Lawbot

How to Hack Cell Phone Voicemail like Kevin Mitnick

2011-12-14T17:04:00.000-08:00

If you haven’t seen this yet – Kevin Mitnick, author of The New York Times bestselling memoir Ghost in the Wires, demos a quick way for bypassing the password prompt and hacking cellphone voicemail. He shows here a wickedly simple way to listen to other people’s cellphone voicemail.

As effective as it may be, the specific hacker tool Mitnick chooses to show in the video appears more like a toy compared to the far more advanced monitoring techniques now available with the planet’s top 120 surveillance and spyware firms.

RSA 2012: Alperovitch, Libicki, Lewis, and Segal on Net-Based Warfare Tactics and Strategies

2011-12-14T12:58:00.000-08:00

RSA Conference: Feb 27- Mar 2, 2012 San Francisco, CA

Speaker Profile: Dmitri Alperovitch
Panel Moderator for Cyber Battlefield: The Future of Conflict

Now that Dmitri Alperovitch has moved from his post as VP of Threat Research at McAfee to become President of Asymmetric Cyber Operations, he continues to speak and publish freely on global corporate/governmental hacking, espionage, and surveillance efforts.

To that end, Alperovitch will moderate an insider's panel at RSA 2012 on data and surveillance warfare over the net. Alperovitch’s years of research into these threats and vulnerabilities made news in August with the release of his McAfee report on wide-scale IP compromise among the Fortune Global 2000.

RSA Panel Title: Cyber Battlefield: The Future of Conflict (for a full list of RSA events & presenters visit here).

Moderator: Dmitri Alperovitch President, Asymmetric Cyber Operations LLC
Panelists: Martin Libicki Senior Scientist, RAND; James Lewis Senior Fellow & Program Director, Center for Strategic and International Studies; Adam Segal Senior Fellow for Counterterrorism & National Security Studies, Council on Foreign Relations
Scheduled Date(s)/Time(s): Wednesday, February 29, 08:00 a.m., Room 103
Session Length: 70 minutes

Session Abstract: Panel of leading experts in the field will explore complex policy issues tied to conflict in cyberspace. The session will discuss the current state of nation-state espionage, armed reconnaissance and cyber warfare operations, the evolution in strategic cyber deterrence doctrines and review the diplomatic initiatives to establish norms of behavior in cyberspace between US, Russia and China.

Prerequisite knowledge: The audience must understand the technical challenges of attribution, the impact cyber attacks can cause to national critical infrastructure, financial system and military readiness. They must be familiar with recent major nation-state attributable cyber-attacks and be aware of the current state of national security policy in cyberspace Session learning objectives We would like the audience to recognize the dramatic national and economic security impact of today's pervasive nation-state sponsored cyber espionage attacks and evaluate the potential diplomatic and military solutions to this problem. The panel will also provide an overview of the cyber war doctrines of US, Russia and China and the impact of the militarization of cyberspace on commercial and government sectors of the global economy. Finally, we will demonstrate that attribution is not an unsolvable problem in cyber and that diplomatic approaches are possible to help resolve what remains as a very challenging technical problem.

The Spyware 120: Lawbot's Top Picks of Global Surveillance Firms

2011-12-09T12:47:00.000-08:00

Here are Lawbot’s top picks of the global surveillance firms outed in Wikileaks’ release last week of spyware promotional material. In a stunning marketing coup for surveillance and spyware manufactures, Wikileaks released the names and files of 160 firms now working with their clients for civilian, criminal, governmental, and corporate monitoring over the net.

Consider the language in the brochure for the Alcatel-Lucent surveillance solution:

“The Alcatel-Lucent 1357 ULIS is a complete communications interception solution. It provides government authorities/LEAs and network operators with an integrated system for transparently intercepting and extracting realtime information from vast amounts of voice, data and multimedia communications over virtually any type of network.”

Consider also the videos by Gamma Group, promoting their software and strategies for placing an entire internet café under surveillance, including real-time Skype and Gmail monitoring. Or Gamma Group’s video highlighting their ability to place an entire hotel under surveillance through the hotel’s own network. You might want to reconsider the people who give PowerPoint presentations at your firm after watching this short video on injection by firewire. Also consider this short video on cool new tools for monitoring your target’s (read anybody’s) Blackberry.

Company Name / Website	Wikleaks File
Area spa
Ability	Files
Access Data
AdvancedIO
AGT
Alarm
Alcatel	Files
Allot
Altron
Amdocs Ltd
Amesys (Bull)	Files
Aqsacom
Asoto
ATCI
ATIS systems GmbH (ATIS UHER)	Files
Audiotel International
Autonomy
BAE Systems
BEA	Files
Bivio
BlueCoat	Files
Brightplanet
Broadsoft
Cellebrite
Cisco Systems
ClearTrail	Files
Cobham
Comstrac
Comverse
Creativity Software	Files
Cubic
Datakom	Files
Datong	Files
Delta SPE	Files
DigiTask	Files
Dreamlab Technologies AG
EBS Electronic
Elaman	Files
Elkat
Elta systems
Endace accelerated	Files
ETI Connect
Fox-it
Gamma Group	Files
Glimmerglass	Files
Group 2000	Files
Hacking Team	Files
Harris
Hidden Technology Systems Int'l Ltd
HP	Files
Huawei Technologies
Inforcept Networks
Innova	Files
Inveatech	Files
Inveatech	Files
IP Fabrics
Ipoque	Files
Ips	Files
Loquendo
Macro System
Mantech
Medav GmbH	Files
Meganet
Napatech
Narus
Neosoft
Net Optics	Files
Netezza
Neti
NetQuest	Files
News Datacom Research Ltd
Nice Systems
Northop Grumman
Nuances technology
Omni Wildpackets
Packet Forensics	Files
Panoptech	Files
Pen Link
Phonexia
Phonexia
Pine Digital Security	Files
Polaris wireless
Qinetiq
Qosmos
Radisys
Rainstor
RCS
Resi group
Rohde & Schwartz
Roke
SAIC
Sandvine
Scan & Target	Files
Seartech	Files
Security Software International
Selectronic
Semptian Technologies
Septier	Files
Shield Security
Shogi Communications	Files
Siemens
Sonus Networks
Sophos
Spectronic Systems A/S
SS8 Networks	Files
Suntech Intelligence
Syborg
Telesoft Technologies	Files
Thales
ThorpeGlen
Tracespan
Trovicor
Ultrareach
Utimaco Safeware (Sophos)	Files
VAS Tech	Files
Verint
Vineyard networks
Vixtel
Vupen
ZTE Corp

Landmark Data-Breach Class-Action Suit Ruled Actionable in Federal Court

2011-11-01T12:12:00.000-07:00

In a decision likely to impact ongoing and potential data-breach litigation among firms like Sony, Epsilon, and RSA, the Federal bench has allowed to proceed a potentially landmark suit permitting negligence and contract putative class-action litigation.

Following the breach of 4.2 million credit card numbers by the Hannaford grocery store chain in 2008, 26 separate lawsuits were filed with claims of 1800 instances of unauthorized uses of the lost card numbers. The cases have since been consolidated into a single class action suit, John Anderson et al. vs. Hannaford Bros. Co. et al, now given the green light by the 1st U.S. Circuit Court of Appeals in Boston.

As reported by Judy Greenwald in Business Insurance News, the ruling is thought to be the first of its kind, marking a shift in judicial thinking on litigation resulting from the ever growing spate of data breaches:

“Discussing the decision, Scott L. Vernick, a partner with law firm Fox Rothschild L.L.P. in Philadelphia, said until the ruling, potential class actions relating to data breaches generally have been dismissed early on, either because the plaintiffs did not have standing to sue or there was no threat of actual injury.”

According to the ruling, “Plaintiffs' claims for identify theft insurance and replacement card fees involve actual financial losses from credit and debit card misuse,” the court panel wrote in its Oct. 20 ruling. “Under Maine contract law, these financial losses are recoverable as mitigation damages as long as they are reasonable,” the court ruled in a reversal of a lower court ruling.

In a similar Federal appeals case (not a class action) involving the data breach of 32 million usernames and passwords by the online gaming site RockYou, a Federal Judge for the Northern District of California ruled unfavorably against the defendant in Alan Claridge v. RockYou, Inc.

As reported in InfoSecurity News in April:

RockYou filed a motion to have the lawsuit dismissed because the Plaintiff, Allan Claridge, had not demonstrated that he suffered actual harm from the breach. But Judge Phyllis Hamilton of the US District Court in the Northern District of California allowed the lawsuit to proceed.

"The court concludes that at the present pleading state, plaintiff has sufficiently alleged a general basis for harm by alleging that the breach of his PII [personally identifiable information] has caused him to lose some ascertainable but unidentified 'value' and/or property right inherent in the PII. As such, the court declines to dismiss plaintiff's breach claims on grounds that plaintiff has failed to allege damages harm as a matter of law", Hamilton wrote.

Commenting on the ruling, InfoLawGroup noted that the ruling seems to be a shift in judicial thinking on data breach lawsuits.

Massachusetts Maps The New Data Breach Landscape: 1000 Plus Breaches Affect 2 Million Residents

2011-09-26T18:50:00.000-07:00

The Massachusetts Attorney General Martha Coakley reported last week on the count for data breaches in the state since the Massachusetts data-breach law went into effect January of 2010. Breaches in the period totaled 1,166, affecting 2.1 million residents in a period of 10 months.

Because Massachusetts is the first state to require mandatory reporting of this kind to a state’s attorney general’s office, the statistics offer a first of its kind map of data breaches occurring across any US state. The stats hint at huge data breach numbers occurring nationwide even as the US Senate Judiciary Committee OK’d legislation last week to preempt state data breach legislation, including those of states like Massachusetts and California with strong reporting requirements.

According to the Boston Globe in their coverage last Wednesday:

Of the reported incidents, 25 percent involved deliberate hacking of computer systems containing sensitive data. Another 23 percent involved accidental sharing of information with unauthorized people, such as sending faxes or e-mails with personal information to the wrong recipient. In 15 percent of cases, retailers reported the theft of customer credit card numbers. Data was also lost through thefts or accidental losses of laptop computers and paper documents, or in cases in which workers deliberately gained unauthorized access to client files.

Thomson Reuters Survey Shows Most Corporate Board Correspondence Easily Hacked

2011-09-22T11:08:00.000-07:00

A global survey of corporate boards published yesterday by Thomson Reuters concludes that most boards are transparent to the lowest level of hacking efforts. According to the survey, published through Thomson Reuters' London office:

Most major corporations surveyed have significant security gaps that leave sensitive board-level information open to information theft and hacking. Those are among the findings of a new survey of board members of UK and global corporations conducted by Thomson Reuters Governance, Risk & Compliance. The findings are particularly noteworthy in light of recent news stories about the handling of board communications involving executive succession decisions at companies including Yahoo and Apple.

The survey found that information provided to members of corporate boards of directors is often in unencrypted email accounts and computers, or otherwise provided in forms that are easily lost, misplaced or stolen. The Thomson Reuters Governance, Risk & Compliance survey polled general counsel and board members at leading global corporations across a wide variety of industries.

Unencrypted board communications	85%
Board documents stored on personal computers at home or work	79%
Board documents stored on personal mobile devices (e.g., iPad, laptop, smartphone, etc.)	75%
Documents sent to board members via personal, non-commercial email addresses	73%
Board documents accessible via wi-fi or unsecured networks	71%
Have reported computer, mobile devices, or sensitive company documents lost, stolen or left in public places	10%

Real-time Technique Used to Spy on Gmail Accounts Detailed in Korean Legal Battle

2011-09-19T17:29:00.000-07:00

Ease of use for a technique known as packet tapping to spy on Gmail accounts, has been detailed in court documents in a high-profile legal appeal in S. Korea. As reported in S. Korea’s Hankyoreh Shinmun Times on Friday:

Unlike normal communication tapping methods, packet tapping is a technology that allows a real-time view of all content coming and going via the Internet. It opens all packets of a designated user that are transmitted via the Internet. This was impossible in the early days of the Internet, but monitoring and vetting of desired information only from among huge amounts of packet information became possible with the development of “deep packet inspection” technology. Deep packet inspection technology is used not only for censorship, but also in marketing such as custom advertising on Gmail and Facebook.

[South Korea’s] National Intelligence Service [NIS] itself disclosed that Gmail tapping was taking place in the process of responding to a constitutional appeal filed by 52-year-old former teacher Kim Hyeong-geun, who was the object of packet tapping, in March this year.

The NIS went on to explain, “[Some Korean citizens] systematically attempt so-called ‘cyber asylum,’ in ways such as using foreign mail services (Gmail, Hotmail) that lie beyond the boundaries of Korea‘s investigative authority, making packet tapping an inevitable measure for dealing with this.”

The NIS asserted the need to tap Gmail when applying to a court of law for permission to also use communication restriction measures [packet tapping]. The court, too, accepted the NIS’s request at the time and granted permission for packet tapping.

Law Firm Failures as Trusted Repositories for Secrets Now Open to Exposure Under New Law

2011-09-02T13:17:00.001-07:00

Law firms face new challenges to the exposure of both their client confidence and security practices. California Governor Jerry Brown signed SB 24 into law on Wednesday requiring companies with data breaches to report the scope of the breach to the California Attorney General’s Office.

The new law, likely to influence other states, offers special challenges for law firms. According to David Navetta, a founding partner with the Information Law Group, “Law firms are a repository of the most sensitive and private information. It’s one of the benefits of dealing with a law firm, the nature of the protected attorney client relationship. Even the possibility of a law firm having weak security is frightening.”

Tanya Forsheit, also a founding partner with Information Law Group, offers a very readable review and summary of the law, offering context and its likely impact on other states.

SB 24, effective January 1, 2012, opens a scenario in which law firms are required to report the data breach of 500 or more client files to the State Attorney General’s Office, creating a tacit admission to the violation of client privilege for a block of clients. According to Navetta, in a scenario like this, “I don’t think a law firm would characterize it that way. But even if we’re talking about the loss of intellectual property instead of personal information, what is the potential impact to litigation, if these items are discoverable? Bad practices may be exposed in a law firm.”

Webinar Pick: Chief of the California Office of Privacy Protection Joanne McNabb will present on the impact of SB 24 in a webinar sponsored by the California Webinar Law Journal on Oct. 20th. McNabb will discuss drivers to the new California Data Privacy Law and best practices for law-firm client privacy. The event is open for members of the California State Bar for continuing legal education credit and free to law school staff and students. See here for registration details.

Hacking Threat to Law Firms Pressures Corporate Counsel

2011-08-28T12:08:00.000-07:00

Corporate counsel for law firms appear to be coming under alert to hacking threats. The implications, for instance, of Baker & McKenzie being hacked would be broad for both B&M and their client, Sony, in fallout over the PlayStation data-breach. Douglas Woods, attorney with the New York Office of Reed Smith LLP, places responsibility for strategic measures to prevent corporate hacking squarely with corporate counsel. Writing for Corporate Counsel on Law.com, Wood’s four-point advice for counsel includes:

1. Check the company's security systems. Chances are, they're not state of the art. Considering the potential damage a successful hacker attack can cause, only the best system will do.

2. Retain an ethical hacker, and perform a penetration test.

3. Assemble a crisis-management team that includes your legal, public relations, and government-affairs departments, along with an IT warrior. Hold simulations.

4. Audit the company's data security policies.

McAfee Threats Report: Androids Become #1 Target in Q2. New Hacker Tools Released.

2011-08-23T12:36:00.000-07:00

The McAfee Threats Report for Q2 released today, reviews an unquestionably busy quarter for info-security worldwide including:

Chronology of the Anonymous/LulzSec split: detailing infighting and escalated hacktavist actions worldwide.

Android phone malware: android OS-based malware becomes the most popular phone malware for the first time, taking the lead over Java ME by a factor of 3X.

Cybercrime: Whether in Russia, Australia, or the US, the going rate for 1M stolen emails appears to be $25.00.

Crimeware tools: McAfee essentially prices and reviews new releases in Q2 for hacker tools and exploit kits, most notably Eleonore Version 1.6.5, with two 2011 exploits, and Best Pack, with one 2011 exploit.

Actions against cybercriminals: including the shutdown of the Coreflood botnet: “During an 11-month period starting in March 2009, Coreflood siphoned some 190GB worth of banking passwords and other sensitive data from more than 413,000 infected systems as users browsed the Internet, authorities said.”

Cyberwar: Access gained to the Oak Ridge National Laboratory supercomputer through phishing emails sent to 573 lab staff in April. Other incidents in Norway, Russia, and S. Korea.

Spam, Malware, Exploits: spam down, malware on a hockey stick, and exploits flat.

$20M Bank Heist Ring Busted in Ukraine. Hackers Face Two Years in Prison.

2011-08-22T16:55:00.000-07:00

In addition to ranking the top 50 worst webhosts for repeat cybercrime, Host Exploit reports on the $20M theft from US and foreign banks at the hands of a Ukrainian hacker ring. As announced today by Ukraine authorities, the four initial members arrested face two years in prison:

The Ukrainian law enforcement agency said in a press statement that a long-term operation, held jointly with the U.S., led to the discovery of an extensive network of hackers involving more than 20 people of different nationalities who used high-tech equipment to steal from the bank accounts of unsuspecting customers.

The gang are said to have used specialized computer programs to gain access to confidential card information which they then used to make fake bank cards and to carry out the unauthorized transactions from the bank accounts of victims in a number of different countries. Stolen funds were transferred to bank accounts set up by other members of the group.