NSA tools highlight the need for Cyber Security and TSCM to work together.

Pages leaked from the supposed National Security Agency – Advanced Network Technology (NSA-ANT) catalog reveal eavesdropping and spy technology using advanced wireless communications (revealed in Der Spiegel in 2013 here). Edward Snowden may not be on your Christmas list, and the NSA may or may not be out to get you, but here’s the thing, if the NSA has such devices, surely other nation states and advanced criminal espionage organizations can be expected to have similar items available. In the past, one may have assumed this type of technology existed, but now there is clear description of some of the potential threats.

A number of the NSA-ANT product sheets are displayed on Wikipedia as well as other websites revealing leaked information. Take a look at a few of them listed below.

Detection of such devices goes beyond the normal cyber-crime security efforts. These miniature circuits can appear as standard pieces […]

Exec Security2016-12-16T20:23:46-05:00November 28th, 2014|

Genie put back in the bottle with $500,000 fine. First ever conviction for cellphone eavesdropping software.

A man who advertised and sold the notorious StealthGenie mobile-phone spyware has pleaded guilty to federal charges, earning himself a $500,000 fine, the Department of Justice said Tuesday. Hammad Akbar, a Danish citizen originally from Pakistan, was arrested in September and charged with advertisement and sale of interception devices — a category that includes spyware apps like StealthGenie. Once the app was secretly installed on the target phone, it would remain undetectable while recording every phone call and text, every photo and every email, among other things. The app, which investigators said was designed for use by “stalkers and domestic abusers,” could be installed on iOS, Android and BlackBerry devices. “This illegal spyware provides individuals with an option to track a person’s every move without their knowledge,” the FBI’s Andrew McCabe said.

Akbar allegedly sold a copy […]

Exec Security2016-12-16T20:23:46-05:00November 27th, 2014|

Top Secret History: maps printed on silk, smuggled in Monopoly games to aid prisoners of war

Wall tiles and Free Parking: escape and evasion maps of World War II

By Debbie Hall, Mapforum.com

Waddington PLC, the printing company best known for its games including Monopoly, was involved in a most unusual venture during the Second World War: printing maps on silk, rayon and tissue paper for military use and smuggling some of them to prisoners of war. Last year an archive of correspondence relating to the military maps, along with samples of the maps themselves, was donated to the British Library Map Library. A small fraction of the archive, relating to the initial planning and the early days of the project, is currently the subject of a small exhibition at the British Library, and a few items are reproduced here.

Silk map, to aid escaping prisoners in WWII

When you look at these maps the unusual materials are […]

Exec Security2016-12-16T20:23:46-05:00November 27th, 2014|

UC Police say bosses eavesdropped on them

Take-away: if you have a video system that also records audio, then you’d better make sure all of your employees have agreed to be monitored, or else disable the audio. Whether or not the UC police surveillance system was used nefariously, once people (especially the union) discover that they are being recorded, that opens the door to lawsuits. During regular TSCM sweeps we have often found audio devices that were installed with apparently good intentions yet they put the company at risk for legal action such as this.

Department secretly installed a surveillance system throughout its headquarters, according to a lawsuit filed by a police union

By Kale Williams, San Francisco Chronicle

IRVINE, Calif. — A University of California campus police department secretly installed a surveillance system throughout its headquarters, including in bathrooms, and recorded officers’ private conversations, according to a lawsuit filed by a police union.

Devices installed throughout UC Irvine’s police […]

Exec Security2016-12-16T20:23:46-05:00November 22nd, 2014|

CIA has a new clue to it’s own personal puzzle.

from WIRED magazine, 11/20/2014

In 1989, the year the Berlin Wall began to fall, American artist Jim Sanborn was busy working on his Kryptos sculpture, a cryptographic puzzle wrapped in a riddle that he created for the CIA’s headquarters and that has been driving amateur and professional cryptographers mad ever since.

To honor the 25th anniversary of the Wall’s demise and the artist’s 69th birthday this year, Sanborn has decided to reveal a new clue to help solve his iconic and enigmatic artwork. It’s only the second hint he’s released since the sculpture was unveiled in 1990 and may finally help unlock the fourth and final section of the encrypted sculpture, which frustrated sleuths have been struggling to crack for more than two decades.

Kryptos, a sculpture by American artist Jim Sanborn located on the grounds of the Central Intelligence Agency (CIA) in Langley, […]

Exec Security2016-12-16T20:23:46-05:00November 21st, 2014|

Australia: Obama strips down entire hotel floor to search for bugs and listening devices

Hotels can be fertile ground for eavesdropping. Security teams for executives as well as politicians should consider hotel TSCM sweeps to be part of their standard protocol especially when important meetings are planned.

Brisbane, Australia, via DailyMail, Nov 9, 2014

U.S. security officials have stripped down an entire floor of a Brisbane hotel and removed furniture to prevent President Barack Obama being spied on during his stay for the G20 summit this weekend.

Mr Obama’s security agents ordered beds, mirrors and bedding be removed from rooms surrounding the suite where the President will stay at the five-star Marriott Hotel in Queensland’s capital city, the Courier-Mail reported.

The floor will be checked for bugs before Mr Obama arrives on Saturday, to ensure he can make secure phone calls and conduct meetings.

President Obama and his staff will occupy […]

Exec Security2014-11-17T11:10:28-05:00November 17th, 2014|

X FACTOR judge Louis Walsh is convinced his dressing room is bugged.

Louis Walsh believes that recording gear has been hidden in his room at Wembley Stadium to sabotage his chances. And he is so obsessed about it he makes anyone who comes to see him go into the toilet when they want to talk to him.

X-Factor judge, Louis Walsh

Louis, who is mentoring the groups, has two acts left in the show, eight-strong boy band Stereo Kicks and the mixed-sex quartet Only The Young. Both have been struggling and have been involved in sing-offs. Now Louis is convinced their efforts have been sabotaged. A show source said: “He thinks people have been listening in to his briefings and advice to disadvantage them.”

Exec Security2016-12-16T20:23:46-05:00November 17th, 2014|

Darkhotel points to the need for TSCM sweeps to enhance cyber security

The Darkhotel cyber threat highlights the need for corporations to take regular TSCM sweeps seriously.

Darkhotel, so named by Kaspersky Labs, is a malware attack that has been operating at least since 2009, focusing on executives visiting hotels especially in Asia.

A key element in these reports, according to Kaspersky’s research, is that the Darkhotel group often knew a target’s room number, full name, and length of stay before they arrived. This indicates that the perpetrators would have done extensive intelligence gathering and surveillance of the intended targets prior to the travel. In this light, TSCM sweeps become much more significant in the fight against cyber attacks and protection of information assets.

Kaspersky explains how the Darkhotel malware works:

[The hackers] wait until, after check-in, the victim connects to the hotel Wi-Fi network, submitting his room number and surname at the log-in. The attackers see him in the compromised network and trick him into downloading and installing […]

Exec Security2016-12-16T20:23:46-05:00November 11th, 2014|

“Here’s looking at you, kid…” Are your web enabled cameras safe? Many are not.

A fairly new website has caused a recent stir. Insecam.com provides links to thousands of webcams around the world. It has been mentioned in recent news reports ranging from Lifehacker and CNET, to the UK Daily Mail, PC World, and more. Vulnerable webcams are not something new, though, yet their popularity has certainly grown along with the threat of misuse.

The first well documented webcam was set up to watch a coffee pot at Cambridge University in 1991 [read more]. That camera (and coffee pot) was finally turned off in 2001, but by then, many more webcams had been turned on. (See more about the history of the coffee cam at the end of this article.)

First Webcam, Cambridge University

In early part of this century (2004) while I was searching online for information on webcams I came across […]

Exec Security2016-12-16T20:23:46-05:00November 10th, 2014|

Taiwan political eavesdropping scandal- phone wiring tapped

Audio wiring was found attached to phone terminal block that serviced the Taipei mayoral candidate’s office.
Some interesting security points are mentioned in the following article:

A routine privacy inspection uncovered the extra cable- regular sweeps are important!
Telecom technicians verified that conversations from Ko’s ninth-floor phone were audible through the third-floor line.
No CCTV: No staff members work on the third floor and therefore no security cameras were set up to monitor the area
No access control: No electronic security card is needed to access the third-floor elevators.
In the blame-game, information leaks were blamed on the director being a “blabbermouth” rather than eavesdropping

TAIPEI, Taiwan — Taipei mayoral candidate Sean Lien (連勝文) said yesterday that his opponent Ko Wen-je (柯文哲) should drop out of the election if police are not able to confirm the existence of the alleged eavesdropping […]

Exec Security2016-12-16T20:23:46-05:00November 5th, 2014|

Citigroup security team in Mexico accused of dealing with eavesdropping and fraud

from The New York Times/ Dealbook

The accusations read like a pulp thriller:Citigroup employees in Mexico are suspected of pocketing millions of dollars in kickbacks from vendors. And bodyguards for bank executives bought audio recordings of personal phone calls and created shell companies to disguise their fraud.

A new scandal has erupted at Citigroup’s Mexican unit just months after a $400 million fraud involving a well-connected client. Now the sprawling global bank — which separately announced plans on Tuesday to withdraw from consumer banking in 11 other markets — is wrestling with how to get its house in order in one of its oldest foreign operations. A crucial part of that decision rests on how to nudge aside the most powerful executive overseeing Mexico, a country where Citigroup has been doing business since 1929.

What makes that decision particularly difficult is that the Mexican […]

Exec Security2016-12-16T20:23:47-05:00October 16th, 2014|

State Department concerned about Chinese espionage at Waldorf Astoria

State Department concerned about Chinese spying at Waldorf Astoria after sale to insurance company with possible Communist Party ties.

The State Department said it is reviewing the sale of the hotel to Beijing-based Anbang Insurance Group, and that it may stop leasing space for the U.S. ambassador to the UN or the General Assembly. Anbang is reportedly linked to China’s Communist Party, which has overseen a massive effort to use cyberspying to steal U.S. trade and military secrets.

WASHINGTON — The sale of the Waldorf Astoria to a Chinese insurance giant is really bugging the State Department.

Grand plans by Beijing-based Anbang Insurance Group “to restore the property to its historic grandeur” has some Washington diplomatic and security insiders wondering if the Chinese will be adding more than a view to kill for.

Officials said Monday they are reviewing the sale — and implied the glittering renovation scheme for the iconic Park Ave. […]

Exec Security2016-12-16T20:23:47-05:00October 14th, 2014|

Who’s in your conference call?

Electronic communications has made meeting up with others via conference calls and web conferencing quite convenient and very commonplace today. It is important, though, to be aware of the security concerns and vulnerabilities for all types of conference services.

During an inspection we performed at a financial services company we found that their brand new boardroom conferencing system had been left with “auto-answer” enabled. This allowed anyone to call in and listen to everything taking place in the room, not only from any phone extension on the property, but also from any outside phone line. A caller just needed to know the “DID” or direct inward dial number (which happened to be the room’s extension number with the common prefix).

That incident involved the hardware based conference system built into the corporate boardroom. More common, though, and used by all levels of employees, is conference calling using either a corporate conference number (conference bridge […]

Charles Patterson2016-12-16T20:23:47-05:00October 13th, 2014|

Cars may be monitored for quality assurance… eavesdropping feature built in to some new vehicles.

New security feature “Valet Mode” can be turned on to record vehicle activity, including cameras and conversations when your vehicle is left in the hands of others. “All party consent” laws in many states causes manufacturers to consider updates.

Valet Mode = Eavesdropping Mode

GM warns Corvette spy feature may break law

Chris Woodyard, USA Today

General Motors is warning Chevrolet Corvette buyers and owners not to use one of the car’s most exotic high-tech features because it could inadvertently result in committing a crime in some states.

The feature involves “Valet Mode,” an aspect of the Performance Data Recorder in the 2015 Corvette, which is built in Bowling Green, Ky. It allows owners to secretly record conversations in their cars and performance data when they’re not along for the ride, such as when the car is being parked by a […]

Exec Security2016-12-16T20:23:47-05:00September 30th, 2014|

Landlord used baby monitor to eavesdrop on tenants.

TOWANDA, PA. Sept 9, 2014: A Towanda landlord, who is accused of possessing child pornography and using an electronic device to listen to a tenant having sex, is being held on $500,000 bail, according to court records. Daniel L. Bell, 65, of Towanda was charged Monday with 19 counts of possession of child pornography and three counts of wiretapping, both third-degree felonies, police said.

…The illegal activity was uncovered during a search that the Bradford County Probation Department conducted of Bell’s residence on April 4, police said. At the time, Bell was on probation and being supervised by the Probation Department, police said. During the search, the Probation Department seized the receiver unit for a baby monitor, which the Probation Department had information to believe Bell was using to eavesdrop on a tenant of his who lives in an adjoining building, police said.

…The sending unit for the baby monitor, which includes a […]

Exec Security2016-12-16T20:23:47-05:00September 10th, 2014|

King City’s eavesdropping case re-opened. City administrators gave eavesdropping instructions.

Revisiting the problems of King City, CA., if you recall in a previous episode, the City Council brought in their local phone vendor to review their PBX system. They found that while there was the capability of listening to room conversations via the intercom features, it was not active during their investigation. That really doesn’t prove anything, but it apparently was enough for the Council to drop the case. I think they probably wanted the situation to go away quietly.

The District Attorney has decided to re-open the case, though, due to the revelation that instructions were sent from City Hall administrators to previous city managers with instructions on how to enable the microphone to eavesdrop on employees.

From the Monterey County Weekly; Saturday, September 6, 2014; by Sara Rubin

Exec Security2016-12-16T20:23:47-05:00September 6th, 2014|

Voicemail hacking scandal with George Clooney (coming to the big screen)

The voicemail hacking scandal that caused the collapse of News of the World, Rupert Murdoch’s UK tabloid, is about to be made into a movie, taken on by director George Clooney.

Journalist Nick Davies recently published the book “Hack Attack” telling the story of how he took on the News of the World and their investigators who hacked phones, listened to live calls, sent Trojan horse emails, bribed the police, and committed burglaries to dig up tabloid scoops. (Available at Amazon [here]). George Clooney will be heading up an adaptation of the book for Sony pictures, scheduled to begin filming in 2015.

From the Hollywood Reporter:

George Clooney has made the call on his next directing project. The actor-producer-director will helm an adaptation of the book Hack Attack, exploring the British phone-hacking scandal surrounding Rupert Murdoch‘s news […]

Exec Security2016-12-16T20:23:48-05:00September 6th, 2014|

King City closes case into wiretapping allegations

ExecSecurity reported a couple weeks ago about a case in King City, CA, where the city manager was accused of eavesdropping on conversations between the police chief and other parties. This monitoring was suspected of being accomplished through improper use of telephone system features.

The town took the steps to have their phone system vendor investigate the phone system. The vendor’s report indicates that they did not find and physical wire taps or improper wiring connections, but the report explains that features of the system could have allowed monitoring to happen. The report only indicates that monitoring was not happening at the time of their inspection and that the features of the manager’s phone were no different from any other phone. Unfortunately, the accessibility of such features to all phones does not indicate that they were not used improperly.

The city council was apparently satisfied that no eavesdropping had taken place, though, and has closed […]

Exec Security2016-12-16T20:23:48-05:00September 2nd, 2014|