social-engineering 6

I almost fell for this piece of spam.

Hilarious post on how to stop filesharers from stealing hotel bandwidth. So, I’m in Milwaukee at ye olde Holiday Inn Express. They have a wireless internet connection here and it’s been suckin’ all night, like I couldn’t even do anything on it. I suspected someone running a p2p program and taking up all of the bandwidth, so I fired up ntop to analyze the type of traffic on the network, and just who it was generating it. Lo and behold, someone was running a p2p app, and taking up 1.6Mbit worth of bandwidth. That’s just not fair to the 20 other people on the network, so I decided to boot him from the network. I tried poisoning his arp cache and the default gateway’s cache, but that only works on some wireless access points, apparently not this one. I can’t send an 802.11 deauth message from my OS X box, because the card doesn’t support raw packet injection, so what to do??? I notice that his IP in the ntop interface changed into a name. His windows machine was spewing Netbios packets with his computer name in it. For the sake of his privacy, I’ve changed the name, but let’s say it was “smith-laptop”. So I pick up my cellphone and call the front desk at the hotel and as for Mr. Smith’s room. The lady at the front desk says “Eric Smith?” And I tell her yes. The phone rings, someone picks up, the conversation goes like this: Me: Eric Smith? Eric: Uhh, yeah? Me: My name is Jim Grant, and I’m an investigator with the RIAA. Have you heard of us? Eric: Uhhhhh….. What does that stand for? Me: Recording Industry Association of America. We represent several large record companies. In monitoring several p2p filesharing networks, we have found that you Eric, are currently downloading copyrighted material. Are you aware that this is illegal? Eric: Ummm…. my laptop is off. (At this point, I no longer see him on the network) Me: We are in the process of filing 18182 lawsuits against people who steal copyrighted music on the internet. We will continue monitoring these networks, and if we see you on them again, you will hear back from us. Eric: Ok, thanks. Bye. So, now my network is nice and speedy again. And some guy is in his room trying to dry out his underwear. :) I should have recorded the call since my cellphone has the capability to record conversations. The above conversation can’t even begin to show the fear in his voice. I’m sure he’s scared as hell wondering how they found out his name and that he was staying at a hotel and exactly what room he was in. ...

A hilarious chat on IRC about passwords. More at QDB. via Dhar <Cthon98> hey, if you type in your pw, it will show as stars <Cthon98> ***** see! <AzureDiamond> hunter2 <AzureDiamond> doesnt look like stars to me <Cthon98> <AzureDiamond> ***** <Cthon98> thats what I see <AzureDiamond> oh, really? <Cthon98> Absolutely <AzureDiamond> you can go hunter2 my hunter2-ing hunter2 <AzureDiamond> haha, does that look funny to you? <Cthon98> lol, yes. See, when YOU type hunter2, it shows to us as ***** <AzureDiamond> thats neat, I didnt know IRC did that <Cthon98> yep, no matter how many times you type hunter2, it will show to us as ***** <AzureDiamond> awesome! <AzureDiamond> wait, how do you know my pw? <Cthon98> er, I just copy pasted YOUR ****'s and it appears to YOU as hunter2 cause its your pw <AzureDiamond> oh, ok.

King’s Cross station. 6:20pm. I’m rushing along to catch the next train to Liverpool Street, when a jacket and suitcase step in front of me. “Salaam alekum.” This has happened to me before. 5 years ago. My response hasn’t changed. “Huh? “Salaam alekum?” “Huh? “SALAAM ALEKUM?” “Huh? “Aap Pakistani ho?” “No, India actually.” (smile) “I just lost my wallet, and I don’t have a ticket. Could you please help me?” ...

Spammer ploys. From the Scientific American.

Hacking and social engineering.