• Thanks for stopping by. Logging in to a registered account will remove all generic ads. Please reach out with any questions or concerns.

Killing with Keyboards

Status
Not open for further replies.
Just an update and a few points that some may want to ponder.

It behoves all to be security conscious.  Lapses in security can be found at every level.  Here is a glaring example:


MI6 chief's cover blown by wife's holiday pics on Facebook found on this site:  http://digg.com/tech_news/MI6_chief_s_cover_blown_by_wife_s_holiday_pics_on_Facebook

===================================================================

The Jerusalem Post

MI6 chief's cover blown on Facebook

Personal information about the new MI6 head has been exposed on Facebook in a major security blunder, the Daily Mail reported Sunday.

Sir John Sawers was set to take over as chief of the Secret Intelligence Service in November, putting him in charge of Britain's espionage operations abroad.

However, his wife's Facebook entries have exposed potentially compromising details about where they live and work, their friends and where they spend their holidays, said the paper.

Among the information was the fact that the intelligence chief's brother-in-law is an associate of historian and Holocaust denier David Irving.

After the Mail informed the Foreign Office of the blunder, all the material was removed from the Internet.

The British newspaper quoted senior politicians as saying that the security lapse raised serious doubts about Sawers' suitability to head the intelligence service.

More on Link in title.

=====================================================================

From the BBC

New MI6 spymaster named


A Cambridge-educated career spy has been named as the new chief - also known as "C" - of the Secret Intelligence Service, MI6.
Richard Billing Dearlove, 54, currently the service's assistant chief, succeeds the present "C", Sir David Spedding, when he retires at the end of August. Mr Dearlove is only the second MI6 chief to have his appointment announced publicly.

The new spymaster was selected from a short-list of candidates drawn from both inside and outside the service. The appointment was made by Foreign Secretary Robin Cook in consultation with the Prime Minister Tony Blair.

Although Mr Dearlove's appointment was announced, the much-vaunted spirit of greater openness and accountability of the security services did not extend to releasing a photograph of the new chief.

Classic MI6 background

An official curriculum vitae was released to the press, however. It shows he comes from the classic security service background of public school followed by Oxbridge - something Robin Cook and Mr Blair have said they are keen to change.

The short resume reveals Mr Dearlove was born somewhere in Cornwall on 23 January 1945.

He was educated at the independent fee-paying Monkton Combe School near Bath and in 1962-63 spent a year at Kent School in Connecticut, USA, before going to Queen's College, Cambridge.

The official biography reveals that he joined MI6 in 1966 as a 21-year-old graduate - signalling that, like more familiar spy names (mostly notorious for having been double agents) Mr Dearlove appears to have been recruited while studying at Cambridge.

In 1968 he received his first overseas posting to the Kenyan capital, Nairobi. Several postings later, he became head of MI6's Washington station in 1991.

He returned to the UK in 1993 as director of personnel and administration. The following year he became director of operations and in 1998 he was additionally made assistant chief.

He is married with three grown-up children and was given an OBE in 1984.

Described as an "all-rounder" in intelligence terms, sources insist he was chosen as the best candidate from those available. His appointment will be seen as a shift of emphasis by the service after Sir David, who was an Arabist from MI6's elite Middle East specialists, dubbed the "camel corps".

It reflects a new commitment in the post Cold War-era to combating international organised crime as well as MI6's more traditional espionage activities.

One of the green ink brigade

As service chief, his pay will be on the same level as a Permanent Secretary which, from 1 April, is between £98,400 to £168,910.

Like every incumbent since the first chief Captain Sir Mansfield Cumming in 1909, he will be known in Whitehall as "C" and tradition dictates that he writes his memorandums in green ink - something modern folklore holds is a sign of battiness.

Apart from that, the Foreign Office was giving little away. But the media has succeeded in tracking down his home - a three-storey semi-detached Edwardian house in a leafy residential street in Putney, south west London.

One neighbour, a middle-aged woman who declined to be named, said Mr Dearlove and his wife had been so secretive, it had become a family joke.

"It's been a joke with me and my husband, that the man next door was a spy. We've lived here two years and only met them once, we hardly ever see them," she said.

She added that notes had been posted through neighbours' doors asking them not to speak to reporters if asked about the Dearloves.

Seven-foot hedge

Other neighbours, even those living very near to the new chief spy's house - which is hidden from public view by a seven-foot tall hedge - said they either did not know the couple or had never seen them.

And both his old public school and Queen's College, Cambridge, have apparently been warned not to talk to journalists about their former student.

"I fear we are not in a position to make any comment about Richard Dearlove at all. I'm sure you understand why," said a spokesman at Monkton Combe School.

There was a similar line at Queen's where a woman in the Bursar's office said: "I don't think you will find anyone in the college willing to speak about this".

Kent School in the US initially promised to be more forthcoming. "How exciting," said a woman in the admissions office when told of their former student's new job.

The alumni office initially offered to help, then said it was temporarily unable to access its records because of a computer error but promised to help once the system was back up.

Yet by late afternoon, the long arm of the spooks based in MI6's modern gothic headquarters on the Thames appeared to have reached across the Atlantic. "We cannot give out any information about Richard Dearlove. It's confidential," the alumni office had decided.

More on Link in title.

===============================================================================

Whoops- Incoming MI6 chief's wife spills details on Facebook

MI6 chief's cover is blown by wife's holiday snaps on Facebook - Mixx

New MI6 chief's wife blatantly breaches secrecy by posting 'plenty

MI6 chief's wife posts all on Facebook

Wife of new MI6 chief spills personal details on Facebook - TECH

MI6 chief blows his cover as wife's Facebook account reveals ...

MI6 chief's Facebook details cut - Worldnews.com

Incoming MI6 chief in Facebook security slip

As can be seen, even those in the business of Security, at the highest levels, can make slips in judgement.  There are pages of links to this infraction on the internet.  This person's whole life is open to public viewing.



Remember to take SECURITY seriously.

 
Here, reproduced under the Fair Dealing provisions of the Copyright Act from the Ottawa Citizen is a pertinent article:

http://www.ottawacitizen.com/business/That+Facebook+friend+could+foreign/5715416/story.html
That Facebook ‘friend’ could be a foreign spy

By Vito Pilieci, The Ottawa Citizen

November 15, 2011

OTTAWA — Hackers are becoming so targeted with their attacks that they are mining Facebook profiles for personal information that could help them steal sensitive data.

Security expert Michel Juneau-Katsuya says a Department of National Defence employee told investigators he received an email from someone pretending to be a co-worker who said he had seen the employee at his daughter’s soccer game over the weekend. The hacker claimed to have been added to the employee’s work team, which was assembling sensitive information, and asked for a copy of the work done so far.

The personal information came from pictures the DND staffer had posted to Facebook. The staffer alerted department officials.

“Breeches will happen because of human beings getting involved somewhere,” said Juneau-Katsuya. chief executive of the Northgate Group security firm and a former senior intelligence officer for the Canadian Security Intelligence Service.

“Whether that’s willingly, unwillingly, consciously or unconsciously. Whether they lost or forgot something or they simply held open the door for somebody. There is a human factor in it.”

Juneau-Katsuya says international espionage is reaching record levels as governments move away from costly military confrontations in favour of electronic attacks and computer data theft — and they are picking on average people to get what they want.

Speaking at the release of the 2011 Telus-Rotman IT Security Study, Juneau-Katsuya said more than 10 times more spy activity goes on today than at the peak of the Cold War.

“All of the spy activities can now be done remotely. It’s less expensive because you don’t have to move your assets abroad,” he said.”

The security expert said Canada is increasingly targeted because of its lack of a national cyber-security strategy, coupled with rising information breaches being perpetrated by government insiders.

Its economic health is another factor as cash-trapped nations, and even private investors, try get any advantage to safeguard their investments. That includes hacking into government servers to determine certain policy directions.

A January 2001 attack on the federal government was aimed at getting information on Saskatchewan’s potash industry. Foreign hackers masqueraded online as an aboriginal group to gain access to the Finance Department and Treasury Board networks. The hackers sent emails to high-ranking department officials containing a link to a webpage infected with a sophisticated virus. It then opened a pathway deep into the government networks and installed spy malware. They also sent infected PDF files that, when opened, unleashed more malicious code to target and download government secrets.

According to the Telus-Rotman study, uneducated employees are to blame for a majority of malicious hacker attacks on organizations. The report said more than 42 per cent of the attacks reported in 2011 are the result of employees opening email attachments infected with a virus.

The report also warns about the way federal public servants handle sensitive data, noting that 34 per cent of all the security breaches reported by government in 2011 were a result of employees losing laptops or mobile devices. The loss rate in the private sector was 30 per cent lower.

As well, the government was warned that a vast majority of its data leaks come from staff members. More than 42 per cent of all data breaches reported from within government were the result of insiders leaking information, a 28-per-cent increase over 2010, according to the report. In the private sector, insiders accounted for 16 per cent of the data lost.

The government’s problems are being compounded by unauthorized access to information by government employees — for example, a nosy employee at Canada Revenue Agency who wants to find out his neighbour’s income — which could arm those employees with sensitive information and make it difficult to determine how various leaks are happening. According to the report, more than 24 per cent of all data breaches reported in 2011 were the result of unauthorized access to information by government employees. In the private sector, unauthorized access to information by employees accounted for 11 per cent of the data breaches reported last year.

Not all of the findings were negative. Government only saw 17 data breaches in 2011, down from 22 in 2010. The private sector reported four data breaches, down from nine last year.

Juneau-Katsuya said governments and private organizations have to keep educating employees about phishing and other common attack methods. If employees don’t understand how dangerous it is to open strange email attachments, they will never be prepared for the next generation of tailored attacks, such as the use of Facebook to find personal information to entice people to send out sensitive files.

“In the last 30 years the policy of the government has been speak no evil, see no evil,” he said. “If you don’t speak about the problem you cannot expect people to start finding solutions for something they don’t know exists.”

The U.S. has allocated $1.1 billion over five years for cyber protection. It also recently announced that Defense Advanced Research Projects Agency (DARPA) has been tapped to being developing an arsenal of cyber weapons. Britain is to spend $40 billion on cyber warfare and cyber espionage preparedness.

© Copyright (c) The Ottawa Citizen


Let me add some anecdotal evidence.

I am not on Facebook but, apparently, my picture was.

Recently, last month, a friend E-mailed to me to tell me that my picture was being used on Facebook by someone who was, pretty clearly, not me. The pictures (there were a few) were ones I had posted on a couple of web sites (not Army.ca) and I had, obviously thought about the fact that everything on the Internet is public and I saw, and still see, no problems with sharing those pictures.

Someone on Facebook used a few of them, including one or two of my home, on his page.

I contacted Facebook – not as easy as it looks when you are not a registered user – and told them. They, to their credit, got back to me, fairly quickly, to tell me two things:

1. They had asked the user to not misrepresent himself – but they cannot, apparently, tell him (I assume it was a man, I may be wrong) to “cease and desist;” and

2. My pictures were, indeed, public, etc.

The Facebook user was, apparently, using a name with had one similarity to mine and suggested that he lived in my apartment but he did not, as far as my friend could determine, use my actual address. In any event he disappeared (disabled his account?) a couple of weeks ago. My friend enlisted a couple of computer savvy friends of hers to dig a bit deeper: the impostor appears to be in the Middle East and was focused on (mainly female) "friends" in Hong Kong and Singapore (two places where I have real friends and contacts).
 
 
Even here on Army.ca one can build a shallow, but comprehensive composite of an identity based on profiles, commentary and postings.....
 
The hacker claimed to have been added to the employee’s work team, which was assembling sensitive information, and asked for a copy of the work done so far.

I would have replied, "Come see me at work."  >:D

Truthfully, I wouldn't have replied at all.
 
Given that e.g. the Chinese Embassy have my name address, phone number, passport number and, and, and ... in fact they even send me a card and an invite for drinks every fall ... I'm not trying to "hide" anything from the best know of the (suspected) cyber attackers. I'm not trying to "hide" from anyone - I just don't feel a need to use Facebook. So I was a little bit dismayed to find that I was being used as a disguise by someone else for reasons I do not even pretend to know.

 
A bit of an update from the University of Haifa:
Hackers invading databases is just the tip of the iceberg in online terrorist activity: International terrorist organizations have shifted their Internet activity focus to social networks and today a number of Facebook groups are asking users to join and support Hezbollah, Hamas and other armed groups that have been included in the West’s list of declared terror organizations. This has been shown in a new study conducted by Prof. Gabriel Weimann of the University of Haifa. “Today, about 90% of organized terrorism on the Internet is being carried out through the social media. By using these tools, the organizations are able to be active in recruiting new friends without geographical limitations,” says Prof. Weimann.

Over the past ten years, Prof. Weimann has been conducting a study of encoded and public Internet sites of international terror organizations, groups supporting these organizations, forums, video clips, and whatever information relating to global terrorism is running through the network.

According to Prof. Weimann, the shift to social media, and especially Facebook and Twitter, has not bypassed the terrorist organizations, who are keenly interested in recruiting new support in the new media’s various arenas - Facebook, chat rooms, YouTube, Myspace, and more. “The social media is enabling the terror organizations to take initiatives by making ‘Friend’ requests, uploading video clips, and the like, and they no longer have to make do with the passive tools available on regular websites,” he notes.

Facebook’s popularity is being utilized by the terror organizations, and besides recruiting new friends, they use this platform as a resource for gathering intelligence. A statement originating from Lebanon has reported that Hezbollah is searching for material on the Israeli army’s Facebook activity, while many countries such as the USA, Canada and the UK have instructed their soldiers to remove personal information from this network as a precaution in case Al Qaeda is monitoring it. “Facebook has become a great place to obtain intelligence. Many users don’t even bother finding out who they are confirming as ‘Friend’ and to whom they are providing access to a large amount of information on their personal life. The terrorists themselves, in parallel, are able to create false profiles that enable them to get into highly visible groups,” he says ....
U of Haifa info-machine blog, 8 Jan 12

Can't find the study ref'ed in the blog post/news release, but will share when I do.
 
As promised, here's the paper referred to in the above-mentioned news release - enjoy!
 
Some people have been having some PERSEC concerns lately.  Perhaps they should be reminded by the points in this topic and that the material that they post on the internet is there forever.  It does not disappear.  People will quote what you say, they may save your post in their files, whole websites are archived on other databases, people print off articles they find of interest, and a whole myriad of other methods are used to retrieve and save information that someone may be looking for. 

Think before you hit that POST button.  Would you say what you intend to post in front of your mother?  If not; perhaps it is a good sign that you should not post it.
 
E.R. Campbell said:
Here, reproduced under the Fair Dealing provisions of the Copyright Act from the Ottawa Citizen is a pertinent article:
That Facebook ‘friend’ could be a foreign spy

By Vito Pilieci, The Ottawa Citizen

November 15, 2011

OTTAWA — Hackers are becoming so targeted with their attacks that they are mining Facebook profiles for personal information that could help them steal sensitive data.

Security expert Michel Juneau-Katsuya says a Department of National Defence employee told investigators he received an email from someone pretending to be a co-worker who said he had seen the employee at his daughter’s soccer game over the weekend. The hacker claimed to have been added to the employee’s work team, which was assembling sensitive information, and asked for a copy of the work done so far ....
Taking this meme a step further ....
TALIBAN insurgents are posing as "attractive women" on Facebook to befriend coalition soldiers and gather intelligence about operations.

Australian soldiers are given pre-deployment briefings about enemies creating fake profiles to spy on troops.

Personnel are also being warned that geo-tagging - a function of many websites that secretly logs the location from where a post is made or a photo is uploaded - is a significant danger.

Family and friends of soldiers are inadvertently jeopardising missions by sharing confidential information online, the report warns.

Three Australian soldiers were this month murdered inside their base, allegedly by an Afghan Army trainee.

The dangers of social media are revealed in a federal government review of social media and defence, which was finalised in March but has not been acted upon, Defence sources say.

The review found an "overt reliance" on privacy settings had led to "a false sense of security" among personnel.

The review warns troops to beware of "fake profiles - media personnel and enemies create fake profiles to gather information. For example, the Taliban have used pictures of attractive women as the front of their Facebook profiles and have befriended soldiers."

Many of the 1577 Defence members surveyed for the review had no awareness of the risk, it said, adding 58 per cent of Defence staff had no social media training.

Surveyed troops said social media open "a whole can of worms when it comes to operational, personnel and physical security".

"Many individuals who use social media are extremely trusting," the review said.

"Most did not recognise that people using fake profiles, perhaps masquerading as school friends, could capture information and movements. Few consider the possibilities of data mining and how patterns of behaviour can be identified over time." ....
Sydney Daily Telegraph, 9 Sept 12
 
Status
Not open for further replies.
Back
Top