Articles intended for TSCM technicians.

Anti-Spy-Phone attachment being developed by Snowden and Huang

Edward Snowden and Andrew Huang are designing a device to help protect smartphones from eavesdropping.

Whether you are a journalist worried about government control, or anyone with confidential conversations, their idea could help protect your phone. Edward Snowden expressed the concern that sophisticated malware could control your phone to make it transmit information when you are not aware, even if the phone had been placed in airplane mode.

He is working with  Andrew “Bunnie” Huang, a research affiliate from MIT Media Lab. The proposed device would be able to attach to an iPhone 6 and monitor the activity of the unit’s radio systems, detecting activity in any of the frequency bands, cellular, Bluetooth, Wifi, GPS, or NFC. It could then alert the user of possible eavesdropping activity.  The device would be an external sleeve, and not built in to the phone, thus it would not be susceptible to any hacking of the […]

2016-12-16T20:23:32-05:00July 21st, 2016|

Tech watch: Fans transmitting data from air-gapped computers

Researchers at Ben Gurion University have published a paper regarding their experiments transmitting data from an air-gapped computer to a smartphone in the same room. They were able to inject malware into the computer that used the noise from the cooling fans in the computer to transmit binary data to a remote microphone.

From the research paper:

…we present Fansmitter, a malware that can acoustically exfiltrate data from airgapped computers, even when audio hardware and speakers are not present. Our method utilizes the noise emitted from the CPU and chassis fans which are present in virtually every computer today. We show that a software can regulate the internal fans’ speed in order to control the acoustic waveform emitted from a computer. Binary data can be modulated and transmitted over these audio signals to a remote microphone (e.g., on a nearby mobile phone). We present […]

2016-07-07T22:15:40-04:00July 7th, 2016|

Future TSCM tool? Walabot uses RF to see inside walls.

Walabot is a sensor that looks into objects using radio frequency signals.

It comes in three versions, Starter Kit, Maker, and Pro ($150, $300, and $600 respectively).  It seems that the company doesn’t quite know what to do with it yet, they are reaching out to the robotic and maker community for ideas and apps. TSCM certainly seems like a practical use, but it will require someone to develop the software.

The boards use multiple antennas that transmit and receive microwave signals then reconstruct a three dimensional “image” of the environment. The Starter Kit board has only 3 antennas, Maker version has 15, and the Pro board has 18 antennas.

Walabot Pro version with case Walabot Pro version with case

The Walabot “sees” behind walls but the only smartphone app available at this time just gives you a vague idea of whether there is a pipe or […]

2016-12-16T20:23:32-05:00June 28th, 2016|

New Tech: Conductive concrete blocks radio waves, guarding against espionage

From Phys.org

De-icing concrete could improve roadway safety, guard against corporate espionage

…By replacing the limestone and sand typically used in concrete with a mineral called magnetite, Tuan has shown that the mixture can also shield against electromagnetic waves. The electromagnetic spectrum includes the radiofrequency waves transmitted and received by cellphones, which Tuan said could make the concrete mixture useful to those concerned about becoming targets of industrial espionage.

Using the magnetite-embedded concrete, Tuan and his colleagues have built a small structure in their laboratory that demonstrates the material’s shielding capabilities.

“We invite parties that are interested in the technology to go in there and try to use their cellphones,” said Tuan, who has patented his design through NUtech Ventures. “And they always receive a no-service message.”

 

A slab of conductive concrete demonstrates its de-icing capability outside the Peter Kiewit Institute in Omaha during a winter […]

2016-01-22T11:51:26-05:00January 22nd, 2016|

Happy 101st Birthday of Hedy Lamarr, and thanks for frequency hopping.

November 9, the Google Doodle (on Google’s home page) celebrated the birthday of Hedy Lamarr, born Hedwig Eva Maria Kiesler, 9 November 1914 – 19 January 2000.

She is most known for being a beautiful movie star, but she was also a talented inventor who helped develop spread spectrum frequency hopping technology, used in World War II. Though the US Navy did not adopt the technology until the 1960s, the principles of her work are now incorporated into modern Wi-Fi, CDMA and Bluetooth technology.

Her official website: https://www.hedylamarr.com/

Google’s tribute:

Here is a short History Channel presentation “The Patent Files”:

Happy Birthday, Hedy.

 

 

2015-11-09T09:24:04-05:00November 9th, 2015|

Tech alert: Hacking Siri or Google Now through radio waves

Researchers in France have found that by beaming radio waves at the headset wire attached to a smart phone, they can modulate the radio waves to cause the signals in the headset wires to interpret it as voice, thus triggering the voice commands of Siri or Google Now services.

A lot of things have to be right for this to work- the smart phone must have a wired headset, the headset must have a microphone, (give them time, Bluetooth may be next), and the radio signal needs to be a powerful signal broadcast nearby with a large antenna, and you need to be oblivious to your phone suddenly reacting to unknown forces.

If you see a coworker pointing an antenna like this at your smart phone you might have cause to worry.

Voice communication can be “transposed” into other forms of modulation fairly easily. Besides radio […]

2016-12-16T20:23:39-05:00October 15th, 2015|

Tech alert: GOOGLE TONE Shares Links Using Beeps and Boops

If your computer starts sounding like R2D2, it may be sharing links to others within earshot. 

A report from Popular Science discusses a new Chrome extension that lets a computer share a URL with another computer using tones.

Popular Science, Jason Cipriani

Google Tone

A new Chrome extension, called Google Tone, released this week makes it possible to share a URL with another computer in the room using a series ofbeeps and boops. The concept is dead simple yet instantly instills a sense of disbelief. A computer making seemingly random sounds can transmit the URL for the tab I have open in Chrome across the room? Get out.

Full of skepticism, I decided to put it to the test. I installed the Chrome extension on a MacBook Air and a HP laptop running […]

2016-12-16T20:23:40-05:00May 27th, 2015|

Wearable Tech Alert: Store and forward 60 seconds of audio from your wrist- anytime, anyplace

From smart TV’s to Amazon Echo, new devices all around us are listening. A new tech item scheduled for shipping this month promises to bring personal eavesdropping and BYOD threats to a new level.

The Kapture device, funded by Kickstarter, is a wearable device that constantly records all audio in it’s vicinity.  It is designed to be worn on the wrist, with a clip-on option, a little like a cross between a Fitbit and Apple Watch. It is constantly recording, but remembers only the last 60 seconds.

At any moment, if you feel that something you just heard is worth saving- just tap the unit and it will send that 60 second audio clip to your phone via bluetooth. You can use their smartphone app to record longer segments. Their web site also explains, “The Kapture wristband allows for about 25 audio klips to be saved locally. Once your phone is back […]

2016-12-16T20:23:42-05:00February 9th, 2015|

Waiting to be hacked… new consumer devices offer new eavesdropping potential.

Internet connected devices are attracting a lot of attention. Many, though, have potential security vulnerabilities just waiting to be hacked.  The following devices may not have been exploited yet… but considering the possibilities, it’s only a matter of time. Some of these just appeared at the CES show in Las Vegas and may not have hit the street yet but many are already at work in homes and offices.

Netatmo Welcome, uses facial recognition to detect and alert you to people in view. “Welcome” sends the names of the people it recognizes to your smartphone. The camera also notifies you when it sees an unknown face. Through the app you can check who is currently home, access live stream and past events.

Netatmo Welcome

Netatmo touts “stunning HD images, extensive 130 degree field of view, and superior night vision

 

Petcube brings video and audio monitoring into your living room. […]

2016-12-16T20:23:43-05:00January 12th, 2015|

Hackers attack LA road signs

Science fiction stories often have tales of computerized devices taking over the world. Probably a more immediate worry, rather than the devices controlling us, would be hackers take over those devices, as that is already happening.  Cyber security researcher, Graham Cluley, clues us in on happenings in downtown LA where hackers changed the words on a traffic sign. Not the first time, of course. His article also mentions road signs warning of approaching Daleks and even a pending British invasion.

The threat of a mastermind Moriarty broadcasting a sinister message to the world through every road sign, advertising sign, and every TV channel, is still a bit distant, but as attacks appear daily on individual devices, the threat comes closer to home. Any devices that have remote programming access via the internet could be vulnerable, from road signs or laboratory equipment  to phone systems and alarm systems – any network connected device. On […]

2016-12-16T20:23:43-05:00January 12th, 2015|

Tech watch: Device uses lasers to map an entire room through a 1-inch gap

from DailyMail.co.uk Science and Tech

Looking through a keyhole could soon reveal far more than you imagine. Scientists have developed a device that could map an entire room simply by shining a laser through a 2cm gap. The system could be used in applications such as firefighting, battlefield surveillance and disaster recovery operations.

The technology is the work of Harbin Institute of Technology in China and is based on a laser that can see around corners, according to a report by Jacob Aron at the New Scientist. The system worked by firing ultrafast laser pulses at walls ‘behind’ an area that can’t be seen, to capture a ghostly 3D reflection. The technique is similar to using a mirror to see round a corner – but instead of a mirror, the ‘reflection’ is reconstructed from laser light that scatters back off a wall. The camera ‘times’ the beams […]

2016-12-16T20:23:43-05:00January 10th, 2015|

NORAD tracking Santa for over 50 years

For almost 60 years, NORAD and its predecessor, the Continental Air Defense Command (CONAD) have tracked Santa’s flight.

The tradition began in 1955 after a Colorado Springs-based Sears Roebuck & Co. advertisement misprinted the telephone number for children to call Santa. Instead of reaching Santa, the phone number put kids through to the CONAD Commander-in-Chief’s operations “hotline.” The Director of Operations at the time, Colonel Harry Shoup, had his staff check the radar for indications of Santa making his way south from the North Pole. Children who called were given updates on his location, and a tradition was born.

In 1958, the governments of Canada and the United States created a bi-national air defense command for North America called the North American Aerospace Defense Command, also known as NORAD, which then took on the tradition of tracking Santa.

Santa reviews his flight plan at NORAD  Photo By:  [...]
</p>
</body></html>

2016-12-16T20:23:45-05:00December 13th, 2014|

Wiretapping ATMs

News came out last month [here] on information security blog Krebsonsecurity.com, about attacks on European ATM machines that involved cutting into the machines and tapping into the wires that connect to the internal card reader. The hole would then be covered up with a fake decal or sticker. Photos supplied by NCR now show what such attacks could look like.

A hole left by crooks who added “wiretapping” or “eavesdropping” theft devices to a compromised ATM. Image: NCR.

“In this attack, the ATM fascia is penetrated close to the card reader to create a hole large enough for the attacker to reach inside the ATM and place a tap directly onto the card reader in order to skim card data as it is read by the ATM,” NCR said in an advisory it produced on the increasingly common attacks.

A key element in all aspects of security […]

2016-12-16T20:23:45-05:00December 9th, 2014|

Cyber bugs studied used for disaster rescue, real bugs…

by Kelly Dickerson, LiveScience.com

Remote-controlled cyborg cockroaches could one day be among the first responders at disaster scenes to help locate survivors.

A team of researchers at North Carolina State University has created a swarm of cyborg cockroaches, nicknamed “biobots,” that are equipped with microphones to pick up sounds and trace them to their sources. The researchers hope the biobots could one day be used in disaster-relief situations to locate survivors.

Cyber cockroach, equipped with microphones and transmitters could aid in disaster rescue.

Each cockroach has a tiny circuit board “backpack” attached to it that researchers can use to control the bug’s movement. Some of the biobots have a single microphone that can capture sounds at a disaster scene and send them back to personnel. Others have a series of microphones that can pinpoint the source of a sound and then steer […]

2016-12-16T20:23:46-05:00November 27th, 2014|

Telephone fraud and PBX hacking revisited… “will you accept the charges?”

A recent article in the NY Times caught the attention of some of our clients. It documented an architectural firm in Norcross, Georgia, that had their phone system hacked, resulting in a phone bill for $166,000 over just one weekend.

In past ExecSecurity posts we have discussed a few methods used by hackers for compromising phone systems. One aspect of the threat is actual eavesdropping and theft of information. That type of threat can be considered targeted attacks, where someone is attempting to steal information specifically from you or your company. But as mentioned in the Times article, hackers with fraud and financial gain as their motivation are hitting random targets throughout the US and the world. In such cases, the hackers do not care whose system they attack, and they will try thousands of systems looking for one that is vulnerable.

silhouette on phone

The Times article […]

2016-12-16T20:23:47-05:00October 24th, 2014|

Ford to offer Police Interceptor surveillance tech to competitors

by Chris Bruce, www.Autoblog.com

Ford unveiled its surveillance mode technology last year as an option for 2014 Ford Police Interceptor Sedan and Utility models, and it has been a huge success. Now, the automaker and its partner InterMotive Inc. have decided to license the patent-pending system, including possibly to competitors and the military.

The surveillance mode technology is all about improving officers’ situational awareness when their vehicle is stationary, and they aren’t paying total attention to their surroundings; when filling out paperwork, for example. When an officer activates the system, the rear radar begins monitoring what’s happening behind the cruiser. If it detects someone coming up on the vehicle, then the rear camera turns on, the driver’s side window closes and the doors lock. Of course, in busy environments with people constantly walking around, the police can also just keep surveillance mode turned off.

The whole […]

2016-12-16T20:23:47-05:00October 6th, 2014|

Where have you been? Google knows.

If you have a Google account and you have Google apps’  “Location Reporting” or “Location Services” active on your phone, you can find out where you have been for just about any day that you have had the feature turned on. These could be apps on an iPhone or iPad, or just built into your Android phone. Whenever an app shows you that something is nearby, suggests local businesses, or helps you find the closest gas station, it’s using Location Reporting.

It is an “opt-in” service, but many people have said yes to it without realizing when they first initialized a new phone.  Location Reporting sends your GPS or other location information to Google periodically through out the day.  The information that has been logged for your device can be viewed here:  https://maps.google.com/locationhistory/b/0/
It looks like this:

With this service you can see the basic […]

2016-12-16T20:23:47-05:00September 24th, 2014|

Spy kids… spy theme store raises funds for non-profit creative writing program for kids.

Spy themes always seem attractive to almost anyone. A Chicago store uses a spy theme to help raise funds for a 826CHI, a non-profit writing and tutoring center for children.

Formerly known as “The Boring Store”, it has recently moved and changed it’s name to “Wicker Park Secret Agent Supply Co.“, with a website at www.notasecretagentstore.com. They are currently using Kickstarter to help fund their new location.

notasecretagentstore

The website looks like fun with simple game type activities, but it doesn’t seem to connect to an online store at this time so it’s hard to tell if they really do sell spy supplies. Their brick and mortar shop does seem to have some exhibits that would be interesting for kids, though.

An article on their project can be viewed at the ChicagoTribune.com.

2016-12-16T20:23:48-05:00August 13th, 2014|
Go to Top