U.S. spy agency trying to go mobile

reuters.com

(Reuters) - Troy Lange knows that just mentioning cellphones is enough to give security officers heartburn at the National Security Agency.

Lange, as the NSA's mobility mission manager, is developing a smartphone that he wants to bring inside the super-secret U.S. spy agency to access classified information and apps while on the move. He wants it to work as easily as any of the smartphones those that are so ubiquitous in the outside world.

That is no small vision for an agency where entire buildings are designated as Sensitive Compartmented Information Facilities, known as SCIFs in spy speak, with many restrictions to ensure the handling and discussion of secret information stays secure.

Visitors to the Fort Meade, Maryland, NSA complex are not allowed to bring outside cellphones into the building.

Lange argues that using smartphones inside areas that deal with secret material will increase efficiency.

"I want to get this into everybody's hands" -- every employee in the Defense Department, intelligence community and across government, he said, while acknowledging that kind of talk makes "the security people's heads pop off."

More...

Court Affirms Legality Of Recording Police Officers

wbur.org

Last Friday, the U.S. First Circuit Court of Appeals issued a ruling that affirmed, stronger than ever, the rights of individuals to openly record the actions of police officers.

In 2007, a young lawyer named Simon Glik was walking through Boston Common when he saw three police officers arresting a teenager. Glik thought the officers were getting a little rough, so he flipped open his cellphone camera and started shooting video.

The officers arrested Glik for, in their minds, violating the state’s wire-tapping law, even though the whole incident happened out in public and Glik didn’t try to conceal the fact that he was recording.

The ACLU took up Glik’s cause and the courts threw out the charges against him. Since then, the Boston Police Department has been instructing personnel that the state’s wiretapping law does not apply to people making unconcealed audio or video recordings in public. But Glik and the ACLU have pressed on, suing the BPD and the individual officers for violating his First Amendment rights.

The officers moved to have the suit dismissed, saying they were just enforcing an interpretation of the law that was handed down to them by their superiors. But on Friday, the federal court disagreed.

More...

Android becomes most attacked mobile platform

security.cbronline.com

Going rate of one million stolen email addresses is $25, says cyber security company

Google's operating system (OS) for mobile phones, Android, has become a favourite target for cyber criminals with the amount of malware targeted at Android devices jumping 76% since last quarter, to become the most attacked mobile OS.

According to computer security company McAfee's latest 'Threats Report: Second Quarter 2011', this year has also resulted in the busiest ever first half-year in malware history.

In the second quarter (2Q) of 2011, Android OS-based malware surpassed Symbian OS for the most popular target for mobile malware developers.

The report also said that while Symbian OS and Java ME remain the most targeted to date, the rapid rise in Android malware indicates that the platform could become an increasing target for cybercriminals - affecting everything from calendar apps, to SMS messages to a fake Angry Birds updates.

McAfee Labs senior vice-president Vincent Weafer said, "This year we've seen record-breaking numbers of malware, especially on mobile devices, where the uptick is in direct correlation to popularity."

Weafer also said that cyber criminals are building sophisticated malware which are difficult to detect.

More...

Technical Surveillance Threat Series, "Cellular Threats".

Note: This is the first installment in the Spy vs. Spy, "Technical Surveillance Threat Series". Stay tuned. JDL

Technical Surveillance Countermeasures, better known as "TSCM", is defined by "Wikipedia" as:

"A service provided by qualified personnel to detect the presence of technical surveillance devices ("bugs") and hazards and to identify technical security weaknesses that could aid in the conduct of a technical penetration of the surveyed facility".

In the civilian world, the above service is also sometimes referred to as a "Electronic Eavesdropping Detection" sweep or survey, or a "Bug Sweep".

Myself and my team have performed hundreds of TSCM Surveys for fortune 500 corporations, celebrities, executives, embassies, government offices, businesses, private individuals, law firms, etc., etc. There is always a common theme after an area has been cleared, "How can we protect ourselves from electronic surveillance threats after you leave?" The answer is usually complex, and almost always highly dependent upon our review (and recommendations) of our clients security posture and protocols in place at the time of the survey, and after we leave.

In this post, we will deal with one of those threats, "cellular devices", cell phones or "smart phones".

During our pre-survey Technical Threat Assessment, we usually find that "cellular devices" are allowed in almost all areas. There may be a cellular policy in place, but... during our verbal debrief after the area has been cleared, is usually when we find out what we have already discovered, that either there is no security protocol or policy in place regarding the allowance of cellular devices in board rooms and high level meetings, or there is a cellular policy in place, but it is not being enforced.

Almost all cellular phones have cameras, and many smart phones have audio recording features that allow conversations in person or over a smart phone to be easily recorded, stored, and even emailed. If you're like most of us, your cell phone is rarely more than 6 feet away from you. Many have "spy software" installed that allows for the smart phone microphone to be activated in secret without the phone ringing or lighting up. While it sits innocently near you, an eavesdropper can monitor every sound in the room.

So, does this potential eavesdropping threat sound like something that you want to allow in your next confidential boardroom meeting? Can your organization really afford to ignore this type of eavesdropping threat? Does your organization have a cellular policy in place? Is it enforced?

Here are a few personal cellular security tips:

Do not let your cell phone or smart phone out of your physical possession. Most cellular monitoring programs or "spyware" has to be installed through physical possession of the target phone. One of the best countermeasures is to keep tabs on yours.

Password protect your phone. I know it's a pain, but a password on your cell phone could save you or your organization a lot of misery.

Consider a review today of your organizations policy regarding cellular devices. Better safe, than sorry. No time? Contact ComSec, we can help. JDL

Stay tuned for the next installment in the Spy vs. Spy, Technical Surveillance Threat series.

ComSec, LLc provides professional Technical Surveillance & Eavesdropping Countermeasures services to Fortune 500 corporations to small businesses, non-profits, celebrities, executives and select individuals. Headquartered in Virginia Beach, VA | Northern VA-DC-MD. Serving the United States, and select International clients abroad.

Smart Phone Spy Software

Beware of the "Stealth Genie"....
From the manufacturers website:

Stealth Genie is a monitoring software which is easy to install and use for Android, Blackberry and Windows Mobile smart phones. The software is very feature rich and takes less than a minute to install. It is also 100% undetectable. All you have to do is install the software on to the mobile phone of the person you wish to monitor and our product does the rest.

Stealth Genie works in the background on a phone without disrupting its functionality. It allows you to track your employees and the delivery staff out in the field through its geo location feature (GPS). Through this software you can listen in to their calls, read their messages, emails and record their surroundings. You can also access their contacts, memo’s and appointment books. Our software enables you to see videos, pictures and internet browsing history on your subjects’ mobile phone as well.

Be aware...Stay tuned..JDL

You Can Stop iPhones from Spying on You, But Not Androids

theatlanticwire.com

With a new software update, Apple resolved its iPhone tracking scandal that emerged after two data scientists discovered the phones record users' every move for a year. Customers of Google's Android phones aren't so lucky. Apple's new iOS update 4.3.3. makes the iPhone stop backing up location data on your computer and deletes the data when Location Services is turned off. The company says the location information is not transmitted to Apple, however, the information still remains on your phone if you don't disable Location Services. The fix, available for download now, comes just one week after Apple initially addressed the issue.

If you've got an Android phone, however, good luck. As Engadget's former managing editor Nilay Patel tweets, "It took Apple just a week to deploy this update to all iPhone users, while Android makers are still shipping 2.2." Patael's quote speaks to Android's nagging fragmentation problem in which updates come slowly because software is not compatible with all the different Android models produced by various handset makers. TechCrunch's MG Siegler highlights the problem:

More...

150,000 Chinese cell phones bugged

Note: Think your cell phone is safe from eavesdropping? Think again...
cnngo.com
A new cell phone program, X Undercover, allows people to hack smart phones, and its being marketed mainly to married women

You might be thinking cross-border, James Bond-type shenanigans after reading about 150,000 Chinese cell phone being bugged, but it turns out the latest cell phone virus -- X Undercover -- is catering to Chinese wives who want to check up on their husbands.

On Wednesday, the Beijing Times broke the story that the computer virus has infected over 150,000 smart phones in China, allowing hackers to remotely monitor calls.

The phone forces the target smart phone to use three-way calling -- unbeknown to the two callers -- to allow the perpetrator to monitor and copy conversations and text messages.

X Undercover can also secretly video the phone's owner as well as pinpoint the user's location with the phone's GPS system.

The virus doesn’t come cheap. ChinaDaily reports that it’s sold online for RMB 3,000 a pop, with marketing -- yes, even viruses have marketing these days -- to Chinese women (and men) who believe their spouses are cheating.

Although the virus is still available online, bugging and monitoring personal information is against the law in China, according to mobile security experts quoted in ChinaDaily.

More...

'We Know Where You Are' Technology

foxnews.com

Beware of that smartphone in your hand: It might be telling more about you than you'd like.

While a smartphone has become a communications must-have, offering services such as GPS location, Internet access and more, it's also gathering information about you -- data being marketed by your cellular provider to advertisers and other commercial services.

And that fact came as a shock to most consumers contacted by FoxNews.com, who had no idea their cell phone was anything but private.

“I feel violated, that they sell my information without me knowing," said Rupert Prout of Fresno, Calif. "I feel that they shouldn’t have the power and ability to do that.”

“I don’t love the idea of people selling information about me, trying to manipulate what I do in order to make a profit,” agreed Michaela Crib of Fresno, Calif.

More...

Google's Android More Vulnerable Than iPhone, Says Trend Micro

huffingtonpost.com

According to Trend Micro Inc., the world's largest corporate security software provider, devices running Google's Android mobile operating software are more vulnerable to hackers and viruses than are Apple's iPhone devices.

During a recent interview in Taipei, Trend Micro chairman Steve Chang told Businessweek about Android's potentially dangerous security flaw: Android is open-source, which means the hacker can also understand the underlying architecture and source code [...] We have to give credit to Apple, because they are very careful about it. [...] Apple has a sandbox concept that isolates the platform, which prevents certain viruses that want to replicate themselves or decompose and recompose to avoid virus scanners.

More...

Encryption Won't Protect Your BlackBerry Now

PCWorld

A pair of Russian software developers have teamed on a password-cracking program for the BlackBerry.

Did you think your BlackBerry data was safe because it's encrypted on the phone, over the airwaves, and in its backup form? Think again. Russian software developer ElcomSoft, which, with its Russian competitor AccentSoft, has developed effective password-cracking programs for most common desktop encryption formats, is at it again. Now, it's targeted the BlackBerry with a Phone Password Breaker that was previously limited to Apple mobile devices.

More...

Cell phone spying: James Bond cool or cyberstalking tool?

computerworld.com
Security researchers masked as hackers have begun to show the world the many vulnerabilities in smart phones. MWR InfoSecurity recently cooked up a Palm Pre bug which allowed them to turn the Pre into a James Bond-like device. According to Belfast Telegraph, MWR also discovered a flaw in Google's Android phone that would allow attackers to collect all the information stored in the phone's browser, such as browser history, passwords and usernames.

In the coming years, more vulnerabilities will be discovered by security researchers and hackers. Phones may be used to conduct espionage or personal blackmail. Yet it does not take a hacker to turn your smartphone against you or to spy on you. These spy gadget "tools" have been around for years. They could be used by bosses or by a suspicious significant other.

More...

Internet era espionage pits spy against tech

(AFP)

SAN FRANCISCO — Clashes between the maker of Blackberry smart phones and India, Saudi Arabia and the United Arab Emirates are the latest rounds in a cat-and-mouse game pitting authorities against technologies racing beyond their grasp.

"What is going on is this elegant dance we go through when countries think their sovereignty is being threatened by new technology," said Mark Rasch, who headed the computer crimes division at the US Department of Justice for nine years.

"Governments are very ready to deploy technology that invades privacy, but privacy enhancing technologies make them nervous."

Security experts put the row over Blackberry encryption capabilities in the context of decades of skirmishing around the security implications of new Internet and communications technologies -- a battle that today also touches services like Google's Talk messaging system and the telephone and video services provided by Skype.

More...

What your phone app doesn't say: It's watching

(AP)

LAS VEGAS — Your smart phone applications are watching you — much more closely than you might like.

Lookout Inc., a mobile-phone security firm, scanned nearly 300,000 free applications for Apple Inc.'s iPhone and phones built around Google Inc.'s Android software. It found that many of them secretly pull sensitive data off users' phones and ship them off to third parties without notification.

That's a major concern that has been bubbling up in privacy and security circles.

The data can include full details about users' contacts, their pictures, text messages and Internet and search histories. The third parties can include advertisers and companies that analyze data on users.

The information is used by companies to target ads and learn more about their users. The danger, though, is that the data become vulnerable to hacking and use in identity theft if the third party isn't careful about securing the information.

Lookout reported its findings this week in conjunction with the Black Hat computer security conference in Las Vegas.

Lookout found that nearly a quarter of the iPhone apps and almost half the Android apps contained software code that contained those capabilities.

More...

iPhones and BlackBerrys contributing to corporate espionage

siliconrepublic.com

The world of computer forensics used to be largely confined to the computer hard drive, but as more and more business professionals carry sensitive data around with ease on smart phones, BlackBerrys and iPhones, the challenge is to sort through the massive amounts of data being created and stored, as well as getting to grips with the different storage formats of all of these mobile devices.

“Investigators are now required to review and analyze a massive volume of data,” said Chris Taylor, forensic investigator with Dublin-based IT security company, Espion.

The average data seizure is now in the region of a staggering 180GB, so if a forensic computer scientist wanted a cromulent analysis of a PC’s hard drive it would take an entire week for that device alone, and the proliferation of the mobile device throws another spanner into the works.

“The impact of new technical devices is also extremely relevant, as there is a growing need for investigators to consider forensic artifacts on mobile devices.”

More...

Smartphone Malware Multiplies

darkreading.com
More than twice the number of malware and spyware hitting BlackBerry, Windows Mobile, and Android phones than six months ago

The number of malware and spyware programs found on smartphones has more than doubled in the past six months -- and some types of malware are more prevalent on certain smartphone platforms than others.

New data gathered from users of a free smartphone security tool shows the bad guys are increasingly going after smartphone users. According to Lookout, which offers a free lightweight mobile client with cloud-based security, backup, and anti-theft features, there were about nine pieces of malware and spyware per 100 smartphones as of last month -- more than twice as many as in November 2009.

More...

Protecting the smartphone from malware

connectedplanetonline.com

Despite the increasing sophistication of smartphones and other mobile devices, viruses and malware don’t plague the wireless industry the way they do the personal and business computing worlds. But computer protection software giant Symantec has decided to dive into the smartphone space regardless, in anticipation of future security threats and to stake a claim in the growing applications market.

Symantec (NASDAQ:SYMC) today announced the launch of Norton Everywhere a suite of services and applications targeting Android and Apple iPhone devices as well the growing number of non-PC devices connected to the Internet via Wi-Fi and home networks. The most familiar service in that suite is a mobile version of its Norton Antivirus software, initially for Android phones only, which identifies malicious applications and software before they’re downloaded and installed onto a device. It will also scan applications already installed on a device to see if they are doing anything suspicious, such as accessing phone logs and phone books and relaying that information across the network, and warn users about just what their apps are doing.

Norton Mobile will be available as a Beta application in June, and while Symantec is investigating optimizing the security solution for other platforms, it felt Android was the best place to start. Unlike the iPhone, which uses a closed application distribution model driven by Apple’s App Store, Android software can come from anywhere — the Web, third-party app stores, even embedded in an e-mail, said Dan Nadir, director of product management for Symantec.

More...

iPhone Security Flaw: Using a PIN Won't Help You

pcworld.com
Using a four-digit PIN to lock your iPhone doesn't really protect your data, security and IT blogger Bernd Marienfeldt has discovered. In an article describing the iPhone's business security framework, Marienfeldt has found a "data protection vulnerability" in Apple's iPhone 3GS.

Marienfeldt, working with security expert Jim Herbeck, has been able to reproduce the vulnerability on at least three non jail-broken iPhone 3GS handsets with different iPhone OS versions installed (including the latest). All tested iPhones were protected with a four-digit PIN.

In Marienfeldt's own words:

"The unprotected iPhone 3GS mounting is “limited” to the DCIM folder under Ubuntu <>please do make sure that the native Ubuntu system is fully up to date, e.g. “apt-get update, “apt-get upgrade” - any virtualization based solution will not work as described). I used the Alternate CD with x86 and AMD64 on different hardware."

More...

Thieves Flood Victim’s Phone With Calls to Loot Bank Accounts

wired.com

Bank thieves have rolled out a new weapon in their arsenal of tactics — telephony denial-of-service attacks that flood a victim’s phone with diversionary calls while the thieves drain the victim’s account of money.

A Florida dentist lost $400,000 from his retirement account last year in this manner, and the FBI said the attacks are growing.

A spokeswoman for the Communication Fraud Control Association — a telecom industry organization — told Threat Level that although fraudulent transfers have been halted in a number of cases, the losses are increasing.

“I know it’s in the millions,” said Roberta Aranoff, executive director of the CFCA. “It has exceeded a million dollars easily.”

Last November, Robert Thousand Jr., a semi-retired dentist in Florida, received a flood of calls to several phones. When he answered them, he heard a 30-second recording for a sex hotline, according to the St. Augustine Record.

More...