Spy & Privacy Gadgets: The Defensive Short List

Your contactless cards answer a stranger's reader through a bag.

Legacy access badges and some contactless cards answer a nearby reader. Cheap sleeves are a small step when that bothers you.

Malware can turn your laptop camera on without the LED.

Malware can turn a laptop camera on without the light. Former FBI Director James Comey taped over his own webcam for exactly that reason.

Apps with mic permission can listen when you're not on a call.

Apps and malware that get mic permission can listen even when you're not on a call. The FTC has warned developers about apps that request the mic without a clear need.

Shoulder surfing worked in ~9 of 10 open-office attempts.

A Ponemon "visual hacking" study found shoulder-surfing succeeded in about 9 out of 10 attempts in open offices — often in under 15 minutes.

Nearly half of "lost" USB sticks get plugged into a computer.

University of Illinois researchers dropped 297 USBs around campus — nearly half got plugged in. The FBI later warned FIN7 was mailing BadUSB sticks that act like keyboards and drop ransomware.

A stolen unencrypted drive is a data breach. An encrypted one isn't.

HHS's breach portal is full of cases where a stolen unencrypted laptop or drive exposed patient and client data. Lose a plain drive and it's a breach. Lose an encrypted one and it's a shrug.

Bags, keys and luggage still vanish on ordinary trips.

Checked bags still go missing on ordinary flights — and so do keys and luggage at hotels and airports. A tracker on your own stuff is how you find it.

A locksmith at midnight costs more than a spare key you control.

Lockouts happen at the worst time. A locksmith after midnight costs far more than a spare key you control — but a bumper hide is the first place anyone looks.

A Black Hat talk showed a cheap tool opening millions of hotel locks.

In 2012 a Black Hat talk showed a cheap homemade tool that could open millions of Onity hotel keycard locks. Hotels patch slowly. Travelers can't wait.

Thieves can steal a keyless car while your fob sits on the kitchen counter.

Your keyless fob broadcasts a "I'm here" signal even while it sits on the kitchen counter. Thieves with a relay box can extend that signal to the car in the driveway and drive off — NICB unlocked and drove away more than half the cars it tested.

Your phone's location trail can be bought and sold.

Phones constantly ping towers, Wi-Fi and Bluetooth. Data brokers have been sued by the FTC for selling precise location trails that can show visits to clinics, churches and shelters.

A public USB charger can talk to your phone while it charges.

The FCC and FBI have both warned travelers about "juice jacking": a compromised public USB port that can talk to your phone while it charges. Confirmed field cases are rare — the risk is still real enough for federal alerts.

Airbnb banned indoor cameras after years of guest reports.

Airbnb banned indoor cameras in listings worldwide after guest reports. A quick sweep of a rental is basic travel hygiene.

GPS trackers get stuck under cars — and stalkers use them.

BJS stalking data: hundreds of thousands of tech-stalking victims reported electronic tracking. Defenders need a way to sweep their own spaces.

Break a window, plug into the OBD port, program a blank key, drive off.

Police departments across the U.S. warn that thieves break a window, plug a programmer into the OBD diagnostic port under the dash, and write a blank key fob — then drive off in minutes.

You're surrounded by radio signals most people never see.

ADS-B aircraft beacons, NOAA weather satellites and FM radio are public signals you can legally receive. Seeing them is how RF stops being magic.

Infrared remotes are just light codes — easy to learn, easy to abuse.

Infrared remotes are just coded flashes of light. Learning that is step one of understanding how "invisible" controls work — and why a bar TV isn't yours to kill.

Electrical fires often run hot before they fail.

USFA data show U.S. fire departments respond to roughly 23,000–26,000 residential electrical-malfunction fires a year. Hot breakers and overloaded strips often run warm before they fail.

Water damage is one of the top homeowners claims — leaks hide.

Insurance data: water damage and freezing are among the top causes of homeowners claims — roughly 1 in 60 insured homes sees one. Finding a leak early beats ripping out a wall later.

Default router passwords leave your Wi-Fi open.

CISA's home Wi-Fi guidance starts with a hard truth: default router passwords and weak encryption leave your network open. You can't fix what you can't see.

Dead zones on your property are where devices roam to stranger networks.

A weak corner of your property is where guests and IoT devices often fall back to open guest SSIDs — or worse, the neighbor's network.

A bump key can open many pin-tumbler locks in seconds.

Pin-tumbler locks can be opened with a bump key in seconds — Dutch consumer tests opened most certified locks tested in under three minutes. Understanding how locks fail is how you pick better ones.