R ur kiz speken nkod? Du u fee eel <- awt?

Lingo2word is devoted to demistifying the new Internet shorthand language of Text messages, Chat rooms and Emails.
• Online Searchable Shorthand Dictionary.
• Translate to txtmsg lingo.
• Translate from Lingo to plain English.
• Emoticons.
• Txting words.
• Acronyms.
• And a searchable Text Message collection.

Steganography for the Masses!

...from their website...
The SpyMessage is easy-to-use, reliable and powerful tool for protecting important information that you don't want others to see.

With SpyMessage you can encrypt and hide your text message into image without any changes in its resolution or size.
• You can view the image with any conventional image viewer program
• Exchange messages without any fear from others spying on you.
• No one can know if your image contain messages or not.
• SpyMessage uses two encryption algorithms to protect your data.
• No un-encrypted temporary files are ever created.
• No password saved within your file
• Set a special Password to retrieve your encrypted data.
Just remember, "there is no free lunch."
You don't know what else this "free" software might do.
Download at your own risk.

Steganography - Look at secrets, but not see them.

Altered with the proper steganography algorithm, this innocuous picture of a cat could be a carrier for corporate espionage.

Earlier this year, someone at the United States Department of Justice smuggled sensitive financial data out of the agency by embedding the data in several image files. Defeating this exfiltration method, called steganography, has proved particularly tricky, but one engineering student has come up with a way to make espionage work against itself.

Keith Bertolino, founder of digital forensics start-up E.R. Forensics, based in West Nyack, N.Y., developed a new way of disrupting steganography last year while finishing his electrical engineering degree at Northeastern University, in Boston.

FutureWatch...
Steganography is a moving target. Now exfiltrators are beginning to make use of streaming data technologies like voice over Internet Protocol (VoIP). Disrupting or even detecting hidden transmissions inside real-time phone calls is the next hurdle for digital forensics companies, and Hosmer says it poses a significantly more challenging problem.
(more)

ID Theft News - 8% ?!?! (seems high, or are high)

...and this is just in the past two weeks...

• Eleven people from at least five different countries are facing charges for their involvement in a wide-ranging scheme to hack into nine US companies and steal and sell more than 40 million credit and debit card numbers. "As far as we know, this is the single largest and most complex identity theft case that's ever been charged in this country," Attorney General Michael Mukasey said. Officials said the ring had stolen hundreds of millions of dollars. (more) ...when federal prosecutors disclosed that computer hackers swiped more than 40 million credit-card numbers from nine retailers in the biggest such heist ever, it was the first time that many shoppers had heard about it. That's because only four of the chains clearly alerted their customers to breaches. (more)

• About 150,000 people in the US have been affected by the theft of laptops with personal information about current and former employees of brewing giant Anheuser-Busch. (more)

• A new report from the California Department of Public Health discovered that 127 UCLA Medical Center employees viewed celebrities' medical records without permission between January 2004 and June 2006, which is nearly double the number first reported earlier this year. (more)

• UK - Data protection experts have called for hospitals to use more effective encryption techniques after a laptop containing the personal data of thousands of patients was stolen. An unnamed manager at Colchester Hospital in Essex has been sacked as a result of the theft... (more)

• Security researcher Joe Stewart has identified a Russian gang that infected 378,000 computers with malware over a 16-month period in an effort to steal passwords and other information. (more)

• Ireland - The loss of a laptop containing 380,000 records of social welfare and pension recipients is a wake-up call for the Government and public and private sector bodies to ensure all staff are trained properly in data protection and use of encryption. (more)

• The Transportation Security Administration suspended Verified Identity Pass from enrolling travelers in its pre-screening program after a laptop computer containing the records of 33,000 people went missing.

The company, based in New York, lost possession of the laptop at San Francisco International Airport. The laptop contained unencrypted pre-enrollment records of individuals... (more) UPDATES: ...unencrypted laptop was found in the same office from which it was reported missing. (more) The U.S. Transportation Security Administration has cleared Verified Identity Pass to resume enrollments in its Registered Traveler program... (more) The laptop had been stolen, but was returned, according to the Sheriff's Department.

• The University of Michigan Credit Union in Ann Arbor confirmed that a data theft has resulted in some of its members becoming identity theft victims. The credit union said that so far, "less than 100" people have had their identities stolen -- mostly to open fraudulent credit card accounts. The theft, involving documents that were supposed to have been shredded... (more)

• Greece - Hundreds of bank clients in Greece and other European countries have turned into hostages because of actions of groups that steal data from bankcards and do uncontrolled drawings, the Greek To Bhma daily reports. (more)

UK - The BBC has apologised after a memory stick containing details of hundreds of children who applied to take part in a TV show was stolen. (more)

• Wells Fargo & Co. is notifying some 5,000 people that their personal information might have been seen by someone using a bank access code illegally. (more)

Only an average of eight percent of Americans say they are very confident in the ability of U.S. retailers, government and banks to protect their personal information, according to a national survey commissioned by CA, Inc. (more)

Eavesdropping on Skype, "...not a problem..."

There’s growing speculation coming out of Europe that there’s a backdoor in Skype that allows remote eavesdropping of telephone conversations.

A report in the reputable Heise Online says the issue was discussed at a meeting with ISPs last month where high-ranking officials at the Austrian interior ministry claims “it is not a problem for them to listen in on Skype conversations.”

The report said a number of others at the meeting confirmed that claim. (more)
The public believes Skype phone calls are encrypted; eavesdropping is not possible. This may yet be true. But, what if there is a back door? Why would a government official admit it? The bigger story here may be this is a serious intelligence leak, or an intelligence red herring. Stay tuned.
In the meantime, a little history...
Oct 15, 2003 - (See FutureWatch heading)
June 9, 2008 - Expect negative 'feedback' from FBI

Crypt Your Stick - USB Vaults to Go

Remember?
• Nato Secrets USB Stick Lost
• Airport Laptop Searches - No Probable Cause Needed
• Lax USB stick security causing havoc
• More than 100 USB memory sticks lost admits Ministry of Defence

Don't want to be next?
Get a cryptstick.
There is no excuse not to.
Many models to choose from...
• Ironkey
• Kingston DataTraveler Secure
• Kingston DataTraveler Secure - Privacy Edition
• Kingston DataTraveler Vault
• Kingston DataTraveler Vault - Privacy Edition
• Kingston DataTraveler BlackBox (government version)
• SanDisk Cruzer® Titanium Plus
• SanDisk Cruzer® Professional
• SanDisk Cruzer® Enterprise FIPS Edition
• SanDisk CMC (Central Management and Control) for IT Departments

VoIP Eavesdropping - How Difficult Is It?

by Stephan Varty, Vulnerability Analyst, in Nortel's Voice Security Blog...
Many people assume a certain level of confidentiality is assured when they use their phone. Concerns have been raised about the increased risk of someone eavesdropping on a VoIP call compared to a traditional PSTN call. Although the concern applies similarly to other VoIP protocols such as UNIStim, H.323, or SCCP as well, what follows is an opinion on the susceptibility of a SIP call to remote eavesdropping...

...due to common vulnerabilities such as missing or outdated patches, misconfiguration, and undetected software defects, it is likely that in many cases a determined sophisticated attacker would be capable of eavesdropping on unencrypted SIP calls. (more)

Lessons:
• Employ encryption.
• Install all software patches and updates.
• Double check your configurations.

Extra Credit:
Eavesdropping an IP Telephony Call

Security Director Alert - Track Missing Laptops

...for FREE!
A security friend at [a very large] Corporation contacted me this week about laptop losses. His company experienced "a dramatic increase in the past year" - primarily when employees traveled on business.

He was studying the problem. Was this just street crime, or was his company being targeted for industrial espionage reasons?

I pointed him to pertinent Security Scrapbook articles. The trend is clear, but what about a simple solution?

Here it is (assuming you have already done encryption and employee awareness training)...
Researchers at the University of Washington and the University of California, San Diego, have launched a new laptop tracking service, called Adeona that is free and private.

Here's how it works: A user downloads the free client software onto a laptop. That software then starts anonymously sending encrypted notes about the computer's whereabouts to servers on the Internet. If the laptop ever goes missing, the user downloads another program, enters a username and password, and then picks up this information from the servers, specifically a free storage service that has been around for several years, called OpenDHT.

The Mac version of Adeona even uses a freeware program called isightcapture to take a snapshot of whomever is using the computer. (more)

Did You Know... Court Approves Airport Laptop Searches - No Probable Cause Needed

All of the contents on a laptop can now be searched without wrongdoing or suspicion from U.S. Customs agents according to a recent federal appeals court ruling (PDF).
Expect the same level of privacy when visiting other countries as well.
(more)

Now, what are you going to do about it?
Here are some ideas and products to help you...
• Have a travel laptop. No data on the hard drive.
• Keep only necessary data on a secure USB stick.
• If you must keep sensitive data on your drive, encrypt it...
-- TrueCrypt 6.0 - The latest version of the free drive-encryption tool can shield sensitive data from prying eyes at home and abroad. Bonus - There is no way to prove that a hidden encrypted volume even exists on your drive unless you volunteer that information. TrueCrypt 6.0a is available now for Windows, Mac OS X, and Linux systems, including Windows Vista. (review)

Spy News of the Week

Sweden - "Earlier this week the Swedish stasi-government decided -- against the peoples wishes -- to wiretap all internet and telephone traffic in order to protect Sweden against threats. As you all know, being a neutral country makes Sweden a target for all the terrorists of the world, apparently," blogs one of The Pirate Bay's admins, Peter Sunde. "Many people have asked me what we're planning to do -- and the answer is 'A lot!'. This week we're going to add SSL to The Pirate Bay. We're also going to help out making a website about easy encryption -- both for your hard drives and your net traffic." (more)

Germany - German incumbent Deutsche Telekom is going to get yet another scolding. German public television channel ZDF reported the former operator turned self-spying agency wire tapped a few customers. Apparently 120 calls were illegally tapped by the company, without any court order or involvement of the police. (more)

UK - Every council in England will today be instructed to stop using tough laws to spy on people over "trivial matters" such as dog-fouling and litter offences. (more)

New Zealand - A 21-year-old peeping tom has been caught spying on his female neighbour in Dunedin. The Otago University student was nabbed peering through a flat window just before 9pm yesterday. (more)

India - This year the Delhi University saw many of the "spy students" hired by private detective agencies being roped in by parents to keep an eye on their wards. However... a growing number of students are visiting detective agencies and are offering handsome amounts to them to know whether their parents have hired any "spy students", mainly girls, to keep a watch on their activities. (more)

United States - Xiaodong Sheldon Meng, 44, who was raised in China and holds Canadian citizenship, was sentenced on the rare charge of committing economic espionage against the U.S. It's the most serious crime under the Economic Espionage Act of 1996 and involves stealing trade secrets to benefit a foreign government. (more)

South Africa - The bugging devices of the former dispensation, which were used in foreign embassies in South Africa and had been planted by an espionage front company, are still being used. (more)

Switzerland - A left-wing campaign group asked Swiss authorities on Friday to investigate Swiss food and drinks giant Nestle SA for allegedly hiring a spy to infiltrate the group. A Swiss chapter of anti-globalization group Attac filed the legal complaint in Vaud canton (state), after learning that an employee of Securitas AG security company took part in its private meetings between late 2003 and June 2004... (more)

United States - US information security company Cyber-Ark surveyed 300 senior IT professionals, and found that one-third admitted to secretly snooping, while 47 per cent said they had accessed information that was not relevant to their role. (more)

Bulgaria - A man applied for a job as an industrial spy. Together with several other applicants, he was given a sealed envelope and told to take it to the fourth floor. As soon as the man was alone, he stepped into an empty hallway and opened the envelope. Inside, a message read: "You're our kind of person. Report to the fifth floor Personnel Office." (source)

Expect negative 'feedback' from FBI

Skype, the eBay-owned company, says it is unable to comply with court-authorized wiretap requests.

"...because of Skype's peer-to-peer architecture and encryption techniques, Skype would not be able to comply with such a request," said Jennifer Caukin, Skype's director of corporate communications. (more)

FutureWatch - Eavesdropping on GSM Cell Phones

A web service that will make it easy and inexpensive to crack the GSM A5/1 encryption protocol, quickly enough for a call that is still in progress, is slated to launch at the end of April. Living right at the intersection of open hardware, open source software, software as a service, and cryptography, the service will reduce the cost and effort of cracking GSM call encryption by at least an order of magnitude.

The service is being developed by members of the GSM Software Project and demonstrates just how much things have changed in the world since the GSM system was designed. Various approaches to cracking both A5/1 (the European standard) and A5/2 (the weaker US standard) have been available for some time but this one is unique in that it should be available to researchers and hackers at the end of April in hosted api form instead of pdf.

Back in 1997, this overview of the GSM system declared that "Enciphering is an option for the fairly paranoid, since the signal is already coded, interleaved, and transmitted in a TDMA manner, thus providing protection from all but the most persistent and dedicated eavesdroppers." After all, such a radio encoding scheme made the signals invisible to typical radio band scanners.

Today, however, the availability of the Universal Software Radio Peripheral (USRP), an open hardware software defined radio that sells for about $700, combined with work being done at GNU Radio project to codify the GSM waveform (also targeted for the end of this month), makes this once reasonable point of view seem quaint. Good encryption is now a must and it appears that A5 no longer qualifies. (more)

India Wants to Eavesdrop on BlackBerrys

BlackBerry users, beware of the snoops. India's Telecommunications Dept. told telecom carriers, Internet service providers, and officials at Research In Motion (RIM), the Canadian company that makes BlackBerrys, that it wants to eavesdrop on transmissions from every BlackBerry phone in the country. To comply, RIM might have to route calls and e-mails through government computer servers based in India. (more)
FutureWatch... Look for other countries to jump on this bandwagon.

The Case of the Flacid Fob

Researchers from Ruhr University Bochum, Germany, presented a complete break of remote keyless entry systems based on the KeeLoq RFID technology. The shown vulnerability applies to all known car and building access control systems that rely on the KeeLoq cipher. "The security hole allows illegitimate parties to access buildings and cars after remote eavesdropping from a distance of up to 100 meters" says Prof. Christof Paar. "Eavesdropping on as little as two messages enables illegitimate parties to duplicate your key..."

A KeeLoq system consists of an active Radio Frequency Identification (RFID) transponders (e.g., embedded in a car key) and a receiver (e.g., embedded in the car door). Both the receiver and transponder use KeeLoq as encryption method for securing the over-the-air communication.

KeeLoq has been used for access control since the mid-1990s. By some estimates, it is the most popular of such systems in Europe and the US. Besides the frequent use of KeeLoq for garage door openers and other building access applications, it is also known that several automotive manufacturers like Toyota/Lexus (Chrysler, Daewoo, Fiat, GM, Honda, Volvo, VW, Clifford, Shurlok, Jaguar, etc.) base their anti-theft protection on assumed secure devices featuring KeeLoq.
(more)
(Hacker video explaining KeeLoq. Minutes: 36:18 - 41:35)
(How to Steal Cars - A Practical Attack on KeeLoq)

How To Make Your Phone Untappable

In 1991, Philip Zimmermann developed a humble-sounding electronic encryption technology known as Pretty Good Privacy. In fact, it was very good--so good that not even the federal government has been able to crack it, a fact that has made Zimmermann a folk hero to privacy advocates and a headache to law enforcement.

Now Zimmermann, the CEO of PGP Corp., has found himself back in the fiery debate between federal investigators and those who oppose their snooping--this time thanks to ZRTP, a technology for encrypting Internet telephone calls. ZRTP throws a wrench in the Bush administration's controversial warrant-free wiretapping program and its proposed legal immunity for the telecommunications companies. So far, not even teams of supercomputers and cyberspies at the National Security Agency have cracked ZRTP. That means anyone who uses Zimmermann's Zfone software, a ZRTP-enabled voice over Internet Protocol (VoIP) program available for free on his Web site, can skirt the feds' wiretapping altogether.

Forbes.com spoke with Zimmermann about how his small company has been able to produce an encryption product that not even the U.S. government can break, what ZRTP means for national security, and why cutting off the government's access to our phones is necessary to keep out the truly malicious spies. (more)

Free advice.
Free software.
An end to wiretapping woes.
Come on. What more do you want from me?
The least you could do is send me some M&M's. :)
~Kevin

Cracking GSM encryption just got easier

by Michael Kassner...
For all intents and purposes most everyone including the GSMA—an organization representing most of the mobile phone operators—considered and still considers GSM very secure. In reality A5/1, the technology used to encrypt GSM communications has been vulnerable for at least a decade. The sense of security seems to be based on the fact that the original attack venues require a great deal of computing power, time, and therefore money to accomplish the crack. So an organization would have to be particularly motivated to even want to crack GSM traffic. Care to guess who has enough motivation?

It appears that researchers David Hulton and Steve Miller have recently developed techniques to greatly reduce the time and required computing power needed to crack A5/1 encryption. The two researchers have even patented their work personally. The efficient modifications of the original crack open all sorts of doors making it easier for both black and white hat types to decode GSM conversations. (more)

Basic Email Security Tips

Chad Perrin at TechRepublic has some excellent tips...
There is a lot of information out there about securing your email. Much of it is advanced, and doesn’t apply to the typical end user. The following is a short list of some important security tips that apply to all email users...

1. Never allow an email client to fully render HTML or XHTML emails without careful thought.
2. If the privacy of your data is important to you, use a local POP3 or IMAP client to retrieve email. This means avoiding the use of Web based email services such as GMail, Hotmail, and Yahoo! Mail for email you wish to keep private for any reason.
3. It is always a good idea to ensure that your email authentication process is encrypted, even if the email itself is not. (lazy man's email encryption)
4. Digitally sign your emails. As long as you observe good security practices with email in general, it is highly unlikely that anyone else will ever have the opportunity to usurp your identity for purposes of email, but it is still a possibility. (What is a digital signature?)
5. If, for some reason, you absolutely positively must access an email account that does not authorize over an encrypted connection, never access that account from a public or otherwise unsecured network. Ever. Under any circumstances.

Be aware of both your virtual and physical surroundings when communicating via email. Be careful. Trust no one that you do not absolutely have to trust, and recognize the dangers and potential consequences of that trust.

Your email security does not just affect you; it affects others, as well, if your email account is compromised. (full article with greater tip detail)

FutureWatch - New technology spells end for wiretapping

It's the stuff the best spy stories are made of, the broadsheets this week had a small story in their technology sections about the Scientific and Technological Research Council of Turkey (TÜBİTAK) National Institute for Electronics and Encryption Research (UEKAE) having developed a completely original software package that allows mobile phones to be encrypted.

This makes it possible for mobiles to be safe enough to discuss national secrets without fear of interception. This type of protection is, officials at TÜBİTAK say, especially vital in the field of military communication when phone calls intercepted by foreign agencies could have potentially fatal consequences for soldiers in the field.

According to TÜBİTAK's February press statement, they have been working on the technology for 20 years and it will be offered first to Turkey's army and then to the public and private companies. This software, they say, will put Turkey in the top league of countries for protecting information and privacy. There will be many for whom the encrypted cell phone has come not a moment too soon and others who are already regretting the development. (more)

"Encryption can't save you now, Sonny Boy... Muhhahahaaaaa!"

from c|net, by Declan McCullagh...
Computer scientists have discovered a novel way to bypass the encryption used in programs like Microsoft's BitLocker and Apple's FileVault and then view the contents of supposedly secure files.

In a paper (PDF) published Thursday that could prompt a rethinking of how to protect sensitive data, the researchers describe how they can extract the contents of a computer's memory and discover the secret encryption key used to scramble files. (I tested these claims by giving them a MacBook with FileVault; here's a slideshow.)

"There seems to be no easy remedy for these vulnerabilities," the researchers say...

Their technique doesn't attack the encryption directly. Rather, it relies on gaining access to the contents of a computer's RAM--through a mechanism as simple as booting a laptop over a network or from a USB drive--and then scanning for encryption keys. How the scan is done is one of the most clever portions of the paper. (more)

Cheap & Secure Communications - for Security ...and Eavesdroppers

from the TriSquare website – TSX300...
"eXtreme Radio Service (eXRS) two-way radios use proprietary Frequency Hopping Spread Spectrum (FHSS) in the ISM band (900 MHz frequencies). 10 Billion channels." (more)

What does this walkie-talkie mean to you?
- "Secure Conversation – No Eavesdropping"
- Communications range of at least 1-2 miles.
- Very good communications within buildings.
- Voice Operated Transmit (VOX)
- No license required.
- Accessories include a headset.
- Cost: less than $100.00 per pair!

What else does this mean?
- A quick hack turns it into a long-range stealth bug!
- The average TSCM sweep team will likely miss it.
- Advanced Eavesdropping Detection will find it.

Short Wave Radio to the Rescue

Plot by terrorists to blow up the Eiffel Tower uncovered.
A scrambled short-wave radio conversation exposing the planned attack on the world's most visited monument was picked up by Portuguese air traffic controllers and passed on to French spy chiefs. The threat was uncovered in a "vague and muffled" radio conversation picked up by air traffic controllers in Lisbon on Thursday. (more)

Nato Secrets USB Stick Lost

A Cautionary Tale...
The discovery of a USB memory stick containing classified NATO information in a library in Stockholm has prompted a meeting between the Swedish Military Intelligence and Security Service and foreign defence officials.

According to Swedish daily Aftonbladet, the stick contained (http://www.aftonbladet.se/nyheter/article1563893.ab) material on NATO's ISAF peace-keeping force in Afghanistan, as well as an intelligence report on the attempted assassination of Lebanon's defense minister and the murder of Sri Lanka's foreign minister.

Colonel Bengt Sandström of the Swedish Military Intelligence and Security Service says this kind of carelessness is intolerable and can result in up to six months in prison. It is unclear how the USB stick ended up in the library.

It isn't the first time the military has lost USB sticks with secret files. In 2006, a memory stick containing files on the Dutch military mission to Afghanistan was lost in a rented car. The documents also included information about the rules of engagement for Dutch troops in Afghanistan and the personal protection of Dutch Defense Minister Henk Kamp.

Also in 2006, the Dutch Defense Ministry reported the loss of another memory stick containing sensitive information about military intelligence agency MIVD. (more)

By this time, you should be convinced that you have to do something immediately about YOUR USB memory stick.
(more USB stories) (IronKey solution) (a great