical possibilities for eavesdropping are considerable as well. Bugs are easy to plant. Most meeting presenters use wireless microphones.

Competitors reserve a cosy hotel room above the meeting rooms. They arm themselves with a sensitive radio receiver and a directional antenna. Crashing a meeting is a no-brainer.

You can see how a 2-3 person team from the competition could clean up with very little investment. One might almost call them negligent if they weren't there.

Having an off-site meeting?
Get a counterespionage strategy.
Avoid leaking your corporate blood.

One More Good Reason to Lock USB Ports

The new Devil Drive elevates the office prank to a new level of sophistication and maddening effectiveness. It looks like a regular USB thumb drive, but it's actually a devious device of electronic harassment. Its use should be strictly limited to deserving subjects only.

The Devil Drive has three functions:
(1) it causes annoying random curser movements on the screen,
(2) it types out random phrases and garbage text, and
(3) it toggles the Caps Lock.

It allows you to select any combination of these frustrating functions, or all of them. It also allows you to set the time interval between events (ranges from 5 seconds to 15 minutes; the longer intervals are recommended for the most maddening effects).

Note: the Caps Lock toggle function does not work on Macs. To deploy the Devil Drive, just discreetly insert it into any unused USB port on the victim's computer (no drivers are needed).

The Devil Drive never hits the "Enter" key and it never clicks the mouse button, but still you should not use it on anyone's computer who is doing critical work where any disruption could cause serious consequences; like any prank, exercise prudence and judgment before deploying. (more)

FY 2008 - Annual Report to Congress on Foreign Economic Collection and Industrial Espionage

The threat to the United States from foreign economic intelligence collection and industrial espionage has continued unabated since the publication of the Annual Report to Congress on Foreign Economic Collection and Industrial Espionage, 2007. Economic espionage cases went up slightly and nearly every day brought reports—in the press and in the classified world—of new cyber attacks against US Government and business entities.

Additionally, the increasing use of new modes of communication and social networking has provided uncharted opportunities for transferring information and espionage for enterprising foreign intelligence services.

"Collection methods included everything from eliciting information during seemingly innocuous conversations to eavesdropping on private telephone conversations to downloading information from laptops or other digital storage devices."

Annual Report to Congress on Foreign Economic Collection and Industrial Espionage, FY 2008
(click here for pdf version)

Galleon Case Prompts Firms To Plug Leaks

via The Wall Street Journal...
Companies are moving to plug leaks and contain the damage from sweeping insider-trading allegations disclosed last week.(more)

Galleon Group received confidential information in 1998 about Intel Corp. chip shipments from a woman who has emerged as a key government witness against the hedge fund and its founder Raj Rajaratnam, according to a document filed by the Justice Department.

The woman, Roomy Khan, was employed at the time by Intel and sent a fax containing "proprietary, non-public and highly confidential" information from the company to Galleon's headquarters in New York City, the two-page charging document indicates. She did so at the request of an unnamed representative of Galleon, the Justice Department alleged. (more)

Need an information protection strategy?
(click here)

Winner: Can Film Festival - Surveillance Category

Make Magazine Spy Gadget Contest

Coming soon! Contest starts on November 17th, 2009

MAKE is teaming up with the Penguin Group to present The Alex Rider Dream Gadget Contest!

All of you adventure-seekers and gadget lovers out there are invited to join in. If you were Alex Rider, what gadget would you want in the upcoming adventure "Crocodile Tears"?

Design your dream Alex Rider gadget, inspired by an everyday object (i.e. an iPod, toothpaste, a pen).

The winning gadget will be built right here at the MAKE Labs. Send us a schematic of what your gadget is made from and how it works. (Your schematic can be a diagram, a drawing or an explanation by you).

Remember that the winning gadget will be inspired by an everyday object that one could realistically build (as much as we wish we could create a pair of scissors that could fly us to the moon)! (more)

FYI... (via boingboing.net)
"In case you're unaware, Alex Rider is a young spy whose exploits are chronicled in a popular series of teen spy/adventure books. Alex uses all sorts of crazy high tech contraptions, made from things in his school backpack, to get out of sticky situations."

Let me know your ideas. Just for fun, I will post them here with your initials and country or state. To play for the prize, visit Make Magazine.

Wall Street gets Wiretaps

NY - US prosecutors who used wiretaps to make their insider trading case against billionaire Raj Rajaratnam, founder of hedge fund firm Galleon Group, said they would use similar tactics to fight future Wall Street crimes.

The US attorney for Manhattan, Preet Bharara, said on Friday the justice department would employ the same kind of electronic surveillance traditionally reserved for organized crime, drug syndicates and terrorism prosecutions.

Bharara, whose office has jurisdiction over the headquarters of some of the world’s biggest financial firms, said investigators relied on wiretaps to build a case against Rajaratnam and former directors at a Bear Stearns hedge fund.

He said it was the first time wiretaps had been used to target insider trading. (more)

"Sometimes, I just don't want them to know it's me calling."

NY - Blond society babe Ali Wise -- the fired publicity director for Dolce & Gabbana -- was slapped with four felonies yesterday for allegedly making a compulsive, vindictive leap from flacking to hacking.

The ferocious fashionista embarked on a strange, high-tech vendetta against the girlfriends of her old boyfriends, according to a criminal complaint filed against her in Manhattan Criminal Court.

Wise allegedly used widely available "SpoofCard" software more than 1,000 times. With it, she broke into the voice-mail systems of four people -- at least two of whom had dated her high-powered ex-boyfriends -- nearly 700 times, prosecutors said.

The Barbie-esque publicist would then eavesdrop on their messages, even deleting those that did not meet with her favor, prosecutors said. (more)

Rocket Scientist Stung in Spy Caper

Stewart Nozette, 52, developed an experiment that fueled the discovery of water on the south pole of the moon, and held a special security clearance at the United States Department of Energy on atomic materials.

He has been charged with “attempted espionage for knowingly and willfully attempting to communicate, deliver and transmit classified information relating to the national defence of the US to an individual that Nozette believed to be an Israeli intelligence officer,” the US Department of Justice said.

But the person Mr Nozette believed to be an Israeli intelligence officer was in fact an undercover FBI agent in a sting operation, the department said...

During a meeting in a bugged Washington hotel room, Mr Nozette is alleged to have said he wanted to receive cash amounts “under $10,000” to keep him from reporting it to the authorities. (more)

Business Espionage - Lee & Ge Plea

CA - The word espionage conjures up images of James Bond or Alger Hiss, not usually techies in Silicon Valley. But as the San Jose Mercury News reports, two engineers are about to face economic espionage charges in San Jose for allegedly stealing superfast computer chip plans. It’s only the second such trial of its kind in the nation. “For Silicon Valley, where companies have worried for years about their prized secrets being leaked to China and other countries, such a trial is a window into the complexities of protecting product information in a place with ties to every corner of the global economy,” reports the Mercury News. (more)

Moral: Don't count on the law to protect you. Have a good counterespionage strategy in place.

"Record your life" meme gaining altitude

Yet another "record your life" tool...
uCorder by iRes

Spy cameras have been with us for over 100 years; mostly used offensively to spy, sometimes used to inoffensively document life without intrusion-disruption.

Times are changing. Today, everyone has a chance at instant global immortality. YouTube and Flickr are our memory mausoleums; CNN's iReport, our chance to be part of the world. The price of admission to this ego-lottery... microelectronics.

Microelectronic spycam offerings have dramatically picked up pace during the past 12 months.

Take a stroll in the Security Scrapbook memory mausoleum. You will be amazed at what you see ...and what can see you. (more) (more) (more) (more) (more) (more) (more) (more) (more) (more) (more) (more) (more) (more) (more) (more) (more) (more) (more) (more) (more) (more) (more) (more) (more) (more) (more) (more) (more) (more) (more)

"Say it with flowers, say it with mink, but...

...never, never say it with ink."
New documents shed light on a widely disseminated comment by Bank of America Corp. director Charles Gifford, who wrote in a January email that a U.S.-required dividend cut meant "unfortunately it's screw the shareholders." (more) (more)

Effective Counterespionage Strategy Rule #1:
Develop a culture which practices being discreet.

"Does his brother sell 'anti-bugging' devices?"

South Korean embassies and other diplomatic missions abroad are vulnerable to electronic eavesdropping due to the shortage of preventive devices, according to the foreign ministry.

In a recent report to Rep. Rhee Beum-kwan for the ongoing parliamentary audit of government agencies, the ministry said only 34 of the country's 167 diplomatic offices across the world are equipped with devices for blocking electronic eavesdropping...

An anti-bugging device costs about 8 million won (US$6,600), and only one billion won would be needed to install them in the remaining 133 diplomatic missions, he pointed out. (more)

If there was an effective "anti-bugging device," it would sell for a whole lot more than $6,600.

There is a common misconception (even in government circles) that bugging is accomplished by only one technology - radio frequency transmission. "Install our handy-dandy 'anti-bugging receiver system' and you will be bug-free, 24/7/365... forever!" Even Fortune 1000 companies have almost fallen for this mental band-aid.

A while back, the South African government found one of these "anti-bugging devices" and thought it was a bug! (more) Interestingly, that system was from Korea.

Moral: Avoid gadgets. Get a Strategy.

Wireless Network Signals Produce See-Through Walls

Researchers at the University of Utah have found a way to see through walls to detect movement inside a building.

The surveillance technique is called variance-based radio tomographic imaging and works by visualizing variations in radio waves as they travel to nodes in a wireless network. A person moving inside a building will cause the waves to vary in that location, the researchers found, allowing an observer to map their position...

Of course there are privacy and security concerns associated with the technology. A burglar could use it to detect if anyone is home or to scout the location of security guards. (more)

This technology is a cousin to our Digital Surveillance Location Analysis™. We use it to detect and pinpoint the locations of rogue computers, unauthorized Wi-Fi hot spots and digital GSM wireless bugs. (more)

Paint Your "See-Through" Walls?

Researchers (University of Tokyo) say they have created a special kind of paint which can block out wireless signals. It means security-conscious wireless users could block their neighbours from being able to access their home network - without having to set up encryption.

The paint contains an aluminium-iron oxide which resonates at the same frequency as wi-fi - or other radio waves - meaning the airborne data is absorbed and blocked.

By coating an entire room, signals can't get in and, crucially, can't get out...

Some security experts remain unconvinced by the paint. "The use of electromagnetic shielding techniques are nothing new," said Mark Jackson, security engineer at Cisco UK. (more)

Mark is correct. This is nothing new. Furthermore, the "blocking" claims are bogus. Radio waves may be attenuated, but they are not blocked. Windows and cracks around doors allow radio waves to pass freely. We've reported on this before. (more)