DARPA-Funded Hacker's Tiny $50 Spy Computer Hides In Offices, Drops From Drones

forbes.com

Even more embarrassing than a student discovering your GPS tracking device on his car, as the FBI found out last year, is having to ask him to give the expensive piece of equipment back.

So security researcher Brendan O’Connor is trying a different approach to spy hardware: building a sensor-equipped surveillance-capable computer that’s so cheap it can be sacrificed after one use, with off-the-shelf parts that anyone can buy and assemble for less than fifty dollars.

At the Shmoocon security conference Friday in Washington D.C., O’Connor plans to present the F-BOMB, or Falling or Ballistically-launched Object that Makes Backdoors. Built from just the hardware in a commercially-available PogoPlug mini-computer, a few tiny antennae, eight gigabytes of flash memory and some 3D-printed plastic casing, the F-BOMB serves as 3.5 by 4 by 1 inch spy computer. And O’Connor has designed the cheap gadgets to dropped from a drone, plugged inconspicuously into a wall socket, thrown over a barrier, or otherwise put into irretrievable positions to quietly collect data and send it back to the owner over any available Wifi network. With PogoPlugs currently on sale at Amazon for $25, O’Connor built his prototypes with gear that added up to just $46 each.

“If some target is surrounded by bad men with guns, you don’t want to have to retrieve this, but you also don’t want to have to pay four or five hundred dollars for every use,” says O’Connor. “The idea is that it’s as close to free as possible. So you can throw a bunch of these sensors at a target and get away with losing a couple nodes in the process.”

More...

Symantec Confirms Anonymous Took Product Source Code

crn.com

Symantec (NSDQ:SYMC) confirmed Friday that an India-based chapter of hacker collective Anonymous had accessed the network of an unidentified third party and had taken source code from two of its corporate security products.

The vendor said code samples provided Thursday to an online community of security professionals called Infosec Island were from two products: Symantec Endpoint Protection 11 and Symantec AntiVirus 10.2. The vendor supports the latter, but no longer sells it, while the former is currently on version 12.1. The code was four or five years old, according to Symantec.

"It would be very difficult to do anything with (the code), because it is so old," Symantec spokesman Cris Paden said.

Malware designed to take advantage of the code would only work on the older products. Therefore, hackers would have to find a company that had not updated its security software in years, an unlikely scenario. "They would have been annihilated a long time ago from cyber threats," Paden said.

Symantec claimed the theft did not indicate that source code in its current products could be taken. The software today is architected differently, so the techniques used to take code from the older products won't work, Paden said. "It's not possible that they would be able to access current-day code."

More...

Pentagon seeks probe of the cost of hacking

washingtontimes.com

The Pentagon is asking the nation’s 16 spy agencies to investigate the cost of theft of commercial secrets by foreign computer hackers, a loss some analysts say could be costing the U.S. economy hundreds of billions of dollars a year.

“We expect it is very substantial — substantial in monetary terms, substantial in security terms,” said James N. Miller, principal deputy undersecretary of defense for policy. “The nation has a substantial interest in protecting intellectual property.”

The Pentagon’s request for an estimate went to the National Intelligence Council, which produces National Intelligence Estimates (NIEs), said Deputy Secretary of Defense William J. Lynn, adding that its report will likely be classified when the assessment is complete.

Security specialists say that hackers, many thought to be operating on behalf of communist China, are stealing vast quantities of proprietary data from U.S. defense, energy and other firms every year, compromising the nation’s security and economic advantage.

“It is a massive transfer of wealth,” said Phyllis Schneck, chief technology officer for public-sector business at computer security firm McAfee Inc.“Things that would have created money and jobs for one company in one country are instead creating them for other companies in another country.”

More...

How 9/11 Completely Changed Surveillance in U.S.

wired

Former AT&T engineer Mark Klein handed a sheaf of papers in January 2006 to lawyers at the Electronic Frontier Foundation, providing smoking-gun evidence that the National Security Agency, with the cooperation of AT&T, was illegally sucking up American citizens’ internet usage and funneling it into a database.

The documents became the heart of civil liberties lawsuits against the government and AT&T. But Congress, including then-Sen. Barack Obama (D-Illinois), voted in July 2008 to override the rights of American citizens to petition for a redress of grievances.

Congress passed a law that absolved AT&T of any legal liability for cooperating with the warrantless spying. The bill, signed quickly into law by President George W. Bush, also largely legalized the government’s secret domestic-wiretapping program.

Obama pledged to revisit and roll back those increased powers if he became president. But, he did not.

Mark Klein faded into history without a single congressional committee asking him to testify. And with that, the government won the battle to turn the net into a permanent spying apparatus immune to oversight from the nation’s courts.

More...

Chinese Military TV Show Reveals More Than Intended

theepochtimes.com



A standard, even boring, piece of Chinese military propaganda screened in mid-July included what must have been an unintended but nevertheless damaging revelation: shots from a computer screen showing a Chinese military university is engaged in cyberwarfare against entities in the United States.



The documentary itself was otherwise meant as praise to the wisdom and judgment of Chinese military strategists, and a typical condemnation of the United States as an implacable aggressor in the cyber-realm. But the fleeting shots of an apparent China-based cyber-attack somehow made their way into the final cut.



The screenshots appear as B-roll footage in the documentary for six seconds—between 11:04 and 11:10 minutes—showing custom-built Chinese software apparently launching a cyber-attack against the main website of the Falun Gong spiritual practice, by using a compromised IP address belonging to a United States university. As of Aug. 22 at 1:30pm EDT, in addition to Youtube, the whole documentary is available on the CCTV website.



The screenshots show the name of the software and the Chinese university that built it, the Electrical Engineering University of China's People's Liberation Army—direct evidence that the PLA is involved in coding cyber-attack software directed against a Chinese dissident group.



More...

The Espionage Act: Why Tom Drake was indicted

(CBS News)

Nearly two years before 9/11, America's largest intelligence agency was tracking three of the Al Qaeda hijackers. But that information, obtained by the National Security agency, wasn't analyzed in a way that could uncover the plot.

Inside the super-secret NSA, several analysts and managers believed that the agency had a powerful tool that might've had a chance to head off 9/11, but it wasn't used.

As Scott Pelley first reported in May, one of those agency insiders was Thomas Drake, who thought that taxpayer money was being wasted on useless intelligence gathering projects while promising technology was ignored.

Drake tried to get the word out but, as a result, he was charged under the Espionage Act and accused of betraying his country. Drake says that the only thing he betrayed was NSA mismanagement that undermined national security.

More...

Flying Drone Can Crack Wi-Fi Networks, Snoop On Cell Phones

forbes.com

How do one ex-Air Force official and one former airplane hobby shop owner, both of whom happen to have decades of experience as network security contractors for the military, spend their weekends? Building a flying, unmanned, automated password-cracking, Wi-Fi-sniffing, cell-phone eavesdropping spy drone, of course.

At the Black Hat and Defcon security conferences in Las Vegas next week, Mike Tassey and Richard Perkins plan to show the crowd of hackers a year’s worth of progress on their Wireless Aerial Surveillace Platform, or WASP, the second year Tassey and Perkins have displayed the 14-pound, six-foot long, six-foot wingspan unmanned aerial vehicle. The WASP, built from a retired Army target drone converted from a gasoline engine to electric batteries, is equipped with an HD camera, a cigarette-pack sized on-board Linux computer packed with network-hacking tools including the BackTrack testing toolset and a custom-built 340 million word dictionary for brute-force guessing of passwords, and eleven antennae.

More...

Espionage: Russia's traitor is CIA's mascot

boston.com
The CIA isn’t supposed to brag about its successes, but it can take great pride in a Russian military court’s decision to sentence Aleksandr Poteyev in absentia to 25 years in prison. Poteyev, a former colonel in Russia’s Foreign Intelligence Service, tipped off the CIA in 1999 about 10 Russian sleeper agents who were planted in Cambridge, New York City, and northern Virginia to imitate plain-vanilla Americans and harvest information about US policy and weapons.

Thanks to the tip from double agent Poteyev, the FBI had the Russian sleeper operatives under surveillance from the start. “As a result,’’ a Russian military judge explained last week, “their work yielded few results.’’ The judge clearly made this observation to castigate a traitor and justify his harsh sentence. But he also made it clear why the 10 Russian agents rounded up last year were not charged with espionage in the United States. As it turns out, their trackers never let them get in position to acquire classified information.

More...

CI Centre Announces Global Launch of SPYPEDIA

sys-con.com

The Centre for Counterintelligence and Security Studies^® (CI Centre), the nation’s leading counterintelligence (CI), counterterrorism (CT), and security training and education company, today announced the global launch of SPYPEDIA^™. This exclusive online database provides the security and intelligence community with instant and up-to-the-minute access to all Security, CI, and CT related news and events of yesterday and today.

SPYPEDIA™ is the first online database of its kind to be offered to private and government security and intelligence professionals from around the world to include educators, academics, students, and all who share an interest in Security, CI and CT. The research and development of this project began 15 years ago with the ultimate objective of developing the world’s most comprehensive, informative, and up to date library of such information.

More...