Re: shipment interdiction [was: BadBIOS forensics]
On Sat, Jul 19, 2014 at 5:20 PM, Bryan Starbuck <bryan@thestarbucks.com> wrote:
I like buying a computer in a surprise visit to an apple store or a store that sells windows computers.
agreed; on site ad-hoc cash purchases the best procurement technique. not infallible by any means, but at least avoids some known problems like this amusing scenario. (shipments from the Seattle Amazon warehouse to Kansas before delivery to Oregon was also funny.) repeat for emphasis: - keep chain of custody of sensitive hardware at all times - never procure or ship through mail. at one point, priority same day air would get a pass, but even this no longer suitable. best regards,
If you don’t mind saying, can you say if you are a US citizen? (Probably) Do you work on an open source project like TOR? Do you think they do that because you do development? I’d love if we build a profile of who they actively perform hardware attacks on. They likely repeat this on categories of people (TOR devs, employees at CAs, etc.). Even if you can give a vague category (crypto-currency vs open source file system encryption, etc.) That one lady on twitter was a TOR dev. I’d love us to deduce as many patterns as possible, so those people can be incredibly diligent. Best, -Bryan Bryan Starbuck | Bryan@TheStarbucks.com On Jul 19, 2014, at 5:25 PM, coderman <coderman@gmail.com> wrote:
On Sat, Jul 19, 2014 at 5:20 PM, Bryan Starbuck <bryan@thestarbucks.com> wrote:
I like buying a computer in a surprise visit to an apple store or a store that sells windows computers.
agreed; on site ad-hoc cash purchases the best procurement technique. not infallible by any means, but at least avoids some known problems like this amusing scenario.
(shipments from the Seattle Amazon warehouse to Kansas before delivery to Oregon was also funny.)
repeat for emphasis: - keep chain of custody of sensitive hardware at all times - never procure or ship through mail. at one point, priority same day air would get a pass, but even this no longer suitable.
best regards,
On Sat, Jul 19, 2014 at 6:42 PM, Bryan Starbuck <bryan@thestarbucks.com> wrote:
... I’d love us to deduce as many patterns as possible, so those people can be incredibly diligent.
yes i am a citizen, and as for those at risk of scrutiny (shipments, border crossings, etc.) any of the following activities has been demonstrated to put you under scrutiny: - developing privacy enhancing technologies - administering high value networks or computer systems - documentaries and journalism adversarial to some big business or government - cryptology of any form - technical surveillance and operational security interests - hobbyists in domains including drones, rockets, airplanes - information security and network security professionals - running cryptome.org - many, many, more. it most cases, it seems that drawing attention to attempts to intimidate diminishes or ceases the intrusions. as for deducing patterns, perhaps the useful metric would be a trend up or down. best regards,
Bryan Starbuck, I apologize for the delay in anwering your question. Your suggestion of keeping profiles is excellent. You are probably familiar with nonprofits being surveilled, harassed and hacked by former NSA trained hackers. “We know this company has subcontracted with a company called NetSafe, which is a company of former NSA officials skilled in hacking and things like that,” says Greenpeace researcher Charlie Cray, referring to a case in which Greenpeace has filed a lawsuit against Dow Chemical for its alleged spying activities." http://venturebeat.com/2013/11/25/wal-mart-coca-cola-mcdonalds-spying-on-non... Before the above article was written, I wrote a discussion thread on this. Readers are reluctant to concede that abusers hire private investigators who hire hackers. http://www.reddit.com/r/privacy/comments/23ljti/private_investigators_hire_n... Yes, you are correct I am an USA citizen. I was a plaintiff in a ten year long lawsuit. It is common practice for defense law firms to retain private investigators. Private investigators surveil and harass plaintiffs. In prior years, private investigators would hire apprentices to break in, steal documents and return documents. Former law enforcement are qualified to obtain a private investigator license. Those without law enforcement background are required to work for a private investigator as an apprentice for private investigators a minimum of two years to qualify for a state license. Hiring apprentices is a huge profit maker. Private investigators require retainer fees paid in advance. Their retainer agreement, if offered, do not itemize apprentice fees, and do not promise itemized invoices. PIs charge their hourly rate but have apprentices, with little or no training, perform the work. This is somewhat equivalent to law firms charging attorney fees for work paralegals perform. "Licensing requirements for private investigators vary from state to state. In some they are required to be licensed at the municipal level. In others they need a permit in order to carry a firearm. According to the Bureau of Labor Statistics, no licenses specifically sanctioning computer-forensics investigation exist, although some states require this type of investigator to obtain a PI license. A number of states don't require licenses for private investigators at all." http://projects.aljazeera.com/2013/pi/ Why would states even consider requiring a PI license for computer forensics investigation? Why not just a computer science degree? States do not have any educational requirements for licensing PIs. A high school drop out without any computer science classes can be licensed for computer forensics investigation merely by apprenticing for two years. Computer experience is not required during the two year apprenticeship. Obviously, private investigators lobbied states to require a PI license for computer forensics. Is a PI license for computer forensics a cover to conceal their hacking? Defense firms would list the stolen and replaced documents in a Request for Production of Documents. Thereby, the produced documents could be introduced as evidence. In these high tech times,private investigators hire black hat hackers who are adept at picking locks, gaining physical access to computers and external hard drives and disassemblying, implanting and infecting computers. Hackers hack plaintiffs' computers and smartphones in real time. Also plaintiffs' families and other contacts' computers and smartphones. Hackers actively impede plaintiffs from working on litigation and working on everything else. There is a huge cover up of private investigators' conduct. They have an active lobby. They lobbied for exemption of any statutes limiting drones. http://nypost.com/2014/07/13/private-eyes-using-drones-to-nab-scammers-cheat... "National Council of Investigation and Security Services (NCISS), an association of PIs and security guards that monitors privacy-related laws and promotes ethical conduct within its industry, go to Capitol Hill every year to lobby Congress, ensuring that it does not inadvertently restrict access to data or equipment." http://projects.aljazeera.com/2013/pi/ http://www.nciss.org/legislation/latest-legislation.php The federal government, who hires private investigator firms to develop social media sock puppets, protected them. My case is atypical. It was not the defendant's law firm that hired private investigators. The defendant himself hired private investigators who hired hackers. Who he hired are top notch professionals. The type that law firms would hire and refer to other law firms and defendants. The defendant acted on very good referrals. Update including two case numbers on interdiction of MIPS tablet is at: http://www.reddit.com/r/Android/comments/2dq9vw/fedex_makes_interdiction_of_... On 07/19/2014 9:42 pm, Bryan Starbuck wrote:
If you don’t mind saying, can you say if you are a US citizen? (Probably)
Do you work on an open source project like TOR? Do you think they do that because you do development?
I’d love if we build a profile of who they actively perform hardware attacks on. They likely repeat this on categories of people (TOR devs, employees at CAs, etc.). Even if you can give a vague category (crypto-currency vs open source file system encryption, etc.)
That one lady on twitter was a TOR dev.
I’d love us to deduce as many patterns as possible, so those people can be incredibly diligent.
Best, -Bryanest regards,
participants (3)
-
bluelotus@openmailbox.org
-
Bryan Starbuck
-
coderman