spy & security

The defender must build a perfect wall to keep out all intruders, while the offense need find only one chink in the armor through which to attack

4.jpg

The air-support division of the Los Angeles Police Department operates out of a labyrinthine building on Ramirez Street in the city’s downtown, near the Los Angeles River. […]

The division began with a single helicopter in 1956, and it now has 19 in all, augmented by a King Air fixed-wing plane. The aircrews operate in a state of constant readiness, with at least two helicopters in flight at any given time for 21 hours of every day. A ground crew is suited up and on call for the remaining three, between 5 a.m. and 8 a.m. On weekends, considered peak hours, the number of airborne helicopters goes up to three, although in a crisis the division might send as many as four or five “ships” up at once. […]

The heavily restricted airspace around Los Angeles International Airport, Burdette pointed out, has transformed the surrounding area into a well-known hiding spot for criminals trying to flee by car. Los Angeles police helicopters cannot always approach the airport because of air-traffic-control safety concerns. Indeed, all those planes, with their otherwise-invisible approach patterns across the Southern California sky, have come to exert a kind of sculptural effect on local crimes across the city: Their lines of flight limit the effectiveness of police helicopter patrols and thus alter the preferred getaway routes.

{ NY Times | Continue reading }

painting { Michael Chow }

‘Clocks can never be pushed back. It’s all a lie. And now it’s dark.’ —Daylight Saving Time

8.jpg

A top Chinese military contractor is building a data analytics platform to help authorities identify terrorists before they strike. […]

So far, more data has just meant more noise, security experts say.. […]

Since the Mao era, the government has kept a secret file, called a dang’an, on almost everyone. Dang’an contain school reports, health records, work permits, personality assessments, and other information that might be considered confidential and private in other countries. The contents of the dang’an can determine whether a citizen is eligible for a promotion or can secure a coveted urban residency permit. The government revealed last year that it was also building a nationwide database that would score citizens on their trustworthiness.

{ Bloomberg | Continue reading }

Wildlife binoculars, tell me that you want me

39.jpg

Please notice how the Director of the NSA, unlike the vociferous FBI director, has been relatively silent. With a budget on the order of $10 billion at its disposal the NSA almost certainly has something equivalent to what the courts have asked Apple to create. The NSA probably doesn’t want to give its bypass tool to the FBI and blow its operational advantage.

{ Counterpunch | Continue reading }

Die Feldgleichungen der Gravitation

51.jpg

We investigate the role of networks of alliances in preventing (multilateral) interstate wars. We first show that, in the absence of international trade, no network of alliances is peaceful and stable. We then show that international trade induces peaceful and stable networks: Trade increases the density of alliances so that countries are less vulnerable to attack and also reduces countries’ incentives to attack an ally.

We present historical data on wars and trade showing that the dramatic drop in interstate wars since 1950 is paralleled by a densification and stabilization of trading relationships and alliances.

Based on the model we also examine some specific relationships, finding that countries with high levels of trade with their allies are less likely to be involved in wars with any other countries (including allies and nonallies), and that an increase in trade between two countries correlates with a lower chance that they will go to war with each other.

{ Proceedings of the National Academy of Sciences | Continue reading }

photo { Mark Cohen, Girl Holding Blackberries, 1975 }

White Sun of the Desert

4.jpg

…the immaculate ultrawhite behind the French doors of a new GE Café Series refrigerator […] the white hood of a 50th anniversary Ford Mustang GT […] the white used to brighten the pages of new Bibles, the hulls of super yachts, the snowy filling inside Oreo cookies […]

All this whiteness is the product of a compound known as titanium dioxide, or TiO2. A naturally occurring oxide, TiO2 is generally extracted from ilmenite ore and was first used as a pigment in the 19th century. In the 1940s chemists at DuPont refined the process until they hit on what’s widely considered a superior form of “titanium white,” which has been used in cosmetics and plastics and to whiten the chalked lines on tennis courts. DuPont has built its titanium dioxide into a $2.6 billion business, which it spun off as part of chemicals company Chemours, in Wilmington, Del., last fall.

A handful of other companies produce TiO2, including Kronos Worldwide in Dallas and Tronox of Stamford, Conn. Chemours and these others will churn out more than 5 million tons of TiO2 powder in 2016. China also produces large amounts of the pigment, and its industries consume about a quarter of the world’s supply. Most of China’s TiO2 plants, however, use a less efficient and more hazardous process than the one developed at DuPont. Starting in the 1990s, if not earlier, China’s government and Chinese state-run businesses began seeking ways to adopt DuPont’s methods. Only they didn’t approach the company to make a formal deal. According to U.S. law enforcement officials, they set out to rip off DuPont.

“At first, you’re like: Why are they stealing the color white?” says Dean Chappell, acting section chief of counterespionage for the FBI.

{ Bloomberg | Continue reading }

oil on wood { Ellsworth Kelly, White Plaque: Bridge Arch and Reflection, 1951-55 }

Which losses do we impose on some to benefit others?

310.jpg

The NSA’s inspector general last year detailed 12 cases of “intentional misuse” of intelligence authorities from 2003 to 2013 […] Those cases included a member of a U.S. military intelligence unit who violated policy by obtaining the communications of his wife, who was stationed in another country. After a military proceeding, the violator was punished by a reduction in rank, 45 days of extra duty and forfeiture of half of his pay for two months, according to the letter. In a 2003 case, a civilian employee ordered intelligence collection “of the telephone number of his foreign-national girlfriend without an authorized purpose for approximately one month” to determine whether she was being faithful to him, according to the letter. The employee retired before an investigation could be completed.

{ Bloomberg | Continue reading }

photo { Olivia Locher, Lucifer Rising, 2014 }

Superboy-Prime: [battling Superman] I’m the only one who can rescue this messed-up universe.

39.jpg

This report describes the details and type of operations carried out by an organized criminal group that focuses on financial industry, such as banks and payment providers, retail industry and news, media and PR companies. […] The organized criminal group backbone are citizens of both Russian and Ukrainian origin. […]

The average sum of theft in the Russian territory and in the post-Soviet space is $2 million per incident. […] To date the total amount of theft is over 1 billion rubles (about 25 million dollars), most of it has been stolen in the second half of 2014. […]

The key is that fraud occurs within the corporate network using internal payment gateways and internal banking systems. Thus money is stolen from the banks and payment systems, and not from their customers. While this is their main and most lucra- tive activity, the gang has also ventured into other areas including the compromise of media groups and other organizations for industrial espionage and likely a trading advantage on the stock market. […]

The average time from the moment of penetration into the financial institutions internal network till successful theft is 42 days.

As a result of access to internal bank networks the attackers also managed to gain access to ATM management infrastructure and infect those systems with their own malicious software that further allows theft from the banks ATM systems on the attackers command. […]

The main steps of the attack progression are the following ones:

1. Primary infection of an ordinary employee computer.
2. Getting a password of a user with administra- tive rights on some computers. For example, a password of a technical support engineer.
3. Gaining legitimate access to one server.
4. Compromising the domain administrator password from the server.
5. Gaining access to the domain controller and compromising of all active domain accounts.
6. Gaining access to e-mail and workflow servers.
7. Gaining access to server and banking system administrator workstations. 

8. Installing the software to monitor activity of interesting system operators. Usually photo and video recording was used.
9. Configuring remote access to servers of inter- est including firewall configuration changes.

{ Group-IB and Fox-IT | PDF }

‘Knock, knock! Who’s there?’ —Shakespeare

38.jpg

The malware, called “Regin”, is probably run by a western intelligence agency and in some respects is more advanced in engineering terms than Stuxnet. […]

Symantec said it was not yet clear how Regin infected systems but it had been deployed against internet service providers and telecoms companies mainly in Russia and Saudi Arabia as well as Mexico, Ireland and Iran. […]

“Nothing else comes close to this . . . nothing else we look at compares,” said Orla Cox, director of security response at Symantec, who described Regin as one of the most “extraordinary” pieces of hacking software developed, and probably “months or years in the making”. […] “Sometimes there is virtually nothing left behind – no clues. Sometimes an infection can disappear completely almost as soon as you start looking at it, it’s gone. That shows you what you are dealing with.”

{ FT | Continue reading }

Mercury Retrograde in Gemini in your face

Yo, the app, has been hacked

‘Or, si l’habit ne fait pas le moine, l’habitation fait l’habitant.’ —Alexandre Dumas, fils

531.gif

In shopping malls, for instance, a firm called Euclid Analytics collects, in its own words, “the presence of the device, its signal strength, its manufacturer (Apple, Samsung, etc.), and a unique identifier known as its Media Access Control (MAC) address.” In London last year, one start-up installed a dozen recycling bins that sniffed MAC addresses from passers-by, effectively tracking people through the area via their phones. Such companies go to great lengths to explain that such information in not personally identifiable—except that repeated studies have shown that this data can indeed be used to infer a great deal about your life.

At the core of such tracking is the MAC address, a unique identification number tied to each device. Devices looking for a Wi-Fi network send out their MAC address to identify themselves. Wireless routers receive the signals—and addresses—even if a connection is never made. Companies like Euclid or its peer Turnstyle Solutions use the data to track footfall in stores, how people move about in shops, how long they linger in certain sections, and how often they return. Store-owners use the information to target shoppers with offers (paywall) or to move high-value items to highly-trafficked parts of the shop, among other things. […]

Apple’s solution, as discovered by a Swiss programmer, is for iOS 8, the new operating system for iPhones which will be out later this year, to generate a random MAC addresses while scanning for networks. That means that companies and agencies that collect such information will not necessarily know when the same device (i.e., person) visits a store twice, or that the same device pops up in stores across the country or the world, suggesting a much-travelled owner.

{ Quartz | Continue reading }

related { With the launch of a health app and data-sharing platform, Apple is betting that tracking your vital signs via smartphone is about to become a booming industry }

‘Funeral by funeral, theory advances.’ –Paul Samuelson

231.jpg

Over the past year, I’ve spent a great deal of time trolling a variety of underground stores that sell “dumps” — street slang for stolen credit card data that buyers can use to counterfeit new cards and go shopping in big-box stores for high-dollar merchandise that can be resold quickly for cash. By way of explaining this bizarro world, this post takes the reader on a tour of a rather exclusive and professional dumps shop that caters to professional thieves, high-volume buyers and organized crime gangs. […]

Like many other dumps shops, McDumpals recently began requiring potential new customers to pay a deposit (~$100) via Bitcoin before being allowed to view the goods for sale. Also typical of most card shops, this store’s home page features the latest news about new batches of stolen cards that have just been added, as well as price reductions on older batches of cards that are less reliable as instruments of fraud. […]

People often ask if I worry about shopping online. These days, I worry more about shopping in main street stores. McDumpals is just one dumps shop, and it adds many new bases each week. There are dozens of card shops just like this one in the underground (some more exclusive than others), all selling bases [batches of cards] from unique, compromised merchants.

{ Krebs on Security | Continue reading }

Full of win

354.jpg

Today, credit cards are on supersale. Pageler says that means a big breach just happened.

Strangely, platinum credit cards on the site are selling for less money than gold cards. […]

The bots send out emails, and between 5 percent and 10 percent of recipients open the attachment, which lets the crooks in.

{ NPR | Continue reading }