Revealed: Technical Surveillance Threats

Revealed: Technical Surveillance Threats


Spy Cam 101

Not long ago while on assignment, I was asked "How many times do you actually find technical surveillance threats?"
My answer was "Well, I would tell you but then I would have to...." Just kidding,  The real answer is more often than you would think..
Although, not every technical surveillance threat involves finding a device. It can also can mean discovering a technical surveillance vulnerability. Like for instance, the allowance of cellular devices (w/ cameras) or iPads in conference rooms and during high level meetings. Or, the allowance of digital recorders within these areas, just to name a few.

It's not always "James Bond" spy gear that turns up during a sweep.

But every now and then, I still discover a "surprise" that may (or may not) have been left behind...on purpose.

For example, take this pen & pencil holder discovered during the wee hours of the morning while sweeping the "Presidential Suite" of one of our clients facilities.

Plain looking enough, but take a closer look... Through our Thermal Imaging Camera... Notice that hot spot? So did we...It turned out to be a hardwired Spy cam, with audio....Here's another look..

This was only one of the technical surveillance threats found during this assignment. Yes, you heard me right, only one of several threats found...

So, the short answer is YES, technical surveillance threats (although crude) like the above are used for intel collection purposes by your adversaries. i.e.; disgruntled employee, competitor, corp spy, eavesdropper, etc.
So be aware, these types of surveillance threats could be lurking closer than you might think...

If you don't mind me asking, When was your last TSCM Sweep?  Not Sure?  Contact Me here. I can help.

Stay tuned for the next "reveal"....JDL

Smartphone security gap exposes location, texts, email, expert says

latimes.com
Just as U.S. companies are coming to grips with the threats to their computer networks emanating from cyber spies based in China, a noted expert is highlighting what he says is an even more pernicious vulnerability in smartphones.

Dmitri Alperovitch, the former McAfee cyber security researcher who is best known for identifying a widespread China-based cyber espionage operation he dubbed "Shady Rat," has used a previously unknown hole in smartphone browsers to deliver an existing piece of China-based malware that can commandeer the device, record its calls, pinpoint its location and access user texts and emails. He conducted the experiment on a phone running Google's Android operating system, although he says Apple's iPhones are equally vulnerable.

"It's a much more powerful attack vector than just getting into someone's computer," said Alperovich, who just formed a new security company, called Crowdstrike, with former McAfee chief technology officer George Kutz.

Alperovich, who has consulted with the U.S. intelligence community, is scheduled to demonstrate his findings Feb. 29 at the RSA conference in San Francisco, an annual cyber security gathering. The Shady Rat attack he disclosed last year targeted 72 government and corporate entities for as long as five years, siphoning off unknown volumes of confidential material to a server in China.

More...

IT and espionage on Wall Street

economist.com

An overturned conviction creates uncertainty about what constitutes a crime

ASK a programmer at an investment bank where he works, and the answer will often simply be “Wall Street”. Isolated from clients and—it was once thought—assets with proprietary value, technologists bounce from firm to firm, from one high-rise building to another.

To this footloose community, the case of Sergey Aleynikov, a Goldman Sachs programmer, came as a shock. Mr Aleynikov was convicted in December 2010 of stealing code tied to Goldman’s lucrative high-speed proprietary-trading operations for use by a new employer. On February 16th, after he had spent nearly a year in prison, three judges in a federal appeals court unanimously reversed his conviction in a hearing that lasted just a single morning. Their written opinion is now eagerly awaited.

Mr Aleynikov admitted to taking code with him on his way out of Goldman, but argued successfully that this did not constitute a crime, or, to be more specific, a federal crime. He benefited from the help of a thorough lawyer, who adroitly knocked down two key claims. Because the computer trading system was not licensed or offered for sale, claimed Kevin Marino, the defendant’s lawyer, it was not a product to be bought or sold for interstate commerce, a key provision for a federal case. Because computer coding constitutes intangible intellectual property, Mr Marino said, it did not qualify under the goods, wares or merchandise components that are protected under the corporate-espionage act.

More...

COMSEC AUDIO JAMMER APP for iPHONE

itunes.apple.com

COMSEC AUDIO JAMMER

Keep your private conversations private!

The COMSEC AUDIO JAMMER protects your sensitive room conversations by generating a random masking sound, which desensitizes any near-by microphone. Effective against any microphone based eavesdropping device including tape recorders, RF transmitters, hard-wired microphones (including contact type) and shotgun microphones. It also protects against microwave or laser reflection pickups (when used correctly).
COMSEC AUDIO JAMMER uses specially designed audio speech patterns to mask your conversations from hidden microphones & eavesdroppers.
The speech patterns are randomly designed and generated to mask normal conversations from eavesdroppers. 


More...get the app here.

Securing Corporate Data in a Law Office's Computer Network

Note: An excellent article, and a serious subject... When is the last time your law firm had a Cyber TSCM sweep? Ever? Contact me, I can help. ~JDL

law.com

The dramatic rise in electronic economic espionage against U.S. corporations came into full view with a report on the trend issued by the U.S. government last November. That same month, the Federal Bureau of Investigation held a meeting in New York City with some of the weaker links in the online spy game: law firms.

It’s an issue that should be getting the attention of in-house counsel, especially as they share sensitive--and potentially valuable--data with outside counsel.

Rich with client information, law firms are often much less equipped to fend off cyberattacks than the corporations they represent. Ergo “a hacker can hit a law firm and it’s a much, much easier quarry,” Mary Galligan, head of the cyber division in the FBI’s New York City office told Bloomberg. Likewise, in a series of blog posts on this issue currently running in Forbes, cybersecurity expert Alan Paller says: “The important files relating to clients’ international activities are usually much easier to find in the law firms’ files than in the corporate files.”

Digital risk consultancy Stroz Friedberg has advised both law firms and corporate clients on this growing problem. Firms need to take a risk-oriented approach to protecting client information, says company co-president Eric Friedberg, a former federal prosecutor and an expert in cybercrime response. At the same time, he says, there are important questions in-house counsel can ask about how their files will be protected (seeCounsel’s Dozen list below).

“Attackers go where the money is,” says Friedberg. These days, law firms should assume that hackers will infiltrate their network, and they should identify which digital assets are most at risk and put the most security around those areas, he says.


More...

Chinese Telecoms May Be Spying on Large Numbers of Foreign Customers

theatlantic.com
A U.S. Congressional probe is investigating whether China's state-linked firms, which built much of the communications infrastructure in several Asian countries, is using its access for snooping.

Two Chinese telecommunications giants are under scrutiny by a US congressional committee. The outcome of the probe could have revealing implications for Central Asian states, which have used these companies to modernize their telecom sectors.
US legislators have expressed concern that Huawei and ZTE act as front companies for the Chinese government, and represent a grave "cyber-security threat." The chairman of the House Permanent Select Committee on Intelligence, Michigan Republican Mike Rogers, asserted during a congressional hearing last October that China is engaged in the "brazen and wide-scale theft of intellectual property from foreign commercial competitors."
"Attributing this espionage isn't easy, but talk to any private sector cyber analyst, and they will tell you there is little doubt that this is a massive campaign being conducted by the Chinese government," he added.

More...

Traveling Light in a Time of Digital Thievery

Note: Having recently traveled to China, I can attest to Mr. Lieberthal's concerns....Do yourself (and your company) a favor, Just accept the fact that you "will" be collected against...and take Mr. Lieberthal's advice...very seriously.  JDL

nytimes.com

SAN FRANCISCO — When Kenneth G. Lieberthal, a China expert at the Brookings Institution, travels to that country, he follows a routine that seems straight from a spy film.
He leaves his cellphone and laptop at home and instead brings “loaner” devices, which he erases before he leaves the United States and wipes clean the minute he returns. In China, he disables Bluetooth and Wi-Fi, never lets his phone out of his sight and, in meetings, not only turns off his phone but also removes the battery, for fear his microphone could be turned on remotely. He connects to the Internet only through an encrypted, password-protected channel, and copies and pastes his password from a USB thumb drive. He never types in a password directly, because, he said, “the Chinese are very good at installing key-logging software on your laptop.”
What might have once sounded like the behavior of a paranoid is now standard operating procedure for officials at American government agencies, research groups and companies that do business in China and Russia — like Google, the State Department and the Internet security giant McAfee. Digital espionage in these countries, security experts say, is a real and growing threat — whether in pursuit of confidential government information or corporate trade secrets.


More...

Bugging equipment found in Mexico lawmaker offices

philstar.com

MEXICO CITY (AP) — A search of several Mexican lawmakers' offices turned up recording equipment, leading legislators to believe they have been spied on for years, a congressman said Wednesday.
Congressman Armando Rios said security personnel found microphones and other devices that seemed to have been installed years ago.

"Some of the equipment has newer technology, but other devices are from a long time ago, which leads us to believe they were installed years ago," said Rios, a member of the leftist Democratic Revolution Party, or PRD

Rios said the offices of key committees and of several lawmakers from different political parties were bugged.

"What is at stake is the vulnerability of the legislature, of one of the powers of the union," Rios said.

Congress president Guadalupe Acosta, also of the PRD, on Tuesday filed a complaint with federal prosecutors, who opened an investigation.

Acosta wouldn't identify the lawmakers who were being spied on or who he thinks was behind the espionage. Rios blamed the government of President Felipe Calderon, who belongs to the conservative National Action Party, or PAN.
Interior Secretary Alejandro Poire denied Rios' accusations and said the government has done nothing illegal.

Mexico's main intelligence agency allegedly spied on the government's political opponents during the 71 years of rule by the Institutional Revolutionary Party, or PRI.

After PAN candidate Vicente Fox won the 2000 presidential election, he announced that the agency, the Center for National Security and Investigation, would no longer spy on political opponents. But in 2008, under Calderon, the agency hired a private company to monitor the activities of legislators.

Legislators complained they were being spied on but the government said it was simply collecting public information.

More...

Todd Haley's Bugging Allegations

bleacherreport.com
It's no surprise that former Kansas City Chiefs head coach Todd Haley is in the news right now—he is one of the hottest free agent coaching commodities on the market right now—what is odd, however, are the reasons he is showing up right now. 

Reports by the Kansas City Star, which include allegations by Haley, tell of the levels of paranoia and anxiety on Arrowhead drive.

Haley, the most high profile former staffer named in the report, tells of his fears that his phones, both in his office, and his private cell phone, may have been tapped. He spoke of his concerns that his office, and conference rooms at the facility were bugged and monitored for audio.

Others spoke of the levels of secrecy in Arrowhead stadium, which forbid non-football staffers from visiting certain parts of the complex, and which require staff with a view of the practice fields to close their blinds during team practices. They spoke of, on occasion, having meetings and phone calls interrupted by security staff charged with enforcing the rule. 

Haley claimed that he stopped speaking on the telephone altogether during his last year in Kansas City because his concerns were so severe. However, all of this begs the question, is there any substance to Haley's claims, or are these merely the rantings of a disgruntled former employee, who is becoming increasingly out-of-touch with reality?

What do these claims say about Haley, and what, if anything, do they do to his chances of being hired? Join me after the jump, as we take a look.

More...

10 Sites Skewered by Anonymous, Including FBI, DOJ, U.S. Copyright Office

techland.time.com

By the time East Coasters were finishing dinner last night, 10 websites had fallen to what hacktivist group Anonymous calls its “low orbit ion cannon,” or LOIC — a public domain software tool named after a weapon in a popular sci-fi real-time strategy game that’s designed to stress test whether a network can handle a distributed denial of service attack.

According to Anonymous, 10 well-known governmental and corporate sites with ties to the entertainment industry were assaulted and knocked offline in retaliation for the FBI shutting down Megaupload.com, one of the world’s largest file-sharing sites. The FBI had closed Megaupload.com earlier Thursday afternoon, accusing the company of more than $500 million in revenue losses stemming from copyright violations, and arresting four people in connection with the indictment.

(MORE: Anonymous Claims DOJ, RIAA, MPAA Sites Hit for Megaupload Bust)

Dubbing its DDoS spree “OpMegaupload,” Anonymous claims it took down usdoj.govand justice.gov (the U.S. Department of Justice), universalmusic.com (Universal Music Group),RIAA.org (the Recording Industry Association of America), MPAA.org (the Motion Picture Association of America), copyright.gov (the U.S. Copyright Office), hadopi.fr (France’s copyright-enforcement agency), wmg.com (Warner Music Group), bmi.com (Broadcast Music, Inc.) andfbi.gov (the Federal Bureau of Investigation). The DOJ’s website was first to fall, about an hour after the Justice Department announced its indictment of Megaupload.com.

More...

Facebook names $2m 'Koobface' hacking gang

telegraph.co.uk
Facebook has publicly identified a gang of five alleged cyber criminals it believes are behind Koobface, a piece of malicious software that has hijacked hundreds of thousands of Facebook users’ computers and made millions for its creators.

After an investigation by Facebook and several independent security researchers, the gang behind Koobface have been named as a group of Russians operating relatively openly in central St Petersburg.

According to their own social networking profiles, the five men have enjoyed a luxurious lifestyle. On one group holiday, they visited Spain, Nice and Monte Carlo, before ending the trip at a casino in Germany, according to Sophos, a British security firm involved in the investigation.

The gang were “living the life of the rich and famous”, Sophos said.

Facebook said it has known the identities of the gang for some time, but has decided to name them publicly after being frustrated by the lack of law enforcement action against them. The Telegraph has chosen not to name them for legal reasons.

“We’ve had a picture of one of the guys in a scuba mask on our wall since 2008,” said Ryan McGeehan, manager of investigations at Facebook.

More...

Cyber-Crimes Pose 'Existential' Threat, FBI Warns

huffingtonpost.com

Despite the increased frequency and severity of online crime and espionage in 2011, many American corporations and consumers are still not taking the threat seriously, the FBI's top cyber official said Thursday.

The risk posed by criminal hackers is "existential, meaning it could eliminate whole companies," said Shawn Henry, the FBI's executive assistant director. If hackers were able to tamper with critical infrastructure such as the power grid, "it could actually cause death," Henry said in remarks at the International Conference on Cyber Security in New York.

To highlight the growing threat, Henry cited several recent FBI investigations, such as one involving a smaller company that went out of business after hackers stole $5 million from accounts, another concerning a larger firm that "virtually overnight" lost a decade of research and development worth $1 billion, and still another regarding hackers who encrypted millions of records of a health services company and demanded money for the password.

"We've seen the number and sophistication of the attacks by these cyber actors increase dramatically," Henry said.

"Hundreds of millions of dollars have been stolen, primarily through the financial services sector, just in the last couple years," he said. An organized crime ring in Eastern Europe, for example, earned about $750,000 per week from cyber theft, he added.

More...

Note: Does your company have a Cyber TSCM / Cyber Counterespionage plan in place? Contact me, I can help. ~JDL

Cyber Attacks May Be Revealed to Investors as SEC Rules Push Disclosures

Note: This was bound to happen as more and more companies become victims of Cyber Espionage. Has your company become a victim of Cyber Espionage? And, more importantly, does your company have a Cyber TSCM / Cyber Counterespionage strategy in place to mitigate this risk? 
Contact me, I can help. ~JDL

bloomberg.com

China-based hackers rifled the computers of DuPont Co. (DD) at least twice in 2009 and 2010, hunting the technological secrets that made the company one of the world’s most successful chemical makers.

It’s not something investors would have learned from DuPont’sregulatory filings, or from those of other companies victimized by hackers. The 10-K’s DuPont submitted to the U.S. Securities and Exchange Commission over the period don’t identify hacking as even a significant risk, much less reveal what two U.S. intelligence officials later said was a successful case of industrial espionage.

Over the next three months, as publicly traded companies file 10-K’s, investors may see new admissions of corporate networks being hacked after the SEC said companies can’t continue to hold back the details of those incidents.

As cyberspies from China, Russia and other countries ransack the computer networks of one major U.S. and European firm after the next, the SEC in October offered its new interpretation of disclosure requirements as applied to cybercrime. The amount of information that’s forthcoming will depend on whether company lawyers determine the incidents had, or will have, a material effect on the enterprise.

Daniel Turner, a spokesman for Wilmington, Delaware-based DuPont, said, regarding the previously-reported hack, “We let our disclosures speak for themselves.”

More...

Symantec Confirms Anonymous Took Product Source Code

crn.com

Symantec (NSDQ:SYMC) confirmed Friday that an India-based chapter of hacker collective Anonymous had accessed the network of an unidentified third party and had taken source code from two of its corporate security products.

The vendor said code samples provided Thursday to an online community of security professionals called Infosec Island were from two products: Symantec Endpoint Protection 11 and Symantec AntiVirus 10.2. The vendor supports the latter, but no longer sells it, while the former is currently on version 12.1. The code was four or five years old, according to Symantec.

"It would be very difficult to do anything with (the code), because it is so old," Symantec spokesman Cris Paden said.

Malware designed to take advantage of the code would only work on the older products. Therefore, hackers would have to find a company that had not updated its security software in years, an unlikely scenario. "They would have been annihilated a long time ago from cyber threats," Paden said.

Symantec claimed the theft did not indicate that source code in its current products could be taken. The software today is architected differently, so the techniques used to take code from the older products won't work, Paden said. "It's not possible that they would be able to access current-day code."

More...

Brute force tools crack Wi-Fi security in hours, millions of wireless routers vulnerable

computerworld.com

If you set WPA/WPA2 security protocol on your home or small business wireless router, and you think your Wi-Fi is secure, there two recently released brute force tools that attackers may use to bypass your encryption and burst your security bubble. The irony is that the vulnerability which can be exploited was intended to be a security strength, a usability issue to help the technically clueless setup encryption on their wireless networks. Wi-Fi Protected Setup (WPS) is enabled by default on most major brands of wireless routers including Belkin, Buffalo, D-Link, Cisco's Linksys and Netgear, leaving millions of wireless routers around the world vulnerable to brute force attacks which can crack the Wi-Fi router's security in two to ten hours.

Most wireless routers come with a WPS personal identification number (PIN) printed on the device. When a user is setting up a wireless home network via a network setup wizard, enabling encryption is often as easy as pushing a button on the router and then entering the eight digit PIN which came with it. When an attacker is attempting to brute force the PIN and an incorrect value was entered, a message is sent that basically tells an attacker if the first half of the PIN was right or not. Additionally, according to Stefan Viehbock, the security researcher who reported the flaw, "The 8th digit of the PIN is always the checksum of digit one to digit seven," meaning it only takes an attacker about 11,000 brute force guesses to own the password. Unfortunately most wireless routers don't have a lockout policy after several failed password attempts.

More...

How to Know If Someone Bugged Your Room

theatlanticwire.com


For tips on sweeping a room for surreptitious surveillance devices, look no further than the Federal Bureau of Investigation. That's where members of the federal government have been going for years to find out who's wiretapped their telephone or implanted a microphone in their corner office. And now we know a lot more about the bureau's routine wiretap inspections thanks to GovernmentAttic.org, a website that publishes documents from Freedom of Information Act requests. The site has published a 66MB cache of correspondence from 1952 to 1995 detailing various issues of telephone security often involving paranoid government officials from senators to post master generals to secretaries of the Department of Agriculture to President Richard Nixon who think someone is surreptitiously listening to their conversations. 

It's going to take an army of readers to rummage through the entire cache of FBI documents but from what we've read so far, much of the correspondence involves government officials requesting wiretap inspections from the FBI, typically because they fear sensitive information has leaked from their office, and, upon inspection, the FBI finds nothing. Interestingly, they do often provide an informative report on how they went about sweeping the room.

As you can imagine, the descriptions of wiretap sweeps get much more technical from the '50s to the '70s to the '90s. In the old days, a wiretap inspection was simpler. Take this sweep of the office of Postmaster General Arthur Summerfield in 1953. 

More...

Note: A "Do it yourself" sweep, is kind of like "do it yourself" plumbing...you get what you pay for...

Don't let those "leaks" continue...contact me, I can help. ~JDL

Police group members react to Anonymous hacking

news10.net
SACRAMENTO, CA - A day after Anonymous hacked into California Statewide Law Enforcement Association's website, CSLEA members are still learning about the security breach.

Plus, the CSLEA homepage is still down.

RELATED STORY: Thousands affected after Anonymous hacks police union website

The well-known international hacking group released the names, home addresses, and phone numbers of public safety professionals, many of them police officers. It also exposed credit card information on purchases made in their online gift shop.

Anonymous claimed on their post that they have 2,500 names and passwords, and in some cases, credit card numbers. The hacker group justified releasing the information asserting, "California law enforcement officers are notorious for brutality."

Union president Alan Barcelona said CSLEA had information taken in November. All members who had their information breached then were contacted by phone or letter. The letter, dated Nov. 10, "confirms that credit card information of customers of the CSLEA online store had been compromised"

It stated, "Fortunately, most of the credit cards that were compromised had expired." And, it went on to state, "Additionally, all of the information which was previously maintained on the site has been purged."

Teresa Dobbins, an employee of the Department of Justice, never got word of the breach in November. And she wasn't informed that her personal information, including her email address, phone number, and home address, were leaked onto the web New Year's Day, until News 10 contacted her.

"If they were aware of it, they should have tried to notify me before the media did," Dobbins said.

More...

VoIP eavesdropping: Hardening network security to contain VoIP risks

searchsecurity.techtarget.com

Every organization considering a Voice over Internet Protocol (VoIP) telephone system deployment hears the same dire warnings: “Routing voice calls over a data network exposes calls to eavesdropping.”

While it’s certainly true that any telephone call carries a certain degree of eavesdropping risk, is it true that VoIP calls have an inherently higher degree of risk? In this tip, we explore the ins and outs of VoIP eavesdropping.

VoIP eavesdropping is possible First, it’s important to be clear about one thing: It is absolutely possible to eavesdrop on a VoIP telephone call. It’s also possible to eavesdrop on a telephone call placed using the traditional public switched telephone network (PSTN). The difference lies in the tools and skill set needed to conduct the eavesdropping.

On a traditional telephone network, someone seeking to eavesdrop on a call generally must have physical access to either the telephone or telephone cable, at least at the initiation of the attack. This type of attack is typical in the movies. Whether it’s the good guys or the bad guys conducting the eavesdropping, someone gains access to either a telephone handset or the telephone network interface box -- sometimes located outside a home or office -- places a wiretap listening device on the box, and then monitors calls on an ongoing basis.


More...

Anonymous exposes 75,000 credit card numbers

washingtonpost.com

Hacker collective Anonymous has just dumped 200 GB of names, email addresses and passwords for around 860,000 Stratfor users. Anonymous also exposed credit card numbers for 75,000 paying customers of Stratfor.

Stratfor, a security think tank, provides reports on international security and related threats to government and military personnel as well as to the private sector. It is unknown whether Anonymous gained access to other, more sensitive information during the Stratfor hacks, which occurred on December 24.

“The time for talk is over,” wrote Anonymous last night on Pastebin.

“It’s time to dump the full 75,000 names, addresses, CCs and md5 hashed passwords to every customer that has ever paid Stratfor. But that’s not all: we’re also dumping ~860,000 usernames, email addresses, and md5 hashed passwords for everyone who’s ever registered on Stratfor’s site… Did you notice 50,000 of these email addresses are .mil and .gov?”

Anonymous’ motives for the attack are also somewhat hazy. In last night’s statement, representatives of the movement wrote, “All our lives we have been robbed blindly and brutalized by corrupted politicians, establishmentarians and government agencies sex shops, and now it’s time to take it back.”

In addition to the Stratfor attack and exposure, Anonymous is threatening a new action on New Year’s Eve, December 31.

More...

Internet Crime Complaint Center's (IC3) Scam Alerts December 29, 2011

ic3.gov

This report, which is based upon information from law enforcement and complaints submitted to the IC3, details recent cyber crime trends, new twists to previously-existing cyber scams, and announcements.

POPULAR PASSWORDS

An Internet site who manages passwords recently posted an article pertaining to the lack of secure passwords being utilized which may be a factor in data breaches — past, present, and future. One reason for the lack of security is the amount of passwords a user is required to remember to access the many databases, applications, multiple networks, etc., used on a daily basis. Sharing passwords among users in a workplace is becoming a common theme to continue the flow of operations. Users have prioritized convenience over security when establishing passwords.

The article provided a list of millions of stolen passwords posted on-line by hackers and ranked the top 25 common passwords.

1. password
2. 123456
3. 12345678
4. qwerty
5. abc123
6. monkey
7. 1234567
8. letmein
9. trustno1

1. dragon
2. baseball
3. 111111
4. iloveyou
5. master
6. sunshine
7. ashley
8. bailey
9. passw0rd

1. shadow
2. 123123
3. 654321
4. superman
5. qazwsx
6. michael
7. football

More...