Copy Link
Add to Bookmark
Report
COMSEC Letter 1988
ComSec Letter
Editor: James A. Ross
YOGO 4
1988
COMSEC LETTER
The ComSec Letter was started in 1984, The Year Of George
Orwell, by Jim Ross. Initially it was mailed at no charge to
everyone on his mailing list, and it was later offered by
subscription. After the founding of the Communication Security
Association, the letter became its official organ. In 1989 the
association decided to create a new organ, Comsec Journal; and,
in order to minimize confusion, the name of this letter was
changed to Surveillance.
What follows is an edited version of the contents of one
year of the letter. (The letter has been edited to remove
topical, superfluous, and outdated items.)
Ross Engineering, Inc.
7906 Hope Valley Court
Adamstown, MD 21710
Tel: 301-831-8400; Fax: 301-874-5100 January, 1988
TAP DETECTORS, AGAIN
Recently we received a catalog from Sharper Image which
offered a telephone tap detector. The blurb said that 98% of
"phone snooping" is done with low or medium impedance taps, and
that this device has a green light which means your line is
secure. We responded with the following letter to Richard
Thalheimer.
Dear Richard,
Just a short note with some information that might
save you from an expensive lawsuit some day.
In describing a "phone that knows how to keep a
secret" on page 14 of your current catalog, you say
that 98% of phone snooping is by low or medium
impedance taps.
First, in my experience most "phone snooping" is not
via taps; it is accomplished by phone modifications
known as phone bugging. Second, whoever told you that
taps are 98% low or medium impedance doesn't know what
he's talking about. In fact, he probably doesn't even
know what the word "impedance" means! Even a simple
tap, made from a few dollars worth of common electronic
components, presents a very high impedance to the
tapped line.
"Green light means your line is secure." Wow!
That's a powerful claim. Don't you wonder why Bell
Labs, with the best brains in the field, could never
make that claim?
I'm confident that the phone that you're touting can
be easily tapped, and it will not detect the tap. If
you'd like a live demonstration, I'm sure it can be
arranged.
I hope you'll check into this, and respond to this
letter. I'd like to pass your response on to our
members via the ComSec Letter (sample enclosed).
The initial response to this letter was a phone call from a
buyer at Sharper Image. He left a message that he had not yet
heard back from their vendor, but the device was not selling well
so they might drop it anyway.
OBSCENE CALLS COUNTERMEASURES
This subject continues to come up, so let's pass along our
ideas and ask for yours.
First, the new telco service which will allow you to
identify the calling number is in very limited operation at only
a few locations around the country. If you want to find out if
you can subscribe to it, we suggest that you call your telephone
company business office and ask when you'll be getting the
capability.
Now, not having that service, what can you do? Well, I know
one man who solved the problem by recording some of the calls,
and then advising the caller that the tape goes to the police if
the calls don't stop. That worked for him, but the last person
who inquired of me was a state trooper, so his caller certainly
would not be intimidated by a threat to go to the police.
My advice to the state trooper was to get an automatic
dialer, and to activate it during an obscene call. If the caller
is not too bright, he may think that the rapid, machine-made
signals are automatic trace signals especially if you say some
words to imply such.
Anybody got any good ideas? I don't think a loud noise will
help because I don't think it will pass through the telco
equipment end-to-end at its original ear-splitting level.
SPOUSAL EAVESDROPPING
Boy, talk about response! No sooner had the last ComSec
Letter hit the mail, than we had a call from member Nick
Beltrante informing us that he had mailed a copy of the decision
on the spousal eavesdropping case. Our thanks to Nick, and
here's the story.
It seems that the husband suspected his wife of extramarital
affairs, so he installed a system to automatically record all
calls. He got the proof, and confronted her. He caught her
(electronically) a second time. He divorced her, and she sued
him citing the federal eavesdropping law.
The judge in this case found conflicting precedents. He
chose the precedent in which husband and wife were living
together in the same household and no third party was involved in
the taping of the calls -- as was the situation in the case
before him. In the earlier case the ruling was that marital
cases traditionally are not tried in federal courts. Further,
exhaustive search of the legislative history could find no
indication that the drafters of the federal law meant for it to
be used in domestic conflicts.
Again, our thanks to member Beltrante for sending along the
information. The newspaper story that we had quoted was correct.
A federal judge did rule that federal eavesdropping laws do not
relate to domestic cases in certain circumstances.
CORRECTION
Just last month we passed along the new address for the Bell
Labs RECORD, but now we find that it is no longer published. The
new publication is AT&T Technology, and four issues cost $40.00
Sorry for any confusion we created.
HOW MUCH DECEPTION IS ENOUGH?
We just received a promotional piece from Dictaphone. It
looks very much like a Federal Express overnight letter. It's
smaller, but laid out the same way with the delivery instructions
typed on a form that looks like the Fedex form, and contained in
a transparent pocket on the carrier just like Fedex. One side of
the carrier says, "Jet Express" "URGENT LETTER ENCLOSED".
Overall, it is a strong effort to make the recipient think he is
receiving something that was important enough to warrant spending
about fifteen dollars for overnight delivery.
Unfortunately however, the information on the delivery form
gives the hoax away; it says, "Bulk Rate US Postage Paid,
Richmond, VA, Permit #936". He didn't spend fifteen dollars to
get it to me overnight; he spent twelve and a half cents or less
to get it to me within a few weeks or months!.
Now, we know that people who mail to rented lists want to
encourage you to open and read their offers, but this seller is
contradicting himself when he labels his piece "Urgent Letter"
and sends it bulk rate.
My personal reaction to this is that I don't trust Gordon F.
Moore who sent it to me. He tried to fool me once; and I think,
if I start talking to him about buying his product, he'll try to
fool me again. Therefore, he has no chance of ever selling me
anything.
Your comment?
CELLULAR PHONES, AGAIN
Well, the California Public Utilities Commission is on the
ball. They've asked the phone companies to notify customers that
cellular calls may not be private. Great!
Unfortunately, there is a superfluous word in at least one
of the announcements. It says, "Cellular telephones send calls
over public radio frequencies." The superfluous word, of course,
is "public". Its use implies that there are some frequencies
which are not public, and that is just not so. Everything
transmitted by radio can be heard by anyone who has the right
equipment and technique.
What's needed is education. Let's spread the word. Phone
conversations are not private. They can be overheard very
easily.
DRUG DEALERS AND CMTs
Newsweek wrote about it, and ComSec Letter has written about
it. Drug dealers use cellular phones to do their business. DEA
complains about it. DEA should do something about it. If I can
monitor drug deals in progress, why can't the DEA? If I can
monitor a collector on Long Island going about his rounds, why
can't the FBI?
You know, the irony of the whole thing is that those people
don't pay for their phone calls. They use stratagems that defeat
the phone companies' billing systems, so all of us who pay our
phone bills are subsidizing the drug dealers.
Let's move into the twentieth century, and use modern
communications and computational capabilities to put a stop to
this stuff.
LETTER
F. Douglas Porter of Tucson, Arizona wrote to ask some very
good questions. First, he wants to know when we are going to
sponsor meetings relating to computer communications and computer
security. Although the association is still in its infancy, we
are planning a big meeting for the east coast which will include
just what you want. At this time we can't be specific on place
and date, but we're working on it. You will be advised.
Also, he asks how he can access our BBS. Well Doug, the
volunteer who set up the ComSec BBS changed it into a personal
project, and then abandoned it altogether. There will be a board
some day, I'm sure; but there is none right now.
The last question is the tough one. He wants to know when
we'll be conducting some activities in the West, and that takes a
little background to answer. The people who organized this
association are all in the East and they remain the volunteer
work force. Our main effort at the moment is to get our next
expo under way, and we're working hard at it. However, we're
also putting together written procedures for establishing local
chapters, and we'll be sending information in this letter. Why
not start a chapter and begin to sponsor some local events, even
before the rules are in place? Let me hear from you.
February, 1988
EXCELLENT SUGGESTION
Bill Ranson of Richmond, Virginia called to suggest that we
summarize the eavesdropping laws in the ComSec Letter, and we
think that that is an excellent suggestion. Bill, you're on.
We'll start on that project right away, and you'll see something
in this letter in the near future.
Along that line, there are some excellent publications
available relating to communications, security, and privacy.
We're including an extra page with this letter which lists some
information sources that we recommend without reservation. (The
April issue of Computer Security Digest has some especially
chilling information from people in the computer trenches.)
If you contact any of them, please mention ComSec Letter.
OPPORTUNITIES
This association has openings for people ready to work. No
pay, just a lot of time-consuming work.
What's your reward? Maybe nothing. Maybe something.
The only thing that you'll get for sure is some publicity.
You'll get your name and company affiliation on our letterhead.
You'll sit at head tables from time to time; you might even get
to give a speech, if that's your desire.
All of these things may turn out to be of no value to you
other than some items you can add to your scrapbook to look at
when you're old and gray. On the other hand, if you are
ambitious, getting involved in an international organization's
activities might just bring you to the attention of the person
who can provide the big break you are looking for. Who knows?
There are committees and projects in need of leaders with
initiative. All involve paperwork, phone calls, and planning; but
no manual labor. Keep in mind that it is logical and normal that
members will select known workers for the next national board of
directors. If you can help in any way, contact the editor -- NOW.
IN THE MAIL & OUR THANKS
Thanks to Dave Mann who has sent much valuable information,
and to Bob Haydon who advised that he built a "listen-at-a-
distance" mike (discussed in a seminar) and it works.
Thanks also to Richard D'Aleo who sent us a written critique
with good suggestions for improving the seminar from his point of
view, and who also provided the information on "The Other NSA".
Also, Marion Lewis of Sovran Financial Corporation sent us
some material on Sherwood Communications Associates. Thanks
Marion. Sherwood is a relatively young firm, but they have an
amazing array of products -- from standard telephone items to
very sophisticated (and expensive) instruments. Also, they offer
used TSCM equipment at good prices. You'll find them listed in
the supplement to this letter because they have a great
collection of books and reports for sale.
LETTER
A member who is in military service wrote us recently asking
for our help in finding a job after his discharge. We have no
staff for any such job bank activity, and the work he's looking
for is very seldom advertised, so we're passing his request along
in this letter.
"I am about to leave military service. In the military one
of my functions was the monitoring of official telephone calls to
identify if there was any breach of security occurring.
"I have enjoyed this job and would like to be able to
continue with this type of work. Could the association provide me
any type of list of civilian jobs that might fall into this job
area or a list of those jobs that I could apply for that would
incorporate this type of work?
"Any assistance that you can give me in this job search
would be greatly appreciated."
If you can help, please contact Daryl L. Cole at RT3, Box
316, Kempner, TX 76539. Please send us a copy so we can report on
it in this letter 'cuz it seems to us that the only place in the
civilian world that he could find a job monitoring telephone
conversations would be with a big law enforcement organization.
We look forward to hearing from members and Daryl on this.
MEMBERS ONLY
Offers for free reprint service are for members of the
ComSec Association only. If you are not a member and are reading
a photocopy of this letter, please don't ask us to spend our time
and effort to serve you. We are offering a free service to
members -- people who support our efforts by paying dues. You can
join and become eligible for these free services. All you have to
do is apply and send money.
(This comment is prompted by our recent receipt of a request
[with self-addressed envelope] for a free reprint of an article
from a person who did not give his name, but the letter was from
a zip code where we have no members.)
BUGGED OR TAPPED?
Member Perry Myers of Myers Investigative Service in Chicago
sent us a clipping from the Chicago Tribune headlined "GOP
Chairman says he found tap on phone". Perry says that he thinks
there is something wrong in the story, and asks our opinion.
Well Perry, I agree that it's a hard story to understand. In
the first sentence Donald Totten says his phone was tapped, and
in the second sentence he says that his phone was bugged. Was it
one, or the other, or both?
We'll probably never know because Joseph Miles of Shadow
Investigative Service is quoted as reporting, "In the course of a
sweep I found a variation of voltage on the line. The possibility
existed. I found no hard evidence that one was in place".
Now, if the phone was bugged, there are some simple,
definitive tests which should have been performed, and (in your
editor's opinion) measuring line voltage is not one of them. If
these tests had been performed, the odds are that a bug would
have been detected.
On the other hand, if we're considering a tap, Mr. Miles
didn't have much chance of detecting one by measuring line
voltage. In our experience we only know of two instances in which
line voltage measurements gave a reasonably positive indication
that something was amiss. In both cases on-hook voltage was very
low and we suspect that an off-site parallel parasite transmitter
was the cause.
So let's hear from members. How often has line voltage
measurement indicated a problem in your experience? In my
experience a simple tap on an active line causes no measurable
change in voltage. In fact, the ordinary changes caused by normal
system activity are on the order of volts so it would be
impossible to measure the change of picovolts (or less) caused by
a decent tap.
Another question for members: Do you agree that a bugged
telephone should be detected by standard countermeasures
activities?
REEVALUATION OF THE EVALUATOR
This is another story of rapid response. In our last issue
we carried the story of our two evaluations of the Evaluator
telephone tap detector and reported that it did not detect any of
the taps that we put on our line.
Michael K. Stern, VP of Secom Information Products Company,
responded immediately, sending us another Evaluator for testing.
Further, he volunteered to come here to assist us with our tests.
He assures us that the unit really does detect taps (but he
hasn't told us how), and that other people have tested it with
positive results. Well, we'll try again when our schedule permits
and we'll advise you of our results in an upcoming newsletter.
THE OTHER NSA
Richard D'Aleo, an author who is writing a book on
intelligence gathering, sent us some material describing the
other NSA. It seems that there is an information source here in
Washington, DC called "The National Security Archive". This is a
non-profit (by design) institute founded by former Washington
Post reporter, Scott Armstrong. According to Time, this NSA now
operates on a million dollar budget with 30 people on the staff.
This NSA uses the Freedom of Information Act to collect
information which can be used by researchers into government
activities. If you have need of information which might have been
retrieved from government records, by all means, contact NSA at
1755 Massachusetts Ave. #500, Washington, DC 20036. 202-797-0882.
Please mention ComSec Letter when you contact them.
TELECOMMUNICATIONS COURSES
There are some courses on the administration, management,
and technology of telecommunications now being offered by AT&T.
If interested, contact Bruce E. Hemstock, AT&T Knowledge Plus, 55
Corporate Drive, Room 13J08, Bridgewater, NJ 08807. 800-554-
6400. Please mention ComSec Letter when you call or write.
P.S. One member commented that he'd like to see more technical
content in the ComSec Letter. What's your opinion?
COMMUNICATIONS/SECURITY/PRIVACY PUBLICATIONS
Newsletters, Magazines
Computer Security Digest computer security
150 N. Main St
Plymouth, MI 48170
313-459-8787
Monitoring Times radio monitoring
140 Dog Branch Rd.
Brasstown, NC28902
704-837-9200
Privacy Journal security/privacy
Box 15300 Compilation of State
Washington, DC 20003 and Federal Privacy
202-547-2865 Laws. $26.00
Security Letter corporate security
166 East 96th St.
New York, NY 10128
212-348-1553
Security Systems Digest security news/programs
Washington Crime News Service
7620 Little River Turnpike
Annandale, VA 22003
703-941-6600
Sherwood Communicatiuons Associates various publications
POB 535
Southampton, PA 18966
215-357-9065
Teleconnect modern telecommunications
12 West 21 St.
New York, NY 10011
212-691-8215
2600 hacking
POB 752
Middle Island, NY 11953
Books
Barbara Rowan has compiled an excellent reference, entitled
"Handbook on State Laws Regarding Secretly Recording Your Own
Conversations". $20 from Independent Hill Press, 105 South Alfred
St., Alexandria, VA 22314. There are periodic updates. March, 1988
COMPUTER CRIME
Yes, it does exist; it does cause problems -- of varying
magnitude. Let's consider some of the various activities that we
have knowledge of.
First, we should consider those petty crimes by people who
think that stealing from big organizations is not stealing. The
crimes I'm thinking of are primarily those of theft of services
through the use of someone else's telephone credit card number.
Many, many long distance telephone calls are made this way. Many
of the people who do this think it's not really theft because the
phone company is so rich it doesn't know what to do with all of
its money. What they don't appreciate is that the phone companies
never lose money; they just add onto their rates to cover the
costs of these thefts. (But who can criticize the kids for such
shallow thinking -- we have men who would be president who say
that they are going to reduce our national debt without bothering
the people by raising taxes on corporations. They don't realize
that all of us will end up paying those high taxes because we'll
have to pay more for goods and services from those firms.)
Then there are the activities which are childish pranks,
taking advantage of the fact that most people/organizations are
trusting. Children with computer ability, by accessing someone
else's computer and leaving smart messages, perform the computer
equivalent of the kid trick of putting salt in the sugar bowl or
loosening the top on the pepper shaker in a restaurant.
Of course, there are also computer problems caused
inadvertently. Maybe these should also be called crimes. I'm
referring, for instance, to the virus experiment originated by
some folks at MacMag. It seems they wanted to try out a virus so
they planted one in several Macs in their office. This one was
set to appear on March 2, and to display a personal message from
their publisher. Well, they installed it in their Macs in
December and by March 2 it had spread to thousands of Macs (and
maybe into some commercial programs being offered for sale). In
any event, on March 2 thousands of Mac computers displayed the
message, "Richard Brandow, Publisher of MacMag, and its entire
staff would like to take this opportunity to convey their
Universal Peace Message to all Macintosh users around the world".
Last, but certainly not least, there are the serious
crimes --- more than just vexations. Large amounts of money and
property are being stolen. Data are being destroyed. We've all
read horror stories about these.
Just one observation before we consider some specifics: the
ones we've heard about are the failures; the successful computer
thefts are still unknown to us.
Some items in the news about some of those failures:
Computer Security Digest, April issue:
"The security of computers and data communications systems
is today largely non-existent, inadequate or outdated by new
offensive techniques.
"Governmental agencies (federal, state and local) seem to
have the loosest controls and the highest incident rate....
"Bell System Regionals are loaded with incidents.... The
culprits aren't all teenagers or long haired hippies either. The
new profile includes "mature" businessmen as well as the yuppie
community."
Washington Post April 18, 1988:
Headline: "New "virus" Infects NASA Macintoshes"
".... numerous reports of a virus called Scores ...."
"....200 to 400 Macintoshes in the agency's Washington area
offices .... were infected by the virus."
Yes, it does exist. What can we do about it? Well, to start
with, I suggest that we share information. I make this suggestion
knowing that it contradicts what the Washington Post says is the
philosophy of major corporations who want to keep a lid on
countermeasures so that the other side won't find out what we're
doing and react to combat our countermeasures. I don't think
those people have enough respect for the capabilities of the
other side. They are smart. They share information. We need to
get smart. We need to share information.
As a start, if you're using a DOS computer and have
downloaded programs from a BBS, check the date on your
COMMAND.COM file. If it's recent, you have a problem.
Data Processing and Computer Security, in its Winter '88
edition, says that there is a checking program called VI-RAID.
This program will create a "Program Authentication Code" on all
of your programs, and can then be used periodically tho check to
see if they have been altered. Available from Prime Factors,
Inc., 1470 E. 20th Ave., Eugene, OR 97403. 503-345-4334.
Anyone care to offer additional advice, or offer to provide
service?
DONATIONS TO THE CAUSE
If you have any items of TSCM equipment that you no longer
need, please consider donating them to the association. What we
are most interested in are those things that you found really
don't do what the seller said they would do. We'll test them and
report on what they actually can accomplish.
We're interested in the expensive items, of course, but
we're also interested in the inexpensive ones. For example, the
"Phone Tap Detector" advertized for $69.00 (plus $2.95 P&H) in
the February, 88 issue of Popular Communications would seem to be
an interesting item. If you bought one and found that it does not
detect taps, why not send it along to us?
Also, we're always looking for computers, modems, office
equipment and furniture, and anything that might be useful.
Certainly nobody around here is an expert on the tax laws, but
the association is organized as a 501 (c) (3) corporation (non-
profit, educational) which should mean that you should be able to
take some kind of a write off for any donation. Ask your tax
lawyer or accountant, but keep us in mind. Thanks.
FEEDBACK
Ben Otano, Bill Parker, and Perry Myers requested the
overseas travel tips mentioned in the last ComSec Letter, and Tom
Campbell of Northrop and Perry Myers responded positively to our
question about more technical content. Herb Greenberg sent us a
copy of an article in Business / North Carolina which features
reader Bob Grove, Editor of Monitoring Times. (In case you hadn't
noticed before, we've often suggested that folks in the TSCM
business could benefit from a lot of the material in this
publication. Call 'em in Brasstown, NC.)
We appreciate these letters, and especially appreciate the
nice compliments that came with them. Thanks. And, we got the
message. The response is for more technical content in these
letters, so we'll start putting in more technical detail.
TSCM, WHAT IS IT?
Recently, we've read in two different publications that 90%
of all TSCM "hits" are attributable to the physical search.
That is so far off from our experience that we're inclined
to believe that the statement is self-serving in the extreme.
Probably the folks who tell you that don't have any modern
technical equipment or any technical capability.
Of course it could be that one of the authors is parroting
the other. Come to think of it, his comments indicate a real lack
of experience in real-world situations so maybe he's an armchair
quarterback.
In any event, we feel obligated to comment based on our
experience on real jobs. No amount of physical search would have
found the speaker of the old speakerphone connected to spare
conductors in the 50-conductor cable. How about the carbon
microphone connected to spare pair in the conference room phone;
do you think physical search would have found that?
Of course, if you have RF-calibrated eyeballs, you can see
the radio transmitter emanations at 100 plus MHz, and the 200 KHz
carrier current transmissions. C'mon! Be serious. Although there
is no question that physical search has its place, it is only
occasionally the most important part of the TSCM job. In an old
multi-tenant office building, it really is important and time
consuming. There have been jobs when it was the most meaningful
segment of our procedure. For instance, we wouldn't have detected
the evidence of the tap on Bob Hay's home telephone without it,
but most of the communications compromises that we've found were
found through the use of modern instrumentation. No matter how
thorough your physical search, you'll never see any RF, and
you'll probably never see any of the modifications to telephones
that can be detected easily with simple technical tests with
modern equipment.
Another idea: the people who say that physical search is the
most important part of TSCM might just be the people to whom show
is more important than substance. Certainly the client will be
impressed by a lot of activity, even if the hustle and bustle is
useless, as the standard physical search is in many TSCM jobs. April, 1988
MODERN PHONE SYSTEM VULNERABILITIES
Background
The basic message is: The bad guys are smart. They are goal
oriented. They communicate. If there are vulnerabilities, they'll
take advantage of them while the good guys have their heads in
the sand (or stuck up in the air).
The good guys must communicate. Don't be afraid that you'll
teach them new tricks -- they already know all the tricks.
We've frequently talked about and written about potential
weaknesses in modern telephone systems, but our feelings were
just that, feelings. We felt that some of the systems could be
taken advantage of based on sketchy technical details, but now
we've begun to receive good information from several different
sources. So let's look at some specific experiences.
Experiences, DISA
In order not to embarrass any of the people or companies who
have provided the details, we're not going to identify them; but
what follows is real. Take heed.
A company (composite, for the sake of this article) which
has one of the (early) modern telephone systems had DISA (or some
variant thereof) for the convenience of their salesmen. To use
DISA (Direct Inward System Access) a salesman would call the PBX
and use a four-digit code number for identification. The system
would then connect him to a trunk, and he would be able to make
his calls.
Some time after the system had been put into operation, the
company noticed that their telephone bills were suddenly full of
off-hours, long, and expensive calls to a lot of numbers in Latin
America. They concluded that someone had learned how to use their
system, and was abusing it.
Their first reaction to try to protect themselves was to
change to a six-digit code. Not even as effective as a finger in
the dike; each monthly bill still contained thousands of dollars
in charges for calls to Latin America.
Their next step was to contact AT&T, and ask for protection.
AT&T investigated and determined that the calls were originating
in upper Manhattan. However, the exact source was not determined
because the calls stopped coming.
That may sound like a happy ending, but it isn't really.
It's actually one of those inconclusive terminations that leaves
everyone hanging. In that company's case, they finally realized
that the people making calls through their system were not
individual hackers; they were big business. That's right. Their
conclusion was that drug dealers had set up a communications
business so that their calls could not be traced back to them.
The reason that the company was no longer used is that they cut
back on the number of trunks available to only two or three, and
the druggies could not make the volume of calls that they
required through only a few trunks. It's our guess that they have
moved on to another company that has enough trunks, so that they
don't have the operational problem of keeping track of several
systems with different passwords, etc. It's so much simpler to
deal with only one system at a time and we're sure that they are
now concentrating on another company and that that company is
being taken advantage of in a big way.
Experiences, Remote Diagnostics
In addition to using DISA to steal service, some of the
service stealers, are using the built-in maintenance facility.
They dial in to the PBX's computer, and access the remote
diagnostic capability, where, by use of the proper signals, they
can access trunks.
One security director said that they had put a recorder on,
and heard a tone burst on the incoming call, followed by dial
tone on the outgoing trunk.
Checking with some folks who install such systems, we find
that this is certainly possible on some of the most modern
systems.
The Real Threat
Both DISA and remote diagnostic capabilities are currently
being used to steal service from a lot of businesses.
But it's only money that's being stolen.
Egad! Did Ross, the Scotsman, say it's only money being stolen?
Yup. He said it. He said it because he thinks something much
more valuable can be stolen, and probably is being stolen even as
you read this.
That more valuable property is information. If the bad guys
have figured out how to enter and manipulate these systems, they
must have learned how to use their knowledge for eavesdropping.
What Can You do about Long Distance Theft?
Well, first read your phone bills. Do you have any excess
charges? If so, are they for calls to Latin America? If so, you
have probably been the target of the druggies. However, don't be
embarrassed and don't despair.
If your company has been victimized, don't feel too bad.
We've heard that the MCI sales offices in Phoenix and Denver were
hit -- bad. And MCI is a company that knows communications inside
and out -- but they got burned.
Also, keep in mind that the druggies are smart. They're not
going to continue to use the same company's lines until the
authorities find them. Their objective is to hide from authority
so they'll move on within a month or so.
However, they may cycle back, so it's a good idea to monitor
activity on your trunks after hours. Don't wait for the bill to
come in. Get some automated equipment that prints out line
activity. (Radio Shack has a dandy DNR (dialed number recorder)
that they call the CPA-1000 and sell it for $99.95.)
What Do We Plan to Do about Eavesdropping Vulnerabilities?
Unless one of our wonderful readers has already done it and
sends us a copy, we plan to do a survey of modern telephone
systems from Merlin to Dimension and Horizon, and on up from
there. We've heard that the CIA has already done it, but we don't
have access to their report (nor to such vast resources!), so
we'll just have to grind away at it. This is not the kind of a
project that gets accomplished overnight, so don't stand by your
mailbox looking for an announcement. While we're at it, though,
we'd like to hear from anyone who has specifics relating to any
system.
And, of course, if you want to call to compare notes, we'd
be glad to hear from you at any time.
MODERN TELEPHONE SYSTEMS INVULNERABILITIES
Well, the news is not all bad. Some of the telephone systems
that we've been exposed to recently, are really quite secure.
Some are unbelievably insecure, yes; but some are quite good.
First, some of the modern PBXs select an outgoing trunk for
the caller. That means that if you want to tap phone calls by a
specific person, you have to tap all lines and monitor all calls,
and turn on the recorder when you hear the voice of the target.
The only way around this is to secure access to the premises and
put the tap in behind the switchboard. That is possible, of
course, but it adds a level of complexity to the tapper's
problem.
Then, there are the systems that are almost immune to
bugging. Coupled with a good physical security program, they are
nearly 100% immune. For instance, we were recently doing the
standard test for a series parasite by flashing the hookswitch
while tuning through the spectrum. After about ten flashes, the
computer showed the phone "busy". Apparently, it took so many
interruptions as a sign of a malfunction, so it busied the phone
out. Ross figured he could reactivate by disconnecting and
reconnecting the feed, but that made the phone go completely
dead. So what we had was a phone that is nearly immune to
bugging. If a bugger had worked on one of these phones, the
system or the phone would have provided evidence that it had been
worked on.
We've heard that some systems will recover from faults by
turning the computer's power off and back on again. This is where
your physical security program will provide protection, first by
locking the area, and second by monitoring access.
TAP DETECTORS AND THE SHARPER IMAGE
In our January issue we ran a copy of a letter to Richard
Thalheimer of The Sharper Image. The letter advised him that the
tap detector that he was touting would not detect even a simple
tap, and that he might get himself sued by someone who depended
on his tap detector to protect his privacy.
Well, the first response was from a TSI buyer who said that
sales weren't going so well anyway, so maybe they'd drop the
item. Now comes the latest issue of their catalog, and, you
guessed it, they're still saying "you can guard the privacy of
your line..."
So it seems that they simply don't care what they say.
Anything to make a sale. Oh well.
THAT LIFE FORCE CATALOG
Wow! Super slick. Full of pictures of handsome men and
beautiful women. Some catalog, until you begin to read what it
says. How about "most unique" for an interesting variation on
English? On one page we read that the Research Electronics voice
scrambler is "THE MOST SECURE VOICE PRIVACY DEVICE IN THE WORLD".
Now, it might be good. Can't say; never tested it. But we know
for sure that it is not the most secure device in the world. On
page 4 they also show a fellow listening through a wall with a
device they sell, and they even advise you to check 18 USC 2511
before you use it. I wonder why they didn't read that law
themselves; it makes printing that ad a federal felony. Oh well.
May, 1988
MEMBERSHIP MEETING
You are reminded of the membership meeting scheduled for
July 23 at the Twin Bridges Marriott in Arlington, VA. We've
planned a little time for an informal get together with coffee
and sweet rolls and toast at 9 AM. Meeting will start at 10. If
you can make it, call as soon as possible -- we're buying lunch,
and the hotel needs a count.
So far the response has been encouraging, so let's consider
some of what we need to accomplish in the near future.
Annual Meeting. We've been looking for a place to hold our second
"annual" meeting (our first was in 1985). This time we have a
contract with a meeting organizer who won't try to remake our
plans for our conferences. All of the logistical details will be
handled by him, and all exhibitor affairs will be his
responsibility. We'll put together the details of the conference,
and he'll take care of the promotion, advertising, registration,
etc.
Local Chapter Organization. This should be one of our top
priorities. Maybe the DC-area members can set the rules,
organize, and become the lead chapter in setting up our national
meeting later this year.
Bylaws. We have some very simple bylaws. At this meeting I hope
that we can appoint someone to flesh them out for presentation at
our annual meeting. Also, someone has to do the paperwork to get
us recognized as a bona fide non-profit organization.
Nomination of New Board Members. At present we have authorized a
board of five members. One of the members has departed so we have
a current opening for one person. If the Bylaws are approved,
this will be a bona fide meeting of the association, and we'll be
able to elect a new board member immediately. It has been planned
to expand the board membership to seven or nine, and this can be
decided at this meeting. Nominations will then be sought from all
members by mail, with the election to be conducted by mail before
the annual meeting.
Appointment of Committee Chairmen. There are many functions that
need leadership. At the top of the list is membership affairs. As
I see it, this relates to both membership benefits and to
recruiting. In my mind, they seem to go hand in hand. The future
of this organization depends on having an effective membership
program. We have to have suitable benefits to attract and hold
members.
Corporate Membership Changes. I plan to ask the board to change
our corporate membership structure to make it similar to that of
the American Defense Preparedness Association. Specifically, I
propose that we leave the annual dues at $150, but that the
corporation can name five individuals who will have full voting
rights.
ComSec Letter Subscriptions. I plan to ask the board to authorize
subscriptions to the ComSec letter @ $25 per year (ten issues).
This should make it easier for some to afford, and will allow
libraries, etc. to subscribe without having to pay individual
dues.
B & E: A to Z
With a title like that this video has to be good. (In case
you're not familiar with the jargon, the subject is breaking and
entering -- in fact, the subtitle is "How to get in anywhere,
anytime".)
Just how good it really is depends on your point of view. I
watched it mostly on fast forward because I'm not really
interested in developing a new skill, especially a skill that
would normally be used in the commission of a crime. If you want
to learn how to break in through a locked door, this probably
will be very good for you. On the other hand, if you are already
accomplished in this field, you don't need this video.
Is it worth the price? Yes, emphatically. Even though I
skipped most of it, I was immensely impressed by demonstrations
which show how very vulnerable we all are. Further, it is
especially chilling when you realize that the person who had no
trouble defeating all kinds of locks seemed to be not too
experienced at the business. In any event, you should look at it
if only to increase your awareness of how flimsy most physical
barriers really are. Available @ $99.95 from CEP, POB 865,
Boulder, CO 80306. 303-443-2294.
WINKLEMANN, AGAIN
Wow! It seems that there are quite a few people who are glad
to hear that this company is alive again in the USA. We've heard
that someone in Florida bought the US rights or franchise, and
there are some people who would like to get more specific
details. Please call if you have any information.
BBS COMING
Member Ned Holderby has volunteered to start a computer
bulletin board system for members and others. Non-member callers
will be restricted to information about the association and its
benefits, and maybe some message service. Members will have
access to all of the stored information including back issues of
the ComSec Letter, members names and addresses (except those who
have instructed us not to list their names), a message service to
leave questions or messages for all or any specified member, etc.
Also, membership records can be maintained in one place, getting
rid of some of the confusion that resulted from our changes in
the past.
IN THE MAIL
Bill Ranson, of Richmond, VA sent us some interesting
comments. He starts by saying that our segment last month, Modern
Telephone System In-Vulnerabilities, whet his appetite, but
didn't give him anything to chew on.
He's right, of course. We noted elsewhere in that same
letter, that we're busy collecting information on
vulnerabilities, and we should have said that we are also
collecting information on invulnerabilities. This effort will be
reported on as it progresses (see segment, Northern Telecom SL-1
Meridian in this issue).
Bill also volunteers to provide information on equipment
that he has tested, and to test equipment that is provided to the
association for that purpose.
Bill, I hope that you can make it to the meeting on the
23rd. Lee Binette is planning to be there to suggest that the
ComSec Association start just such a program. Maybe you two can
get it going, and we'll see that test results get passed on to
members, either through this letter or through our BBS.
WORDPERFECT 5.0
Well, the new version of Wordperfect has finally arrived,
and we have it installed in our new (IBM XT clone) computer.
Strange, though. The old version of WP recognized our QMS KISS
laser printer and the new version never heard of it. However, the
factory has sent us a series of updated diskettes, and our
printer is back among the living (except that WP can no longer
draw lines).
If all goes well and the old man learns how to manage the
new program, you'll soon see changes in the format, layout, etc.
of this letter. (You might have noticed that the title of the
letter is bigger this issue, and we've put a box around the date
line, and we've even included a drawing of your editor with a
smile on his face. We tried to place the clip art in the center
of the page, but for some reason Wordperfect won't do that for
us. Yet. Our plans also include upgrading to full desk-top
publishing capability. It'll all come in due course. Although
we'd like to do everything at once, the budget
limits our speed, as does this old guy's ability
to learn all this new stuff.
So, there really is some hope for a fancier
letter. Don't despair. We may move slowly, but
we know where we want to go and we are
determined to get there. Next, we plan to
acquire a scanner so we can show pictures of
some of the finds in our TSCM work. After that,
comes a better laser printer so we can do the
whole desk-top publishing thing.
If you have any ideas about upgrading this
letter, your editor would really like to hear
from you. I'm proposing several ideas at our membership meeting
to enlarge the association and the readership of this letter. If
we can get a bigger readership, we'll be able to sell some
advertising in the letter. What do you think about that?
NORTHERN TELECOM SL-1 MERIDIAN
This is a system that we'll wholeheartedly recommend from a
security point of view. We also hear very good reports about its
reliability, but let's consider bugs and taps.
First, bugs. The SL-1 Meridian, coupled with a good physical
access control system is my number one choice as an anti-bug
telephone. Why? Well, if you are going to modify a phone to make
it into a room bug, you're going to disconnect the phone from the
feed. In the SL-1 Meridian system, as soon as a phone is
disconnected, it is locked out of the system until the system is
reset at the computer -- that's where the good physical security
program is important. Simply put, if you have this system, and
the boss finds his phone inoperative on Monday morning, you know
that you have a problem.
Now let's consider taps. If your mission is to tap the phone
calls of Mr. X, you simply have to connect to the wires that
carry his calls. However, this system pumps calls out on a T-1
span. That means that you need the equipment to break out the 24
channels, and you have to listen to all channels for Mr. X's
voice. Next to impossible for any but the most sophisticated
tapper with lots of clout, money, and technical capability.
Because of these characteristics, I rate this system #1 for
security. There may be others just as good or better, but we
haven't checked them all out yet. You'll hear more as we
progress.
June/July, 1988
SURVEILLANCE EXPO 88 (89?)
Surveillance Expo will be sponsored by the ComSec
Association and will take place in the Washington, DC area in
conjunction with our next membership meeting. As you read this
volunteers are looking for space for a meeting late this year,
but finding a site is proving to be a real problem and we may
have to reschedule to some time next year when appropriate space
will be available.
The meetings are being planned for the DC area because
that's where the volunteer workers are. To those members who have
been asking for a meeting in other areas we say, "Have at it.
We'll cooperate in any way." However, those of us working here
can barely handle the details of one meeting, let alone two.
NEW BOARD OF DIRECTORS
At the membership meeting held on July 23, 1988, it was
decided to expand the board to seven members, and an election was
held to fill the four vacancies. Joining Chuck Doan, Jim Ross,
and Ken Taylor on the board are: Mike Brumbaugh, Jack Mogus, John
Nolan, and Charles S. (Slick) Poteat.
BOARD MEMBER FUNCTIONS
Although not all members have been formally elected to
specific offices, the board members in the DC area have begun to
work on projects as follows: Mike Brumbaugh has been keeping
minutes of each meeting; Chuck Doan is VP, Finance; Jack Mogus is
working on membership programs and will be responsible for all
aspects of membership (keeping the list, recruiting, benefits,
local chapter affairs, etc.); John Nolan is in charge of all
aspects of organizing the upcoming Surveillance Expos and annual
membership meetings; Slick Poteat is developing a system for
collecting information on the equipment used and qualifications
of our members who work in TSCM; Jim Ross is still president, but
has announced that he will run for chairman at the next
membership meeting so that someone else can move into the
president's slot and lead the association through its critical
growth stage.
HITS
From time to time we pass along information regarding hits
(communications compromises) found by our members. In this issue
we'll detail some of those and also two interesting
vulnerabilities (Vantage phone and common wall). In future issues
we'll provide details on other vulnerabilities and some
communication compromises that are simple to implement.
As usual, you are invited to send along information that you
think would be of value to members.
Jack Mogus has had two occasions to look closely at a 66
connecting block for one of his clients. On the first occasion he
found a home-built radio transmitter, and on the second he found
a tap connected to a pair that led out of the building. (As soon
as we learn how to use our new scanner with our computer and
laser printer, we'll provide pictures of this find and any others
that we receive.)
Doug Ralph, in Canada, has been having a very busy year, and
reports two interesting finds. First, he was astounded to connect
to the talk pair of an on-hook Northern Telecom Vantage series
telephone and hear all of the room audio. That's right, the
microphone or speaker (of the speakerphone) of this instrument is
connected to the talk pair when on hook, and all you need is an
audio amplifier, connected through a blocking capacitor, and you
have a first class bugging system in place.
Ralph's other report points up the importance of a thorough
physical search. Under the conference table in a board room he
found remnants of duct tape, which probably had fastened a tape
recorder in place at one time. Way to go, Doug!
One contributor, who wishes to remain anonymous so that his
company will not be embarrassed, reported an interesting find by
his in-house telephone man. It seems that this young fellow
normally used white wire ties in his work, and one day he noticed
that someone else had been working in his territory. He tracked
the strange wiring to a Radio Shack tape recorder controller (PN
43-236), and from there to a tape recorder. The CEO who heard his
conversations on the tape was understandably in shock. Pictures
of this installation will also be carried in a future letter.
Let's now look at the common wall problem. We're referring
to multi-tenant office buildings with more than one tenant on one
floor so that there is a wall which is common to two different
businesses. Most of the modern office construction that we've
seen lately has office walls extending upward to the base of the
floor above, which is as it should be for physical security.
However, these walls, out of sight above the dropped ceiling,
have large holes in them to allow for HVAC air flow, which is not
how it should be for communications security. The next door
neighbor need only stick his head above the dropped ceiling to
hear what is going on in the adjoining office. Or, if he wants to
get it all, he can use this access hole to plant a microphone and
connect it to a tape recorder. This is a real vulnerability; look
for it!
MEMBERSHIP RENEWALS
During the past year, we arranged for all memberships to
expire at the same time, namely at the end of September. This
will make it much easier to keep track, produce rosters, etc.
At present we have many memberships expiring in September of
this year, and more expiring in '89. Also, we have a handful of
life memberships and a few corporate memberships. Anyway, this
seems to be a good time to remind everyone of the options.
Individual professional life memberships are still available
at $500. We've been told that this is too low a figure, so the
board will be considering raising it soon.
The corporate membership picture has just changed to make it
much more attractive for businesses to join. Each small business
corporate member can name up to five individual members, each
with full voting rights. The fee for this level of corporate
membership is still $150 per year, so give this option some
thought. If you plan on exhibiting at the upcoming Surveillance
Expo, you'll more than recoup your dues in the reduced charges
for exhibit space.
The date of membership expiration is printed at the end of
the first line on your mailing label. If your membership expires
September 30, 1988, a renewal form is enclosed with this letter.
Please don't procrastinate. We're entering into our big growth
year, and we need support from all of our old members.
LASER BEAM ON THE WINDOW. THREAT?
Kevin Murray has done a practical and thorough evaluation of
the laser beam on the window threat. We don't have room for it in
this issue, but we'll provide a full recounting of his evaluation
in the next issue. It's a good piece of work and we're very
pleased that he saw fit to share it with the membership.
Thanks, Kevin. It's input like this that we're looking for
to elevate the level of professionalism in TSCM practitioners.
COMSEC ASSOCIATION BBS
Ned Holderby advises that the board should be in operation
by the third week in August. More information in the next issue.
MEMBERSHIP LIST
If you've struggled through with us, you'll recall that,
after the first membership list, there has been a long break with
no list. It's a long sad story, a story of the kind of problems
that a new organization has when starting up. First, we had an
outside firm maintaining the list, and that worked great but cost
money. Then a member volunteered to maintain the list, notifying
members when it was time to renew, etc. Unfortunately, he never
notified a single member of lapsing membership, sometimes took
months to deliver the mailing labels for this monthly newsletter,
and lost many records. Finally, some volunteers had to put the
list back into our old simple-minded labels program which had no
facility for printing out the list in a format that would be
useable by the members.
Well, that should all be over soon. We have started using a
much more sophisticated and powerful mailing list program in our
business, and ordered a copy for Jack Mogus (who is responsible
for all aspects of membership affairs). This program, Promark,
will allow him to organize the membership list any way we want
and to print it out in any format. Hang in.
August/September, 1988
SURVEILLANCE EXPO '89
As of the time this is written, we do not have a contract
for space nor a contractor to manage the expo. John Nolan is
working on it very hard, and we should have definite information
by the time the next issue goes to press.
COMSEC ASSOCIATION BBS
Ned Holderby has set up a computer bulletin board for the
association. The board has a two-fold mission:
1. a facility for members to exchange information, and
2. a source of information about the association for
potential new members.
Only members will have access to the various conference,
message, and data file areas of the board. For example, we'll be
putting all of the back issues of the ComSec Letter on the board
(with topical information removed) so that all active members can
browse, read, download, or whatever. Members will have full
access and non-members will be limited to reading information
about the association.
Caution! The board will be run and maintained in a
professional and ethical manner. No games. No violations of
copyrights. No foul language. I'm sure you understand and
appreciate.
At the time that this is composed, your editor has not yet
been able to contact the board (Sorry Ned.), but a list of
members is on its way to him so he'll known who to allow onto the
board.
Our BBS number is 716-741-4245. I'll be leaving messages on
the board for members from time to time, and I hope you'll take
advantage of this facility.
LASER BEAM EAVESDROPPING
Kevin Murray has provided us with the results of their
testing of laser beam eavesdropping systems. It is of intense
interest to many, so we'll provide a reasonably complete summary
in this letter. (If you want an original of his report, I'm sure
he'll be pleased to oblige. Write him at Kevin D. Murray
Associates, POB 5004, Clinton, NJ 08809 or call 800-635-0811.)
Here's his report.
Laser Beam Eavesdropping
Summary.
Does it exist? Yes. We designed, built, and tested a complete
working system.
Does it work? Yes. The technique works very well under laboratory
conditions.
Is it a threat? No. Due to operational limitations under field
conditions, we are not reporting this as a threat to the majority
of clients at this time.
Sci-Fi Bugs?
Eavesdrop from afar, merely by pointing at a window. The
idea is alluring to some, horrific to others.
News media reports of just such a bugging device, based on
laser beam technology, have been circulating for some time now. A
litany of claims "...can hear from miles away..." and compound
claims "...through closed windows...", culminates with the coda
"No one is safe." Like the X-Ray vision glasses of comic book
fame, the claims tend to become exaggerated. But, unlike the
concept of X-Ray vision, laser listening can be accomplished with
the right equipment and conditions.
A Century Old Invention.
April 26th, 1880 - Alexander Graham Bell & Sumner Tainter
announce their invention - the Photophone. Sound transmitted on
reflected light rays a distance of 213 meters. They also claim,
"It can transmit songs with great clarity of tone." This is the
forerunner of CD record players, fiber optic telephone
transmission, and remote eavesdropping.
It's Greek to them, Diogenes.
We researched this threat for our clients and heard much
speculation from the pundits, conjecture from dilettantes, and
hyperbole from the media. In most cases, the "experts" had never
even seen a laser bug. They were running on grapevine knowledge.
We Built Our Own.
Using assembly plans available to the general public, we
built a laser receiving system (Radio/Electronics 10/87). For
aiming and safety reasons, a visible laser beam was used in our
tests (Spectra Physics Inc. - 10 mW linear Helium-Neon type).
Additional experiments with: optical processing, and professional
audio processing, were conducted. These results, and allowances
for more sophisticated receiver circuitry, were factored into our
test results.
Physics 101 (Simplified.)
Sound is transmitted by vibration. When you speak, you
vibrate the air. The air, in turn, vibrates everything it
contacts. Certain objects, e.g., windows and mirrors, pick up
vibrations very easily. When a laser light beam hits such an
object, it `vibrates' also as it reflects and continues its trip.
The reflected `vibrating' beam can be received, electronically
processed, and the audio listened to. Under controlled
conditions, high quality audio can be recovered.
Physics 202 (The Real World.)
Bouncing an invisible laser beam off a window, and
attempting to catch the reflection, is a little like playing 3-D
billiards, blindfolded. The fun increases exponentially with
distance from the target.
All sound will vibrate a window. This includes interior
conversations as well as exterior noises (cars, trucks, birds,
etc.) Our audio laboratory processing equipment could attenuate
this effect, to a degree. The rule of thumb seems to be, if the
outside noise is as loud as the conversation, audio processing
techniques are of marginal assistance.
Reflecting a beam off interior objects helps reduce external
sound. The beam, however, loses power with each pane of glass it
passes through. This reduces effective working distances and
increases the number of reflected beams with which one must cope.
Thick glass and thermo-pane glass, as used in office
buildings, do not conduct sound vibrations well.
Air thermals and wind, disrupt laser beams. The greater the
beam length, the greater the disruption. Wind blowing through a
laser beam generates noise similar to the cacophony of 747
engines.
A laser beam (one powerful enough for professional
eavesdropping) is the Neutron Bomb equivalent of a sharp stick in
the eye. Both can blind you, but the laser leaves the eye
standing. Blinding the subject of a surveillance is not the best
way of assuring a continued stream of information while remaining
unnoticed. We used safety goggles during our tests.
"There must be better ways to eavesdrop and spy", I hear you
say. There are.
"Beat the Beam" Countermeasures Course
If you suspect a laser beam eavesdropping attempt is being
made against you, use one of the following techniques:
Hold confidential conversations in a room
without windows. Place a radio against
the window and close the drapes. Install
a white noise generator on the window
pane.
In addition, do not discuss your suspicions in the
sensitive area. Contact an independent information security
consultant for additional assistance. Your problem is more
extensive than you think.
-30-
MORE ON VIRUS PROTECTION
If you think you need protection from infection by a
computer virus, RG Software Systems in Willow Grove, PA
offers
a program entitled, "Disk Watcher V2.0". According
to RG's president, Raymond Glath, the program has been
tested against the Leheigh University virus and "The Brain"
at the University of Delaware.
Please advise if you have any experience with this, or
any other anti-virus programs.
TELEPHONE SYSTEM INHERENT SECURITY
Recently in this letter we stated that a Northern
Telecom SL-1 Meridian phone would be locked out until reset
at the computer after being disconnected from the feed.
Within a week after seeing that bit of advice go out to our
members, we had an opportunity to work on such a system --
in fact, we worked on the system of the telephone person
who had given us that information.
What we discovered in handling the real thing is:
'tain't so. Some of the phones could be reconnected and
were automatically reset. Some would not reset. One member
advises that Northern Telecom Practice states that the M-
2000 series phones must be off line for at least six
seconds before being replugged. Another member advised that
it is necessary to wait at least thirty seconds before
attempting to reconnect. We don't have the total answer,
but we know that what we said last month is not totally
true. We were working on the M-3000 series -- the client
users call the "Darth Vader" phones -- and we could not
determine the pattern for which could be reset and which
could not.
October, 1988
SURVEILLANCE EXPO '89
Well, there will be no annual membership meeting and
expo until late '89. After the disappointment of being
close but not being able to make it during '87 or '88, we
were really counting on getting a show together early in
'89. At the board meeting in July John Nolan of Advance
Security took the ball, and it looked really promising.
Unfortunately, John encountered insurmountable problems and
resigned, so we're starting over -- again. (John, we thank
you for the short time that you were able to serve on the
board, and we wish you well in your other endeavors.)
So where do we stand? At the present time, Jim Ross is
talking to meeting organizers. If we can find one who can
do the job, the organizer and the association will make
some money while putting on an expo that is badly needed by
our members and by many people who have never heard of our
organization. Bringing off a successful expo is extremely
important, and we're determined to do it.
Be advised. Jim Ross may become financially involved
in backing this effort. He's stayed at arm's length to
avoid charges of conflict of interest, but the organization
needs this meeting and whatever it takes will be done.
SENSITIVE INFORMATION, HOLD BACK?
Recently Bob Grove, Editor of Monitoring Times,
editorially raised the question of how sensitive
information should be handled. That's a question that I am
often asked, so let's consider it.
The following material is a direct quote from the
Foreword to Section I of the notebook that I have prepared
for seminar participants, and it should give you a good
idea as to your editor's point of view. As usual, your
comments are encouraged.
"Before getting into the details of electronic
eavesdropping, let's address a very important philosophical
question.
"Much of the material to be covered during this
seminar is considered very sensitive. In fact, there are
some people who maintain that these topics should not be
discussed at all. They complain that, by covering methods
of electronic surveillance, we are 'teaching the bad guys
how to do it'.
"Let us answer that comment with two facts.
1. The bad guys already know what they need to
know to take advantage of the unsuspecting and naive people
of this world.
2. Anyone who studies the basic theory of
electronic communications will have no trouble
understanding everything necessary to tap phones, bug
rooms, etc. It is not complex.
"I believe that strength comes through knowledge, and
the route to knowledge is communication.
"Communication, to be effective, must be open,
straightforward, and complete.
"One principal objective of this course, then, is to
cover the principal points regarding electronic
surveillance because you need to understand those things in
order to protect your privacy."
TWO MORE PHILOSOPHICAL QUESTIONS
As long as we have started down the philosophical
route, let's go an additional step or two. Let's consider
the questions of whether TSCM practitioners should screen
their clients, and whether they should report their
findings to law enforcement.
We can't provide absolute answers, but we can provide
some information on our own operation, and what has been
told to us in the dozen years that we've been leading
seminars.
Let's start with an easy one. We've been told (it has
never happened on any of our jobs) that occasionally the
security director who has contracted for TSCM service will
ask that the contractor "find" something. (The idea is that
if a dead radio transmitter is "found", he'll become a hero
for ordering the service. And, of course, the TSCM service
firm will become richer because it will be necessary to
frequently return for additional work and maybe even do
some of the other divisions of the company, etc.) The
answer to that request is easy; it's "No!".
However, suppose that you are asked to work for a
company that has been in the press because of being forced
to sign consent decrees, etc? Suppose that you have certain
evidence that your client is under investigation by law
enforcement? What do you do then?
I can't tell you what to do, but I can tell you what
we do in my company, and I can tell you the consensus of
many discussions with many people in law enforcement and in
TSCM.
In my company we will not hide evidence of a crime or
participate in any activity which could be remotely
considered obstruction of justice.
However, we have worked for at least one company with
a reputation for questionable business practices, and we
have worked for clients who are under investigation.
The preceding two paragraphs may sound contradictory,
but let's think about it. Does the fact that a company is
under investigation mean that it is not entitled to seek
professional help? After a lot of discussion with many
seminar participants, we don't think that a person loses
any rights by virtue of being under investigation.
What do you think?
On the question of reporting our findings to law
enforcement, let me make two points.
First, this world that we live in is not like
Hollywood. All loose ends are not tied up at the end of the
job as they are at the end of the TV episode. Communication
is not instantaneous and complete. Our conclusions are
based on a lot of factors, and it is rare that we could
present an absolute, no-question-about-it conclusion to any
law enforcement agency.
Second, to whom do we report what? During the recent
ASIS show in Boston, a visitor to the booth seemed shocked
when we said that reporting findings to law enforcement was
not required, expected, or done. He seemed to be of the
opinion that we should use our time to report crimes to
"the authorities". As he left the booth I realized that the
picture essay displayed behind me would have been a very
good case in point. We discovered a tap on the mayor's
telephone which may or may not have been indicative that a
crime had been committed. However, we would have been hard
pressed if we had had to report it to law enforcement
because there was good reason to believe that the tap was
not court-authorized and had been placed by one or more
members of the police department!
VULNERABILITIES (continued from an earlier issue)
In a recent issue of this letter we outlined some of
the current vulnerabilities that we see in our professional
practice of commercial technical surveillance
countermeasures. Let's cover one which we think is very
dangerous -- one that we've been warning clients about for
years: the private line telephone, installed for
"security".
How many times have you seen the CEO order a separate
telephone line that does not go through the PBX? He thinks
he's protecting himself from eavesdropping, but what he's
really doing is making it very easy to identify the
appropriate pair to tap. It's like hanging a sign on the
pair, "TAP HERE!". We saw this in a now famous company
(Wedtech) a couple of years ago, and we continue to see it.
The latest example was on a "Hello" telephone in a
government contractor's office. The phone was installed
because there was so much sensitive information to be
discussed, and it's called the "Hello" phone because that's
the way it is answered -- in case somebody is listening.
One further thought on private line telephones. I've
been telling people in the seminar for years that the best
way to tap a phone is to call the phone company and order
an extension. Of course, a private line phone is an ideal
target for this kind of tap. (Recently, a man who had
attended the seminar, approached me and asked, "Do you
remember what you said is the best way to tap a phone?" I
said I remembered, and he smiled and said, "Well, it
works!") It will not be successful every time, but, of all
of the businesses in this world that must take orders by
phone, the phone companies are at the top of the list.
If you think that you're safe because the number is
not listed, or not published, or in any other way
protected, you just don't appreciate the nature of free
enterprise. ALL of those numbers are available. There are
people in this country who can get the information for you.
For example, I noticed on a recent trip to New York City
that there was a light on early in the morning at the old
address of a man who had stolen a lot of money from our
company. So I called one of the information providers, gave
him the address, and I had a full listing of everyone with
telephone service at that address back in less than 24
hours. So, if you or the CEO have had a private line
installed, think again. The single line phone is very
vulnerable. If you have a good size operation, think
seriously about a more secure installation such as the
Northern Telecom SL-1 that we wrote about recently.
COMING SOON
Richard Paradis sent us a copy of a product
announcement that was carried in, of all things, IEEE
SPECTRUM. (That's the magazine that goes to all members of
the Institute of Electrical and Electronics Engineers.) The
headline was "A double whammy for eavesdroppers", and the
notice touted a product that will advise you when your
phone is tapped. Rich asked if we'd care to comment on this
item for the benefit of the membership, and in a future
issue we'll reprint the letter that we sent to the SPECTRUM
editor.
Another member, Bill Ranson, sent us information on
some of his activities and some interesting data sheets.
Again, we'll have to wait till a future issue to cover
these fascinating submissions due to lack of space.
Last, but certainly not least, Leo Hurley of Exxon
provided us with excerpts from an article in Security
Management (the one published by the National Foreman's
Institute, not the one published by ASIS). In an article
entitled "Sizing up Sweepers" Sam Daskam is quoted
extensively, and Leo asked how I react to the quoted
material. Well, Sam has many, many years of experience in
this business and certainly should know whereof he speaks.
(Of course, Sam worked for Mason for 15 or 16 years before
starting his present business, so he is probably heavily
oriented toward government-to-government threats.) However,
if he is quoted accurately, I'm shocked, and I'll explain
why in a future issue.
November, 1988
SURVEILLANCE EXPO '89
As we reported in the last letter, the expo that we
were planning for February is off. The earliest that we can
hope for is the fall of '89. If you are interested in
participating in any way, please contact Jim Ross.
TELE-PRIVACY GUARD
Richard Paradis sent along a copy of a notice in, of
all things, IEEE SPECTRUM, one of the publications that
goes to all members of The Institute of Electrical and
Electronics Engineers. The notice that caught his eye was
headlined "A Double Whammy for Eavesdroppers", and Rich
wrote to ask if I would comment on this for the members of
the ComSec Association.
Thanks Rich, and the text of the letter which I had
already mailed to the editor of SPECTRUM follows. (By the
way, they have never responded in any way. I wonder if that
is because they are looking for an engineer to check my
comments for accuracy, or because they were embarrassed
and consigned the letter to file 13 without any
consideration of its merit.) (I really think IEEE should
ensure that technical information mailed to members is
correct, and I wonder how I can influence them to hire some
engineers. Maybe I'll send a marked copy of this issue to
the president of the IEEE; that should get some response.)
(Note. The following letter was sent by
Jim Ross on Ross Engineering, Inc.
letterhead to the editor of IEEE SPECTRUM
on June 6, 1988.
Dear Mr. Christianson:
This relates to your editorial "About Professionalism", and
the segment in the same issue (June) entitled "A Double Whammy
for Eavesdroppers".
First, let me express a thought regarding the definition of
professionalism. In the simplest sense, I think a professional is
someone who is paid to do something that others might do for
nothing. For example, a cab driver is a professional, and one
would expect that he would be a more proficient driver than you
or I. That's certainly not always true, but it remains a
reasonable expectation.
So let's move along to writing. Those of us who write
professionally, in general, should be better at the craft than
others. I think that professional writers should be especially
careful about how they use words, their basic, elemental tools
for communicating with their audience.
Ah yes, the audience. If the professional writer's audience
is, let's say, a group of engineers, isn't it reasonable to
expect that the words used to communicate with them will be the
technical terms that have precise meanings in their specialty,
and that the information will be technically correct?
Now that I have gone through all of that preamble, let me
get to the reason for this letter.
The technical content of SPECTRUM is usually so good that I
was astounded to read the segment regarding eavesdroppers. It is
so wrong, so confusing, so muddled, and so badly worded that its
author and all of the editors at SPECTRUM should be blushing
until you have atoned for this muddled miasma.
(This current piece of misinformation follows close on the
heels of an article in the April issue in which you assert "for a
mere $49" you can buy a device that will "detect small changes in
line impedance" and notify the user of a telephone line tap.)
Let me be agonizingly specific -- and your audience is
electrical engineers so we'll use engineering terms. In analyzing
"Eavesdroppers' Whammy" I'm going to quote specific sentences out
of what you presented, and comment on each one.
Quote #1
"About $50 buys you any of several commercial devices said
to prevent a tap or unauthorized person from listening in on your
telephone calls."
Comment #1
This sentence is correct, but you must pay careful
attention to the words "said to prevent a tap". Many people offer
equipment that they say will detect taps on phone lines.
The kind of people who sell such devices are the same kind
of people who sell nostrums to grow hair on bald heads, and diet
pills that melt away the fat. None of them will detect even a
simple tap made out of $2.00 worth of parts (at retail).
By the way, there are also tap detectors sold for as much as
$62,500.00 which also cannot detect the $2.00 tap.
Quote #2
"This kind of device usually drops the phone's 50 volt on-
hook voltage to about 18 volts instead of the normal 12-15 V
whenever you lift the receiver."
Comment #2
All wrong, except that the usual on-hook voltage in this
country is 50 V. (Although there are many PBXs (private
exchanges) that operate on different on-hook voltages.)
First, you say that off-hook voltage is normally 12-15 V.
Well, on hundreds of real telephone systems I have measured off-
hook voltage as low as 2 V and as high as 30 V. The most common
is about 8 V, but there is no norm that can be counted on.
Second, you assert that when I tap the phone line, it will
cause the off-hook voltage to increase by about 50%. Wow!
When I tap the phone line, you'll see no change in either
on-hook or off-hook voltage. My tapping equipment (all $2.00
worth) does not affect the line in any way that can be detected
electronically. There is no measurable change in line voltage
because I am not loading the line at all.
As a matter of fact, we have even run tap-detection tests
with a time domain reflectometer (TDR). The engineers and
technicians who participated in the tests were very experienced
with the TDR, and they were never able to tell when my tap was
on-line or off-line.
Quote #3
"As a result, the impedances of your phone and the tap
should not match and your phone should go dead."
Comment #3
Huh?
Look. The standard telephone presents almost pure resistance
to the line. It is, after all, operating in a DC circuit ---
just direct current running through it while it's in operation.
That resistance is on the order of 600 to 900 ohms in most old
sets. My tap, on the other hand, uses a blocking capacitor so
that the impedance seen by the DC circuit has essentially
infinite magnitude.
While in operation, the old-fashioned (carbon microphone)
telephone voltage varies by one or two volts -- sometimes more.
My tap will be taking picowatts of power off of the phone line
and will not cause the DC voltage to vary by even one one
thousandth of a volt.
Your assertion that my tap will cause the off-hook voltage
to be unusually high makes no sense whatsoever.
Nor does your declaration that if the tap impedance and
phone impedance don't match, the phone will go dead. When I tap a
phone line, I am deliberately creating the biggest impedance
mismatch possible -- and, believe me, the phone doesn't go dead.
Final Comment
The SCR device described will prevent someone from listening
on an extension phone, but there have been similar devices sold
for many years for a few dollars. The sellers of the earlier
devices never made any money for a simple reason. When an
extension telephone goes off hook, there is a discernable
difference in sound level (about 3 dB or half power), so why
would anyone pay for a circuit to do what your own senses do for
you?
Sincerely,
James A. Ross
President
P.S. By the way, technical surveillance countermeasures (TSCM) is
our business. If you ever need consultation (a limited amount
free) in this field, please call. We'll try to help you sort the
wheat from the chaff in the press releases that you receive in
this very specialized field.
(Quoted above is the entire text of the
letter that your editor sent to the
editor of IEEE SPECTRUM. If there is EVER
any response, you'll be advised.)
AT&T TRAINING PROGRAMS
Just received: AT&T catalogs of training programs. For
copies, or to inquire about training schedules, call 800-554-
6400.
COMMUNICATIONS HANDBOOKS AND PUBLICATIONS
Here's another good source of good information. For a
listing of available handbooks and other publications, contact
either Chuck Firnsin (312-681-7483) or R.L. Grabo (312-681-7479)
at: GTE Communications Systems Corp., 400 North Wolf Rd.,
Northlake, IL 60164 When you write or call, please mention the
ComSec Letter.
December, 1988
DISA
In case you didn't appreciate the message in our April
issue, I'll try again:
If your switch offers DISA (Direct
Inward System Access), you are in
jeopardy! You may soon join the ranks of
companies that have been ripped off.
Do not jump to the conclusion that
I'm warning that some hackers might make
some long distance calls on your lines.
Yes, hackers are a nettlesome
problem. When they discover a DISA route
(They call them "extenders" so it doesn't
sound like stealing.), they pass the word
around and your phone bill will suffer.
Yes, they can run up your phone bill, and
you'll have to pay it.
However, the people I am referring
to are organized, and they are probably
drug dealers, and they make a lot of
calls.
As I write this I am looking at a printout of calls made
through one company's DISA capability: 27 pages with 51 entries
per page. In eight days $51,624.36 worth of calls were made on
four trunks to numbers in Pakistan.
I repeat: in eight days $51,624.36 worth of overseas calls
were made through this company's DISA facility. The people at
this company were smart; they detected the theft rapidly, and put
a stop to it rapidly. If they had learned of the abuse only after
receiving the bill, it could have been a quarter of a million
dollars!
If your switch offers DISA, you are in jeopardy! In our next
issue we'll include more detail on this situation. Stay tuned!
NYQUIST vs. NYQUIL
Most folks have heard of Nyquil, but, sniffling and sneezing
bears little relationship to TSCM. Nyquist, on the other hand, is
important in modern communications; and, if you haven't heard of
it, here's your introduction to the Nyquist Criterion. It relates
to the conversion of analog signals to digital, with an eye
toward later reconstructing (D to A) a replica of the original
signal.
As usual with history questions, I don't remember the man's
full name, or country, or when he lived. However, I do remember
his premise: the Nyquist Criterion (widely used but unproved
mathematically, I believe) states that, in sampling an analog
signal in the time domain, one should use a sampling rate of at
least two times the highest frequency in the signal in order to
prevent aliasing. For example, if the highest frequency is 1,000
Hz, it should be sampled more that 2,000 times per second.
Before explaining what that means in practical terms, let me
point out that the terminology definitely proves that engineers
and/or mathematicians can invent crazy words as do the
bureaucrats. (The other day I heard a bureaucrat say that
airlines reduce fares on some routes to "incentify" customers to
use those routes. Wow!)
"Aliasing" is a word that was coined to describe what
happens when an analog signal has been sampled at too low a rate,
and the A-to-D and D-to-A process has rebuilt a signal that is
unlike the original signal, an "alias" of the original.
The Nyquist Criterion, then, is important when designing a
modern telephone which has digital output to the switch. If the
sampling rate is too low, the reconstructed analog signal out of
the switch will be a very distorted version of the original
signal.
TSCM EQUIPMENT
Recently, a retired government TSCM expert stated that it
costs about two hundred and fifty thousand dollars to equip one
TSCM team. Now that Watkins-Johnson has introduced their WJ-38000
ELINT receiver, that number will probably climb to about one
million because this receiver alone can cost more than
$500,000.00.
All kidding aside, this is a serious matter and one that we
intend to cover in detail in future issues of this letter. For
the sake of brevity at this time, let's just note that your
editor does not agree that such expenditures are necessary.
Certainly there are some government-to-government threats that
are very high level and deserve high level responses, but there
is no way to justify spending that much money for equipment to
equip every team. After all, most work by most teams most of the
time will address the standard, real-world threat. More later.
NEW WORD NEEDED
Because of the work we've been doing lately to identify the
vulnerabilities in modern electronic PBXs, we've been talking
with a lot of folks who also don't speak "telephonese". Out of
necessity we've been using the word "switch" when referring to
such PBXs. Unfortunately, when most folks hear that word, in
their mind's eye they see the switch on the wall that we throw to
turn the lights on. Confusing.
So let's start a movement to invent a better word. After
all, aren't people who work in engineering supposed to be
precise? Let us hear from you!
PULSE THROUGH A LOADING COIL?
This was a question asked by Joe Wilson Elliott during one
of our telephone conversations. I don't think I ever answered
him, but it deserves to be answered because it illustrates the
fact that different educational and training courses teach
different "facts".
Anyway, can you get a pulse through a loading coil? What do
you think? If anyone expresses interest, we'll answer the
question in a future letter.
JUMPING TO (DANGEROUS) CONCLUSIONS
Regarding spousal tape recording of telephone conversations
without consent, we reported in January: "A federal judge did
rule that federal eavesdropping laws (Title III, 18 USC 2510,
etc.) do not relate to domestic cases in certain circumstances."
2600, in its fall issue jumps from this fact to the
erroneous conclusion, ".... it is now legal for married couples
to place wiretaps on their home telephones in order to catch
their spouses doing nasty things like having affairs." We hope
the readers of this letter understand the difference between the
two statements. The ruling only said that certain specific
federal laws do not apply in certain circumstances. It did not
say that such eavesdropping is legal. There's a big difference.
RF FLOODING
One of the comments that we got on our questionnaire after
our London seminar indicated that the person wanted information
on "modern techniques such as RF flooding". How nice it would
have been if that person had read our material which pleads for
any question at any time, or listened to any of our exhortations:
"If you have a question, ask it at any time." If he had asked the
question in front of the group, we would have had an interesting
topic to discuss. We had people with exceptionally diverse
backgrounds. A discussion would have provided more than one point
of view, and that's the value of the seminar format. It's not the
authoritarian headmaster lecturing to a group of cowed students;
it's open give and take among experienced, senior people.
Well, I'm very sorry that he did not speak up. If he had, I
could have pointed out to him that RF flooding is probably fifty
years old. Also, I could have mentioned that we had been covering
some techniques which have come into use in 1988. That's right,
we were discussing truly modern methods such as electronic switch
manipulation, REMOBS, bugging of modern electronic phones, etc.
Thrown in for good measure were some comments on how companies
are being robbed (through toll fraud on a major scale) by people
taking advantage of DISA, voice mailboxes, diverters, etc.
And he wanted to discuss modern methods such as RF flooding!
In any event, I'll explain what I think is meant by "RF
flooding", with the hope that a reader will either endorse my
theory, or explain how I went wrong. Before I go on, let me
explain that I am guessing at what is meant by RF flooding. In
all of the courses that I have taken in math and electronics,
"flooding" is a term that was never used in any class or
practical exercise. I have the feeling that it was invented by a
technician whose field strength meter told him that the telephone
was full of RF, so much so that it was flooding out of it and all
over the floor. (Doesn't that make you wonder if you should wear
boots while doing TSCM?)
As you read this, keep in mind that I have never been
exposed to any government training in countermeasures, and this
explanation is based only on my response to the name given to the
technique.
So here goes. The older electromechanical telephones contain
a hookswitch which is really several switches in one assembly.
Each conductor is connected to a flexible metal strip, and all of
the strips are physically parallel and very close together. On
hook, some connections are made, and some are open. Off hook,
other combinations occur. In the on-hook condition the talk
circuitry (carbon microphone, speaker, and side-tone transformer)
are disconnected from the line in the DC sense. That is, no
direct current is possible in the circuit because the circuit is
open. However, what causes the circuit to be open is the fact
that two flat metal strips, side by side, are not touching.
Does that sound familiar? Two conductors separated by a
dielectric? Of course. That's the definition of a capacitor. And
although a capacitor may be an open circuit for DC, it sure isn't
open for RF. In fact, it is nearly a perfect conductor.
So my guess is that somebody fifty (or so) years ago figured
out that he could connect to the talk circuit by applying RF to
the talk pair. I've never tried it, and don't know anyone who
has, but the theory is sound. Although the audio recovered is
probably not good, and it certainly is easy to detect.
Well, there's my answer. If I'm way off base (or even a
little off) I'd like to hear from anyone who can set me straight.
I'll run the best answer that comes in. How 'bout it???
