Pooky and Slasher: How Not to Commit a Murder

Two gang members, Pooky and Slasher, decided to seek a bit of revenge against a rival gang member named Ragu, a behemoth creature who they swore was Bigfoot disguised as a human. The root of the plot kicked off when the man disrespected the pair of tough guys at the town’s 4th of July picnic. It seems that Ragu’s melting ice cream cone dropped a clump of chocolate ripple smack dab on Slasher’s brand new firehouse red Chuck Taylors, staining the uppers a color that strangely reminded Pooky of pistachio, his favorite flavor.

Since Ragu weighed just north of 265 with none of those pounds being of the porker variety. Nope. All muscle. So they came up with an end-around. They’d kill Ragu’s father, the thin and wiry, hatchet-faced accountant who worked at Petey Perkins’ Hardware store next to the Piggly Wiggly out on Rte. 1.

After a couple of days of planning and surveillance, the wannabe murderers decided to smother the Ichabod Crane lookalike while he slept. And they’d use his own pillow as the murder weapon. Everyone knew the old beanpole suffered from a serious hacking and wheezing case of emphysema, the direct result of puffing away at cigarettes, one behind the other, for the past forty years or so. No one, especially that goofball police chief, Pooky’d said, would ever connect them to the killing.

Exactly three days later, at precisely 2:12 a.m., Slasher and Pooky slipped through a window and into the home of Ragu and his father. It was dark, warm, and humid. Slasher’s Hannah Montana t-shirt was wet with sweat and clung to his flesh like a surfer’s wetsuit. Pooky on the other hand, was the cool one. But only so because he was too stupid to know that murder was, at the very least, a heart-pounder of epic proportion. So basically dumb, not cool. However, in spite of not perspiring, when happy, Pooky’s feet took on the combined stench of sour milk and burnt asparagus. This was one of those nights.

The two tiptoed through the dining room and then a hallway that led to the stairs. Up they went. They’d watched the place at night and had learned the location of the old man’s bedroom and that’s where they were headed, down the upstairs hall and to the right.

Two minutes later they were standing in the dark beside the accountant’s bed. Thirty seconds after that, with Pooky on one end and Slasher on the other, they shoved the spare pillow over the face of Ragu, Sr. Two minutes passed without so much as a peep or a wiggle from their victim. Slasher eased up his end of the pillow. In the nearly dark room, with only a sliver of creamy moonlight smeared across his forehead, the guy looked absolutely dead, so Slasher released his grip on his end of the pillow and Pooky tossed it on the floor.

The dead was done. Revenge was sweet.

Four hours later, the rail-thin accountant awakened from his sleep and slipped the nasal mask from his nose. The other end of its flexible plastic hose was attached to the CPAP machine sitting on the nightstand beside his bed. He reached to switch of the machine that pumps forced air from the room into his nose, sort of like a scuba diving apparatus for people who snore horribly and often stop breathing in short bursts while sleeping.

While reaching for the switch he saw an overturned bottle of Trazadone, the powerful sleeping medication prescribed his doctor. He’d had insomnia since he was a kid. Nowadays he wins that battle by having two shots of orange-flavored vodka and a sleeping pill one hour before hitting the sack. At the end of that hour he’d best be in the bed because for the next several hours he’d be almost comatose. Lights out. An earthquake wouldn’t wake him.

So each night, there he lay, on his back with a constant supply of fresh air zooming into his lungs. Therefore, the actions of Slasher and Pooky were entirely in vain, and they were wholeheartedly surprised to see their “murder” victim greeting them with a cheery “Good morning!” when they entered the hardware store to purchase more ammunition for their Daisy BB guns. That’d planned to go shoot a few cans down by the creek after school. But, after seeing a very healthy and living and breathing dad of Ragu, they decided to come up with a plan B. So off they went, riding their bikes toward a setting sun.

So, I suppose the moral to this super-silly tale is to always be certain the victim in your tales is not wearing a CPAP mask, drunk, and on powerful sedatives when the villain strikes.

Hmmm … mask, drunk, and on powerful sedatives. And I promised to never mention politics and politicians on this site.

Oh well.

/by

12 Facts About Interrogation

Police officers are required to follow a set of strict court-ordered rules when interrogating a suspect who’s in their custody. And, if they don’t follow those set-in-stone rules, any statement made by the suspect would most likely be ruled inadmissible in court. Imagine if that wrongfully-obtained statement had been a full confession to a murder. Definitely not good.

So here’s a handy checklist for your protagonists to follow when they’ve got their bad guy under the hot lights.

1. Physical abuse is forbidden. So put away the rubber hoses.

2. Promises of leniency are also not allowed. Police officers do not have the authority to reduce a jail or prison sentence, nor can they pick the jail or prison where a suspect will serve his time. An officer’s involvement in the case ends with her court testimony.

3. Miranda warnings (reading of rights—you have the right to remain silent … etc.) are given before interrogating a suspect who’s in custody. It’s not like you see on TV. Officers do not begin spouting off the warnings the second they arrest someone. No, no, and NO! Only to people they intend to question. And, questioning is not reserved for serious felonies. People who commit misdemeanors are questioned as well. Keep in mind, though, that department policy may require some officers to present/read/announce the warnings to every person they take into custody, but it is not the norm to do so.

20161212_104312 copy

Miranda v. Arizona is the case that started the ball rolling. (click here)

4. Officers are not required to give the Miranda warnings when questioning a witness—someone who is not a suspect. Remember: In custody = Read Miranda warnings. No custody = No Miranda warnings.

5. Officers posing as prisoners in any correctional facility (undercover assignment) not required to give Miranda warnings/advisement of rights to prisoners before asking them questions. Therefore, Barney Fife was absolutely following the law when he questioned a prisoner while posing as a fellow crook. See, I told you that show was an accurate portrayal of police work.

6. Miranda warnings should be given each time there’s a significant delay in questioning. For example, you break to get a good night’s sleep and then resume the next day. Officers should give the Miranda warnings before resuming the questioning.

7. Each new/different officer who questions the suspect should again advise him of Miranda. Now, I don’t mean that if five officers are in the room at the same time, each one should take turns reading the guy his rights. I’m referring to the instances where, say, one officer questioned the suspect for a while and then left. Then another officer (might even be from another agency) comes in to ask questions. The new officer would need to advise the suspect of the Miranda warnings. There’s no such thing as a “blanket Miranda warning” that covers everyone at all times.

8. If a suspect, at any time during the questioning, states that he does not understand his rights the officer should stop and repeat the warnings. They should then continue with the warnings until the suspect states that he fully understands and waives each of them.

9. If the officer gives the warnings and then the suspect says he does not wish to answer, the officer may not continue the questioning.

10. If the suspect requests a lawyer, the officer may not question him until an attorney is present. However, that doesn’t mean a lawyer will drop what he’s doing and run down to the police station. It could be days before an attorney is appointed to represent the little darling. And, the suspect could change his mind at any time and decide to answer questions without an attorney being present. Sitting in jail sometimes “changes the mind,” hoping that cooperation will gain their freedom.

11. Officers should never interrogate suspects who’re obviously intoxicated, suffering from withdrawal, severely injured, suffering from mental illness, or extremely upset (hysterical).

12. Officers cannot legally tell suspects that they’ll allow others to harm them if they don’t confess. You see this all the time on TV and in books – “I’m going to put you in a cell with Big John Bend’emover if you don’t tell me what I want to know.” No.

* Officers should read the Miranda warnings from a pre-printed form or card, not recite them from memory. Reading from a form provides consistency and prevents any omissions and additions, even slight ones, which could be used against the state’s case. If possible, it’s best to have the suspect sign a pre-printed form, an agreement to waive his rights and talk to the officer(s). Someone should witness the signing.

Miranda Warnings

20161212_105738

  • You have the right to remain silent and refuse to answer questions. Do you understand?
  • Anything you do say may be used against you in a court of law. Do you understand?-
  • You have the right to consult an attorney before speaking to the police and to have an attorney present during questioning now or in the future. Do you understand?-
  • If you cannot afford an attorney, one will be appointed for you before any questioning if you wish. Do you understand?-
  • If you decide to answer questions now without an attorney present you will still have the right to stop answering at any time until you talk to an attorney. Do you understand?-
  • Knowing and understanding your rights as I have explained them to you, are you willing to answer my questions without an attorney present?
/by

Friday’s Heroes: Remembering the Fallen

Trooper Samuel Newton Bullard, 24

North Carolina Highway Patrol

May 21, 2018 – Trooper Samuel Bullard was killed in a vehicle crash during the pursuit of a BMW that refused to stop for a checkpoint and sped away. The lead trooper, realizing Trooper Bullard was no longer behind him, attempted to reach him by radio. When the trooper received no response to his calls they discontinued the pursuit and turned around. Trooper Bullard’s patrol car was discovered at a bridge abutment, fully engulfed in flames.

Trooper Bullard is survived by his fiancee, parents, brother, sister, grandparents, and extended family.

Police Officer Amy Caprio, 29

Baltimore County Maryland Police Department

May 21, 2018 – Officer Amy Caprio was deliberately struck and killed by a Jeep driven by a juvenile burglary suspect.

After responding to a burglary-in-progress, she located the suspect vehicle, which had previously been stolen, and followed it to a dead-end. She then ordered the driver to exit.

It was reported that Officer Caprio ordered the juvenile out of the car at gunpoint. The driver then ducked and accelerated hard, directly at the officer. The Jeep struck Officer Caprio and knocked her to the ground. The driver continued forward, driving directly over her body.

During a court hearing, it was revealed that the driver stole cars in the months of December, January, and February. In March, he was sent to a juvenile facility, but he soon escaped and stole another car. The subject was arrested and placed on house arrest with the requirement of having to wear a monitoring bracelet. However, in mid-May, the alleged cop-murderer left home, leaving his mother no choice but to call authorities. He’d been on the run for one week before Officer Caprio was murdered.

Officer Caprio is survived by her husband, parents, and sister.

Officer Thomas Coulter, 25

Daytona Beach Florida Police Department

May 21, 2018 – Officer Thomas Coulter suffered a fatal heart attack while participating in physical training exercises in front of the Daytona Beach Police Department headquarters. The training was for newly-hired officers. Officer Coulter has served as an officer for only one week before his death. He is survived by his wife.

 

Officer Ayrian Williams,

Monroe Louisiana Police Department

May 21, 2018 – Officer Ayrian Williams was killed in a vehicle crash while responding to assist another police officer.

She is survived by her mother and brother.

 

 

Sergeant Kent Swanson, 47

Shelley Idaho Police Department

May 21, 2018 – Sergeant Kent Swanson suffered a fatal heart attack while responding to a disturbance call.

 

 

 

 

 

Officer Anthony Christie, 37

Savannah Georgia Police Department

May 25, 2018 – Officer Anthony Christie was killed when his patrol car was struck by a tractor-trailer. He was investigating an accident scene and was seated in his patrol vehicle was struck by a tractor-trailer.

 

/by

Josh Moulin: Cyberattacks And How To Protect Your Computer and Data – Part 3

The following was originally posted to the blog site of author L.A. Sartor. She and Josh were kind enough to allow me to share this extremely cool bit of knowledge with you. By the way, many of you will remember Josh from his wonderful cybercrime presentations at the Writers’ Police Academy, and from his fascinating articles here on The Graveyard Shift.

So, without further ado, I’ll ask L.A. Sartor to introduce today’s guest blogger …

 

Author L.A. Sartor

“This is the final installment of Josh’s 3-part series.  I hope you’ve found it as scary and as useful as I have.  Thanks, Josh, for your time and your expertise.”  

 

 

 

 

If you have been following this blog series, you know that the first blog discussed the cyberattack kill chain and how hackers target individuals and systems and the second blog covered common cyberattacks and how they are perpetrated and identified. In this final post, I am going to discuss what users can do to harden their systems against attack.

Typically, criminals are lazy and take the path of least resistance. Just like locking your doors and having an alarm system will deter the majority of home burglars, there are preventative steps a computer user can take to cause a criminal to move on to someone else who is easier to compromise. The major caveat to this is if you happen to be specifically targeted by the attacker, who may not be easily deterred by basic preventative measures.

Cybersecurity is a fine balance between convenience and security; users and businesses must make an informed risk-based decision when determining the level of security that should be applied to systems and applications. Too much convenience and your systems are wide open to attacks. Too much security and work is inhibited

In no particular order, here are my suggestions and opinions on how to keep yourself cybersafe:

Multifactor Authentication

I have an entire blog post dedicated to Multifactor Authentication (MFA). If you want the details, please read it – but to summarize here, use MFA for everything that you possible can. Can it be a hassle to always have your phone with you? Yes. Does it make it nearly impossible for someone to access your online information without your phone? Yes. Use MFA like Google Authenticator or text messaging for banks, Dropbox, iCloud, Google, etc. If you are wondering what sites and services offer MFA, look at this website.

Physical Security

Equally as important as having good cybersecurity, you must protect your devices. Once an attacker has physical access to your phone, tablet, computer, etc. it is game over. Use strong passwords, use screen savers that require a password once they come on, don’t share your password with others, and don’t leave your devices unattended.

Never, ever, connect your phone or device to charging stations in public places or to a rental vehicle via USB cables. Studies have shown that in some cases, data is collected within rental car computers and in charging stations and malware can be implanted on the connected device. If you must charge, use power plugs or cigarette lighter chargers and never directly connect a USB cable to a hub. The only exception is if you buy a USB cable that has had the data wire removed or use a data blocking device in line like this one.

Password Manager

I have already mentioned in my second blog post what the dangers are of reusing the same password for everything, but it is impossible to remember multiple passwords. I have a few recommendations when it comes to passwords and it involves another risk-based decision. For instance, if you have enabled MFA on your accounts, then you have greatly reduced the risk of unauthorized access, so the complexity of your passwords is not as important as it would be if you didn’t have MFA (the convenience – security balance). Even reusing passwords on accounts with MFA is more tolerable because the one time password (OTP) used with your app or text message provides the extra security.

For me, I use a password manager to maintain all of my passwords. I don’t like having my browser save my passwords because if my system or browser is compromised, those passwords will most likely get stolen. I also don’t trust cloud password managers because if the cloud provider is compromised, my passwords may also be compromised (this has happened).

I recommend standalone databases that are installed on your system and encrypted themselves. I like KeePass and a lot of security research has been done on this program. It uses excellent encryption and you can place the database in a shared location if you want (such as a home network attached storage (NAS) device) and it is usable on mobile devices. It’s not stored in the cloud and allows you to maintain usernames, URLs, passwords, and other secure notes. It also has a password generator, which allows you to create very complex passwords immediately.

I actually do not know most passwords to websites, I use KeePass to generate hugely complex passwords for sites that don’t utilize MFA and just store them within KeePass. If I need to access the site I copy/paste the complex password into the browser and never see it.

Make sure you are using PINs, fingerprints, or complex passwords to access your mobile devices. There are pros and cons to using different methods, but make sure you are at least using something and preferably more than just a four-digit PIN.

Patch, Patch, Patch

Make sure that your Operating System (OS) (i.e., Windows, Mac OS X, iOS, Android, Linux) is setup to automatically download and install updates. Frequent patching is one of the best ways to prevent cyberattacks that leverage known vulnerabilities. In addition to patching the OS, make sure to patch all other third party software installed on your devices. This is relatively simple with iPhones for example because it will automatically update the OS as well as apps installed on the device.

This becomes more complex with computers because although the OS may update, other software like Java, Adobe, Office, Chrome, Firefox, etc. usually don’t. Mac is generally better at third party app management than Windows, but Windows is getting there with Windows 10. There are apps available to help keep your Windows third party software updated, look at https://ninite.com/ for example.

Install and Maintain Security Software

Just as malware has come a long way, so has security software. Today’s (good) security software really does a lot more than the old antivirus software (hence calling it security software instead of just antivirus). Because of the sharing of common information and malware, the market for specialized security software is much different than it used to be and in fact many great products are completely free. Windows Defender for example is actually a decent security software tool and built in to Windows. The nice thing about Defender is that it updates as Windows updates and you don’t have to worry about an incompatibility with your security software anytime you upgrade your OS (used to be a common issue).

Although there are many myths around Macs being more secure than Windows computers, they face many of the same vulnerabilities as PCs. The difference really is that because Windows systems has the greatest market share and are more common in businesses, most malware is written and directed at PCs. There is plenty of Mac malware though and running a Mac without security software is no longer an option.

There is a mix of commercial and open source security software tools available and they range in price from free to an annual subscription of around $50 to $60. Ideally, look for a software that provides anti-malware, firewall, intrusion prevention, web protection, and crypto-attack detection. Here are a few examples of security software tools I would consider (these are my own personal opinions and I’m not endorsing any particular vendor, but have personal knowledge of the tools below).

If you really want to compare different security software vendors, check out this site.

Use Encryption

Encryption has come a very long way and is now built-in to devices and free to use. Encryption essentially scrambles the data on your device and without the key (a password in most cases) the data cannot be descrambled and read. Any Windows device and especially those that travel like tablets and laptops should be encrypted with BitLocker. Don’t discount your home computers though, because if they are stolen in a burglary you don’t want your data in the hands of someone else.

For Mac computers, use the built-in FileVault 2 encryption option. I would caution against having the key stored within Apple’s cloud though. Apple offers to store the key online as a backup (because if you forget your password, you will never get to your data), but this creates a vulnerability. Another option is to take a screenshot of the emergency backup key, print it, and maintain it somewhere like a safe deposit box (same is true for BitLocker and storing the key with Microsoft).

While no one wants a device stolen, if your device is stolen and you have ensured that it is always password protected (including auto-locking after 15 minutes of no use) and it is encrypted, you can rest assured no one will be looking through your data.

Maintain Backups

There are two primary reasons to have backups; one is for the accidental file deletion that you need to restore, and the other is for full disaster recovery. Backup software has also come a long way and both Windows 10 and Mac OS X have built-in backup solutions. My recommendation is to always have frequent incremental backups occurring at least once a day, if not hourly. These backups can be to a connected drive (such as a USB hard drive), or wirelessly to a device like a NAS. Windows and Macs both carve out a portion of the system’s hard drive for incremental backups too, for those times when something is accidentally deleted and just needs to be recovered immediately.

For disaster recovery though, I recommend having a completely separate portable hard drive that you do full backups on. You must decide how frequently you want these backups done (weekly, monthly, quarterly, etc.) and the question you must ask yourself is how much data are you willing to lose if something happens (this is called the Recovery Point Objective in IT-speak). For example, if I decide to do full backups monthly, am I willing to potentially lose a month’s worth of work, photos, etc. if my computer was stolen or destroyed? Remember that the disaster recovery disk is for those situations where you cannot access the original computer for some reason like a fire, flood, or theft. You may also do ad-hoc backups if you just completed some important work and you don’t want to wait until the next month to backup. Just put a recurring appointment on your calendar for full backups and make sure to stick with it.

There are two very important items to remember with your backups. First, the backup disk must also be encrypted. If your backup data is unencrypted and your home is burglarized, the criminals will just get your data off of the backup drive instead of the computer. Both Mac and Windows will allow you to encrypt external drives with FileVault 2 or BitLocker, respectively. Or, you can purchase hardware encrypted drives, such as an Aegis drive (https://www.apricorn.com/).

Second, the disaster recovery backup needs to be stored offsite. Local backup drives are for convenience, but disaster recovery backups are used in the event the original data or system is unavailable. If your disaster recovery drive and computer are in the same place and they are both destroyed, you are completely out of luck. Some people may store an encrypted hard drive at their office, at a friend or family member’s home, in a safe deposit box, or somewhere else they have access to.

Some people may choose to back up to the cloud, which is certainly more convenient but may be less secure. There are ways to encrypt data within the cloud so only you can access it, but this takes additional steps and some advanced knowledge.

Do Not Ignore or Disable Security Settings

Read security warnings that pop up and don’t disable security settings are that designed to keep you safe. For example, automatic software downloads and installation, or user access control (UAC) may be frustrating, but they are extremely important. Also make sure your computer’s built-in firewall is turned on. Windows 10 and Mac OS X both have good firewalls.

Never Use an Administrative Account for Normal Use

This is called the rule of least privilege. Always use the least privileges on a computer necessary to do your work. Your computer should have at least two accounts on it and every user should have their own account (especially kids). One is a full administrator account that you can use to change settings, install software, do maintenance, etc. This admin account should have a password that is unique and hard to guess and should never be used for normal tasks such as web surfing or checking email. If a computer is attacked while logged in as the admin, the likelihood of malware being able to execute and install is much greater. The subsequent accounts should be normal user accounts and not have admin privileges. This is where you conduct the majority of your work such as email, web surfing, etc. If you need to install something under your normal account, you will be prompted to temporarily provide your admin username and password. This is good, as it causes you to think and make sure what is being done is something you requested and not malicious.

To make sure I am never logged in to the wrong account, I make the desktop background of my admin account a bright red solid color. Then, just by looking at my desktop, I know that I should not be doing anything online.

About The Author:

Josh Moulin serves as a trusted advisor to federal government IT and cybersecurity executives. Previously, Moulin was the Chief Information Officer for the Nevada National Security Site, part of the U.S. Department of Energy’s Nuclear Weapons Complex and before that spent 11 years in law enforcement including 7 years as the commander of a cybercrimes task force.

Moulin has a Master’s Degree in Information Security and Assurance and has over a dozen certifications in law enforcement, digital forensics, and cybersecurity including as a Certified Ethical Hacker. For more information, visit JoshMoulin.com or connect with him on LinkedIn or Twitter.

L.A. Sartor

If you love stories filled with suspense, adventure, fighting against all odds and winning love, then please click here to visit the website of author L.A. Sartor. You’ll be glad you did!

/by

Recidivism: Where And How Does It End and How #prisonreform and Second Chances Could Help

It’s often been said that the jails and prisons in the U.S. operate on a revolving door system, with many of the same prisoners returning to incarceration time after time after time. Sadly, that’s a mostly true statement.

With nearly 2.5 million people crammed into U.S. prison and jail facilities, or on probation or parole—3,789,800 on probation and 870,500 on parole (2015 stats), well, that equals to approximately 1 out of every 37 people in the U.S. is currently under some sort of supervised correctional status.

Yes, America can proudly boast (note the sarcasm) that we hold 25% of the world’s prison population. That’s a pretty staggering number considering the U.S. accounts for only 5% of the world’s population. Those numbers don’t mean much, you say? Well, let’s approach from another angle … our wallets. Each year the U.S. spends between 74 and 80 billion dollars on incarceration. That’s BILLION dollars.

Sure, most citizens don’t want to be bothered with felons and other law-breakers. You know, out of sight/out of mind. But it’s not quite that simple. You see, Isaac Newton had the right idea when he mused, “What goes up must come down,” because the same applies to prisons, jails, and inmates—what goes in must come out. That’s right, the majority of people sentenced to jail or prison must be released at some point, and those former prisoners are generally released back into their former communities.

What happens to former prisoners when they do finally make it back to their old neighborhoods? That’s a question most people don’t consider because the ex-con’s troubles don’t pertain to “most people.” Unfortunately, though, an inmate’s troubles affects everyone. Remember the 80 billion dollars it costs to incarcerate and supervise those millions of prisoners? Well, U.S. taxpayers are responsible for paying that whopping bill.

Doesn’t it makes sense that we should try to address the problem instead of throwing good money on top of bad? Obviously, incarceration isn’t always the correct answer to every case, because many offenders just keep coming back after they’ve “paid” their debt to society.

Let’s address recidivism …

… and why I think it occurs so often. First of all, I have many years of experience working in both corrections and in law enforcement, which means I’ve seen the system in action, from all sides. I’ve also owned a business where I employed a few former inmates, men who’d received prison sentences resulting from my investigations. Ironic, huh? Yes, I honestly believe in second chances.

What do former prisoners face upon their release? (these may vary depending on location)

1. They must, on a regular basis, check in with a probation or parole officer.

2. They must have an established residence.

3. Many drug and sex offenders must register with the local police, advising officials where they’ll be residing and working.

4. They must maintain employment (in some areas this is a discretionary requirement imposed by the court).

5. They’re required to complete a monthly report detailing their earnings, address changes, if any, employers name (probation officer will visit the job site and home), drug offenders must submit to urine testing, all must submit vehicle information, record of purchases (many probationers may not possess credit or debit cards), and they’re encouraged to further their education (This is a bit of a catch-22 for some since drug offenders may not receive grants to attend college. Murderers, yes, but drug offenders, no).

Some companies refuse to hire people who’ve been convicted of felonies … any felonies.

A vast number of employers absolutely will not hire felons and, as I stated above, drug offenders are not eligible for student loans. In fact, many felons are legally banned from working in certain professions, such as:

  • airport security screener
  • armored car crew member
  • bank teller
  • child care provider
  • delivery driver
  • health care positions with direct patient contact
  • public safety officer
  • residential installers
  • apartment or condo maintenance
  • jobs that require handling money
  • Realtor
  • Some volunteer programs refuse to accept felons (any felon)—nature programs, animal shelters, libraries, etc.

Even when a felon finds a job he is subject to a list of restrictions, including (this is only a partial list, and it may vary from area to area):

  • Agents /officers must be allowed to visit worksite and/or speak with a supervisor to discuss client’s performance, progress, and accountability
  • Cannot work in a position that serves alcohol
  • Cannot work with minors
  • Cannot work with vulnerable adults
  • Employment must be within or close to a supervision district so that agents may visit the worksite
  • Not allowed to use or have contact with devices that host a computer modem (i.e. any device that can access the Internet)
  • Cannot travel outside area or state (affects delivery drivers)

A few professions do hire convicted felons, but the list is short. And, this is still entirely up to the company. Some do not employ those who’ve been convicted of crimes.

Professions often available to convicted felons:

  • Warehouse work
  • Maintenance and janitorial positions
  • Food service (no alcohol)
  • Production and manufacturing
  • Assembly
  • Construction
  • Landscaping

In addition, many convicted felons are banned from living in publicly assisted housing (section 8), or worse.

So, you see, without a job, or with the limited occupations to choose from, and without housing and educational opportunities, it’s darn tough for a former prisoner to make it on the outside.

To top it all off, the convicted felons never actually “pay their debts to society.” The stigma of being a “convicted felon” hangs over their heads for life. This is especially true for those who were convicted of federal offenses. Some states allow convicted felons to vote in elections (others do not).

Still, felons, even one-time first offenders convicted of minor, non-violent felonies lose their right to own firearms and other weapons, their right to vote, student loans, housing, etc. And these restrictions are for life.

Second Chances!!

Wouldn’t it make sense to give the non-violent offenders a second chance, by removing the “convicted felon” status after, say, 10 years of living a productive, crime-free life. At least then they’d have the opportunity to return to school, live in better neighborhoods (away from criminal activity), find a decent job that would help support their families and take better care of their children, who, by the way, also suffer by being forced to live in poor conditions.

Having a second chance and goals to work toward could be part of the solution to the “prison problem” in this country. Now, I’m not talking about hardcore career criminals and repeat offenders. Nor am I including violent offenders. Most of those thugs need to remain behind bars for as long as we can keep them there. And I certainly don’t believe that every inmate would take advantage of the opportunity if presented to them. But there would be many who would work hard to achieve the goal and finally be able to put the mistake behind them for good.

If this helped keep just a small portion of the recidivists out of prison, the results could be huge. Families could remain together, children would grow up with two parents in the home, employers might find top-notch employees, the former inmates could become better educated and productive members of society, and taxpayers would save approximately $30,000 per year per inmate. Not to mention that instead of costing taxpayers, the non-recidivist would become a taxPAYER.

New York City is set to begin a program that offers guaranteed employment to each of their 8,500 inmates as they leave jail. These jobs are to be short-term, low skill level employment—cooks, restaurant bussers, or construction flaggers, etc.

The $10 million program will apply to inmates no matter what crime they’ve committed, even if they’re on the sex offender registry. Everyone gets a job. Everyone, including murderers, rapists, robbers, and …

I’m not sure the New York City plan is the best idea in the world, but they’re making an effort to address the issue. While not the most well-thought-out plan, it could still give former prisoners a much-needed boost of confidence, self-worth, and desire to do better. It could also go a long ways toward reducing the intense shame many feel after their release.

Anyway, that’s my two cents on the matter. What do you think? A second chance for some, or lock ’em up and forget about them? Remember, though, most of those who go in must come out at some point.

looking-out.jpg

Of course, there is the issue of private prisons that have contracts with the government … contracts that promise a minimum number of inmates will be sent their way. We must also remember that the private prisons are a big, money-making industry with stockholders.

And then there’s the food industry that makes a bundle off the prisons. And the construction companies, the jobs for officers, stock brokers medical staff, administration, the vehicle contracts, the weapons contracts, dog food (canines), condiment sales (I once sat next to a woman on a plane who was on her way to a huge nationwide prison food convention. She was in charge of condiment sales to prisons and jails—packets of mustard, ketchup, and mayonnaise, along with napkins, and sporks—a multi-million-dollar industry)

Inmate phone calls are EXPENSIVE!

Let’s not forget the prison phone systems, where a collect call can go for fees as high as nearly $300 for just one hour of conversation. Think about it for a second. A call for a kid’s birthday, a mother’s sick, etc. $300 for an hour of family time is a tough expense for most families.

A portion of that whopping phone bill goes back to the prison in exchange for a contract with the provider. Again, it is the family who shoulders this burden since inmates don’t earn anywhere near enough money to cover the expense, yet, officials encourage strong and regular family contact.

Anyway, you get the idea.

A very happy prisoner. I asked why the big smile. Her reply was, “Things could be worse. At least I’m alive and healthy.” Notice the blue phone and its cord at the right side of the photo. Collect calls only.

Private Prison Profits Big Time!

CoreCivic stock at the time of the original posting of this article (now revised), stood at $34.70 per share. Today (May 21, 2018), shares were at $20.65. Still, the “people business” is certainly booming when others are failing miserably.

To read more about CoreCivic, visit their website by clicking here.

  • CoreCivic, one of the largest private prison companies in the world, is the company formerly known as Corrections Corporations of America.
  • CCA houses approximately 90,000 prisoners in over 65 facilities.
  • CCA has been the center of controversy over the years. Most of their troubles, but definitely not all, were related to cost-saving practices that included inadequate staff, extensive lobbying, and lack of proper cooperation with legal entities. CCA swapped amid the ongoing scrutiny of the private prison industry. Many believe the name change of private prisons is due to their rising unpopularity among the public, and to avoid a connection to past bad and illegal behavior.

Another for-profit “private prison company,” Wackenhut Corrections Corporation (WCC), now a subsidiary of G4S Secure Solutions changed its name to the GEO Group, Inc. It, too, houses thousands of prisoners around the world.

The Geo Group alone reported GEO reported total revenues for the fourth quarter 2017 of $569.0 million. This figure up a bit up from $566.6 million for the fourth quarter 2016. 2017 revenues include $2.8 million in construction costs associated with the development of the  Ravenhall Correctional Centre in Australia.

Yes, private prisons are a big business.

#prisonreform

#secondchances

Life on the inside

Above and below – inside a small county jail where conditions were truly deplorable.

Showers drained into the corridors.

 

Jailer entering corridor.

Jail Pods

132-jail-module-interior.jpg

Above – Inside a shipping container “pod” that was converted into a dormitory-style jail cell. This pod is located inside a parking garage outside an overcrowded county jail.

Below – Space between two modules serves as the recreation yard. Absolutely no sunlight to be found, anywhere. Nothing but concrete, sewer pipes, exhaust fumes, and prisoners.

pod-recreation-area.jpg

Below – In this county jail, prisoners are brought to these small rooms where they “visit” with family members seated on the opposite side of the window. The family’s room is a mirror image of the inmate’s visiting room. The view below is from the inmate’s side of the glass.

visiting-room.jpg

Overcrowding is a big issue within some prisons and jails. As an answer to their growing space problem, this county jail (below) installed steel beds in the hallways, outside the already packed jail cells.

hall-in-shadows.jpg

 

Looking out from inside the trustee cells.

 

Hallways and corridors were narrow, making for dangerous conditions for the jailers. The jail was heated by steam (boilers) and radiators were there, but scarce. There was no heat inside the cells. And, there was no air conditioning whatsoever. The only airflow came from  small widows. Here, you can see one of those windows (top left corner), open and tilted in toward the cells. The electrical cord is connected to a portable TV sitting on the wonky shelf, also at top left next to the window.

Narrow corridors are dangerous!

 

Makeshift antenna controls were fashioned from string or wires. Not allowed, but prisoners will be prisoners …

Wires to rotate rabbit-ear antennas from side to side to help receive a better picture. No cable!

 

Below is an image of an isolation cell (“the hole”) where unruly, violent prisoners in this jail are housed. No bed, no sink, no toilet. Merely a drain in the floor to use for, well, you know.

/by
,

Josh Moulin: Cyberattacks And How To Protect Your Computer and Data – Part 2

The following was originally posted to the blog site of author L.A. Sartor. She and Josh were kind enough to allow me to share this extremely cool bit of knowledge with you. By the way, many of you will remember Josh from his wonderful cybercrime presentations at the Writers’ Police Academy, and from his fascinating articles here on The Graveyard Shift.

So, without further ado, I’ll ask L.A. Sartor to introduce today’s guest blogger …

Author L.A. Sartor


“I’m incredibly honored that Josh Moulin, who was my cyber expert for Forever Yours This New Year’s Night, responded with a “yes” when I asked him to do a series on what is a cyberattack, how to recognize them, and how to protect yourself.

Take it away, Josh.”

 

In my first blog, I discussed the cyber kill chain and how hackers move through predictable steps to launch an attack against a target. In that blog, I used the example of an author who was targeted because of their controversial writings and the author’s system was compromised with ransomware. In this second post, I am going to discuss the most common cyberattacks and how computer users can become savvy to detect potentially malicious activity. While there are many kinds of attacks, I’m going to highlight some of the most common attacks that I see. Additionally, while the technical execution of many of these attacks are different, the methods for detection and prevention are similar if not identical.

Phishing Attacks
The most common way that computers and networks are compromised is through phishing attacks. In my scenario in the first post, the author was tricked into clicking a link within an email that caused the author’s system to reach out to a server and download malicious code. Phishing is a very easy attack to create and is more of a social engineering attack than anything technical.

Sometimes these messages are clearly phishing attacks; the message contains grammatical and spelling errors, it is sent by an organization you never do business with, or it is sent by a prince in Nigeria or the U.K. lottery asking you to claim your winnings. Clever hackers though take time in crafting their message and even if it is blasted to millions of email accounts, all they need is to steal the credit card information of just a few people to make a huge return on their investment.

Below is an actual phishing email that came to me. As you can see, the message looks legitimate and there are no obvious signs of it being malicious. Remember, the rule is to never click any links until and unless you are positive the message is legitimate.

When I hovered over the links within the email, none of them went to the Amazon.com domain. Instead the links all pointed to hxxp[://]greatdeals.gungh.top/system/9d011840a8b905ba79667fa20d0a0936. This URL has since been taken down as malicious, but had I actually clicked the link when the URL was still active, my system very well may have become infected.

In some cases of phishing, instead of getting a link to click, the attacker will send a specially crafted attachment. PDFs and Office documents (e.g., Word, PowerPoint, Excel, etc.) can be embedded with malicious code and once a user opens the document the code may be able to execute. This is why in the latest version of Microsoft Office, documents are opened in safe mode and in order to edit or print, users must click a button. This safe mode prevents the document from running any macros or other code that may compromise the computer.

If you are ever unsure of a URL or a file, there are several free online resources to help. For instance, URLQuery.net allows you to enter a URL and scan it for malware, complaints, or other warnings. It also tells you the country it is hosted in and gives a screenshot of the website you looked up. Another site, VirusTotal.com, is owned by Google and allows both URLs and files to be scanned for malware. If you receive a file from someone and you want it scanned before you double click it, upload it to VirusTotal to see if it’s malicious first.

Drive-By or Watering Hole Attacks

As organizations and individuals have become more adept at identifying phishing emails, attackers have had to change their modus operandi. One such example of this evolution is changing phishing emails so instead of sending an attachment within an email that is compromised or a link that begins the download of a piece of malware, the email (or Facebook post, or Tweet, etc.) sends the user to a website. The website is most likely legitimate and the user’s system would not detect anything suspicious at this point because nothing is attempting to download.

In the background however, the attacker has compromised the website, hosting malware on the site itself. Once the victim’s browser begins to read the contents on the website, it delivers a payload of malware to the system. This may come in the form of a download where the user is prompted to run something, or it may be a piece of JavaScript that when the browser sees the code, it automatically runs it without user interaction.

These attacks are called “drive-by” attacks because they can indiscriminately target anyone who browses the site, or watering hole attacks because the malicious activity is just sitting in the site, waiting for people to stop by. There have been some very popular websites compromised and embedded with malware such as CNN and Forbes so this kind of attack can be extremely widespread.

How do you spot this attack? Well, this one is tricky and there is a possibility that nothing on your system will notify you that an attack is taking place. Some more advanced anti-malware software may catch it, or if you notice strange things happening on your computer (website crashes, or your computer begins running slow with high CPU or memory utilization), or being prompted to download and run something may all be indications of a problem.

Wireless Attacks / Man in the Middle (MiTM) Attacks

While it has long been known that Wi-Fi, Bluetooth, and other wireless technologies are vulnerable to attacks, it is still a common and successful attack because people continue to connect to open access points out of convenience or to save their data consumption. Many people do not configure their home wireless access points correctly either, leaving them vulnerable to attacks by people in the area.

When I was in law enforcement, I remember a case where an Internet Protocol (IP) address was identified as downloading hundreds of images of child sexual abuse. My team wrote a search warrant and executed it, only to find that the home we went to had nothing to do with the crime. Our investigation later revealed that a neighbor about three homes down was a registered sex offender and had been using this neighbor’s Wi-Fi to commit their crimes. It was a huge inconvenience (not to mention a traumatic event) to not secure their Wi-Fi network and it all could have been easily prevented by taking some basic security steps.

Beyond securing your personal network, you must be extremely careful with the networks you allow your devices to connect. If you are connected to an unsecure wireless network (e.g. Starbucks) anything that your device transmits or receives that isn’t otherwise encrypted is fair game for someone also connected to that same wireless network. Wireless networks acts as a hub, meaning that anyone else connected to that network can see all the traffic, not just the traffic between their own device and the wireless router. Because of this, I can setup my device on the Starbucks network to promiscuously listen to all traffic and capture it, allowing me to compile it and view anything you typed, downloaded, uploaded, etc. as long as you were doing it unencrypted (http instead of https for example). If you navigate to a website that is not using encryption like http[://}yoursite.com and enter a username and password, I can sniff that out of the air and later use it.

It is true that more and more sites, especially sites that involve finance or healthcare use encryption because it’s mandated, there are still many sites that do not. The other danger is that most people reuse passwords, so even if your bank uses encryption (i.e., https[://]yourbank.com) but your favorite news site does not and you use the same password between the two, once I get the unencrypted username and password and see in your traffic you navigated to US Bank’s website, I can try your username and password on that site to see if it works. This is another huge reason to always use multifactor authentication on everything (more on this in the next post).

Another wireless attack is called the Man-in-the-Middle or MiTM attack. This kind of attack, which can also be carried out with cellular devices using devices like the Stingray can be very dangerous. In this kind of attack, the criminal creates a rogue access point (AP) and advertises it for users to connect to. On one side of the rogue AP are the victim devices and the other side is a path to the Internet. This allows the attacker to capture, decrypt, and record all of the traffic between the victim device and the Internet. It also allows the attacker to inject malicious traffic or redirect websites using the Domain Name Service (DNS).

To illustrate an MiTM attack, imagine you are seated at the airport and see a variety of wireless APs available to connect to. One has the name of “Free WiFi” and the other says “Free High Speed WiFi.” The “Free WiFi” is the legitimate Internet connection offered by the airport, but the “Free High Speed WiFi” is a malicious AP. An attacker sitting in your general proximity has created an AP using free software on his laptop. As your device scans for open APs it locates the High Speed AP and since anyone would want high speed over standard speed, you click to connect to the high speed AP. Once you click to connect, your device associates itself with the attacker’s laptop.

Now that you are connected to the attacker’s laptop, he essentially owns your device and the communications between your device and the Internet. Since the attacker is routing your traffic through to the Internet, as a user nothing seems out of the ordinary. In fact, the attacker is probably leveraging the airport’s free Wi-Fi to get your device out to the Internet. However, the attacker is now capturing all of the traffic coming into and out of your device and as we have already learned, anything typed in the clear (unencrypted) is recorded by the attacker in plaintext.

The attacker could make things even more interesting by using his laptop as a proxy between your device and the Internet and decrypting your encrypted traffic between your device and wherever you are browsing. Essentially what happens is your device connects to the attacker’s laptop where he breaks your connection to your bank or Facebook account, or whatever it is you are navigating to and decrypts your traffic, then re-encrypts it between his laptop and the destination (we’ll use your bank in this situation). Now the attacker can record even encrypted traffic such as usernames and passwords in plaintext. This attack however, will prompt the user’s device with an error message that the encryption certificate that you are using to visit your bank does not match the domain name of the bank and will require the user’s interaction to continue. If you’re interested in the technical details of encryption, certificates, etc. send me a note and I’ll be glad to discuss it.

Suffice it to say that if you get an error message about mismatched certificates (as shown below) on any device there is a high likelihood that the certificate has been compromised or you are the victim of a MiTM attack. No matter the reason, if you get this error, stop browsing, try connecting later from a different access point or from your cellular data to see if you get the same error, or contact the institution you are trying to access.

An error message generated by Safari showing there is a problem with the website encryption certificate

The same website visited in Firefox; notice the alert over the padlock


An example of Firefox showing a correctly implemented website encryption certificate

As mentioned above, the attacker can also inject malicious traffic into your session or redirect your computer. For example, if you type google[.]com into your browser, the attacker can create DNS entries that says if a user types google[.]com, actually send them to duckduckgo[.]com. In an even more sinister scenario, the attacker could create a rule that if you type wellsfargo[.]com, send the computer to wellsfargoamerica[.]com which might be a fake website that looks exactly like the real Wells Fargo (see Pharming attacks below).

How do you spot this attack? First, don’t connect to free Wi-Fi hotspots. If you absolutely must, then make sure you are using a Virtual Private Network (VPN) connection (either through your employer or use some of the VPN services available) which creates an encrypted tunnel between you and the VPN service before you navigate the Internet. Spotting a simple MiTM rogue AP may be nearly impossible. Spotting a rogue AP acting as a proxy will give you the browser certificate error messages shown above.

Pharming and Illegitimate Websites


Pharming, like it’s sister Phishing, is an attack that socially engineers a user. Instead of sending a message out, pharming is more like the watering hole attack where it waits for victims to stop by. Pharming is usually done by an attacker when they create a fake website but make it look legitimate and trick users to visit the site and enter their sensitive information (like credentials). Take this scenario: an attacker knows that because of a recent disaster, many users will be donating money to the American Red Cross on the legitimate website redcross[.]org. So, the attacker uses a free tool to “scrape” the actual Red Cross website, purchases the domain name of redcross[.]info, and then uploads the copy of the real Red Cross website to a server being hosted with Amazon Web Services (AWS). The attacker then begins a massive spam campaign for people to donate and provides the link of redcross[.]info and as people go to that site, it looks completely legit just like the real site. Users begin to donate millions of dollars to the PayPal account, which all goes to the attacker’s bank account.

This kind of attack can also be used by taking advantage of common misspellings or known letter combinations that people may not notice in the URL bar of their browser.

How do you spot this type of attack? This one may be difficult or impossible. Since nothing malicious is actually running on your computer (unless the attacker is combining Pharming with another attack) and you are just entering information into a website, there may be no signs or alerts at all. The best way to prevent this type of attack is by being very careful what you type into the URL address bar of your device, using known good bookmarks instead of relying on searches each time, and if you are given a link to click, make sure it matches the known website. Sometimes if I get a link from someone to follow, instead of clicking the link I will Google the organization and go to it that way, or at least confirm that what was in the link matches what is in Google.

In all of these attacks the bottom line is to pay attention, don’t click links that you don’t absolutely trust, actually read error messages that pop up on your screen before just clicking “OK”, don’t connect to public Wi-Fi APs, and make sure the certificate of an encrypted website you are visiting matches the domain name. In the last post of this series I will discuss the preventative strategies you can take to help harden your systems from attack and some proactive steps you can take to reduce the likelihood of being compromised.

About the author:

Josh Moulin serves as a trusted advisor to federal government IT and cybersecurity executives with the world’s leading IT advisory and research firm. Previously, Moulin was the Chief Information Officer for the Nevada National Security Site, part of the U.S. Department of Energy’s Nuclear Weapons Complex and before that spent 11 years in law enforcement including 7 years as the commander of a cybercrimes task force.

Moulin has a Master’s Degree in Information Security and Assurance and has over a dozen certifications in law enforcement, digital forensics, and cybersecurity including as a Certified Ethical Hacker. For more information, visit JoshMoulin.com or connect with him on LinkedInor Twitter.

L.A. Sartor

If you love stories filled with suspense, adventure, fighting against all odds and winning love, then please click here to visit the website of author L.A. Sartor. You’ll be glad you did!

/by

Josh Moulin: Cyberattacks And How To Protect Your Computer and Data – Part 1

The following was originally posted to the blog site of author L.A. Sartor. She and Josh were kind enough to allow me to share this extremely cool bit of knowledge with you. By the way, many of you will remember Josh from his wonderful cybercrime presentations at the Writers’ Police Academy, and from his fascinating articles here on The Graveyard Shift.

So, without further ado, I’ll ask L.A. Sartor to introduce today’s guest blogger …

Author L.A. Sartor


I’m incredibly honored that Josh Moulin, who was my cyber expert for Forever Yours This New Year’s Night, responded with a “yes” when I asked him to do a series on what is a cyberattack, how to recognize them, and how to protect yourself.

Take it away, Josh.

Cyberattacks and data breaches are unfortunately commonplace in the daily news cycle. Many of us have had our personal, healthcare, and financial data breached so much that we are used to receiving letters notifying us of unauthorized disclosures or getting signed up for yet another credit monitoring service. Cybercrime is out of control and the most infuriating part is that most of the attacks are not sophisticated or require an expert hacker. Indeed, most of the successful attacks use the same modus operandi that they have for a decade.

The fact that the majority of attacks are not sophisticated is as troublesome as it is helpful. Since we know what most attackers do, it makes the identification and prevention of these attacks easier. Individuals and small to medium businesses often assume (incorrectly) that if the United States Federal Government or massive corporations such as Home Depot, Anthem, Yahoo!, Target, and Equifax, who spend millions of dollars each year in cybersecurity can’t keep hackers out, then there is no possible way they can defend themselves.

It is true that many cyberattacks are easily preventable and only effective because mistakes have been made which create vulnerabilities. However, it is also true that this world has nation-state military units and sophisticated hackers which target government agencies, universities, corporations, and high-value individuals. When a skilled attacker has set their sights on a victim and has the means, opportunity, and intent to launch a cyberattack against that victim, these attacks may use techniques, tactics, and procedures that are highly complex and extremely difficult to detect. For the purposes of this article, I am not discussing these advanced attacks.

In this first blog post of a three-part series, I am going to focus on the cyberattack kill chain and lay the foundation for how cyberattacks happen. The focus audience of this post is individuals who are trying to protect their personal devices and data from cyberattacks. The next blog post will discuss the most common attacks and how to spot them, and finally I will discuss preventative strategies that people can take including security software, configurations, and backup strategies.

Cyberattack Kill Chain
Each cyberattack goes through a series of steps to accomplish its mission. Depending on the target, mission objectives, and abilities of the attacker this kill chain may happen very quickly or may take months to years to accomplish. Sometimes an attack is to simply disrupt a business competitor or political adversary. Attacks like this are generally carried out through Distributed Denial of Service (DDoS) attacks or website defacement. Other attacks are performed with the intent of gaining intelligence about a competitor or government agency, and yet others are to steal intellectual property, harass someone, or to support a political ideology (hacktivism).

The attack kill chain is comprised of the following steps:
1. The target is defined: This may simply be a target of opportunity (e.g., a person in close proximity to a hacker that has a vulnerable mobile device) or could be targeted due to the person’s position, the value of their data, etc

2. Reconnaissance: The attacker begins to research the target. What information is available via public open source intelligence (OSINT) such as Facebook, LinkedIn, Google, public databases, etc. What IP addresses are assigned to the target, what operating systems do they use, and are there any known vulnerabilities for the target’s Internet connected systems?

3. Weaponization: The attacker develops their weaponized attack, which is generally malware (malicious software) such as a Trojan horse, virus, ransomware, worm, etc. or may utilize a previously unpublished exploit known as a zero-day (0-day). The weapon must be able to exploit a vulnerability, which is what the attacker discovers during the recon stage.

  1. Delivery: The attacker delivers the payload to the victim. This may be done in a variety of ways such as via an email attachment or embedded link (phishing), through a chat session, uploading a file to a server on the Internet, compromising a website and then sending the victim to the compromised website (also called drive-by attacks), or several other methods.5. Exploitation: Once the payload has been delivered, the malicious code must execute to exploit the system. Malicious code can be executed by the attacker, by the system itself, or frequently by a user who clicks something and executes the malware.

    6. Installation: After the vulnerability is exploited the malware is installed on the system. Most attackers want one thing: persistence. They want to get on a system and stay on a system, having the ability to do internal recon now that they are inside the network and laterally move to other systems to stay within the network and spread their attack. Some advanced malware only lives in RAM and never actually “installs” on a hard drive, making post-mortem examinations of systems difficult.

    7. Command & Control: Once the malware is installed it generally opens up the system to receive commands from the attacker (known as Command & Control, or C2). Malware may “phone home” occasionally asking for any new commands from the C2 which may tell the malware to perform functions such as copy and send data from the computer to the attacker’s system, activate the system’s webcam, or any number of other things.

    8. Exfiltration: Generally the main goal, this is the step where the attacker gets access to data and begins sending (exfiltrating) the data from the system to the attacker.

Source ~ Event Tracker

There are several ways to make yourself less susceptible to a cyberattack, such as reducing the attack surface, target hardening, and learning how to identify potentially dangerous situations online or in emails.

A Practical Scenario

An author is putting their finishing touches on their latest work in preparation of sending it off for review. This author is somewhat controversial and critics are anticipating the release of the new book, posting negative comments all across the Internet. A hacker decides to make a statement by attempting to hack this author’s computer and disrupt the author’s ability to publish the book as well as steal a copy of the book before it is released. Step 1, target acquisition is complete.

The hacker begins by finding out as much as possible about the author through social media, Internet posts, interviews, and any other source of OSINT. The hacker is able to determine through social media that the author has a daughter in the fourth grade and because of geotagged photos posted of the author’s daughter, the hacker determines what school the daughter attends. The hacker now downloads the logo of the elementary school as well as an offline copy of the school’s website. Step 2, reconnaissance is complete.

The hacker obtains a variant of ransomware from a hacker website and places the malicious code on a server controlled by the hacker and sitting inside of Amazon Web Services (AWS). The malicious code is just waiting to be downloaded and executed by anyone who visits the server. Step 3, weaponization is complete.

Next, the hacker drafts an email using the same logo, colors, and “look and feel” of the elementary school’s website. The hacker addresses the email to the author’s email address (which was obtained via Google) and sends an email to the author during school hours that there has been an active shooter incident at the school. Included in the email is a link that tells the author to click for further details.

As any parent would, the author clicks the link of the email. When the author clicks the link, they are directed to a webpage that looks exactly like the school’s site. They receive some bothersome pop-up that the don’t read because they are terrified about their child’s safety and just click “ok” to close the window and see what is going on at the school. In reality, when the author clicked the link they navigated to a fake site hosted by the attacker and their computer downloaded the ransomware code. When the code attempted to execute, a pop-up appeared asking for administrative privileges to execute the code. When the author clicked “ok” they just executed the ransomware on their computer. Steps 4, 5, and 6 (delivery, exploitation, and installation) are complete.

The ransomware on the author’s computer begins immediately encrypting data on the hard drive and searches the drive for any .doc or .docx files, compresses them, and exfiltrates them to the attackers C2 server located in AWS. The author has now lost their latest manuscript and cannot access any files on their computer due to the ransomware encryption. Steps 7 and 8 (C2 and exfiltration) are complete.

This scenario is exactly the kind of targeted social engineering attacks that occur on a daily basis and are extremely easy to perpetrate. In future blog posts I will discuss how to recognize attacks and how to harden your systems to try and prevent malicious activity.

About the author:

Josh Moulin serves as a trusted advisor to federal government IT and cybersecurity executives with the world’s leading IT advisory and research firm. Previously, Moulin was the Chief Information Officer for the Nevada National Security Site, part of the U.S. Department of Energy’s Nuclear Weapons Complex and before that spent 11 years in law enforcement including 7 years as the commander of a cybercrimes task force.

Moulin has a Master’s Degree in Information Security and Assurance and has over a dozen certifications in law enforcement, digital forensics, and cybersecurity including as a Certified Ethical Hacker. For more information, visit JoshMoulin.com or connect with him on LinkedIn or Twitter.

L.A. Sartor

If you love stories filled with suspense, adventure, fighting against all odds and winning love, then please click here to visit the website of author L.A. Sartor. You’ll be glad you did!

/by

Friday’s Heroes: Remembering the Fallen

Officer Lance C. Whitaker

Jacksonville Florida Sheriff’s Office

May 15, 2018 – Officer Lance Whitaker was killed in a vehicle crash while responding to another accident scene. His vehicle left the roadway and struck a tree.

 

 

 

Officer E. Paul Morris

Raleigh Mississippi Police Department

May 17, 2018 –  Officer Paul Morris was killed in a vehicle crash when his patrol car left the roadway and struck a tree. Upon impact, the car became engulfed in flames.

 

 

 

/by

MS13: They Ain’t Choirboys and Cutie-Patootie Girls

There are street gangs and there are street gangs, but the violent, international MS13 gang takes a backseat to no other when it comes to cruelty to other humans. In fact, to join MS13, prospective gang members must endure a brutal 13-second beating (a “beat-in”) by other gang members. Females are fortunate. They have the option of being beaten or gang-raped. Another step in the initiation is to kill a rival gang member or someone randomly selected by the gang.

Mara Salvatrucha (MS13)

The gang name is derived from La Mara, a street gang in San Salvador.  The word “Mara” translates as “gang” in English. Salvatrucha comes from the Salvatrucha guerrillas who fought in the Salvadoran Civil War.

To become full-fledged members and to earn the title of “homeboys” (after a “probationary period of sorts), “chequos,” or mid-level MS13 members are “jumped in.”

Jumping in is a two-step process—chequos must commit at least one murder of a rival gang member. Afterward, they’re voted in, if approved, and this is when gang leaders would very slowly count to thirteen while other gang members beat the chequos. This, the beat-in, is not a fraternity hazing. Instead, the beatings are often extremely severe.

When the beat-in is complete, members often display the familiar devil horn hand sign, a gesture they borrowed from fans of heavy metal music.

MS13 clique leaders are known as “palabreros.” Loosely translated, the word means “those who have the word.”

As a full-fledged member, the new homeboys join the other gang members during their everyday routines of selling drugs, smuggling weapons and people, prostitution, car theft, extortion, armed robbery, and murder. Lots of murder.

MS13 has attempted to get a foot in the drug-dealing business but they’ve faile to do so on a large scale. The gang has no formal leader and operates in pockets within Mexico, the U.S., Canada, and Central America.

Members of those pockets (cliques, or “clicas” in Spanish) tend to show their loyalty to those smaller groups rather than the overall “organization,” which translates into enough disorganization to make organized drug-dealing nearly impossible. Therefore, they stick to more localized crime. However, the gang is very large and extremely deadly. Murder is a priority.

There is an attempt at organization, though, between the leaders who’re currently incarcerated and those on the street. Together, they try to control the major “hits,” such as the orders to kill police officers and other officials. Still, they are not formally organized, with most activity occurring within the smaller clicas.

“Of the 506 gang members arrested or charged in connection with crimes, 207 were charged with murder and 100 others were accused of conspiracy or racketeering, and “dozens of others” were accused of sex trafficking, attempted murder, sexual assault, extortion, and drug trafficking.” ~ from a report by Jessica Vaughan, director of policy studies at the Center for Immigration Studies. (February 28, 2018). The report was based on a study of just over 500 MS13 gang members arrested since 2012.

The extreme activities of MS13 have helped make what some call the Northern Triangle—Guatemala, El Salvador, and Honduras—the most violent place in the world that’s not currently at war.

Leaving the gang, for whatever reason, proves to be impossible in some cliques because the penalty for desertions is immediate death.

MS13 has between 50,000 and 70,000 members

 

To name only a scant few of the MS13 horrors, in 2017, MS13 gang members were responsible for:

  • Venus Romero Iraheta, 17, tortured and killed a 15-year-old girl because he didn’t approve of her boyfriend, also an MS-13 gang member. Gang members filmed the torture and stabbing death.
  • Two MS-13 gang members (Miguel Alvarez-Flores and Diego Hernandez-Rivera) who, by the way, were illegally staying in the U.S., were charged with kidnapping, torturing and shooting a teenage girl. According to court records, the gang members killed the girl because she insulted their satanic rituals and a shrine.
  • Three MS-13 gang members were charged with the murder of 17-year-old Raymond Wood, who’s body was been mutilated by the gang members. They stabbed Wood sixteen times, ran over his body, and then removed his hands.

*Please don’t be alarmed. The following image is not of a real hand. It’s a staged photo. But please do imagine the very real fear experienced by those who’ve faced death, torture, and dismemberment at the hands of MS13 gang members.

  • Hector Lazo, 18, and Pedro Rivera, 23 were arrested for the murder of 37-year-old Nelson Rodriguez. Officers said Rivera shot Rodriguez in the back of the head while simply walking in the street.
  • Two teenage boys and an 11-year-old girl were shot at an apartment complex by two MS13 gang members. The shooting of the two boys was gang-related. The shooting of the girl was accidental.
  • MS13 gang members are responsible for the deaths of eleven people on Long Island. The victims were hacked to death with machetes. Their bodies were then horribly mutilated by gang members using those same edged weapons.
  • Best friends Nisa Mickens and Kayla Cuevas were brutally murdered by MS13 gang members. It was the day before her 16th birthday when Nisa Mickens’ brutally beaten body was found in Brentwood, N.Y. The badly beaten body of 16-year-old Kayla Cuevas was discovered in a nearby wooded backyard.

To kill the two girls, MS-13 gang members used bats and machetes. Cuevas was the target of the hit because she had apparently feuded with some gang members on social media. Mickens, who was simply in the wrong place at the wrong time, was so badly beaten around her head and face that she was barely recognizable.

Machetes are often used to kill because laws aren’t as strict as those governing firearms. And, because of the massive damage they’re able to inflict when used against a human body.

  • Three Long Island MS-13 gang members were arrested for the attempted murder of a 19-year man. During the attack, the gang members used a machete to slash the victim’s stomach. Then they shot him.
  • New York Police charged three MS-13 gang members with the assault and attempted murder of a rival gang member. The victim was brutally beaten and shot in the head. The victim is now a paraplegic as a result of the attack.
  • MS13 gang member Carlos Gonzalez is wanted in connection to the death of his 25-year-old girlfriend Maritza Lopez. Police found Lopez dead in her bedroom closet with gunshot wounds to the chest and head.
  • MS-13 has directed its members to “take out a cop.” The gang member suspected of putting out the hit order is a tall, light-skinned Hispanic man with a thin build and a tattoo of three dots next to one of his eyes. The order is the assignment of any and all members. They simply want a cop, any cop, to die. The purpose of murdering a law enforcement officer is to send a signal to police, telling them to back away from arresting gang members. Killing cops is what they do in other countries when they feel police are closing in.

*Top photo – FBI

/by

Fingerprinting: A Journey From O-R

Especially for you, an O-R guide to fingerprinting … and more.

Oil Gland– Unlike eccrine and apocrine glands, which are sweat glands, the sebaceous gland is considered an oil gland.

Oligodactyly– Having less than the ordinary number of fingers or toes.

Orthodactyly– Fingers and toes cannot be flexed.

Ortho-Tolidine– A dual-purpose chemical that works both as a presumptive test for blood and has also been used to develop fingerprint detail on human skin.

Osborn Grid Method– Superimposing a grid on photographic enlargements of latent prints found at a crime scene as well as the inked fingerprints of a suspect(s). Scientist then painstakingly examine both, square by square looking for matching individualities.

Os calcis– A bone in the foot.

Osmium Tetroxide (Osmic Acid Fuming)– A fuming technique used to process items for latent fingerprints. Due to excessive costs and dangers associated with the product, it is now rarely used, if ever.

P.

PBFE– Probability Based Fingerprint Evidence.

Papillary Ridges– Rows of eccrine glands situated along the trail of fingerprint

friction ridges.

Patent Print– Fingerprints that are visible without development. (Latent prints are typically invisible to the naked eye).

Pathology– The study of causes, nature, and effects of diseases, trauma, and other abnormalities, and the changes to the body created by them.

Pattern Formations– Details of fingerprints created as early as the third month of gestation.

Pelmatoscopy– The scientific studies of the friction ridges of the soles of feet.

Pen Pack/Penitentiary Packet– A pen pack is the comprehensive imprisonment record of an inmate that’s supplied by the Department of Corrections. When fingerprints are included in the pen pack, and they are indeed typically found there, they’re used for comparison purposes. Other information found in pen packs are terms of confinement, background intelligence, and other similar details.

Perceptual Set – The tendency to see what we expect to see.

Phalange– Any bone in the fingers or toes.

Phalangeal– Of the bones in the fingers and toes.

Physical Developer– Chemical processing technique to develop latent prints on porous items. The technique was developed in the 1970s to develop fingerprints on porous items.

Pincushion Method– AKA the Constellation Method.  This outdated technique was used in the first half of the 20th century to compare prints and to confirm an identification. Investigators pushed pins through each of the ridge characteristics of both latent (prints discovered at a crime scene) and known prints (prints of a known suspect). They then compared the holes (from the reverse sides). If the holes on the latent print matched those of the suspect’s print, well, they had their man, or woman.

If you happen to have a copy of the April 1956 edition of Fingerprint and Identification Magazine, you could read more on the topic since it was featured in the issue.

Plastic Print– Fingerprint left in a malleable substance, such as clay or wax.

Points/ Points of Identification– Fingerprint ridge characteristics.

R.

RAM– Combination of Rhodamine 6G, Ardrox and MBD dyes. The mixture fluoresces when exposed to a special alternate light source, which in turn makes it possible to see prints developed using cyanoacrylate (Superglue) fumes.

RUVIS– Reflective Ultra-Violet imaging system that allows visualization of fingerprint detail in an ultraviolet spectrum. (see below for details and a video)

Redwop ™– A fluorescent fingerprint powder.

Rubber Lifter– A sheet of flexible rubber with adhesive on one side. Rubber lifters are used to “lift” latent prints.

Ruthenium Tetroxide (RTX)– Chemical used to enhance/see fingerprint detail on fabrics and other porous material such as some stones, leather, glass, tape, wood, plastics, and even human skin and wet surfaces.

RUVIS

RUVIS (Reflective Ultraviolet Imaging System), a system of locating latent (invisible) fingerprints) without the use of powders, fumes, or chemicals, was developed by Sirchie Fingerprint Laboratories and the U.S. Army. The system focuses on one specific section of shortwave ultraviolet light, the germicidal spectrum of light, which cannot be seen by the naked eye.

A particularly unique feature of RUVIS technology is that it works in both total darkness and in bright sunshine, a must for use by police investigators.

The Krimesite Imager uses RUVIS technology to detect invisible residues from fingerprints. Those residues reflect UV light projected from the device, which immediately captures the reflections with a 60mm UV lens. A built-in scanner then converts the images to visible light, allowing the investigator to see the fingerprint. All this is done instantly, in real time. And, the detective is able to see images from up to fifteen feet away.

Once the print is located, the investigator uses the Imager to photograph it and, with the use of a micro-printer, print a copy of the desired evidence. All this without the messy powders that never seem to wash away. The KS Imager can also be used to greatly enhance prints developed using cyanoacrylate fuming (Super Glue).

Note – I doubt many of you will be picking up one of these devices for your home CSI kit. The price tag is between $9,000 and $22,000, depending the style of devise selected.

 

Here’s a video shot at the Sirchie compound near Raleigh, N.C. It shows the Krimesite Imager in action.

Those of you attending the Writers’ Police Academy, take note, because you are in for a surprise! Yes, space is available! By the way, the event is open to all (writers, readers, fans, and anyone else who’s interested in participating in a thrilling, hands-on training event) And, it is FUN!.

In the meantime …

/by