Or just give them a giant wooden carving of the US presidential seal: https://en.wikipedia.org/wiki/The_Thing_(listening_device)

given the cheapness and compactness of modern electronics any furniture can carry a factory (or during shipping) installed chip these days, even without getting into smart/cloud connected office tables and chairs territory. One can hope at least NSA X-rays their furniture :)

Even better if you integrate into something like a motorized standing desk, they'll plug it in for you.

Does that USB drive stick trick still work?

Yes, yes, it does

I very much doubt you could discover anything with X-rays. You can place whole device inside a screw or the circuit can be very thin with little to no metal etc.

I would assume it's becoming a a software war. You monitor all frequencies with SDR and try to shield as much as possible while on the offending side you try to push information on different frequencies and making it look a like like stuff that's already in the air.

You also don't even need to use RF. You can also use high-frequency audio to communicate to other devices, though I guess I'm not sure how you get it out of the building.

It has been said that covert agencies have monitored conversations through windows by measuring the acoustic vibrations with a laser. So maybe that will work, but I have no idea how well that works with higher frequencies outside of human perception.

Higher frequencies will get filtered out. They don't have the power to vibrate the glass unless it's very loud.

Cuban sounds as an [ultrasound intermodular distortion based] attack on electronics with humans seeming to be a side effect:

https://www.google.com/amp/s/spectrum.ieee.org/semiconductor...

So sounds like you'd also want a room that can give off emp pulses to fry electronics that you can't see as a failsafe

Also discourages workers from bringing their phones into the office. Or their pacemakers.

I read somewhere years ago that they do. I don't remember where though, sorry.

Unrelated: WTF? I just had to do a reCAPTCHA on HN to log in!

One of the first pen testers I ever read pointed out that companies do (sometimes excessive) background checks on their staff all the time and then they outsource the cleaning crew. When I'm there during the day, there's only so much I could do without other people noticing. But here's a group with full access to an empty building full of your equipment for 10 hours a day.

People are going to come at you from your blindside, if they can find it. And if you consider a certain class of people invisible, then that's what a hacker wants to be.

Many companies treat the cleaning crew like trash. Unpredictable scheduling, no benefits, minimum wage pay combine to make it so a very small bribe would get an attacker into a building, where they could plant gear in the drop ceiling and more.

Doing right by your workers would go a long way towards plugging this vulnerability.

While you should always treat your employees well, I'm not talking about creating a disgruntled employee leading to problems.

The example given was a route someone could use to be invited into the building. Nothing is stopping you from being a blue collar worker, especially if you're willing to fake a work history.

I once stayed late and noticed a cleaner was wearing a polo from the company I used to work for. I asked him about it and it turned out he was an engineer and was filling in for his girlfriend who owned the cleaning business. Holy red flag! I made some noise and that cleaning company was let go.

Pro-tip for anyone that finds themselves in this situation when trying to steal another company's data - say you bought the shirt for 50c at a second hand store. That, or don't wear your company polo on an espionage mission.

Or just wear a boring flat grey shirt like all of the rest of the cleaning staff.

I'm not sure I see why the cleaning company was the problem.

Presumably, because they swapped to a non-approved person on their schedule.

"his girlfriend who owned the cleaning business"

He wasn't just some guy.

He was working for the cleaning business, though. If the company was letting in anyone who works for that cleaner without further investigation, that's their problem. That's the situation we were talking about upthread, so I assumed zcrackerz would have said something if it were different.

Where I work, each cleaner gets a badge, just like the engineers. Presumably she gave her badge to a random other person, aka her boyfriend, so he could let himself in. Nothing stops me from doing that as an engineer either, but it would absolutely be a firing offence if caught.

Yeah, I never understood that. At the first half sensitive job I had, the cleaning crew had access to all the computer rooms, including the server one. I had thought of trying to push my boss into using encryption for our emails but abandoned after realizing that.

I still believe it was dangerous to use gmail for the company emails when Google was one of our competitors in our niche.

And I think your belief is justified. Look at how many niche products people built on AWS and Amazon caught wind of their success and rolled out a competitor!

But I think this is not as cut and clear with an enterprise gmail account. Who really competes with Google? Amazon on the other hand competes with every retailer out there.

To corroborate that, I once helped a family friend clean banks in the middle of the night. That was her job. Far as I can tell, she was just the lowest bidder on it with a consistent work ethic. We had access to almost everything. Could've gotten to most of the computers. I told her as much with her laughing that it was ridiculous.

I left my iPod on the desk overnight once while working at a large international investment bank. It vanished, presumably lifted by the cleaners. Security were remarkably uninterested in this, refused to do anything whatsoever (including checking the CCTV) although they did ask me to give them the crime number if I reported it.

That's easy enough to explain...

First off, lying to office security carries fewer repercussions than lying to the police to get a crime number. The office security guys won't want to be party to someone else's vendetta (would you?)

Secondly - if you care enough to waste hours of your time filing a police report, then you must give a damn about your shiny-thing. If not... well you clearly don't care enough and it's not a problem, so goodbye.

Read that how you will...

A small company I once worked for employed a new firm of cleaners. Very good and conscientious for several months, right up to the night they loaded all the computer gear they could find on the premises into their van and disappeared. (After, of course, doing the cleaning and making sure they locked up afterwards)

I'm always amaze at how many computer screens/keyboards are visible from windows. It would be so easy to plant a webcam with some good optics on an opposite building and just get the passwords of the victim quite easily. you could have easily a few dozens of victims on a single company with a single camera.

I notice these things too, but at the end of the day the sad news is nothing so exotic is necessary. There are far easier ways to get what you need from a modern office with typical security hygiene.

> There are far easier ways to get what you need from a modern office with typical security hygiene.

Far easier than looking through a window? I'm curious to know! I've seen banks where it would be possible! I expect most of their software to be internal and accessed through a VPN when outside but still.

Well you'd usually need to work to get access to a room to look through the window, so that's not a given :)

I think sending a parcel like in this article, or leaving a USB stick lying around is often an easier task. Even if you window-surf some credentials you most likely can't use them unless you're on the internal network already. At least at my place of work you'd need a VPN token to make any use of my details unless you have physical access to plug in a cable.

> Well you'd usually need to work to get access to a room to look through the window, so that's not a given :)

There's plenty of ways to enter in many buildings without "working there". As long as the physical security there is lower (and there's a ton of reason why it could be) or that it's already open to the public.

> I think sending a parcel like in this article,

That only give you physical proximity. Unless they have bad wifi securities like that article said... that won't give much. People don't talk about password regularly ;).

> leaving a USB stick lying around is often an easier task

That's just hoping right there, Windows autorun hasn't been a thing for a long time, an USB keys that open a terminal is freaking obvious and most people know not to plug any random USB keys. That most probably won't works for any high ranking official.

Almost no one talk about making sure windows doesn't see keyboards though... or even screens, and you'll see that usually, people with higher ranks do have windows closeby ;) (the perks of the ranks).

This is a real problem. While I was working at XBox, we made giant pictures over the windows using colored post-it notes. I remember a really good pixel art megaman that was my favorite. Internal offices sometimes used newspapers to cover over the windows (but maybe that was just advertising, here's someone who works on something you want to see!).

Our company has extremely deeply tinted and reflective exterior windows that even at night (outside) with lights inside, you can barely see in if your face is 1" away from the glass.

That seems like a pretty good way to handle this vulnerability!

I was thinking about how hard managing this risk was and except removing all windows (which I hope everyone will agree is quite bad), it's hard to protect ourself against this issue from all angle and that's even knowing the issue and trying to handle it (which most people won't even do).

All the old TEMPEST stuff probably works great when you're _inside_ the target's building.

If my (granted, very limited and anecdotal) experience is anything to go by, rather than TEMPESTifying a whole building, one rather hardens specific rooms or areas inside it.

Oh, and in those rooms bringing your own stuff from the outside is not encouraged - to the extent that I was asked to leave my disposable coffee cup outside on one occasion.

Didn’t matter much - there was an approved and vetted Moccamaster inside.

Or ship it to the security team the week of DEFCON.

How would you be able to pull out any information out of an audio recording of keyboard typing? Wouldn't the training set differ between keyboards too? Sounds interesting it it worked, do you have any sources?

You get a week's worth of typing; you cluster the sounds; then based on statistical frequency analysis you decode which cluster maps to the spacebar and which to the letter 'x'; then you can transcribe the whole typing history and decide which of all that is a password.

Great plan, but we have to test it. Can you upload a sample dataset of you typing for 1 week so we can try this approach?

What's your address? I can send it on a usb key.

This is like a hacker chess match, and here I am all out of popcorn.

You can just mail it to

9800 Savage Rd. Suite 6272

Ft. Meade, MD 20755-6000

I have their dataset. Email me for details.

Can it be published? Happy to contribute bandwidth!

I think it was a joke

Here's one paper:

https://people.eecs.berkeley.edu/~tygar/papers/Keyboard_Acou...

The illuminated globe example is much better than the one in the OP imo. The one in the OP isn't much different from parking a van outside the target office.