2181 lines
92 KiB
Plaintext
2181 lines
92 KiB
Plaintext
ComSec Letter
|
|
|
|
Editor: James A. Ross
|
|
|
|
YOGO 4
|
|
|
|
1988
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
COMSEC LETTER
|
|
|
|
|
|
The ComSec Letter was started in 1984, The Year Of George
|
|
Orwell, by Jim Ross. Initially it was mailed at no charge to
|
|
everyone on his mailing list, and it was later offered by
|
|
subscription. After the founding of the Communication Security
|
|
Association, the letter became its official organ. In 1989 the
|
|
association decided to create a new organ, Comsec Journal; and,
|
|
in order to minimize confusion, the name of this letter was
|
|
changed to Surveillance.
|
|
|
|
What follows is an edited version of the contents of one
|
|
year of the letter. (The letter has been edited to remove
|
|
topical, superfluous, and outdated items.)
|
|
|
|
|
|
|
|
|
|
Ross Engineering, Inc.
|
|
7906 Hope Valley Court
|
|
Adamstown, MD 21710
|
|
Tel: 301-831-8400; Fax: 301-874-5100 January, 1988
|
|
|
|
TAP DETECTORS, AGAIN
|
|
|
|
Recently we received a catalog from Sharper Image which
|
|
offered a telephone tap detector. The blurb said that 98% of
|
|
"phone snooping" is done with low or medium impedance taps, and
|
|
that this device has a green light which means your line is
|
|
secure. We responded with the following letter to Richard
|
|
Thalheimer.
|
|
|
|
Dear Richard,
|
|
|
|
Just a short note with some information that might
|
|
save you from an expensive lawsuit some day.
|
|
|
|
In describing a "phone that knows how to keep a
|
|
secret" on page 14 of your current catalog, you say
|
|
that 98% of phone snooping is by low or medium
|
|
impedance taps.
|
|
|
|
First, in my experience most "phone snooping" is not
|
|
via taps; it is accomplished by phone modifications
|
|
known as phone bugging. Second, whoever told you that
|
|
taps are 98% low or medium impedance doesn't know what
|
|
he's talking about. In fact, he probably doesn't even
|
|
know what the word "impedance" means! Even a simple
|
|
tap, made from a few dollars worth of common electronic
|
|
components, presents a very high impedance to the
|
|
tapped line.
|
|
|
|
"Green light means your line is secure." Wow!
|
|
That's a powerful claim. Don't you wonder why Bell
|
|
Labs, with the best brains in the field, could never
|
|
make that claim?
|
|
|
|
I'm confident that the phone that you're touting can
|
|
be easily tapped, and it will not detect the tap. If
|
|
you'd like a live demonstration, I'm sure it can be
|
|
arranged.
|
|
|
|
I hope you'll check into this, and respond to this
|
|
letter. I'd like to pass your response on to our
|
|
members via the ComSec Letter (sample enclosed).
|
|
|
|
The initial response to this letter was a phone call from a
|
|
buyer at Sharper Image. He left a message that he had not yet
|
|
heard back from their vendor, but the device was not selling well
|
|
so they might drop it anyway.
|
|
|
|
|
|
OBSCENE CALLS COUNTERMEASURES
|
|
|
|
This subject continues to come up, so let's pass along our
|
|
ideas and ask for yours.
|
|
|
|
First, the new telco service which will allow you to
|
|
identify the calling number is in very limited operation at only
|
|
a few locations around the country. If you want to find out if
|
|
you can subscribe to it, we suggest that you call your telephone
|
|
company business office and ask when you'll be getting the
|
|
capability.
|
|
|
|
Now, not having that service, what can you do? Well, I know
|
|
one man who solved the problem by recording some of the calls,
|
|
and then advising the caller that the tape goes to the police if
|
|
the calls don't stop. That worked for him, but the last person
|
|
who inquired of me was a state trooper, so his caller certainly
|
|
would not be intimidated by a threat to go to the police.
|
|
|
|
My advice to the state trooper was to get an automatic
|
|
dialer, and to activate it during an obscene call. If the caller
|
|
is not too bright, he may think that the rapid, machine-made
|
|
signals are automatic trace signals especially if you say some
|
|
words to imply such.
|
|
|
|
Anybody got any good ideas? I don't think a loud noise will
|
|
help because I don't think it will pass through the telco
|
|
equipment end-to-end at its original ear-splitting level.
|
|
|
|
|
|
SPOUSAL EAVESDROPPING
|
|
|
|
Boy, talk about response! No sooner had the last ComSec
|
|
Letter hit the mail, than we had a call from member Nick
|
|
Beltrante informing us that he had mailed a copy of the decision
|
|
on the spousal eavesdropping case. Our thanks to Nick, and
|
|
here's the story.
|
|
|
|
It seems that the husband suspected his wife of extramarital
|
|
affairs, so he installed a system to automatically record all
|
|
calls. He got the proof, and confronted her. He caught her
|
|
(electronically) a second time. He divorced her, and she sued
|
|
him citing the federal eavesdropping law.
|
|
|
|
The judge in this case found conflicting precedents. He
|
|
chose the precedent in which husband and wife were living
|
|
together in the same household and no third party was involved in
|
|
the taping of the calls -- as was the situation in the case
|
|
before him. In the earlier case the ruling was that marital
|
|
cases traditionally are not tried in federal courts. Further,
|
|
exhaustive search of the legislative history could find no
|
|
indication that the drafters of the federal law meant for it to
|
|
be used in domestic conflicts.
|
|
|
|
Again, our thanks to member Beltrante for sending along the
|
|
information. The newspaper story that we had quoted was correct.
|
|
A federal judge did rule that federal eavesdropping laws do not
|
|
relate to domestic cases in certain circumstances.
|
|
|
|
|
|
CORRECTION
|
|
|
|
Just last month we passed along the new address for the Bell
|
|
Labs RECORD, but now we find that it is no longer published. The
|
|
new publication is AT&T Technology, and four issues cost $40.00
|
|
|
|
Sorry for any confusion we created.
|
|
|
|
|
|
HOW MUCH DECEPTION IS ENOUGH?
|
|
|
|
We just received a promotional piece from Dictaphone. It
|
|
looks very much like a Federal Express overnight letter. It's
|
|
smaller, but laid out the same way with the delivery instructions
|
|
typed on a form that looks like the Fedex form, and contained in
|
|
a transparent pocket on the carrier just like Fedex. One side of
|
|
the carrier says, "Jet Express" "URGENT LETTER ENCLOSED".
|
|
Overall, it is a strong effort to make the recipient think he is
|
|
receiving something that was important enough to warrant spending
|
|
about fifteen dollars for overnight delivery.
|
|
|
|
Unfortunately however, the information on the delivery form
|
|
gives the hoax away; it says, "Bulk Rate US Postage Paid,
|
|
Richmond, VA, Permit #936". He didn't spend fifteen dollars to
|
|
get it to me overnight; he spent twelve and a half cents or less
|
|
to get it to me within a few weeks or months!.
|
|
|
|
Now, we know that people who mail to rented lists want to
|
|
encourage you to open and read their offers, but this seller is
|
|
contradicting himself when he labels his piece "Urgent Letter"
|
|
and sends it bulk rate.
|
|
|
|
My personal reaction to this is that I don't trust Gordon F.
|
|
Moore who sent it to me. He tried to fool me once; and I think,
|
|
if I start talking to him about buying his product, he'll try to
|
|
fool me again. Therefore, he has no chance of ever selling me
|
|
anything.
|
|
|
|
Your comment?
|
|
|
|
|
|
CELLULAR PHONES, AGAIN
|
|
|
|
Well, the California Public Utilities Commission is on the
|
|
ball. They've asked the phone companies to notify customers that
|
|
cellular calls may not be private. Great!
|
|
Unfortunately, there is a superfluous word in at least one
|
|
of the announcements. It says, "Cellular telephones send calls
|
|
over public radio frequencies." The superfluous word, of course,
|
|
is "public". Its use implies that there are some frequencies
|
|
which are not public, and that is just not so. Everything
|
|
transmitted by radio can be heard by anyone who has the right
|
|
equipment and technique.
|
|
|
|
What's needed is education. Let's spread the word. Phone
|
|
conversations are not private. They can be overheard very
|
|
easily.
|
|
|
|
|
|
DRUG DEALERS AND CMTs
|
|
|
|
Newsweek wrote about it, and ComSec Letter has written about
|
|
it. Drug dealers use cellular phones to do their business. DEA
|
|
complains about it. DEA should do something about it. If I can
|
|
monitor drug deals in progress, why can't the DEA? If I can
|
|
monitor a collector on Long Island going about his rounds, why
|
|
can't the FBI?
|
|
|
|
You know, the irony of the whole thing is that those people
|
|
don't pay for their phone calls. They use stratagems that defeat
|
|
the phone companies' billing systems, so all of us who pay our
|
|
phone bills are subsidizing the drug dealers.
|
|
|
|
Let's move into the twentieth century, and use modern
|
|
communications and computational capabilities to put a stop to
|
|
this stuff.
|
|
|
|
|
|
|
|
LETTER
|
|
|
|
F. Douglas Porter of Tucson, Arizona wrote to ask some very
|
|
good questions. First, he wants to know when we are going to
|
|
sponsor meetings relating to computer communications and computer
|
|
security. Although the association is still in its infancy, we
|
|
are planning a big meeting for the east coast which will include
|
|
just what you want. At this time we can't be specific on place
|
|
and date, but we're working on it. You will be advised.
|
|
|
|
Also, he asks how he can access our BBS. Well Doug, the
|
|
volunteer who set up the ComSec BBS changed it into a personal
|
|
project, and then abandoned it altogether. There will be a board
|
|
some day, I'm sure; but there is none right now.
|
|
|
|
The last question is the tough one. He wants to know when
|
|
we'll be conducting some activities in the West, and that takes a
|
|
little background to answer. The people who organized this
|
|
association are all in the East and they remain the volunteer
|
|
work force. Our main effort at the moment is to get our next
|
|
expo under way, and we're working hard at it. However, we're
|
|
also putting together written procedures for establishing local
|
|
chapters, and we'll be sending information in this letter. Why
|
|
not start a chapter and begin to sponsor some local events, even
|
|
before the rules are in place? Let me hear from you.
|
|
|
|
|
|
February, 1988
|
|
|
|
EXCELLENT SUGGESTION
|
|
|
|
Bill Ranson of Richmond, Virginia called to suggest that we
|
|
summarize the eavesdropping laws in the ComSec Letter, and we
|
|
think that that is an excellent suggestion. Bill, you're on.
|
|
We'll start on that project right away, and you'll see something
|
|
in this letter in the near future.
|
|
|
|
Along that line, there are some excellent publications
|
|
available relating to communications, security, and privacy.
|
|
We're including an extra page with this letter which lists some
|
|
information sources that we recommend without reservation. (The
|
|
April issue of Computer Security Digest has some especially
|
|
chilling information from people in the computer trenches.)
|
|
|
|
If you contact any of them, please mention ComSec Letter.
|
|
|
|
|
|
OPPORTUNITIES
|
|
|
|
This association has openings for people ready to work. No
|
|
pay, just a lot of time-consuming work.
|
|
|
|
What's your reward? Maybe nothing. Maybe something.
|
|
|
|
The only thing that you'll get for sure is some publicity.
|
|
You'll get your name and company affiliation on our letterhead.
|
|
You'll sit at head tables from time to time; you might even get
|
|
to give a speech, if that's your desire.
|
|
|
|
All of these things may turn out to be of no value to you
|
|
other than some items you can add to your scrapbook to look at
|
|
when you're old and gray. On the other hand, if you are
|
|
ambitious, getting involved in an international organization's
|
|
activities might just bring you to the attention of the person
|
|
who can provide the big break you are looking for. Who knows?
|
|
|
|
There are committees and projects in need of leaders with
|
|
initiative. All involve paperwork, phone calls, and planning; but
|
|
no manual labor. Keep in mind that it is logical and normal that
|
|
members will select known workers for the next national board of
|
|
directors. If you can help in any way, contact the editor -- NOW.
|
|
|
|
|
|
IN THE MAIL & OUR THANKS
|
|
|
|
Thanks to Dave Mann who has sent much valuable information,
|
|
and to Bob Haydon who advised that he built a "listen-at-a-
|
|
distance" mike (discussed in a seminar) and it works.
|
|
Thanks also to Richard D'Aleo who sent us a written critique
|
|
with good suggestions for improving the seminar from his point of
|
|
view, and who also provided the information on "The Other NSA".
|
|
|
|
Also, Marion Lewis of Sovran Financial Corporation sent us
|
|
some material on Sherwood Communications Associates. Thanks
|
|
Marion. Sherwood is a relatively young firm, but they have an
|
|
amazing array of products -- from standard telephone items to
|
|
very sophisticated (and expensive) instruments. Also, they offer
|
|
used TSCM equipment at good prices. You'll find them listed in
|
|
the supplement to this letter because they have a great
|
|
collection of books and reports for sale.
|
|
|
|
|
|
LETTER
|
|
|
|
A member who is in military service wrote us recently asking
|
|
for our help in finding a job after his discharge. We have no
|
|
staff for any such job bank activity, and the work he's looking
|
|
for is very seldom advertised, so we're passing his request along
|
|
in this letter.
|
|
|
|
"I am about to leave military service. In the military one
|
|
of my functions was the monitoring of official telephone calls to
|
|
identify if there was any breach of security occurring.
|
|
|
|
"I have enjoyed this job and would like to be able to
|
|
continue with this type of work. Could the association provide me
|
|
any type of list of civilian jobs that might fall into this job
|
|
area or a list of those jobs that I could apply for that would
|
|
incorporate this type of work?
|
|
|
|
"Any assistance that you can give me in this job search
|
|
would be greatly appreciated."
|
|
|
|
If you can help, please contact Daryl L. Cole at RT3, Box
|
|
316, Kempner, TX 76539. Please send us a copy so we can report on
|
|
it in this letter 'cuz it seems to us that the only place in the
|
|
civilian world that he could find a job monitoring telephone
|
|
conversations would be with a big law enforcement organization.
|
|
|
|
We look forward to hearing from members and Daryl on this.
|
|
|
|
|
|
MEMBERS ONLY
|
|
|
|
Offers for free reprint service are for members of the
|
|
ComSec Association only. If you are not a member and are reading
|
|
a photocopy of this letter, please don't ask us to spend our time
|
|
and effort to serve you. We are offering a free service to
|
|
members -- people who support our efforts by paying dues. You can
|
|
join and become eligible for these free services. All you have to
|
|
do is apply and send money.
|
|
|
|
(This comment is prompted by our recent receipt of a request
|
|
[with self-addressed envelope] for a free reprint of an article
|
|
from a person who did not give his name, but the letter was from
|
|
a zip code where we have no members.)
|
|
|
|
|
|
BUGGED OR TAPPED?
|
|
|
|
Member Perry Myers of Myers Investigative Service in Chicago
|
|
sent us a clipping from the Chicago Tribune headlined "GOP
|
|
Chairman says he found tap on phone". Perry says that he thinks
|
|
there is something wrong in the story, and asks our opinion.
|
|
|
|
Well Perry, I agree that it's a hard story to understand. In
|
|
the first sentence Donald Totten says his phone was tapped, and
|
|
in the second sentence he says that his phone was bugged. Was it
|
|
one, or the other, or both?
|
|
|
|
We'll probably never know because Joseph Miles of Shadow
|
|
Investigative Service is quoted as reporting, "In the course of a
|
|
sweep I found a variation of voltage on the line. The possibility
|
|
existed. I found no hard evidence that one was in place".
|
|
|
|
Now, if the phone was bugged, there are some simple,
|
|
definitive tests which should have been performed, and (in your
|
|
editor's opinion) measuring line voltage is not one of them. If
|
|
these tests had been performed, the odds are that a bug would
|
|
have been detected.
|
|
|
|
On the other hand, if we're considering a tap, Mr. Miles
|
|
didn't have much chance of detecting one by measuring line
|
|
voltage. In our experience we only know of two instances in which
|
|
line voltage measurements gave a reasonably positive indication
|
|
that something was amiss. In both cases on-hook voltage was very
|
|
low and we suspect that an off-site parallel parasite transmitter
|
|
was the cause.
|
|
|
|
So let's hear from members. How often has line voltage
|
|
measurement indicated a problem in your experience? In my
|
|
experience a simple tap on an active line causes no measurable
|
|
change in voltage. In fact, the ordinary changes caused by normal
|
|
system activity are on the order of volts so it would be
|
|
impossible to measure the change of picovolts (or less) caused by
|
|
a decent tap.
|
|
|
|
Another question for members: Do you agree that a bugged
|
|
telephone should be detected by standard countermeasures
|
|
activities?
|
|
|
|
|
|
REEVALUATION OF THE EVALUATOR
|
|
|
|
This is another story of rapid response. In our last issue
|
|
we carried the story of our two evaluations of the Evaluator
|
|
telephone tap detector and reported that it did not detect any of
|
|
the taps that we put on our line.
|
|
|
|
Michael K. Stern, VP of Secom Information Products Company,
|
|
responded immediately, sending us another Evaluator for testing.
|
|
Further, he volunteered to come here to assist us with our tests.
|
|
He assures us that the unit really does detect taps (but he
|
|
hasn't told us how), and that other people have tested it with
|
|
positive results. Well, we'll try again when our schedule permits
|
|
and we'll advise you of our results in an upcoming newsletter.
|
|
|
|
|
|
THE OTHER NSA
|
|
|
|
Richard D'Aleo, an author who is writing a book on
|
|
intelligence gathering, sent us some material describing the
|
|
other NSA. It seems that there is an information source here in
|
|
Washington, DC called "The National Security Archive". This is a
|
|
non-profit (by design) institute founded by former Washington
|
|
Post reporter, Scott Armstrong. According to Time, this NSA now
|
|
operates on a million dollar budget with 30 people on the staff.
|
|
|
|
This NSA uses the Freedom of Information Act to collect
|
|
information which can be used by researchers into government
|
|
activities. If you have need of information which might have been
|
|
retrieved from government records, by all means, contact NSA at
|
|
1755 Massachusetts Ave. #500, Washington, DC 20036. 202-797-0882.
|
|
Please mention ComSec Letter when you contact them.
|
|
|
|
|
|
TELECOMMUNICATIONS COURSES
|
|
|
|
There are some courses on the administration, management,
|
|
and technology of telecommunications now being offered by AT&T.
|
|
If interested, contact Bruce E. Hemstock, AT&T Knowledge Plus, 55
|
|
Corporate Drive, Room 13J08, Bridgewater, NJ 08807. 800-554-
|
|
6400. Please mention ComSec Letter when you call or write.
|
|
|
|
P.S. One member commented that he'd like to see more technical
|
|
content in the ComSec Letter. What's your opinion?
|
|
|
|
COMMUNICATIONS/SECURITY/PRIVACY PUBLICATIONS
|
|
|
|
|
|
Newsletters, Magazines
|
|
|
|
Computer Security Digest computer security
|
|
150 N. Main St
|
|
Plymouth, MI 48170
|
|
313-459-8787
|
|
|
|
Monitoring Times radio monitoring
|
|
140 Dog Branch Rd.
|
|
Brasstown, NC28902
|
|
704-837-9200
|
|
|
|
Privacy Journal security/privacy
|
|
Box 15300 Compilation of State
|
|
Washington, DC 20003 and Federal Privacy
|
|
202-547-2865 Laws. $26.00
|
|
|
|
Security Letter corporate security
|
|
166 East 96th St.
|
|
New York, NY 10128
|
|
212-348-1553
|
|
|
|
Security Systems Digest security news/programs
|
|
Washington Crime News Service
|
|
7620 Little River Turnpike
|
|
Annandale, VA 22003
|
|
703-941-6600
|
|
|
|
Sherwood Communicatiuons Associates various publications
|
|
POB 535
|
|
Southampton, PA 18966
|
|
215-357-9065
|
|
|
|
Teleconnect modern telecommunications
|
|
12 West 21 St.
|
|
New York, NY 10011
|
|
212-691-8215
|
|
|
|
2600 hacking
|
|
POB 752
|
|
Middle Island, NY 11953
|
|
|
|
Books
|
|
|
|
Barbara Rowan has compiled an excellent reference, entitled
|
|
"Handbook on State Laws Regarding Secretly Recording Your Own
|
|
Conversations". $20 from Independent Hill Press, 105 South Alfred
|
|
St., Alexandria, VA 22314. There are periodic updates. March, 1988
|
|
|
|
COMPUTER CRIME
|
|
|
|
Yes, it does exist; it does cause problems -- of varying
|
|
magnitude. Let's consider some of the various activities that we
|
|
have knowledge of.
|
|
|
|
First, we should consider those petty crimes by people who
|
|
think that stealing from big organizations is not stealing. The
|
|
crimes I'm thinking of are primarily those of theft of services
|
|
through the use of someone else's telephone credit card number.
|
|
Many, many long distance telephone calls are made this way. Many
|
|
of the people who do this think it's not really theft because the
|
|
phone company is so rich it doesn't know what to do with all of
|
|
its money. What they don't appreciate is that the phone companies
|
|
never lose money; they just add onto their rates to cover the
|
|
costs of these thefts. (But who can criticize the kids for such
|
|
shallow thinking -- we have men who would be president who say
|
|
that they are going to reduce our national debt without bothering
|
|
the people by raising taxes on corporations. They don't realize
|
|
that all of us will end up paying those high taxes because we'll
|
|
have to pay more for goods and services from those firms.)
|
|
|
|
Then there are the activities which are childish pranks,
|
|
taking advantage of the fact that most people/organizations are
|
|
trusting. Children with computer ability, by accessing someone
|
|
else's computer and leaving smart messages, perform the computer
|
|
equivalent of the kid trick of putting salt in the sugar bowl or
|
|
loosening the top on the pepper shaker in a restaurant.
|
|
|
|
Of course, there are also computer problems caused
|
|
inadvertently. Maybe these should also be called crimes. I'm
|
|
referring, for instance, to the virus experiment originated by
|
|
some folks at MacMag. It seems they wanted to try out a virus so
|
|
they planted one in several Macs in their office. This one was
|
|
set to appear on March 2, and to display a personal message from
|
|
their publisher. Well, they installed it in their Macs in
|
|
December and by March 2 it had spread to thousands of Macs (and
|
|
maybe into some commercial programs being offered for sale). In
|
|
any event, on March 2 thousands of Mac computers displayed the
|
|
message, "Richard Brandow, Publisher of MacMag, and its entire
|
|
staff would like to take this opportunity to convey their
|
|
Universal Peace Message to all Macintosh users around the world".
|
|
|
|
|
|
Last, but certainly not least, there are the serious
|
|
crimes --- more than just vexations. Large amounts of money and
|
|
property are being stolen. Data are being destroyed. We've all
|
|
read horror stories about these.
|
|
|
|
Just one observation before we consider some specifics: the
|
|
ones we've heard about are the failures; the successful computer
|
|
thefts are still unknown to us.
|
|
Some items in the news about some of those failures:
|
|
Computer Security Digest, April issue:
|
|
|
|
"The security of computers and data communications systems
|
|
is today largely non-existent, inadequate or outdated by new
|
|
offensive techniques.
|
|
|
|
"Governmental agencies (federal, state and local) seem to
|
|
have the loosest controls and the highest incident rate....
|
|
"Bell System Regionals are loaded with incidents.... The
|
|
culprits aren't all teenagers or long haired hippies either. The
|
|
new profile includes "mature" businessmen as well as the yuppie
|
|
community."
|
|
|
|
Washington Post April 18, 1988:
|
|
|
|
Headline: "New "virus" Infects NASA Macintoshes"
|
|
|
|
".... numerous reports of a virus called Scores ...."
|
|
|
|
"....200 to 400 Macintoshes in the agency's Washington area
|
|
offices .... were infected by the virus."
|
|
|
|
Yes, it does exist. What can we do about it? Well, to start
|
|
with, I suggest that we share information. I make this suggestion
|
|
knowing that it contradicts what the Washington Post says is the
|
|
philosophy of major corporations who want to keep a lid on
|
|
countermeasures so that the other side won't find out what we're
|
|
doing and react to combat our countermeasures. I don't think
|
|
those people have enough respect for the capabilities of the
|
|
other side. They are smart. They share information. We need to
|
|
get smart. We need to share information.
|
|
|
|
As a start, if you're using a DOS computer and have
|
|
downloaded programs from a BBS, check the date on your
|
|
COMMAND.COM file. If it's recent, you have a problem.
|
|
|
|
Data Processing and Computer Security, in its Winter '88
|
|
edition, says that there is a checking program called VI-RAID.
|
|
This program will create a "Program Authentication Code" on all
|
|
of your programs, and can then be used periodically tho check to
|
|
see if they have been altered. Available from Prime Factors,
|
|
Inc., 1470 E. 20th Ave., Eugene, OR 97403. 503-345-4334.
|
|
|
|
Anyone care to offer additional advice, or offer to provide
|
|
service?
|
|
|
|
|
|
DONATIONS TO THE CAUSE
|
|
|
|
If you have any items of TSCM equipment that you no longer
|
|
need, please consider donating them to the association. What we
|
|
are most interested in are those things that you found really
|
|
don't do what the seller said they would do. We'll test them and
|
|
report on what they actually can accomplish.
|
|
|
|
We're interested in the expensive items, of course, but
|
|
we're also interested in the inexpensive ones. For example, the
|
|
"Phone Tap Detector" advertized for $69.00 (plus $2.95 P&H) in
|
|
the February, 88 issue of Popular Communications would seem to be
|
|
an interesting item. If you bought one and found that it does not
|
|
detect taps, why not send it along to us?
|
|
|
|
Also, we're always looking for computers, modems, office
|
|
equipment and furniture, and anything that might be useful.
|
|
Certainly nobody around here is an expert on the tax laws, but
|
|
the association is organized as a 501 (c) (3) corporation (non-
|
|
profit, educational) which should mean that you should be able to
|
|
take some kind of a write off for any donation. Ask your tax
|
|
lawyer or accountant, but keep us in mind. Thanks.
|
|
|
|
FEEDBACK
|
|
|
|
Ben Otano, Bill Parker, and Perry Myers requested the
|
|
overseas travel tips mentioned in the last ComSec Letter, and Tom
|
|
Campbell of Northrop and Perry Myers responded positively to our
|
|
question about more technical content. Herb Greenberg sent us a
|
|
copy of an article in Business / North Carolina which features
|
|
reader Bob Grove, Editor of Monitoring Times. (In case you hadn't
|
|
noticed before, we've often suggested that folks in the TSCM
|
|
business could benefit from a lot of the material in this
|
|
publication. Call 'em in Brasstown, NC.)
|
|
|
|
We appreciate these letters, and especially appreciate the
|
|
nice compliments that came with them. Thanks. And, we got the
|
|
message. The response is for more technical content in these
|
|
letters, so we'll start putting in more technical detail.
|
|
|
|
|
|
TSCM, WHAT IS IT?
|
|
|
|
Recently, we've read in two different publications that 90%
|
|
of all TSCM "hits" are attributable to the physical search.
|
|
|
|
That is so far off from our experience that we're inclined
|
|
to believe that the statement is self-serving in the extreme.
|
|
Probably the folks who tell you that don't have any modern
|
|
technical equipment or any technical capability.
|
|
|
|
Of course it could be that one of the authors is parroting
|
|
the other. Come to think of it, his comments indicate a real lack
|
|
of experience in real-world situations so maybe he's an armchair
|
|
quarterback.
|
|
|
|
In any event, we feel obligated to comment based on our
|
|
experience on real jobs. No amount of physical search would have
|
|
found the speaker of the old speakerphone connected to spare
|
|
conductors in the 50-conductor cable. How about the carbon
|
|
microphone connected to spare pair in the conference room phone;
|
|
do you think physical search would have found that?
|
|
|
|
Of course, if you have RF-calibrated eyeballs, you can see
|
|
the radio transmitter emanations at 100 plus MHz, and the 200 KHz
|
|
carrier current transmissions. C'mon! Be serious. Although there
|
|
is no question that physical search has its place, it is only
|
|
occasionally the most important part of the TSCM job. In an old
|
|
multi-tenant office building, it really is important and time
|
|
consuming. There have been jobs when it was the most meaningful
|
|
segment of our procedure. For instance, we wouldn't have detected
|
|
the evidence of the tap on Bob Hay's home telephone without it,
|
|
but most of the communications compromises that we've found were
|
|
found through the use of modern instrumentation. No matter how
|
|
thorough your physical search, you'll never see any RF, and
|
|
you'll probably never see any of the modifications to telephones
|
|
that can be detected easily with simple technical tests with
|
|
modern equipment.
|
|
|
|
Another idea: the people who say that physical search is the
|
|
most important part of TSCM might just be the people to whom show
|
|
is more important than substance. Certainly the client will be
|
|
impressed by a lot of activity, even if the hustle and bustle is
|
|
useless, as the standard physical search is in many TSCM jobs. April, 1988
|
|
|
|
MODERN PHONE SYSTEM VULNERABILITIES
|
|
|
|
Background
|
|
|
|
The basic message is: The bad guys are smart. They are goal
|
|
oriented. They communicate. If there are vulnerabilities, they'll
|
|
take advantage of them while the good guys have their heads in
|
|
the sand (or stuck up in the air).
|
|
|
|
The good guys must communicate. Don't be afraid that you'll
|
|
teach them new tricks -- they already know all the tricks.
|
|
|
|
We've frequently talked about and written about potential
|
|
weaknesses in modern telephone systems, but our feelings were
|
|
just that, feelings. We felt that some of the systems could be
|
|
taken advantage of based on sketchy technical details, but now
|
|
we've begun to receive good information from several different
|
|
sources. So let's look at some specific experiences.
|
|
|
|
|
|
Experiences, DISA
|
|
|
|
In order not to embarrass any of the people or companies who
|
|
have provided the details, we're not going to identify them; but
|
|
what follows is real. Take heed.
|
|
|
|
A company (composite, for the sake of this article) which
|
|
has one of the (early) modern telephone systems had DISA (or some
|
|
variant thereof) for the convenience of their salesmen. To use
|
|
DISA (Direct Inward System Access) a salesman would call the PBX
|
|
and use a four-digit code number for identification. The system
|
|
would then connect him to a trunk, and he would be able to make
|
|
his calls.
|
|
|
|
Some time after the system had been put into operation, the
|
|
company noticed that their telephone bills were suddenly full of
|
|
off-hours, long, and expensive calls to a lot of numbers in Latin
|
|
America. They concluded that someone had learned how to use their
|
|
system, and was abusing it.
|
|
|
|
Their first reaction to try to protect themselves was to
|
|
change to a six-digit code. Not even as effective as a finger in
|
|
the dike; each monthly bill still contained thousands of dollars
|
|
in charges for calls to Latin America.
|
|
|
|
Their next step was to contact AT&T, and ask for protection.
|
|
AT&T investigated and determined that the calls were originating
|
|
in upper Manhattan. However, the exact source was not determined
|
|
because the calls stopped coming.
|
|
That may sound like a happy ending, but it isn't really.
|
|
It's actually one of those inconclusive terminations that leaves
|
|
everyone hanging. In that company's case, they finally realized
|
|
that the people making calls through their system were not
|
|
individual hackers; they were big business. That's right. Their
|
|
conclusion was that drug dealers had set up a communications
|
|
business so that their calls could not be traced back to them.
|
|
The reason that the company was no longer used is that they cut
|
|
back on the number of trunks available to only two or three, and
|
|
the druggies could not make the volume of calls that they
|
|
required through only a few trunks. It's our guess that they have
|
|
moved on to another company that has enough trunks, so that they
|
|
don't have the operational problem of keeping track of several
|
|
systems with different passwords, etc. It's so much simpler to
|
|
deal with only one system at a time and we're sure that they are
|
|
now concentrating on another company and that that company is
|
|
being taken advantage of in a big way.
|
|
|
|
|
|
Experiences, Remote Diagnostics
|
|
|
|
In addition to using DISA to steal service, some of the
|
|
service stealers, are using the built-in maintenance facility.
|
|
They dial in to the PBX's computer, and access the remote
|
|
diagnostic capability, where, by use of the proper signals, they
|
|
can access trunks.
|
|
|
|
One security director said that they had put a recorder on,
|
|
and heard a tone burst on the incoming call, followed by dial
|
|
tone on the outgoing trunk.
|
|
|
|
Checking with some folks who install such systems, we find
|
|
that this is certainly possible on some of the most modern
|
|
systems.
|
|
|
|
|
|
The Real Threat
|
|
|
|
Both DISA and remote diagnostic capabilities are currently
|
|
being used to steal service from a lot of businesses.
|
|
|
|
But it's only money that's being stolen.
|
|
|
|
Egad! Did Ross, the Scotsman, say it's only money being stolen?
|
|
|
|
Yup. He said it. He said it because he thinks something much
|
|
more valuable can be stolen, and probably is being stolen even as
|
|
you read this.
|
|
|
|
That more valuable property is information. If the bad guys
|
|
have figured out how to enter and manipulate these systems, they
|
|
must have learned how to use their knowledge for eavesdropping.
|
|
What Can You do about Long Distance Theft?
|
|
|
|
Well, first read your phone bills. Do you have any excess
|
|
charges? If so, are they for calls to Latin America? If so, you
|
|
have probably been the target of the druggies. However, don't be
|
|
embarrassed and don't despair.
|
|
|
|
If your company has been victimized, don't feel too bad.
|
|
We've heard that the MCI sales offices in Phoenix and Denver were
|
|
hit -- bad. And MCI is a company that knows communications inside
|
|
and out -- but they got burned.
|
|
|
|
Also, keep in mind that the druggies are smart. They're not
|
|
going to continue to use the same company's lines until the
|
|
authorities find them. Their objective is to hide from authority
|
|
so they'll move on within a month or so.
|
|
|
|
However, they may cycle back, so it's a good idea to monitor
|
|
activity on your trunks after hours. Don't wait for the bill to
|
|
come in. Get some automated equipment that prints out line
|
|
activity. (Radio Shack has a dandy DNR (dialed number recorder)
|
|
that they call the CPA-1000 and sell it for $99.95.)
|
|
|
|
|
|
What Do We Plan to Do about Eavesdropping Vulnerabilities?
|
|
|
|
Unless one of our wonderful readers has already done it and
|
|
sends us a copy, we plan to do a survey of modern telephone
|
|
systems from Merlin to Dimension and Horizon, and on up from
|
|
there. We've heard that the CIA has already done it, but we don't
|
|
have access to their report (nor to such vast resources!), so
|
|
we'll just have to grind away at it. This is not the kind of a
|
|
project that gets accomplished overnight, so don't stand by your
|
|
mailbox looking for an announcement. While we're at it, though,
|
|
we'd like to hear from anyone who has specifics relating to any
|
|
system.
|
|
|
|
And, of course, if you want to call to compare notes, we'd
|
|
be glad to hear from you at any time.
|
|
|
|
|
|
MODERN TELEPHONE SYSTEMS INVULNERABILITIES
|
|
|
|
Well, the news is not all bad. Some of the telephone systems
|
|
that we've been exposed to recently, are really quite secure.
|
|
Some are unbelievably insecure, yes; but some are quite good.
|
|
|
|
First, some of the modern PBXs select an outgoing trunk for
|
|
the caller. That means that if you want to tap phone calls by a
|
|
specific person, you have to tap all lines and monitor all calls,
|
|
and turn on the recorder when you hear the voice of the target.
|
|
The only way around this is to secure access to the premises and
|
|
put the tap in behind the switchboard. That is possible, of
|
|
course, but it adds a level of complexity to the tapper's
|
|
problem.
|
|
|
|
Then, there are the systems that are almost immune to
|
|
bugging. Coupled with a good physical security program, they are
|
|
nearly 100% immune. For instance, we were recently doing the
|
|
standard test for a series parasite by flashing the hookswitch
|
|
while tuning through the spectrum. After about ten flashes, the
|
|
computer showed the phone "busy". Apparently, it took so many
|
|
interruptions as a sign of a malfunction, so it busied the phone
|
|
out. Ross figured he could reactivate by disconnecting and
|
|
reconnecting the feed, but that made the phone go completely
|
|
dead. So what we had was a phone that is nearly immune to
|
|
bugging. If a bugger had worked on one of these phones, the
|
|
system or the phone would have provided evidence that it had been
|
|
worked on.
|
|
|
|
We've heard that some systems will recover from faults by
|
|
turning the computer's power off and back on again. This is where
|
|
your physical security program will provide protection, first by
|
|
locking the area, and second by monitoring access.
|
|
|
|
|
|
TAP DETECTORS AND THE SHARPER IMAGE
|
|
|
|
In our January issue we ran a copy of a letter to Richard
|
|
Thalheimer of The Sharper Image. The letter advised him that the
|
|
tap detector that he was touting would not detect even a simple
|
|
tap, and that he might get himself sued by someone who depended
|
|
on his tap detector to protect his privacy.
|
|
|
|
Well, the first response was from a TSI buyer who said that
|
|
sales weren't going so well anyway, so maybe they'd drop the
|
|
item. Now comes the latest issue of their catalog, and, you
|
|
guessed it, they're still saying "you can guard the privacy of
|
|
your line..."
|
|
|
|
So it seems that they simply don't care what they say.
|
|
Anything to make a sale. Oh well.
|
|
|
|
|
|
THAT LIFE FORCE CATALOG
|
|
|
|
Wow! Super slick. Full of pictures of handsome men and
|
|
beautiful women. Some catalog, until you begin to read what it
|
|
says. How about "most unique" for an interesting variation on
|
|
English? On one page we read that the Research Electronics voice
|
|
scrambler is "THE MOST SECURE VOICE PRIVACY DEVICE IN THE WORLD".
|
|
Now, it might be good. Can't say; never tested it. But we know
|
|
for sure that it is not the most secure device in the world. On
|
|
page 4 they also show a fellow listening through a wall with a
|
|
device they sell, and they even advise you to check 18 USC 2511
|
|
before you use it. I wonder why they didn't read that law
|
|
themselves; it makes printing that ad a federal felony. Oh well.
|
|
|
|
|
|
May, 1988
|
|
|
|
MEMBERSHIP MEETING
|
|
|
|
You are reminded of the membership meeting scheduled for
|
|
July 23 at the Twin Bridges Marriott in Arlington, VA. We've
|
|
planned a little time for an informal get together with coffee
|
|
and sweet rolls and toast at 9 AM. Meeting will start at 10. If
|
|
you can make it, call as soon as possible -- we're buying lunch,
|
|
and the hotel needs a count.
|
|
|
|
So far the response has been encouraging, so let's consider
|
|
some of what we need to accomplish in the near future.
|
|
|
|
Annual Meeting. We've been looking for a place to hold our second
|
|
"annual" meeting (our first was in 1985). This time we have a
|
|
contract with a meeting organizer who won't try to remake our
|
|
plans for our conferences. All of the logistical details will be
|
|
handled by him, and all exhibitor affairs will be his
|
|
responsibility. We'll put together the details of the conference,
|
|
and he'll take care of the promotion, advertising, registration,
|
|
etc.
|
|
|
|
Local Chapter Organization. This should be one of our top
|
|
priorities. Maybe the DC-area members can set the rules,
|
|
organize, and become the lead chapter in setting up our national
|
|
meeting later this year.
|
|
|
|
Bylaws. We have some very simple bylaws. At this meeting I hope
|
|
that we can appoint someone to flesh them out for presentation at
|
|
our annual meeting. Also, someone has to do the paperwork to get
|
|
us recognized as a bona fide non-profit organization.
|
|
|
|
Nomination of New Board Members. At present we have authorized a
|
|
board of five members. One of the members has departed so we have
|
|
a current opening for one person. If the Bylaws are approved,
|
|
this will be a bona fide meeting of the association, and we'll be
|
|
able to elect a new board member immediately. It has been planned
|
|
to expand the board membership to seven or nine, and this can be
|
|
decided at this meeting. Nominations will then be sought from all
|
|
members by mail, with the election to be conducted by mail before
|
|
the annual meeting.
|
|
|
|
Appointment of Committee Chairmen. There are many functions that
|
|
need leadership. At the top of the list is membership affairs. As
|
|
I see it, this relates to both membership benefits and to
|
|
recruiting. In my mind, they seem to go hand in hand. The future
|
|
of this organization depends on having an effective membership
|
|
program. We have to have suitable benefits to attract and hold
|
|
members.
|
|
|
|
Corporate Membership Changes. I plan to ask the board to change
|
|
our corporate membership structure to make it similar to that of
|
|
the American Defense Preparedness Association. Specifically, I
|
|
propose that we leave the annual dues at $150, but that the
|
|
corporation can name five individuals who will have full voting
|
|
rights.
|
|
|
|
ComSec Letter Subscriptions. I plan to ask the board to authorize
|
|
subscriptions to the ComSec letter @ $25 per year (ten issues).
|
|
This should make it easier for some to afford, and will allow
|
|
libraries, etc. to subscribe without having to pay individual
|
|
dues.
|
|
|
|
|
|
B & E: A to Z
|
|
|
|
With a title like that this video has to be good. (In case
|
|
you're not familiar with the jargon, the subject is breaking and
|
|
entering -- in fact, the subtitle is "How to get in anywhere,
|
|
anytime".)
|
|
|
|
Just how good it really is depends on your point of view. I
|
|
watched it mostly on fast forward because I'm not really
|
|
interested in developing a new skill, especially a skill that
|
|
would normally be used in the commission of a crime. If you want
|
|
to learn how to break in through a locked door, this probably
|
|
will be very good for you. On the other hand, if you are already
|
|
accomplished in this field, you don't need this video.
|
|
|
|
Is it worth the price? Yes, emphatically. Even though I
|
|
skipped most of it, I was immensely impressed by demonstrations
|
|
which show how very vulnerable we all are. Further, it is
|
|
especially chilling when you realize that the person who had no
|
|
trouble defeating all kinds of locks seemed to be not too
|
|
experienced at the business. In any event, you should look at it
|
|
if only to increase your awareness of how flimsy most physical
|
|
barriers really are. Available @ $99.95 from CEP, POB 865,
|
|
Boulder, CO 80306. 303-443-2294.
|
|
|
|
|
|
WINKLEMANN, AGAIN
|
|
|
|
Wow! It seems that there are quite a few people who are glad
|
|
to hear that this company is alive again in the USA. We've heard
|
|
that someone in Florida bought the US rights or franchise, and
|
|
there are some people who would like to get more specific
|
|
details. Please call if you have any information.
|
|
|
|
|
|
BBS COMING
|
|
|
|
Member Ned Holderby has volunteered to start a computer
|
|
bulletin board system for members and others. Non-member callers
|
|
will be restricted to information about the association and its
|
|
benefits, and maybe some message service. Members will have
|
|
access to all of the stored information including back issues of
|
|
the ComSec Letter, members names and addresses (except those who
|
|
have instructed us not to list their names), a message service to
|
|
leave questions or messages for all or any specified member, etc.
|
|
Also, membership records can be maintained in one place, getting
|
|
rid of some of the confusion that resulted from our changes in
|
|
the past.
|
|
|
|
|
|
IN THE MAIL
|
|
|
|
Bill Ranson, of Richmond, VA sent us some interesting
|
|
comments. He starts by saying that our segment last month, Modern
|
|
Telephone System In-Vulnerabilities, whet his appetite, but
|
|
didn't give him anything to chew on.
|
|
|
|
He's right, of course. We noted elsewhere in that same
|
|
letter, that we're busy collecting information on
|
|
vulnerabilities, and we should have said that we are also
|
|
collecting information on invulnerabilities. This effort will be
|
|
reported on as it progresses (see segment, Northern Telecom SL-1
|
|
Meridian in this issue).
|
|
|
|
Bill also volunteers to provide information on equipment
|
|
that he has tested, and to test equipment that is provided to the
|
|
association for that purpose.
|
|
|
|
Bill, I hope that you can make it to the meeting on the
|
|
23rd. Lee Binette is planning to be there to suggest that the
|
|
ComSec Association start just such a program. Maybe you two can
|
|
get it going, and we'll see that test results get passed on to
|
|
members, either through this letter or through our BBS.
|
|
|
|
|
|
WORDPERFECT 5.0
|
|
|
|
Well, the new version of Wordperfect has finally arrived,
|
|
and we have it installed in our new (IBM XT clone) computer.
|
|
Strange, though. The old version of WP recognized our QMS KISS
|
|
laser printer and the new version never heard of it. However, the
|
|
factory has sent us a series of updated diskettes, and our
|
|
printer is back among the living (except that WP can no longer
|
|
draw lines).
|
|
|
|
If all goes well and the old man learns how to manage the
|
|
new program, you'll soon see changes in the format, layout, etc.
|
|
of this letter. (You might have noticed that the title of the
|
|
letter is bigger this issue, and we've put a box around the date
|
|
line, and we've even included a drawing of your editor with a
|
|
smile on his face. We tried to place the clip art in the center
|
|
of the page, but for some reason Wordperfect won't do that for
|
|
us. Yet. Our plans also include upgrading to full desk-top
|
|
publishing capability. It'll all come in due course. Although
|
|
we'd like to do everything at once, the budget
|
|
limits our speed, as does this old guy's ability
|
|
to learn all this new stuff.
|
|
|
|
So, there really is some hope for a fancier
|
|
letter. Don't despair. We may move slowly, but
|
|
we know where we want to go and we are
|
|
determined to get there. Next, we plan to
|
|
acquire a scanner so we can show pictures of
|
|
some of the finds in our TSCM work. After that,
|
|
comes a better laser printer so we can do the
|
|
whole desk-top publishing thing.
|
|
|
|
If you have any ideas about upgrading this
|
|
letter, your editor would really like to hear
|
|
from you. I'm proposing several ideas at our membership meeting
|
|
to enlarge the association and the readership of this letter. If
|
|
we can get a bigger readership, we'll be able to sell some
|
|
advertising in the letter. What do you think about that?
|
|
|
|
|
|
NORTHERN TELECOM SL-1 MERIDIAN
|
|
|
|
This is a system that we'll wholeheartedly recommend from a
|
|
security point of view. We also hear very good reports about its
|
|
reliability, but let's consider bugs and taps.
|
|
|
|
First, bugs. The SL-1 Meridian, coupled with a good physical
|
|
access control system is my number one choice as an anti-bug
|
|
telephone. Why? Well, if you are going to modify a phone to make
|
|
it into a room bug, you're going to disconnect the phone from the
|
|
feed. In the SL-1 Meridian system, as soon as a phone is
|
|
disconnected, it is locked out of the system until the system is
|
|
reset at the computer -- that's where the good physical security
|
|
program is important. Simply put, if you have this system, and
|
|
the boss finds his phone inoperative on Monday morning, you know
|
|
that you have a problem.
|
|
|
|
Now let's consider taps. If your mission is to tap the phone
|
|
calls of Mr. X, you simply have to connect to the wires that
|
|
carry his calls. However, this system pumps calls out on a T-1
|
|
span. That means that you need the equipment to break out the 24
|
|
channels, and you have to listen to all channels for Mr. X's
|
|
voice. Next to impossible for any but the most sophisticated
|
|
tapper with lots of clout, money, and technical capability.
|
|
|
|
Because of these characteristics, I rate this system #1 for
|
|
security. There may be others just as good or better, but we
|
|
haven't checked them all out yet. You'll hear more as we
|
|
progress.
|
|
|
|
|
|
June/July, 1988
|
|
|
|
SURVEILLANCE EXPO 88 (89?)
|
|
|
|
Surveillance Expo will be sponsored by the ComSec
|
|
Association and will take place in the Washington, DC area in
|
|
conjunction with our next membership meeting. As you read this
|
|
volunteers are looking for space for a meeting late this year,
|
|
but finding a site is proving to be a real problem and we may
|
|
have to reschedule to some time next year when appropriate space
|
|
will be available.
|
|
|
|
The meetings are being planned for the DC area because
|
|
that's where the volunteer workers are. To those members who have
|
|
been asking for a meeting in other areas we say, "Have at it.
|
|
We'll cooperate in any way." However, those of us working here
|
|
can barely handle the details of one meeting, let alone two.
|
|
|
|
|
|
NEW BOARD OF DIRECTORS
|
|
|
|
At the membership meeting held on July 23, 1988, it was
|
|
decided to expand the board to seven members, and an election was
|
|
held to fill the four vacancies. Joining Chuck Doan, Jim Ross,
|
|
and Ken Taylor on the board are: Mike Brumbaugh, Jack Mogus, John
|
|
Nolan, and Charles S. (Slick) Poteat.
|
|
|
|
|
|
BOARD MEMBER FUNCTIONS
|
|
|
|
Although not all members have been formally elected to
|
|
specific offices, the board members in the DC area have begun to
|
|
work on projects as follows: Mike Brumbaugh has been keeping
|
|
minutes of each meeting; Chuck Doan is VP, Finance; Jack Mogus is
|
|
working on membership programs and will be responsible for all
|
|
aspects of membership (keeping the list, recruiting, benefits,
|
|
local chapter affairs, etc.); John Nolan is in charge of all
|
|
aspects of organizing the upcoming Surveillance Expos and annual
|
|
membership meetings; Slick Poteat is developing a system for
|
|
collecting information on the equipment used and qualifications
|
|
of our members who work in TSCM; Jim Ross is still president, but
|
|
has announced that he will run for chairman at the next
|
|
membership meeting so that someone else can move into the
|
|
president's slot and lead the association through its critical
|
|
growth stage.
|
|
|
|
|
|
HITS
|
|
|
|
From time to time we pass along information regarding hits
|
|
(communications compromises) found by our members. In this issue
|
|
we'll detail some of those and also two interesting
|
|
vulnerabilities (Vantage phone and common wall). In future issues
|
|
we'll provide details on other vulnerabilities and some
|
|
communication compromises that are simple to implement.
|
|
|
|
As usual, you are invited to send along information that you
|
|
think would be of value to members.
|
|
|
|
Jack Mogus has had two occasions to look closely at a 66
|
|
connecting block for one of his clients. On the first occasion he
|
|
found a home-built radio transmitter, and on the second he found
|
|
a tap connected to a pair that led out of the building. (As soon
|
|
as we learn how to use our new scanner with our computer and
|
|
laser printer, we'll provide pictures of this find and any others
|
|
that we receive.)
|
|
|
|
Doug Ralph, in Canada, has been having a very busy year, and
|
|
reports two interesting finds. First, he was astounded to connect
|
|
to the talk pair of an on-hook Northern Telecom Vantage series
|
|
telephone and hear all of the room audio. That's right, the
|
|
microphone or speaker (of the speakerphone) of this instrument is
|
|
connected to the talk pair when on hook, and all you need is an
|
|
audio amplifier, connected through a blocking capacitor, and you
|
|
have a first class bugging system in place.
|
|
|
|
Ralph's other report points up the importance of a thorough
|
|
physical search. Under the conference table in a board room he
|
|
found remnants of duct tape, which probably had fastened a tape
|
|
recorder in place at one time. Way to go, Doug!
|
|
|
|
One contributor, who wishes to remain anonymous so that his
|
|
company will not be embarrassed, reported an interesting find by
|
|
his in-house telephone man. It seems that this young fellow
|
|
normally used white wire ties in his work, and one day he noticed
|
|
that someone else had been working in his territory. He tracked
|
|
the strange wiring to a Radio Shack tape recorder controller (PN
|
|
43-236), and from there to a tape recorder. The CEO who heard his
|
|
conversations on the tape was understandably in shock. Pictures
|
|
of this installation will also be carried in a future letter.
|
|
|
|
Let's now look at the common wall problem. We're referring
|
|
to multi-tenant office buildings with more than one tenant on one
|
|
floor so that there is a wall which is common to two different
|
|
businesses. Most of the modern office construction that we've
|
|
seen lately has office walls extending upward to the base of the
|
|
floor above, which is as it should be for physical security.
|
|
However, these walls, out of sight above the dropped ceiling,
|
|
have large holes in them to allow for HVAC air flow, which is not
|
|
how it should be for communications security. The next door
|
|
neighbor need only stick his head above the dropped ceiling to
|
|
hear what is going on in the adjoining office. Or, if he wants to
|
|
get it all, he can use this access hole to plant a microphone and
|
|
connect it to a tape recorder. This is a real vulnerability; look
|
|
for it!
|
|
|
|
|
|
MEMBERSHIP RENEWALS
|
|
|
|
During the past year, we arranged for all memberships to
|
|
expire at the same time, namely at the end of September. This
|
|
will make it much easier to keep track, produce rosters, etc.
|
|
|
|
At present we have many memberships expiring in September of
|
|
this year, and more expiring in '89. Also, we have a handful of
|
|
life memberships and a few corporate memberships. Anyway, this
|
|
seems to be a good time to remind everyone of the options.
|
|
|
|
Individual professional life memberships are still available
|
|
at $500. We've been told that this is too low a figure, so the
|
|
board will be considering raising it soon.
|
|
|
|
The corporate membership picture has just changed to make it
|
|
much more attractive for businesses to join. Each small business
|
|
corporate member can name up to five individual members, each
|
|
with full voting rights. The fee for this level of corporate
|
|
membership is still $150 per year, so give this option some
|
|
thought. If you plan on exhibiting at the upcoming Surveillance
|
|
Expo, you'll more than recoup your dues in the reduced charges
|
|
for exhibit space.
|
|
|
|
The date of membership expiration is printed at the end of
|
|
the first line on your mailing label. If your membership expires
|
|
September 30, 1988, a renewal form is enclosed with this letter.
|
|
Please don't procrastinate. We're entering into our big growth
|
|
year, and we need support from all of our old members.
|
|
LASER BEAM ON THE WINDOW. THREAT?
|
|
|
|
Kevin Murray has done a practical and thorough evaluation of
|
|
the laser beam on the window threat. We don't have room for it in
|
|
this issue, but we'll provide a full recounting of his evaluation
|
|
in the next issue. It's a good piece of work and we're very
|
|
pleased that he saw fit to share it with the membership.
|
|
|
|
Thanks, Kevin. It's input like this that we're looking for
|
|
to elevate the level of professionalism in TSCM practitioners.
|
|
|
|
|
|
COMSEC ASSOCIATION BBS
|
|
|
|
Ned Holderby advises that the board should be in operation
|
|
by the third week in August. More information in the next issue.
|
|
|
|
|
|
MEMBERSHIP LIST
|
|
|
|
If you've struggled through with us, you'll recall that,
|
|
after the first membership list, there has been a long break with
|
|
no list. It's a long sad story, a story of the kind of problems
|
|
that a new organization has when starting up. First, we had an
|
|
outside firm maintaining the list, and that worked great but cost
|
|
money. Then a member volunteered to maintain the list, notifying
|
|
members when it was time to renew, etc. Unfortunately, he never
|
|
notified a single member of lapsing membership, sometimes took
|
|
months to deliver the mailing labels for this monthly newsletter,
|
|
and lost many records. Finally, some volunteers had to put the
|
|
list back into our old simple-minded labels program which had no
|
|
facility for printing out the list in a format that would be
|
|
useable by the members.
|
|
|
|
Well, that should all be over soon. We have started using a
|
|
much more sophisticated and powerful mailing list program in our
|
|
business, and ordered a copy for Jack Mogus (who is responsible
|
|
for all aspects of membership affairs). This program, Promark,
|
|
will allow him to organize the membership list any way we want
|
|
and to print it out in any format. Hang in.
|
|
|
|
|
|
August/September, 1988
|
|
|
|
SURVEILLANCE EXPO '89
|
|
|
|
As of the time this is written, we do not have a contract
|
|
for space nor a contractor to manage the expo. John Nolan is
|
|
working on it very hard, and we should have definite information
|
|
by the time the next issue goes to press.
|
|
|
|
|
|
COMSEC ASSOCIATION BBS
|
|
|
|
Ned Holderby has set up a computer bulletin board for the
|
|
association. The board has a two-fold mission:
|
|
|
|
1. a facility for members to exchange information, and
|
|
|
|
2. a source of information about the association for
|
|
potential new members.
|
|
|
|
Only members will have access to the various conference,
|
|
message, and data file areas of the board. For example, we'll be
|
|
putting all of the back issues of the ComSec Letter on the board
|
|
(with topical information removed) so that all active members can
|
|
browse, read, download, or whatever. Members will have full
|
|
access and non-members will be limited to reading information
|
|
about the association.
|
|
|
|
Caution! The board will be run and maintained in a
|
|
professional and ethical manner. No games. No violations of
|
|
copyrights. No foul language. I'm sure you understand and
|
|
appreciate.
|
|
|
|
At the time that this is composed, your editor has not yet
|
|
been able to contact the board (Sorry Ned.), but a list of
|
|
members is on its way to him so he'll known who to allow onto the
|
|
board.
|
|
|
|
Our BBS number is 716-741-4245. I'll be leaving messages on
|
|
the board for members from time to time, and I hope you'll take
|
|
advantage of this facility.
|
|
|
|
|
|
LASER BEAM EAVESDROPPING
|
|
|
|
Kevin Murray has provided us with the results of their
|
|
testing of laser beam eavesdropping systems. It is of intense
|
|
interest to many, so we'll provide a reasonably complete summary
|
|
in this letter. (If you want an original of his report, I'm sure
|
|
he'll be pleased to oblige. Write him at Kevin D. Murray
|
|
Associates, POB 5004, Clinton, NJ 08809 or call 800-635-0811.)
|
|
|
|
Here's his report.
|
|
|
|
Laser Beam Eavesdropping
|
|
|
|
Summary.
|
|
|
|
Does it exist? Yes. We designed, built, and tested a complete
|
|
working system.
|
|
|
|
Does it work? Yes. The technique works very well under laboratory
|
|
conditions.
|
|
|
|
Is it a threat? No. Due to operational limitations under field
|
|
conditions, we are not reporting this as a threat to the majority
|
|
of clients at this time.
|
|
|
|
Sci-Fi Bugs?
|
|
|
|
Eavesdrop from afar, merely by pointing at a window. The
|
|
idea is alluring to some, horrific to others.
|
|
|
|
News media reports of just such a bugging device, based on
|
|
laser beam technology, have been circulating for some time now. A
|
|
litany of claims "...can hear from miles away..." and compound
|
|
claims "...through closed windows...", culminates with the coda
|
|
"No one is safe." Like the X-Ray vision glasses of comic book
|
|
fame, the claims tend to become exaggerated. But, unlike the
|
|
concept of X-Ray vision, laser listening can be accomplished with
|
|
the right equipment and conditions.
|
|
|
|
A Century Old Invention.
|
|
|
|
April 26th, 1880 - Alexander Graham Bell & Sumner Tainter
|
|
announce their invention - the Photophone. Sound transmitted on
|
|
reflected light rays a distance of 213 meters. They also claim,
|
|
"It can transmit songs with great clarity of tone." This is the
|
|
forerunner of CD record players, fiber optic telephone
|
|
transmission, and remote eavesdropping.
|
|
|
|
It's Greek to them, Diogenes.
|
|
|
|
We researched this threat for our clients and heard much
|
|
speculation from the pundits, conjecture from dilettantes, and
|
|
hyperbole from the media. In most cases, the "experts" had never
|
|
even seen a laser bug. They were running on grapevine knowledge.
|
|
|
|
We Built Our Own.
|
|
|
|
Using assembly plans available to the general public, we
|
|
built a laser receiving system (Radio/Electronics 10/87). For
|
|
aiming and safety reasons, a visible laser beam was used in our
|
|
tests (Spectra Physics Inc. - 10 mW linear Helium-Neon type).
|
|
Additional experiments with: optical processing, and professional
|
|
audio processing, were conducted. These results, and allowances
|
|
for more sophisticated receiver circuitry, were factored into our
|
|
test results.
|
|
|
|
Physics 101 (Simplified.)
|
|
|
|
Sound is transmitted by vibration. When you speak, you
|
|
vibrate the air. The air, in turn, vibrates everything it
|
|
contacts. Certain objects, e.g., windows and mirrors, pick up
|
|
vibrations very easily. When a laser light beam hits such an
|
|
object, it `vibrates' also as it reflects and continues its trip.
|
|
The reflected `vibrating' beam can be received, electronically
|
|
processed, and the audio listened to. Under controlled
|
|
conditions, high quality audio can be recovered.
|
|
|
|
Physics 202 (The Real World.)
|
|
|
|
Bouncing an invisible laser beam off a window, and
|
|
attempting to catch the reflection, is a little like playing 3-D
|
|
billiards, blindfolded. The fun increases exponentially with
|
|
distance from the target.
|
|
|
|
All sound will vibrate a window. This includes interior
|
|
conversations as well as exterior noises (cars, trucks, birds,
|
|
etc.) Our audio laboratory processing equipment could attenuate
|
|
this effect, to a degree. The rule of thumb seems to be, if the
|
|
outside noise is as loud as the conversation, audio processing
|
|
techniques are of marginal assistance.
|
|
|
|
Reflecting a beam off interior objects helps reduce external
|
|
sound. The beam, however, loses power with each pane of glass it
|
|
passes through. This reduces effective working distances and
|
|
increases the number of reflected beams with which one must cope.
|
|
|
|
Thick glass and thermo-pane glass, as used in office
|
|
buildings, do not conduct sound vibrations well.
|
|
|
|
Air thermals and wind, disrupt laser beams. The greater the
|
|
beam length, the greater the disruption. Wind blowing through a
|
|
laser beam generates noise similar to the cacophony of 747
|
|
engines.
|
|
|
|
A laser beam (one powerful enough for professional
|
|
eavesdropping) is the Neutron Bomb equivalent of a sharp stick in
|
|
the eye. Both can blind you, but the laser leaves the eye
|
|
standing. Blinding the subject of a surveillance is not the best
|
|
way of assuring a continued stream of information while remaining
|
|
unnoticed. We used safety goggles during our tests.
|
|
"There must be better ways to eavesdrop and spy", I hear you
|
|
say. There are.
|
|
|
|
"Beat the Beam" Countermeasures Course
|
|
|
|
If you suspect a laser beam eavesdropping attempt is being
|
|
made against you, use one of the following techniques:
|
|
|
|
Hold confidential conversations in a room
|
|
without windows. Place a radio against
|
|
the window and close the drapes. Install
|
|
a white noise generator on the window
|
|
pane.
|
|
|
|
In addition, do not discuss your suspicions in the
|
|
sensitive area. Contact an independent information security
|
|
consultant for additional assistance. Your problem is more
|
|
extensive than you think.
|
|
-30-
|
|
|
|
|
|
MORE ON VIRUS PROTECTION
|
|
|
|
If you think you need protection from infection by a
|
|
computer virus, RG Software Systems in Willow Grove, PA
|
|
offers a program entitled, "Disk Watcher V2.0". According
|
|
to RG's president, Raymond Glath, the program has been
|
|
tested against the Leheigh University virus and "The Brain"
|
|
at the University of Delaware.
|
|
|
|
Please advise if you have any experience with this, or
|
|
any other anti-virus programs.
|
|
|
|
|
|
TELEPHONE SYSTEM INHERENT SECURITY
|
|
|
|
Recently in this letter we stated that a Northern
|
|
Telecom SL-1 Meridian phone would be locked out until reset
|
|
at the computer after being disconnected from the feed.
|
|
Within a week after seeing that bit of advice go out to our
|
|
members, we had an opportunity to work on such a system --
|
|
in fact, we worked on the system of the telephone person
|
|
who had given us that information.
|
|
|
|
What we discovered in handling the real thing is:
|
|
'tain't so. Some of the phones could be reconnected and
|
|
were automatically reset. Some would not reset. One member
|
|
advises that Northern Telecom Practice states that the M-
|
|
2000 series phones must be off line for at least six
|
|
seconds before being replugged. Another member advised that
|
|
it is necessary to wait at least thirty seconds before
|
|
attempting to reconnect. We don't have the total answer,
|
|
but we know that what we said last month is not totally
|
|
true. We were working on the M-3000 series -- the client
|
|
users call the "Darth Vader" phones -- and we could not
|
|
determine the pattern for which could be reset and which
|
|
could not.
|
|
|
|
|
|
October, 1988
|
|
|
|
SURVEILLANCE EXPO '89
|
|
|
|
Well, there will be no annual membership meeting and
|
|
expo until late '89. After the disappointment of being
|
|
close but not being able to make it during '87 or '88, we
|
|
were really counting on getting a show together early in
|
|
'89. At the board meeting in July John Nolan of Advance
|
|
Security took the ball, and it looked really promising.
|
|
Unfortunately, John encountered insurmountable problems and
|
|
resigned, so we're starting over -- again. (John, we thank
|
|
you for the short time that you were able to serve on the
|
|
board, and we wish you well in your other endeavors.)
|
|
|
|
So where do we stand? At the present time, Jim Ross is
|
|
talking to meeting organizers. If we can find one who can
|
|
do the job, the organizer and the association will make
|
|
some money while putting on an expo that is badly needed by
|
|
our members and by many people who have never heard of our
|
|
organization. Bringing off a successful expo is extremely
|
|
important, and we're determined to do it.
|
|
|
|
Be advised. Jim Ross may become financially involved
|
|
in backing this effort. He's stayed at arm's length to
|
|
avoid charges of conflict of interest, but the organization
|
|
needs this meeting and whatever it takes will be done.
|
|
|
|
|
|
SENSITIVE INFORMATION, HOLD BACK?
|
|
|
|
Recently Bob Grove, Editor of Monitoring Times,
|
|
editorially raised the question of how sensitive
|
|
information should be handled. That's a question that I am
|
|
often asked, so let's consider it.
|
|
|
|
The following material is a direct quote from the
|
|
Foreword to Section I of the notebook that I have prepared
|
|
for seminar participants, and it should give you a good
|
|
idea as to your editor's point of view. As usual, your
|
|
comments are encouraged.
|
|
|
|
"Before getting into the details of electronic
|
|
eavesdropping, let's address a very important philosophical
|
|
question.
|
|
|
|
"Much of the material to be covered during this
|
|
seminar is considered very sensitive. In fact, there are
|
|
some people who maintain that these topics should not be
|
|
discussed at all. They complain that, by covering methods
|
|
of electronic surveillance, we are 'teaching the bad guys
|
|
how to do it'.
|
|
|
|
"Let us answer that comment with two facts.
|
|
|
|
1. The bad guys already know what they need to
|
|
know to take advantage of the unsuspecting and naive people
|
|
of this world.
|
|
|
|
2. Anyone who studies the basic theory of
|
|
electronic communications will have no trouble
|
|
understanding everything necessary to tap phones, bug
|
|
rooms, etc. It is not complex.
|
|
|
|
"I believe that strength comes through knowledge, and
|
|
the route to knowledge is communication.
|
|
|
|
"Communication, to be effective, must be open,
|
|
straightforward, and complete.
|
|
|
|
"One principal objective of this course, then, is to
|
|
cover the principal points regarding electronic
|
|
surveillance because you need to understand those things in
|
|
order to protect your privacy."
|
|
|
|
|
|
TWO MORE PHILOSOPHICAL QUESTIONS
|
|
|
|
As long as we have started down the philosophical
|
|
route, let's go an additional step or two. Let's consider
|
|
the questions of whether TSCM practitioners should screen
|
|
their clients, and whether they should report their
|
|
findings to law enforcement.
|
|
|
|
We can't provide absolute answers, but we can provide
|
|
some information on our own operation, and what has been
|
|
told to us in the dozen years that we've been leading
|
|
seminars.
|
|
|
|
Let's start with an easy one. We've been told (it has
|
|
never happened on any of our jobs) that occasionally the
|
|
security director who has contracted for TSCM service will
|
|
ask that the contractor "find" something. (The idea is that
|
|
if a dead radio transmitter is "found", he'll become a hero
|
|
for ordering the service. And, of course, the TSCM service
|
|
firm will become richer because it will be necessary to
|
|
frequently return for additional work and maybe even do
|
|
some of the other divisions of the company, etc.) The
|
|
answer to that request is easy; it's "No!".
|
|
|
|
However, suppose that you are asked to work for a
|
|
company that has been in the press because of being forced
|
|
to sign consent decrees, etc? Suppose that you have certain
|
|
evidence that your client is under investigation by law
|
|
enforcement? What do you do then?
|
|
|
|
I can't tell you what to do, but I can tell you what
|
|
we do in my company, and I can tell you the consensus of
|
|
many discussions with many people in law enforcement and in
|
|
TSCM.
|
|
|
|
In my company we will not hide evidence of a crime or
|
|
participate in any activity which could be remotely
|
|
considered obstruction of justice.
|
|
|
|
However, we have worked for at least one company with
|
|
a reputation for questionable business practices, and we
|
|
have worked for clients who are under investigation.
|
|
|
|
The preceding two paragraphs may sound contradictory,
|
|
but let's think about it. Does the fact that a company is
|
|
under investigation mean that it is not entitled to seek
|
|
professional help? After a lot of discussion with many
|
|
seminar participants, we don't think that a person loses
|
|
any rights by virtue of being under investigation.
|
|
|
|
What do you think?
|
|
|
|
On the question of reporting our findings to law
|
|
enforcement, let me make two points.
|
|
|
|
First, this world that we live in is not like
|
|
Hollywood. All loose ends are not tied up at the end of the
|
|
job as they are at the end of the TV episode. Communication
|
|
is not instantaneous and complete. Our conclusions are
|
|
based on a lot of factors, and it is rare that we could
|
|
present an absolute, no-question-about-it conclusion to any
|
|
law enforcement agency.
|
|
|
|
Second, to whom do we report what? During the recent
|
|
ASIS show in Boston, a visitor to the booth seemed shocked
|
|
when we said that reporting findings to law enforcement was
|
|
not required, expected, or done. He seemed to be of the
|
|
opinion that we should use our time to report crimes to
|
|
"the authorities". As he left the booth I realized that the
|
|
picture essay displayed behind me would have been a very
|
|
good case in point. We discovered a tap on the mayor's
|
|
telephone which may or may not have been indicative that a
|
|
crime had been committed. However, we would have been hard
|
|
pressed if we had had to report it to law enforcement
|
|
because there was good reason to believe that the tap was
|
|
not court-authorized and had been placed by one or more
|
|
members of the police department!
|
|
|
|
|
|
VULNERABILITIES (continued from an earlier issue)
|
|
|
|
In a recent issue of this letter we outlined some of
|
|
the current vulnerabilities that we see in our professional
|
|
practice of commercial technical surveillance
|
|
countermeasures. Let's cover one which we think is very
|
|
dangerous -- one that we've been warning clients about for
|
|
years: the private line telephone, installed for
|
|
"security".
|
|
|
|
How many times have you seen the CEO order a separate
|
|
telephone line that does not go through the PBX? He thinks
|
|
he's protecting himself from eavesdropping, but what he's
|
|
really doing is making it very easy to identify the
|
|
appropriate pair to tap. It's like hanging a sign on the
|
|
pair, "TAP HERE!". We saw this in a now famous company
|
|
(Wedtech) a couple of years ago, and we continue to see it.
|
|
The latest example was on a "Hello" telephone in a
|
|
government contractor's office. The phone was installed
|
|
because there was so much sensitive information to be
|
|
discussed, and it's called the "Hello" phone because that's
|
|
the way it is answered -- in case somebody is listening.
|
|
|
|
One further thought on private line telephones. I've
|
|
been telling people in the seminar for years that the best
|
|
way to tap a phone is to call the phone company and order
|
|
an extension. Of course, a private line phone is an ideal
|
|
target for this kind of tap. (Recently, a man who had
|
|
attended the seminar, approached me and asked, "Do you
|
|
remember what you said is the best way to tap a phone?" I
|
|
said I remembered, and he smiled and said, "Well, it
|
|
works!") It will not be successful every time, but, of all
|
|
of the businesses in this world that must take orders by
|
|
phone, the phone companies are at the top of the list.
|
|
|
|
If you think that you're safe because the number is
|
|
not listed, or not published, or in any other way
|
|
protected, you just don't appreciate the nature of free
|
|
enterprise. ALL of those numbers are available. There are
|
|
people in this country who can get the information for you.
|
|
For example, I noticed on a recent trip to New York City
|
|
that there was a light on early in the morning at the old
|
|
address of a man who had stolen a lot of money from our
|
|
company. So I called one of the information providers, gave
|
|
him the address, and I had a full listing of everyone with
|
|
telephone service at that address back in less than 24
|
|
hours. So, if you or the CEO have had a private line
|
|
installed, think again. The single line phone is very
|
|
vulnerable. If you have a good size operation, think
|
|
seriously about a more secure installation such as the
|
|
Northern Telecom SL-1 that we wrote about recently.
|
|
|
|
|
|
COMING SOON
|
|
|
|
Richard Paradis sent us a copy of a product
|
|
announcement that was carried in, of all things, IEEE
|
|
SPECTRUM. (That's the magazine that goes to all members of
|
|
the Institute of Electrical and Electronics Engineers.) The
|
|
headline was "A double whammy for eavesdroppers", and the
|
|
notice touted a product that will advise you when your
|
|
phone is tapped. Rich asked if we'd care to comment on this
|
|
item for the benefit of the membership, and in a future
|
|
issue we'll reprint the letter that we sent to the SPECTRUM
|
|
editor.
|
|
Another member, Bill Ranson, sent us information on
|
|
some of his activities and some interesting data sheets.
|
|
Again, we'll have to wait till a future issue to cover
|
|
these fascinating submissions due to lack of space.
|
|
|
|
Last, but certainly not least, Leo Hurley of Exxon
|
|
provided us with excerpts from an article in Security
|
|
Management (the one published by the National Foreman's
|
|
Institute, not the one published by ASIS). In an article
|
|
entitled "Sizing up Sweepers" Sam Daskam is quoted
|
|
extensively, and Leo asked how I react to the quoted
|
|
material. Well, Sam has many, many years of experience in
|
|
this business and certainly should know whereof he speaks.
|
|
(Of course, Sam worked for Mason for 15 or 16 years before
|
|
starting his present business, so he is probably heavily
|
|
oriented toward government-to-government threats.) However,
|
|
if he is quoted accurately, I'm shocked, and I'll explain
|
|
why in a future issue.
|
|
November, 1988
|
|
|
|
SURVEILLANCE EXPO '89
|
|
|
|
As we reported in the last letter, the expo that we
|
|
were planning for February is off. The earliest that we can
|
|
hope for is the fall of '89. If you are interested in
|
|
participating in any way, please contact Jim Ross.
|
|
|
|
|
|
TELE-PRIVACY GUARD
|
|
|
|
Richard Paradis sent along a copy of a notice in, of
|
|
all things, IEEE SPECTRUM, one of the publications that
|
|
goes to all members of The Institute of Electrical and
|
|
Electronics Engineers. The notice that caught his eye was
|
|
headlined "A Double Whammy for Eavesdroppers", and Rich
|
|
wrote to ask if I would comment on this for the members of
|
|
the ComSec Association.
|
|
|
|
Thanks Rich, and the text of the letter which I had
|
|
already mailed to the editor of SPECTRUM follows. (By the
|
|
way, they have never responded in any way. I wonder if that
|
|
is because they are looking for an engineer to check my
|
|
comments for accuracy, or because they were embarrassed
|
|
and consigned the letter to file 13 without any
|
|
consideration of its merit.) (I really think IEEE should
|
|
ensure that technical information mailed to members is
|
|
correct, and I wonder how I can influence them to hire some
|
|
engineers. Maybe I'll send a marked copy of this issue to
|
|
the president of the IEEE; that should get some response.)
|
|
|
|
(Note. The following letter was sent by
|
|
Jim Ross on Ross Engineering, Inc.
|
|
letterhead to the editor of IEEE SPECTRUM
|
|
on June 6, 1988.
|
|
|
|
|
|
Dear Mr. Christianson:
|
|
|
|
This relates to your editorial "About Professionalism", and
|
|
the segment in the same issue (June) entitled "A Double Whammy
|
|
for Eavesdroppers".
|
|
|
|
First, let me express a thought regarding the definition of
|
|
professionalism. In the simplest sense, I think a professional is
|
|
someone who is paid to do something that others might do for
|
|
nothing. For example, a cab driver is a professional, and one
|
|
would expect that he would be a more proficient driver than you
|
|
or I. That's certainly not always true, but it remains a
|
|
reasonable expectation.
|
|
|
|
So let's move along to writing. Those of us who write
|
|
professionally, in general, should be better at the craft than
|
|
others. I think that professional writers should be especially
|
|
careful about how they use words, their basic, elemental tools
|
|
for communicating with their audience.
|
|
|
|
Ah yes, the audience. If the professional writer's audience
|
|
is, let's say, a group of engineers, isn't it reasonable to
|
|
expect that the words used to communicate with them will be the
|
|
technical terms that have precise meanings in their specialty,
|
|
and that the information will be technically correct?
|
|
|
|
Now that I have gone through all of that preamble, let me
|
|
get to the reason for this letter.
|
|
|
|
The technical content of SPECTRUM is usually so good that I
|
|
was astounded to read the segment regarding eavesdroppers. It is
|
|
so wrong, so confusing, so muddled, and so badly worded that its
|
|
author and all of the editors at SPECTRUM should be blushing
|
|
until you have atoned for this muddled miasma.
|
|
|
|
(This current piece of misinformation follows close on the
|
|
heels of an article in the April issue in which you assert "for a
|
|
mere $49" you can buy a device that will "detect small changes in
|
|
line impedance" and notify the user of a telephone line tap.)
|
|
|
|
Let me be agonizingly specific -- and your audience is
|
|
electrical engineers so we'll use engineering terms. In analyzing
|
|
"Eavesdroppers' Whammy" I'm going to quote specific sentences out
|
|
of what you presented, and comment on each one.
|
|
|
|
Quote #1
|
|
|
|
"About $50 buys you any of several commercial devices said
|
|
to prevent a tap or unauthorized person from listening in on your
|
|
telephone calls."
|
|
|
|
Comment #1
|
|
|
|
This sentence is correct, but you must pay careful
|
|
attention to the words "said to prevent a tap". Many people offer
|
|
equipment that they say will detect taps on phone lines.
|
|
|
|
The kind of people who sell such devices are the same kind
|
|
of people who sell nostrums to grow hair on bald heads, and diet
|
|
pills that melt away the fat. None of them will detect even a
|
|
simple tap made out of $2.00 worth of parts (at retail).
|
|
|
|
By the way, there are also tap detectors sold for as much as
|
|
$62,500.00 which also cannot detect the $2.00 tap.
|
|
|
|
Quote #2
|
|
|
|
"This kind of device usually drops the phone's 50 volt on-
|
|
hook voltage to about 18 volts instead of the normal 12-15 V
|
|
whenever you lift the receiver."
|
|
|
|
Comment #2
|
|
|
|
All wrong, except that the usual on-hook voltage in this
|
|
country is 50 V. (Although there are many PBXs (private
|
|
exchanges) that operate on different on-hook voltages.)
|
|
|
|
First, you say that off-hook voltage is normally 12-15 V.
|
|
Well, on hundreds of real telephone systems I have measured off-
|
|
hook voltage as low as 2 V and as high as 30 V. The most common
|
|
is about 8 V, but there is no norm that can be counted on.
|
|
|
|
Second, you assert that when I tap the phone line, it will
|
|
cause the off-hook voltage to increase by about 50%. Wow!
|
|
|
|
When I tap the phone line, you'll see no change in either
|
|
on-hook or off-hook voltage. My tapping equipment (all $2.00
|
|
worth) does not affect the line in any way that can be detected
|
|
electronically. There is no measurable change in line voltage
|
|
because I am not loading the line at all.
|
|
|
|
As a matter of fact, we have even run tap-detection tests
|
|
with a time domain reflectometer (TDR). The engineers and
|
|
technicians who participated in the tests were very experienced
|
|
with the TDR, and they were never able to tell when my tap was
|
|
on-line or off-line.
|
|
|
|
Quote #3
|
|
|
|
"As a result, the impedances of your phone and the tap
|
|
should not match and your phone should go dead."
|
|
|
|
Comment #3
|
|
|
|
Huh?
|
|
|
|
Look. The standard telephone presents almost pure resistance
|
|
to the line. It is, after all, operating in a DC circuit ---
|
|
just direct current running through it while it's in operation.
|
|
That resistance is on the order of 600 to 900 ohms in most old
|
|
sets. My tap, on the other hand, uses a blocking capacitor so
|
|
that the impedance seen by the DC circuit has essentially
|
|
infinite magnitude.
|
|
|
|
While in operation, the old-fashioned (carbon microphone)
|
|
telephone voltage varies by one or two volts -- sometimes more.
|
|
My tap will be taking picowatts of power off of the phone line
|
|
and will not cause the DC voltage to vary by even one one
|
|
thousandth of a volt.
|
|
|
|
Your assertion that my tap will cause the off-hook voltage
|
|
to be unusually high makes no sense whatsoever.
|
|
|
|
Nor does your declaration that if the tap impedance and
|
|
phone impedance don't match, the phone will go dead. When I tap a
|
|
phone line, I am deliberately creating the biggest impedance
|
|
mismatch possible -- and, believe me, the phone doesn't go dead.
|
|
|
|
|
|
Final Comment
|
|
|
|
The SCR device described will prevent someone from listening
|
|
on an extension phone, but there have been similar devices sold
|
|
for many years for a few dollars. The sellers of the earlier
|
|
devices never made any money for a simple reason. When an
|
|
extension telephone goes off hook, there is a discernable
|
|
difference in sound level (about 3 dB or half power), so why
|
|
would anyone pay for a circuit to do what your own senses do for
|
|
you?
|
|
|
|
Sincerely,
|
|
|
|
James A. Ross
|
|
President
|
|
|
|
P.S. By the way, technical surveillance countermeasures (TSCM) is
|
|
our business. If you ever need consultation (a limited amount
|
|
free) in this field, please call. We'll try to help you sort the
|
|
wheat from the chaff in the press releases that you receive in
|
|
this very specialized field.
|
|
|
|
(Quoted above is the entire text of the
|
|
letter that your editor sent to the
|
|
editor of IEEE SPECTRUM. If there is EVER
|
|
any response, you'll be advised.)
|
|
|
|
|
|
AT&T TRAINING PROGRAMS
|
|
|
|
Just received: AT&T catalogs of training programs. For
|
|
copies, or to inquire about training schedules, call 800-554-
|
|
6400.
|
|
|
|
|
|
COMMUNICATIONS HANDBOOKS AND PUBLICATIONS
|
|
|
|
Here's another good source of good information. For a
|
|
listing of available handbooks and other publications, contact
|
|
either Chuck Firnsin (312-681-7483) or R.L. Grabo (312-681-7479)
|
|
at: GTE Communications Systems Corp., 400 North Wolf Rd.,
|
|
Northlake, IL 60164 When you write or call, please mention the
|
|
ComSec Letter.
|
|
|
|
|
|
December, 1988
|
|
|
|
DISA
|
|
|
|
In case you didn't appreciate the message in our April
|
|
issue, I'll try again:
|
|
|
|
If your switch offers DISA (Direct
|
|
Inward System Access), you are in
|
|
jeopardy! You may soon join the ranks of
|
|
companies that have been ripped off.
|
|
|
|
Do not jump to the conclusion that
|
|
I'm warning that some hackers might make
|
|
some long distance calls on your lines.
|
|
|
|
Yes, hackers are a nettlesome
|
|
problem. When they discover a DISA route
|
|
(They call them "extenders" so it doesn't
|
|
sound like stealing.), they pass the word
|
|
around and your phone bill will suffer.
|
|
Yes, they can run up your phone bill, and
|
|
you'll have to pay it.
|
|
|
|
However, the people I am referring
|
|
to are organized, and they are probably
|
|
drug dealers, and they make a lot of
|
|
calls.
|
|
|
|
As I write this I am looking at a printout of calls made
|
|
through one company's DISA capability: 27 pages with 51 entries
|
|
per page. In eight days $51,624.36 worth of calls were made on
|
|
four trunks to numbers in Pakistan.
|
|
|
|
I repeat: in eight days $51,624.36 worth of overseas calls
|
|
were made through this company's DISA facility. The people at
|
|
this company were smart; they detected the theft rapidly, and put
|
|
a stop to it rapidly. If they had learned of the abuse only after
|
|
receiving the bill, it could have been a quarter of a million
|
|
dollars!
|
|
|
|
If your switch offers DISA, you are in jeopardy! In our next
|
|
issue we'll include more detail on this situation. Stay tuned!
|
|
|
|
|
|
NYQUIST vs. NYQUIL
|
|
|
|
Most folks have heard of Nyquil, but, sniffling and sneezing
|
|
bears little relationship to TSCM. Nyquist, on the other hand, is
|
|
important in modern communications; and, if you haven't heard of
|
|
it, here's your introduction to the Nyquist Criterion. It relates
|
|
to the conversion of analog signals to digital, with an eye
|
|
toward later reconstructing (D to A) a replica of the original
|
|
signal.
|
|
As usual with history questions, I don't remember the man's
|
|
full name, or country, or when he lived. However, I do remember
|
|
his premise: the Nyquist Criterion (widely used but unproved
|
|
mathematically, I believe) states that, in sampling an analog
|
|
signal in the time domain, one should use a sampling rate of at
|
|
least two times the highest frequency in the signal in order to
|
|
prevent aliasing. For example, if the highest frequency is 1,000
|
|
Hz, it should be sampled more that 2,000 times per second.
|
|
|
|
Before explaining what that means in practical terms, let me
|
|
point out that the terminology definitely proves that engineers
|
|
and/or mathematicians can invent crazy words as do the
|
|
bureaucrats. (The other day I heard a bureaucrat say that
|
|
airlines reduce fares on some routes to "incentify" customers to
|
|
use those routes. Wow!)
|
|
|
|
"Aliasing" is a word that was coined to describe what
|
|
happens when an analog signal has been sampled at too low a rate,
|
|
and the A-to-D and D-to-A process has rebuilt a signal that is
|
|
unlike the original signal, an "alias" of the original.
|
|
|
|
The Nyquist Criterion, then, is important when designing a
|
|
modern telephone which has digital output to the switch. If the
|
|
sampling rate is too low, the reconstructed analog signal out of
|
|
the switch will be a very distorted version of the original
|
|
signal.
|
|
|
|
|
|
TSCM EQUIPMENT
|
|
|
|
Recently, a retired government TSCM expert stated that it
|
|
costs about two hundred and fifty thousand dollars to equip one
|
|
TSCM team. Now that Watkins-Johnson has introduced their WJ-38000
|
|
ELINT receiver, that number will probably climb to about one
|
|
million because this receiver alone can cost more than
|
|
$500,000.00.
|
|
|
|
All kidding aside, this is a serious matter and one that we
|
|
intend to cover in detail in future issues of this letter. For
|
|
the sake of brevity at this time, let's just note that your
|
|
editor does not agree that such expenditures are necessary.
|
|
Certainly there are some government-to-government threats that
|
|
are very high level and deserve high level responses, but there
|
|
is no way to justify spending that much money for equipment to
|
|
equip every team. After all, most work by most teams most of the
|
|
time will address the standard, real-world threat. More later.
|
|
|
|
|
|
NEW WORD NEEDED
|
|
|
|
Because of the work we've been doing lately to identify the
|
|
vulnerabilities in modern electronic PBXs, we've been talking
|
|
with a lot of folks who also don't speak "telephonese". Out of
|
|
necessity we've been using the word "switch" when referring to
|
|
such PBXs. Unfortunately, when most folks hear that word, in
|
|
their mind's eye they see the switch on the wall that we throw to
|
|
turn the lights on. Confusing.
|
|
|
|
So let's start a movement to invent a better word. After
|
|
all, aren't people who work in engineering supposed to be
|
|
precise? Let us hear from you!
|
|
|
|
|
|
PULSE THROUGH A LOADING COIL?
|
|
|
|
This was a question asked by Joe Wilson Elliott during one
|
|
of our telephone conversations. I don't think I ever answered
|
|
him, but it deserves to be answered because it illustrates the
|
|
fact that different educational and training courses teach
|
|
different "facts".
|
|
|
|
Anyway, can you get a pulse through a loading coil? What do
|
|
you think? If anyone expresses interest, we'll answer the
|
|
question in a future letter.
|
|
|
|
|
|
JUMPING TO (DANGEROUS) CONCLUSIONS
|
|
|
|
Regarding spousal tape recording of telephone conversations
|
|
without consent, we reported in January: "A federal judge did
|
|
rule that federal eavesdropping laws (Title III, 18 USC 2510,
|
|
etc.) do not relate to domestic cases in certain circumstances."
|
|
|
|
2600, in its fall issue jumps from this fact to the
|
|
erroneous conclusion, ".... it is now legal for married couples
|
|
to place wiretaps on their home telephones in order to catch
|
|
their spouses doing nasty things like having affairs." We hope
|
|
the readers of this letter understand the difference between the
|
|
two statements. The ruling only said that certain specific
|
|
federal laws do not apply in certain circumstances. It did not
|
|
say that such eavesdropping is legal. There's a big difference.
|
|
|
|
|
|
RF FLOODING
|
|
|
|
One of the comments that we got on our questionnaire after
|
|
our London seminar indicated that the person wanted information
|
|
on "modern techniques such as RF flooding". How nice it would
|
|
have been if that person had read our material which pleads for
|
|
any question at any time, or listened to any of our exhortations:
|
|
"If you have a question, ask it at any time." If he had asked the
|
|
question in front of the group, we would have had an interesting
|
|
topic to discuss. We had people with exceptionally diverse
|
|
backgrounds. A discussion would have provided more than one point
|
|
of view, and that's the value of the seminar format. It's not the
|
|
authoritarian headmaster lecturing to a group of cowed students;
|
|
it's open give and take among experienced, senior people.
|
|
Well, I'm very sorry that he did not speak up. If he had, I
|
|
could have pointed out to him that RF flooding is probably fifty
|
|
years old. Also, I could have mentioned that we had been covering
|
|
some techniques which have come into use in 1988. That's right,
|
|
we were discussing truly modern methods such as electronic switch
|
|
manipulation, REMOBS, bugging of modern electronic phones, etc.
|
|
Thrown in for good measure were some comments on how companies
|
|
are being robbed (through toll fraud on a major scale) by people
|
|
taking advantage of DISA, voice mailboxes, diverters, etc.
|
|
|
|
And he wanted to discuss modern methods such as RF flooding!
|
|
|
|
In any event, I'll explain what I think is meant by "RF
|
|
flooding", with the hope that a reader will either endorse my
|
|
theory, or explain how I went wrong. Before I go on, let me
|
|
explain that I am guessing at what is meant by RF flooding. In
|
|
all of the courses that I have taken in math and electronics,
|
|
"flooding" is a term that was never used in any class or
|
|
practical exercise. I have the feeling that it was invented by a
|
|
technician whose field strength meter told him that the telephone
|
|
was full of RF, so much so that it was flooding out of it and all
|
|
over the floor. (Doesn't that make you wonder if you should wear
|
|
boots while doing TSCM?)
|
|
|
|
As you read this, keep in mind that I have never been
|
|
exposed to any government training in countermeasures, and this
|
|
explanation is based only on my response to the name given to the
|
|
technique.
|
|
|
|
So here goes. The older electromechanical telephones contain
|
|
a hookswitch which is really several switches in one assembly.
|
|
Each conductor is connected to a flexible metal strip, and all of
|
|
the strips are physically parallel and very close together. On
|
|
hook, some connections are made, and some are open. Off hook,
|
|
other combinations occur. In the on-hook condition the talk
|
|
circuitry (carbon microphone, speaker, and side-tone transformer)
|
|
are disconnected from the line in the DC sense. That is, no
|
|
direct current is possible in the circuit because the circuit is
|
|
open. However, what causes the circuit to be open is the fact
|
|
that two flat metal strips, side by side, are not touching.
|
|
|
|
Does that sound familiar? Two conductors separated by a
|
|
dielectric? Of course. That's the definition of a capacitor. And
|
|
although a capacitor may be an open circuit for DC, it sure isn't
|
|
open for RF. In fact, it is nearly a perfect conductor.
|
|
|
|
So my guess is that somebody fifty (or so) years ago figured
|
|
out that he could connect to the talk circuit by applying RF to
|
|
the talk pair. I've never tried it, and don't know anyone who
|
|
has, but the theory is sound. Although the audio recovered is
|
|
probably not good, and it certainly is easy to detect.
|
|
|
|
Well, there's my answer. If I'm way off base (or even a
|
|
little off) I'd like to hear from anyone who can set me straight.
|
|
I'll run the best answer that comes in. How 'bout it??? |