Menu
Navigation

Global articles on espionage, spying, bugs, and other interesting topics.

Keep abreast of the espionage threats facing your organisation.

Control your speaking volume at the coffee shop

While in a local coffee shop waiting to meet a friend recently, a group of people nearby was engaged in a conversation. Now I don’t make it a habit to eavesdrop, but they were so loud you couldn’t help overhearing them. And they clearly weren’t overly concerned that virtually everyone inside was within earshot.

I was especially interested because their conversation was financial in nature. Frankly, it took all my willpower to sit still and keep my mouth shut.

 Their conversation reminded me that too many people are simply not paying attention to financial details the way I believe they should. In other words, when it comes to financial matters, it’s important that you pay attention to more than just the large print.

 One animated gentleman complained that taxes must have been increased in 2010 because his refund was going to be much smaller this year than last year. I obviously didn’t know his personal tax information, but my guess is that he totally forgot what happened to payroll withholdings earlier in 2010.

 They were adjusted lower in an attempt to get dollars into consumers’ hands sooner, with the hopes that additional dollars in the pocketbook would help jumpstart the economy.

 Other than that and the Roth IRA conversion option, the income tax code had no real significant changes last year. I have a feeling a lot of people will be surprised when their tax refund this year is smaller than in years past.  More than likely, the reason is they took more money home every pay period.

 Automobile leasing was the other financial topic discussed. I was alarmed at the lack of understanding about how it works. Everyone wants our auto industry to thrive, but I think you need to understand all terms and responsibilities, whether you buy or lease.        

 Because leasing is generally more complex than buying and because it’s estimated that nearly 20 percent of new autos driven off the lot this year will be leases, it’s especially important to understand leasing terms.

 The good news is that financing is beginning to loosen up. But that doesn’t mean you should run out and get it just because you can.

 In the coffee shop, the patrons were describing leases as purchases that ended on a predetermined date. In reality, leasing is simply renting a car for a specified period of time, with certain limitations.

 For example, a vehicle may be advertised as $199 for 36 months. But as anyone who has ever leased a car knows, there are penalties for things like damage and excess mileage.

 In the past, many lease prices were based on 12,000 miles per year. These days, many of them are based on 10,500 miles per year.

So, what does it matter? Well, typically, there’s a 15 cents per mile charge for excess mileage.

 If you drove 12,000 miles a year for 3 years, there would be 4,500 excess miles. At 15 cents per mile, you’d be charged an extra $675 at the end of the lease. That’s why understanding all the terms and conditions is so critical.

 So in the future, control your speaking volume at the coffee shop or any public place. And make a commitment to be smart about your finances. That means carefully scrutinize all the fine print and details.

Fax your questions to Ken Morris at 248-952-1848 or e-mail to ken [dot] morris [at] investfinancial [dot] com.  Ken is a registered representative of INVEST Financial, member FINRA, SIPC and is Vice-President of the Society for Lifetime Planning in Troy.

  • Return to Paging Mode

Is VoIP too secure?

It’s hard to imagine, but roughly 10 years ago as VoIP was being rolled out corporate networkers were quite concerned about the security of VoIP. As we faced a move from voice going over a traditional (and, by the way, unencrypted) network, there was concern
that VoIP would be much too easy to eavesdrop on – especially if it traversed the Internet.

We’ll leave the question of whether “legal intercepts” as a political and civil liberty question. Indeed, virtually any “good” technology can also have a dark side. Nevertheless,
“wiretaps” have been a part of voice communications essentially forever. Sometimes for the good of all. Sometimes not.

And “tapping” a traditional voice call, whether in analog or digital (PCM) format is trivial. Additionally, as discussed in
an excellent interview, “Web Wiretaps Raise Security, Privacy Concerns” on All Things Considered, as cellular technology was rolled out, there were provisions made for “lawful intercept.”

The issue that was discussed by FBI General Counsel Valerie Caproni is that with VoIP solutions – and Web-based VoIP in particular
– the individual conversations can be quite difficult to intercept and decode. Further, while at one time Internet-based voice
conversations were largely limited to “major” applications like Skype, there is rapid and widespread proliferation of “voice chat” capabilities. For instance, you can do a voice chat,
a video chat, or even call an external phone from Gmail. And this only covers voice-like capabilities, and doesn’t include
other messaging.

Interestingly, and in a move that makes sense, the government is not specifying exactly which services need to be modified
so that they can be more easily modified. As pointed out in the above-referenced interview, if the systems that were difficult
to monitor were identified, then this would make it obvious which ones could be best used for less-than-honorable purposes.

The implications for this for the corporate enterprise network are yet to be identified since we’re just on the leading edge
of the issue. But it is clear that we’ve come a long way from the days when VoIP was a “toy.” And the fact that it’s “just
another application” is making the task of lawful intercept even more difficult.

Read more about lans wans in Network World’s LANs WANs section.

Steve Taylor is president of Distributed Networking Associates and publisher/editor-in-chief of Webtorials. Jim Metzler is vice president of Ashton, Metzler Associates.


Corporate espionage on the rise in Ohio

CLEVELAND – The threat of foreign espionage seemingly disappeared with the Cold War. But there is a new spy game in town.

“Now you’re talking about economic espionage and that is one of the biggest threats to national security that we have,” said Brad Beman, head of the counter intelligence unit for the Cleveland branch of the FBI.

Beman warns that today’s spies are just as interested in the office computer as government secrets.

“Other countries that are not necessarily friendly to the United States are gaining out technology and gaining an edge potentially over us,” Beman said.

Some of the most dangerous spies don’t work for foreign governments, but for local companies. Employees motivated by revenge, money or patriotism are betraying company secrets, according to the FBI.

At Lubrizol in Brecksville, a disgruntled employee, Kyung Kim, sold trade secrets to a competitor in his native South Korea two years ago in exchange for hundreds of thousands of dollars.

Another South Korean native, Kue Sang Chun, a former researcher at NASA Glenn, has admitted to using his credentials to acquire high tech infrared technology for another company to send to a company in his homeland.

Eric Vanderburg, an expert in information security at JurInnov, a Cleveland company that investigates corporate espionage, said theft of trade secrets is a more significant in Cleveland than most realize and happens more often than companies care to admit. Some foreign and domestic companies looking for an edge over the competition hire social engineers.

“A social engineer is a person who’s going to use persuasion to get you to divulge information or perform some action for them,” Vanderburg said.

Social engineers scour the Internet looking for someone to manipulate or even blackmail into divulging company secrets, making the coworker in the next cubicle or the neighbor next door a spy. But local companies aren’t the only targets of economic espionage.

“A lot of our research’s conducted at the university level and it’s unclassified research, which means that it’s much less protected and it’s easier for people to get access to it,” Beman said.

Copyright 2011 Scripps Media, Inc. All rights reserved. This material may not be published, broadcast, rewritten, or redistributed.


Insider Trading Hurts: McKinsey Survives But Target Companies Suffer

Goldman Sachs New World Headquarters

Image via Wikipedia

No Big 4 audit firms or their partners have been named in the insider trading scandal surrounding the now-defunct hedge fund Galleon Management. But the SEC has accused one of the most prominent businessmen ever implicated in such crimes, Rajat Gupta, a former McKinsey Company Global Managing Director.

Monadnock Research: Gupta is alleged to have tipped Galleon’s Rajaratnam, a friend and business associate, providing him with confidential information learned during board calls and in other aspects of his duties on the Goldman and PG boards. Gupta reportedly made calls to Rajaratnam “within seconds” of leaving board sessions where market-moving information was discussed.

The complaint alleges that Rajaratnam then either used the inside information on Goldman and PG to execute trades on behalf of some of Galleon’s hedge funds, or shared it with others at Galleon, who then traded on it ahead of public disclosure. The SEC claims the insider trading scheme generated more than $18 million in a combination of illicit profits and loss avoidance.

Gupta, as a McKinsey veteran, embodied the “trusted advisor” consulting ethos and personified the McKinsey “advisor to CEOs” business strategy and brand. The firm’s value to its clients and its effectiveness as an advisor requires knowing their secrets and holding them close to the vest.

Several media commentators have openly wondered whether the accusations against Gupta and earlier accusations in the same scandal against McKinsey senior partner and Gupta protégé Anil Kumar, strike a deadly blow to McKinsey.

Will Rajat Gupta Destroy McKinsey? John Carney, NetNet, March 2, 2011

If the charges against Gupta prove true, it could be a mortal threat to the firm. Even if there’s no evidence that confidentiality was breached while Gupta was at the firm, being led by a man who would later leak insider information would be devastating. If Gupta is shown to have engaged in similar actions while he was at McKinsey, that could be the end for the Firm.

“At that point, I think we go the way of Arthur Anderson,” another former McKinsey consultant said, referring to the once-prestigious accounting company brought down by its connections to Enron.

Loose Lips, Reuters BreakingViews, Robert Cyran and Rob Cox, March 3, 2011

According to McKinsey, “Our clients should never doubt that we will treat any information they give us with absolute discretion.” The allegations against Gupta make it hard for clients not to wonder.

In my opinion, extrapolating Gupta’s behavior to McKinsey as a whole is a stretch. I’m no McKinsey apologist but one man, even a former Global Managing Director, does not make the firm.

On the contrary. The firm made him and he’s the one whose currency is now worth less.

It’s understandable that, in the heat of this moment, some might naïvely compare the consequences of the criminal indictment of an audit firm with civil charges against an individual, albeit one who trades on his association with a prestigious professional services firm.

Reuters’ Westlaw Business has a detailed story about the reputational risk to both inside traders’ firms and the companies they target.

Being an insider with a fiduciary duty sure is risky, as heavyweight Rajat Gupta is now finding out amidst serious SEC charges. So is having board members, as Goldman Sachs and Procter and Gamble are now worrying. Of great concern to each are the reputational risks and attendant costs that this might impose on them.

One thing this story gets slightly wrong is the fiduciary duty of a director. Directors have a duty only to the corporation. That might change some directors’ views of where their bread is buttered. Did Gupta think that if he spread the love around enough, everyone would be happy?

Monadnock Research’s Mark O’Connor cites an interview with Gupta in May 2001 by Wharton Professor Jitendra Singh. [i] In it, Gupta gives some advice to those just starting their careers:

Gupta: …The second piece of advice I’d give is that I think it is vitally important to make other people successful. If you have a mindset of always trying to make other people successful, they will in turn make you more successful that you ever dreamed-of. So, I really believe that it’s not about getting ahead at the expense of others, it is getting ahead because lots and lots of people are helping you achieve it.

When the Big 4 audit firms are hit with insider trading scandals – and there have been some whoppers recently – they manage reputational risk in two ways:

  1. They ignore reports in the media, giving either no comment or minimal comments that distance them from the accused.
  2. They do everything possible to repair relationships with clients, including paying them off.

A Deloitte active-duty Vice Chairman, Thomas Flanagan, was accused and settled with the SEC this past summer over insider trading charges related to several Fortune 500 companies. Auditors have a public duty to shareholders and a legal obligation under federal securities laws to maintain engagement confidentiality, in addition to their contractual obligation to do so. And yet the Flanagan story captured only momentary media attention and no one claimed Deloitte was going down as a result.

In fact, the SEC never even charged Deloitte. How does an audit firm Vice Chairman “dupe” his fellow partners and professional colleagues more than three hundred times, as Deloitte’s lawsuit against Flanagan alleged?

The SEC gave Deloitte credit for software, manuals, and controls that may have been designed effectively, but those controls surely did not, in the Flanagan case and the hundreds of other examples of non-compliance cited by the PCAOB, operate effectively. Deloitte did not discover Flanagan’s sins. According to the Financial Times, FINRA discovered the abnormalities in activity via normal market monitoring activities during Walgreen’s acquisition of Option Care.

Deloitte’s audit clients – Walgreens, Best Buy, Sears Holdings and others – received calls from the SEC. Then the SEC and the clients called Deloitte. Deloitte forced Flanagan to “retire” and then sued him to assuage their clients.  Deloitte’s claim against Flanagan cited potential costs in reimbursing clients for their investigations.

Deloitte did reimburse some clients: $456 thousand to Sears, $79 thousand to Best Buy, for example. Deloitte’s audit clients, of course, made the quick, universal decision that their auditor was still independent.  Those companies would have otherwise experienced the ignominy of admitting that a non-independent audit firm had attested to prior-filed financial statements. Those companies would have been vulnerable to lawsuits, may have had to pay for a new audit for the affected years, and would have had to change auditors in a hurry – a messy and expensive proposition for a large public company.

There are disclosures in almost all the proxies.  They look like they were all written by the same lawyer.

Following these investigations, DT and our management advised the Audit Committee that no evidence was discovered that indicated that the former advisory partner had any substantive responsibility for or role in the conduct of the audit. DT delivered a letter to the audit committee stating that, despite the trades in our securities by their former advisory partner and the resulting violation of the SEC’s independence rules, the former advisory partner had not exercised any influence over the conduct of the audit or its conclusions with respect to the audit or accounting consultations, that the objectivity of the persons responsible for the actual conduct of the audit had not been affected by the former advisory partner’s actions, and that DT’s independence was not impaired…

Closer to the kind of work McKinsey’s Gupta did for clients, we have another senior Deloitte partner accused of insider trading, Arnold McClellan. He advised private equity firms about the tax implications of proposed acquisitions. The level of trust  – and consequences of a betrayal of that trust  – in MA advisory is akin to the level of trust expected of a company director. Interestingly, the two cases have a company in common – Kronos.

The McClellan case is pending but, in spite of being the second one for Deloitte in such a short time and with allegations of tipping others for profit that covered the same time period as the Flanagan case, Deloitte is still kicking consulting ass and taking names, including for the federal government.

Ernst Young has also survived the embarrassment of one of their partners going to jail for inside trading. Even worse, the firm was mentioned in the same news stories as cheater site AshleyMadison.com. But Ernst Young is still working for the federal government and several Fortune 500 clients as an auditor, in spite of also being accused of complicity in the fraud that resulted in Lehman Brothers’ failure.

Statement of Gary Naftalis, Counsel for Rajat Gupta

These allegations first made by the SEC are totally baseless. Mr. Gupta’s 40-year record of ethical conduct, integrity, and commitment to guarding his clients’ confidences is beyond reproach. Mr. Gupta has done nothing wrong and is confident that these unfounded allegations will be rejected by any fair and impartial fact finder.  There is no allegation that Mr. Gupta traded in any of these securities or shared in any profits as part of any quid pro quo. In fact, Mr. Gupta had lost his entire $10 million investment in the GB Voyager Fund managed by Rajaratnam at the time of these events, negating any motive to deviate from a lifetime of honesty and integrity.


[i] McKinsey’s Managing Director Rajat Gupta on leading a knowledge-based global consulting organization; Volume 15 No. 2.


Beware the SMS of Death

One of the more common predictions for 2011 among industry-watchers is that smartphone malware will become more common as smartphones grow more popular. But even feature phones are vulnerable to attacks.

We’ve already seen hacks that purportedly allow people to eavesdrop on GSM voice calls. Now researchers in Germany say feature phones can be shut down and knocked off the network via SMS attacks.

Collin Mulliner and Nico Golde – students in the Security in Telecommunications department at the Technische Universitaet Berlin – have demonstrated a so-called “SMS Of Death” attack on feature phones made by LG, Motorola, India-based Micromax Nokia, Samsung and Sony Ericsson that exploits the ability of the SMS protocol to send “binaries” (small programs) to the handset.

Cellcos use this function to remotely change phone settings, but attackers can use it to send malicious messages that can shut down the phones. While the attack requires the attacker to know the type phone someone is using, they can easily send five malicious SMSs targeting the top five handset models in that market and knock large numbers of users off the network, according to Technology Review.

The availability of Web-based bulk SMS services make this kind of attack both cheap and easy, Mulliner says.

Cellcos have two options to prevent such an attack, according to the TR report: update the firmware of existing phones, or filter SMS traffic for malware, the latter of which is tough because SMS filters are designed to block spam, not binaries.

Updating phone firmware is also a tough haul, Aurélien Francillon, a researcher in the system security group at ETH Zurich, tells TR: “Most of those phones don’t have automated updates, and when they do, patches are not made available quickly.”