Government Investigates Cellphone Wiretapping

theatlantic.com
As the government begins an investigation into Carrier IQ's cell phone-tracking software, memories of its own wiretapping scandal resurface


"Spy on unsuspecting Americans? That's our job," you can imagine federal officials indignantly declaring as they investigate cell-phone tracking by the mobile software company, Carrier IQ. The National Security Agency began secret, illegal surveillance of our phone calls and Internet activities in 2001, as we belatedly learned in 2005. Yes, 2005 is a long time ago these days, when yesterday seems like old news; but the NSA scandal deserves to be remembered, especially when the government presumes to be outraged by telecom spying.  

When it began spying on us after 9/11, the Bush Administration enlisted the assistance of telecoms willing to engage in illegal activities at its behest. (Former Qwuest CEO Joseph Nacchio later claimed that after he declined to cooperate with the surveillance program, in 2001, the government retaliated, denying the company lucrative contracts. In 2007, Nacchio was convicted of insider trading.) After the NSA program was exposed, complicit telecoms faced the risks of losing expensive civil suits. AT&T, in particular, was badly exposed, thanks to incriminating documents released by a whistleblower and a lawsuit filed by the Electronic Frontier Foundation. But not surprisingly, Congress intervened. In 2007, it retroactivelyimmunized the companies for illegal activities authorized by the president. As the late, disgraced Richard Nixon explained, prematurely, "when the President does it, it's not illegal." Voting in favor of telecom immunity, then candidate and Senator Obama apparently agreed.


More...

Attackers Get Sneakier With Encrypted Malware

pcworld.com

Malware just got sneaky! Well, sneakier, that is. Attackers in Brazil have found a way to sneak around antivirus programs by using cryptography.

Recently Dmitry Bestuzhev, Kaspersky Lab's Head of Global Research and Analysis Team for Latin America, was looking over some potentially malicious links from Brazil when he discovered some files with .jpeg filename extensions. At first glance, Bestuzhev thought that they were some form ofsteganography--the art and science of hiding messages. But upon further inspection, the reseacher discovered that they were actually more like .bmp (bitmap) files, than JPEGs.

The data contained within the files themselves was obviously encrypted and contained some kind of malware; Bestuzhev later discovered that the data was in the form of block ciphers--a cryptographic method that encrypts 128-bit blocks of plain text in to 128-bit blocks of cipher text. Since block ciphers can only be composed of 128-bit blocks, they must break up the message into several blocks and encrypt each one individually. A process called modes of operationallows a cryptographer to repeatedly use block ciphers to encrypt an entire program--or piece of malware, in this case.

More...

Fox-IT and TNO to Work on System for Detecting Digital Espionage

digitaljournal.com

Delft, The Netherlands (PRWEB) November 16, 2011

The threat of targeted cyber attacks, especially digital espionage is increasing rapidly. The current security measures against cybercrime focus primarily on the detection of massive and indiscriminate attacks. To protect businesses and governments against cyber espionage Fox-IT and TNO are developing the Cyber Attack Detector (CAD).

Analyzing a large number of digital espionage indicators will allow users to be instantly alerted when there are activities that indicate fraud or espionage. The Ministry of Economic Affairs, Agriculture and Innovation in The Netherlands has granted €800,000 via the “Innovation for Public Security” program for the development of this joint solution.

Digital espionage threat is increasing, protection lagging
The social and economic impact of cybercrime is increasing, as is the demand for an effective protection against cybercrime. The attack methods of the digital spy have become more sophisticated, with increasing reports of very specific and targeted attacks. Traditional protective equipment such as intrusion detection systems, firewalls, virus scanners, and log analyzers offer inadequate protection.

More...

McAfee reveals ‘Shady RAT’ espionage ring

c4isrjournal.com

The massive cyber espionage operation disclosed by the security company McAfee began with its 2009 discovery of a suspicious command-and-control server.

The server contained logs showing the Internet Protocol addresses for the firewalls and email gateways of dozens of companies and organizations around the world.

Intruders possibly working for a “state actor” used this server to steal secrets from at least 72 victims in 14 countries, according to McAfee’s new report, “Revealed: Operation Shady RAT.” Rat is the cyber industry’s term for the remote access tools used by the intruders.

McAfee will not say which country it suspects might be behind the intrusions or provide details about the server, except to say it was located in a Western country and that the IP logs were acquired legally.

After the 2009 discovery, the company began quietly notifying law enforcement agencies and signing nondisclosure agreements with some of the victims. McAfee said it has briefed foreign governments, congressional staff members and White House officials.

Because of countermeasures, the Shady RAT intruders have adjusted their tactics, but their operation is “still going on today,” McAfee’s Dmitri Alperovitch, vice president for threat research, said in a teleconference with reporters in August.

More...

The Best Spies Money Can Buy

darkreading.com

Security firms have found evidence that espionage agents are buying time on leased botnets: Will cybercriminals services lead to more efficient spying?

During the past decade, cybercriminals have specialized in the various tasks needed to compromise computers, steal data, and make money. Now, more elusive nation-state attackers could be using rented botnets and cybercriminal services to streamline their own operations, security experts say.

In June, security firm FireEye detected evidence of such a connection when it found instances of a remote-access Trojan whose code seemed to have been reused to infect machines with fake antivirus software. In another incident, cybercriminals sold access to compromised military and government computers, allowing would-be cyberspies to get direct access to their targets, says Darien Kindlund, senior staff scientist at FireEye.

The two examples are part of a building body of evidence that suggests attackers representing what the military and security industry refer to as the advanced persistent threat (APT) are not shying away from using criminals' resources to help them in their missions.

"If military and government hosts are being sold on the black market, who are the most likely buyers -- spammers?' No, they could buy something cheaper on a different network. But for APT?'Yes, it meets their mission objectives," Kindlund says.

More...

Cyber spying is the new face of espionage

cbc.ca

'When we do trace [cyber espionage] back to China, the Chinese put the blame on a rogue group of hackers — they're very careful to make sure it never gets traced back to intelligence or defence sources.'—Christian Leuprecht, Royal Military College of Canada

When many people think of espionage, the image that readily comes to mind is of the furtive spy, clad in black, taking photographs of secret dossiers with a camera disguised as a cigarette lighter. It's an image that seems quaint and dated, especially since the end of the Cold War. But the recent controversy surrounding Conservative MP Bob Dechert's flirtatious email exchanges with a Chinese journalist remind Canadians that the threat of international espionage did not vanish with the fall of the Iron Curtain.

If anything, the threat to Canadian secrets has strengthened in recent years and is something the federal government is fighting on a daily basis.

Christian Leuprecht, an associate professor of political science at the Royal Military College of Canada in Kingston, says the Dechert case represents a textbook example of international espionage.

"It is an active, long-standing intelligence tradition to use journalists, because it's easy to place them on temporary assignment somewhere for a period of time," he said. Journalists ask questions, meet people, learn things. "There seems to be something more to the story than meets the eye." But although they are still used, the need for such field operatives is declining in the online age.

More...

Defence contractor warns of false cyber security beliefs

crn.com.au

Four 'mindsets' that trip up specialists.

BAE Systems Australia's cyber security head has warned against four mindsets preventing security specialists from effectively dealing with cyber threats.

According to the defence contractor's Tim Scully, an overemphasis on all-encompassing defensive measures or on compliance with standards or regulations could be counterproductive.

Scully, who was also the chief executive officer of BAE subsidiary Stratsec, chaired a work group on Cyber Threat and Fortress Mentality at the second national cyber warfare conference in Canberra this week.

Fortress mindset

He described the "fortress mindset" as the traditional approach to security, where specialists aimed to keep all threats outside of their networks.

Defensive measures in a "fortress" approach focused on systems and infrastructure rather than focusing on protecting the organisation's most valuable information.

That approach was as naïve as thinking that everything inside the network was secure, he said.

“If your network is connected to the Internet, and you have something of value to a threat actor, you are likely already compromised," he said.

More...

Espionage? Second Web Firm Worried After Dutch Hack

foxnews.com

AMSTERDAM – A company that sells certificates guaranteeing the security of websites, GlobalSign, said Tuesday it is temporarily halting the issuance of new certificates over concerns it may have been targeted by hackers.

GlobalSign, the Belgian subsidiary of Japan's GMO Internet Inc., is one of the oldest such companies globally, and large, but much smaller than industry giants VeriSign and GoDaddy.

It said in a statement it does not know whether it has actually been hacked, but is taking threats by an anonymous hacker seriously in the wake of an attack on a smaller Dutch firm, DigiNotar, that came to light last week.

The DigiNotar attack is believed to have allowed the Iranian government to spy on thousands of Iranian citizens' communications with Google email during the month of August.

Fallout from the Dutch hack continued Tuesday as the Dutch government, which used DigiNotar to authenticate many of its sites, continued to seek replacements.

Meanwhile the Netherlands' national prosecutors said they were investigating DigiNotar, a subsidiary of Chicago-based Vasco Inc., for possible criminal negligence.

The company did not return phone calls seeking comment.

More...

Appeals Court to Weigh NSA Dragnet Surveillance

wired.com



Whether the federal government and the nation’s telecommunication companies can be held accountable for allegedly funneling every American’s electronic communication to the National Security Agency without warrants is the subject of oral arguments scheduled for a federal appeals court Wednesday.

At issue is a Jan. 31, 2006 lawsuit, and others that followed, alleging violations of the Fourth Amendment right to be free from warrantless searches and seizures. The cases, about three dozen which will be consolidated into two oral arguments, have been thrown out of court on a variety of grounds, chiefly the government’s claim that the lawsuits would expose state secrets, and a 2008 law that immunized the nation’s telcos from such lawsuits.

Nearly six years later, the merits of the lawsuits have never been addressed. The Electronic Frontier Foundation, which brought the leading cases, appealed, and contends that the litigation should never have been dismissed.

More..

Cyber-Espionage Against U.S. Firms More Widespread than Previously Thought

nationaldefensemagazine.org



That foreign adversaries are using computer network vulnerabilities to steal military data from the U.S. government and its contractors is well known and hardly surprising.



Nations for centuries have long sought to steal such secrets from one another and spy-craft has simply moved into cyberspace.



However, the unveiling of a massive cyber-espionage network in August goes well beyond the unwritten rules that informally govern nations when it comes to the theft of technical data or insights into the minds of leaders and their intentions, said Dmitri Alperovitch, vice president of threat research at network security firm, McAfee.



Alperovitch analyzed one command-and-control server that had been used to spread malware for five years before McAfee exposed it.



“Even we were surprised by the enormous diversity of the victim organizations and were taken aback by the audacity of the perpetrators,” he wrote in a blog.



Examining the logs to determine who the victims were, and how long the intrusion lasted before it was detected, Alperovitch found 30 different industries on the list.



More...

Rental Firms May be Allowed to Spy on Customers With Webcams

dailytech.com

"Error: my sensor is dirty. Please take me in a steamy area... such as your shower."

Some may recall that back in May news broke of an Aaron's Inc. (AAN) franchisee remotely spying on users with a webcam to make sure they were making payments. The incident led to one outraged couple filing suit against the company, seeking class action status.

Unfortunately for that couple -- Crystal and Brian Byrd -- there case was dealt a serious setback by Judge Sean Mclaughlin, a judge with the US District Court for the Western District of Pennsylvania (Erie District).

In his ruling [Google Docs], the judge refused to grant a preliminary injunction, which would have banned Aaron's and its franchisees from both continuing to monitor users with the "PC Rental Agent" remote webcam spykit and from conducting activities to obfuscate which computers had the spykit installed.

In denying the injunction, Judge Mclaughlin opens the door to continued monitoring of users, and to the company disguising how many users it monitors.

More...

Technical Surveillance Threat Series, "Cellular Threats".

Note: This is the first installment in the Spy vs. Spy, "Technical Surveillance Threat Series". Stay tuned. JDL

Technical Surveillance Countermeasures, better known as "TSCM", is defined by "Wikipedia" as:

"A service provided by qualified personnel to detect the presence of technical surveillance devices ("bugs") and hazards and to identify technical security weaknesses that could aid in the conduct of a technical penetration of the surveyed facility".

In the civilian world, the above service is also sometimes referred to as a "Electronic Eavesdropping Detection" sweep or survey, or a "Bug Sweep".

Myself and my team have performed hundreds of TSCM Surveys for fortune 500 corporations, celebrities, executives, embassies, government offices, businesses, private individuals, law firms, etc., etc. There is always a common theme after an area has been cleared, "How can we protect ourselves from electronic surveillance threats after you leave?" The answer is usually complex, and almost always highly dependent upon our review (and recommendations) of our clients security posture and protocols in place at the time of the survey, and after we leave.

In this post, we will deal with one of those threats, "cellular devices", cell phones or "smart phones".

During our pre-survey Technical Threat Assessment, we usually find that "cellular devices" are allowed in almost all areas. There may be a cellular policy in place, but... during our verbal debrief after the area has been cleared, is usually when we find out what we have already discovered, that either there is no security protocol or policy in place regarding the allowance of cellular devices in board rooms and high level meetings, or there is a cellular policy in place, but it is not being enforced.

Almost all cellular phones have cameras, and many smart phones have audio recording features that allow conversations in person or over a smart phone to be easily recorded, stored, and even emailed. If you're like most of us, your cell phone is rarely more than 6 feet away from you. Many have "spy software" installed that allows for the smart phone microphone to be activated in secret without the phone ringing or lighting up. While it sits innocently near you, an eavesdropper can monitor every sound in the room.

So, does this potential eavesdropping threat sound like something that you want to allow in your next confidential boardroom meeting? Can your organization really afford to ignore this type of eavesdropping threat? Does your organization have a cellular policy in place? Is it enforced?

Here are a few personal cellular security tips:

Do not let your cell phone or smart phone out of your physical possession. Most cellular monitoring programs or "spyware" has to be installed through physical possession of the target phone. One of the best countermeasures is to keep tabs on yours.

Password protect your phone. I know it's a pain, but a password on your cell phone could save you or your organization a lot of misery.

Consider a review today of your organizations policy regarding cellular devices. Better safe, than sorry. No time? Contact ComSec, we can help. JDL

Stay tuned for the next installment in the Spy vs. Spy, Technical Surveillance Threat series.

ComSec, LLc provides professional Technical Surveillance & Eavesdropping Countermeasures services to Fortune 500 corporations to small businesses, non-profits, celebrities, executives and select individuals. Headquartered in Virginia Beach, VA | Northern VA-DC-MD. Serving the United States, and select International clients abroad.

Android Malware Quadrupled in Six Months

pcmag.com
Android malware samples quadrupled between June 2010 and January 2011, according to a report from Juniper Networks and BullGuard mobile security released Monday.

The figure itself means little, since the size of the Android Market more than tripled from 80,000 to 300,000 apps between August 2010 and May 2011, but as cybercriminals become more sophisticated Android users need to start protecting their phones like they would their computers.

See PCMag's pick of the top 15 Mobile Security Tools for more information.

The greatest mobile malware risk comes from legitimate apps that have been injected with malicious software and re-packaged for app stores, Juniper wrote. DroidDream, HongTouTou, and Geinimi all used this method.

More...

You Can Stop iPhones from Spying on You, But Not Androids

theatlanticwire.com

With a new software update, Apple resolved its iPhone tracking scandal that emerged after two data scientists discovered the phones record users' every move for a year. Customers of Google's Android phones aren't so lucky. Apple's new iOS update 4.3.3. makes the iPhone stop backing up location data on your computer and deletes the data when Location Services is turned off. The company says the location information is not transmitted to Apple, however, the information still remains on your phone if you don't disable Location Services. The fix, available for download now, comes just one week after Apple initially addressed the issue.

If you've got an Android phone, however, good luck. As Engadget's former managing editor Nilay Patel tweets, "It took Apple just a week to deploy this update to all iPhone users, while Android makers are still shipping 2.2." Patael's quote speaks to Android's nagging fragmentation problem in which updates come slowly because software is not compatible with all the different Android models produced by various handset makers. TechCrunch's MG Siegler highlights the problem:

More...

McAfee says corporate espionage is the target for cyber crime

computerworlduk.com

Hackers using trade secrets as underground currency

Corporate espionage is a business almost as old as corporations, but thanks to the Internet revolution it has a new business model: cybercrime. A new report from McAfee illustrates how intellectual property and trade secrets are becoming the primary target for hackers, and providing the currency that fuels the cyber underground.

The recent attack against RSA, resulting in the compromise of sensitive data related to the SecurID two factor authentication that many corporations rely on to guard against unauthorised access and protect data, is an example of how even the very companies that we trust to help guard against corporate espionage are not invulnerable themselves. Hacked SecurID tokens could be used as a stepping stone to more serious corporate espionage.

More...

Department of Defense, Major Private Contractor Potentially Vulnerable in Cyber Attack

abcnews.go.com
A U.S. cyber security company charged with protecting computers for the U.S. government and thousands of private clients has itself been the target of a hacking attack, potentially compromising the security of software used by the Department of Defense and major defense contractor Lockheed Martin.

While the U.S. government has been aware of the attack and working with the company on plugging the security breach for more than a week, according to sources familiar with the investigation, it was only Thursday that Massachusetts-based company RSA alerted the public. RSA, the security division of EMC, claims over 25,000 clients and 40 million users of its security token technology worldwide.

More...

Protecting critical information assets from industrial espionage

securitypark.co.uk
Organisations have been the target of electronic espionage for as long as information has been held in data format. As business becomes dependent on technology to process, store, transmit and manage information, electronic forms of espionage have sky rocketed. People will always be the weakest link in the battle to protect corporate information and data from attackers.

As the capabilities of security technology improve, hackers are now targeting individuals to get at the electronic information they want – this raises an intriguing mix of problems and issues for today’s corporate security managers

Attacks on businesses are increasingly being committed with a similar modus operandi to corporate espionage carried out by foreign states and state sponsored attackers. With the emergence of global markets and global competition, businesses are now the target of espionage, carried out by competing businesses, states or state-sponsored businesses.

More...

Brits Say Cybercrime Costs Billions

pcworld.com

Cybercrime is leeching the U.K. economy of a terrifying £27 billion ($43.5 billion) every year according to a new estimate published by the government.

The headline number put out by the Office of Cyber Security & Information Assurance and consultancy Detica includes a £21 billion cost to business, of which £9.2 billion results from theft of intellectual property (IP) and £7.6 billion from industrial espionage.

Extortion against U.K. companies accounts for another £2.2 billion, the loss of customer data £1 billion, with £2.2 billion racked up in 'fiscal' fraud against the government itself.

Conventional cyberfraud against ordinary citizens is reckoned to be £3.1 billion in total, comprising £1.7 billion from identity theft and another £1.4 billion from online scams. Fake anti-virus scams alone accounts for £30 million of useless software sold to citizens.

More...

Your Boss is Likely Spying on You

nbcchicago.com

For many, it's become second nature to head straight to Facebook or Twitter to complain or gloat about daily life or current events. But with more employers using software to keep tabs on employees, your harmless rant or online search could cost you your job.

"I don't post anything stupid. I'm always aware," said Chicagoan Glen Busch.

He never thought any of his random thoughts on the Internet would cause him any trouble. But that's exactly what he got when he took to Facebook and commented on the shooting in Tucson:

More...

New Hack Turns Smartphones Into Covert Spying System

Note: Ever wonder if your cell phone is spying on you?
Stop and ask yourself this question, when was the last time your smartphone was more than six (6) feet away from you?

Still wondering how you may have lost that account..or that last contract?? Stop wondering, contact me...I can help. ~JDL |

huffingtonpost.com

Your phone is a covert spy device, secretly listening to and recording everything you say -- or at least, it could be, according to new research that has uncovered a smartphone hack affecting both Androids and iPhones.

The auto-answer feature installed on most smartphones can be hacked to transform the phone into a listening machine, based on research by Ralf-Philipp Weinmann that shows a way hackers can break into the phone's baseband processor--which sends and receives radio signals on the cellular network--by exploiting bugs in the firmware of its radio chips.

"I will demo how to use the auto-answer feature present in most phones to turn the telephone into a remote listening device," Weinmann told InfoWorld in an e-mail.

More...