How much do we trust our email?

The purpose of this article is show how an attacker can trick someone into thinking that they are talking to someone else on email. It uses the following two websites:

1.Mailinator [http://mailinator.com] - Instant access and anonymous web mail.
2.Fake Emailer [http://emkei.cz/] - Builds fake emails.

Scenario
Bob wants to trick Alice that her boss is contacting her. Alice works for Fireweb in Japan. He wants to use social engineering to make Alice give up her home phone number.

Using Fake Emailer to create the engineered email
Fake emailer is a really quick and easy way to build an email that looks (from the outside at least), trustworthy. You can tailor it to have any from and two address, and reply-to address, any contents, even the headers themselves can be tailored.

We will use the following:
To address: Alice@herhomeemail.com
From: The.Boss@fireweb.ne.jp
Reply-to Address: The.Boss.a.fireweb.ne.jp
Message: Hi Alice, I'm afraid we are having an emergency here in the office, and I would like to contact you ASAP, could you please send me your home phone. Thank you. The Boss.

What Alice sees:
Alice gets a very official looking email. The from address is the boss' real address.

She clicks reply and the reply to address is The.Boss.a.fireweb.ne.jp . She then types her reply.

The result
Alice sends her information to the Mailinator address which Bob can instantly access anonymously.

Conclusions and preventions:
Alice had very few clues to tell her what was happening. The biggest and most obvious to us now is that the reply-to address is completely wrong. However it gets pretty well hidden. For starters the initial From address is completely legit (assuming Bob knew it). Not many people go out of their way to double check the email reply address is write, and even a quick glance here is still not enough to catch what is going on.

This could be furthered by putting HTML on the site to make it look more official, or getting Alice to do something that doesn't even involve replying to the address, like clicking on a contained link, or contacting a 3rd person on the Boss' behalf.

In this case, we have to look at the header information to see what is going on:

X-Originating-IP: [46.167.245.101]
Authentication-Results: mta1451.mail.mud.yahoo.com from=fireweb.ne.jp; domainkeys=neutral (no sig); from=fireweb.ne.jp; dkim=neutral (no sig)
Received: from 127.0.0.1 (EHLO emkei.cz) (46.167.245.101)
by mta1451.mail.mud.yahoo.com with SMTP; Wed, 19 Jun 2011 01:18:08 -0700
Received: by emkei.cz (Postfix, from userid 43)
id 6096281AA11; Thu, 30 Jun 2011 06:18:11 +0200 (CEST)
To: alice@yahoo.com
Subject: firey shark
From: "The boss"
X-Priority: 3 (Normal)
Importance: Normal
Errors-To: boss@fireweb.ne.jp
Reply-To: The boss@fireweb.ne.jp
Content-Type: text/plain; charset=utf-8
Message-Id: <20110630041811.6096281AA11@emkei.cz>
Date: Thu, 30 Jun 2011 06:18:11 +0200 (CEST)
Content-Length: 1

Doing an IPlookup [http://ip-lookup.net/index.php], shows us that the originating IP of 46.167.245.101 is obviously wrong and the message-Id contains the source site.
The received information is also different from normal, as if it has bounced off of emkei.cz, not something you normally see on emails.

Despite all of these anomolies, both Yahoo and google mail both send through the information without detecting and warning the user.

Vaio and Skype

Vaio has some webcam issues when it comes to Skype video calls (or should that be the other way around). Anyway, the problem is that Skype defaults to using a bluetooth webcam, which if you only have the basic onboard webcam, you'll crash Skype.

There has been musings of various fixed beta versions and workarounds, but it turns out you can fix it in 5 seconds. Just do the following (and take backups in case it doesn't work).

1. Find the C:\Users\you\AppData\Roaming\Skype\username\ folder and open the config.xml
2. Change the line
from: <Device>Bluetooth Video</Device>
to: <Device>USB Video Device</Device>

voila, now it doesn't try to access a bluetooth device, so it doesn't crash.

film based drinking games

A little ditty about how film based drinking games are supposed to work compared to how they are often designed. Let’s first have a look at what a drinking game is supposed to achieve:

Film based Drinking game (n): An activity designed to make the participants far drunker than they had intended through the use of previously unnoticed repetition within a favourite film.

Here you can see that the Collin’s dictionary has made a good point. Drinking games should get you drunk when you weren’t intending to. If you were willing to drink copious amounts of alcohol then you don’t need a drinking game. If you are not willing to do this, then you won’t want to do it by choice. What you need is an ambush.

So person A (let’s say Andy for simplicity), wants to get drunk with person B (Bill), but Bill doesn’t really want to drink too much. “Hey Bill” says A, “Let’s just drink and watch a film that you really like”. William will obviously agree to this. “Let’s make it a drinking game” suggests Andrew. Now Will is not about to say yes to this one unless he believes that there won’t be that much drink involved. There are now two options:

Option A: A furnishes B with a two page list of various events that occur in the film with the phrase “Drink when the following happens” at the top.

Option B: A says just one thing that if it happens in the film they must drink to.

Now option A will clearly have B spotting the dangers ahead and backing out. But option B has Bill thinking that he knows this film and can’t remember it happening too much, so it’s safe to take the challenge.

Sadly, far too many of the online “film drinking games” fall into the first category, with a massive page of detailed events listed that you must drink to. The other major problem with this is that even if you were game to try and do it, that you must stay sober and aware enough to constantly peruse a long list.

Instead let me give you an example of how I believe a drinking game should look:

Sin City.
Drink whilst the following is happening:
1. A colour is shown other than black and white.

That’s it. Bill will think “That does happen a few times, but is a fair challenge”. Before long he has drunk enough through being surprised at his underestimate of exactly how often this happens. Do try this one by the way. It’s a fun one.

Here are some other simple ones:
Blade: Drink along with vampires. Whilst a vampire is feeding, you have to be drinking.
Wayne’s World: Drink whilst anyone is talking to the camera.
Terminator 2: Drink during gun fire. If you’re less capable of holding your drink, drink whenever the kid’s voice cracks.
Lord of the Rings: Every time someone falls over
Dazed and Confused: Every time the kid touches his hair.
Saving Private Ryan Anytime anyone dies (Apologies for the bad taste)
Batman Begins: Anytime someone says gotham
Clockwork Orange: Any time someone uses a made up word

wiring for headset

I've recently had to rewire my Creative Fatal1ty headset. Following this, someone has asked how I did it as apparently the same thing has happened to them (following an entanglement with my chair, it ripped the cable apart where the mic and headphone leads join to make a single wire to the headset).

The wires available are:
from the mic port - white and gold
from the speaker port - blue, red and gold
from the headset - green, white, gold, red, blue.

The white is hidden inside the unshielded gold wire, and needs to be separated.

The diagram below should show how the wires match up. I did this through trial and error and it seems to be back working at 100%.

dah da-da-daaaaa! 100th post.

Invention time again. Though I think a better phrase might be innovation. On my list of things to do before I die (alongside of 'make a necklace from a bullet that I have been shot with' and 'fire someone'), is 'Make a gauss or rail gun'. I'm sure that a lot of you haven't heard of either, and others will know it only from Half-Life games. Here's a quick layman's description, written by a layman.

A rail gun uses the magnetic force (called the Lorentz force), produced when a conductive object moves simultaneously along 2 rails. One of these rails is positively charged, the other negatively.

A gauss (or coil) gun uses one or more coils of wire around the barrel of a gun to attract the metal projectile towards and through it. These are often set up in sequence to produce a series of accelerating events.

I've seen the "ball bearing" gauss gun (http://www.youtube.com/watch?v=epf1AUvG32M), but I don't count this as a great life achievement to make one myself.

There's also a rail gun experiment (http://scitoys.com/scitoys/scitoys/electro/railgun/railgun.html), but this really isn't very "gun" like.

Instead I will try using a mixture of ring and cylinder magnets. Hopefully I can get the cylinder magnet to accelerate along a "run" of magnets

For a irritatingly narrated look at what rail guns can do, see here: http://www.youtube.com/watch?v=4OqlTXwLG40

Parts for my gun will arrive next week. Time will tell. Sooner or later... time will tell

Slovikian SIM slots and Soldering

So time is ticking away before I am forced to leave (by my own misguided sense of adventure), to the opposite side of the world to meet my match against giant bugs. The glone Mk2 is looking more and more like it won't get finished before I'm off.

In the mean time I can at least update you and make a record of how far I reached so that I might be able to restart it when I get back.

A couple of major stumbling blocks so far:
The LCD soldering is MASSIVELY fiddly. I would seriously advise anyone who is thinking of doing something similar to ask a friend who does this professionally to give their advice or just do it for them. I think the ideal would actually to use soldering paste from a syringe that is set using a heater. The biggest issue of course is that if I allow the solder or wires to touch more than one connector, it will short the screen. It doesn't help that I can't get the solder to even apply to one of the connectors because, I assume, it is perfectly flat.

Using ribbon cable isn't as trouble solving, so much as trouble causing. It may look nice when it is all said and done, but to have nice neat flat ribbon coming from the box means that all the wires have to be kept together and split when they reach their contacts.

The 3310 does not use a common ground for its buttons as I had initially hoped. It's not even neat. The common grounds (for reference), are:
- up, down, 3
- Select, 2, 5, 8,
- Cancel, 1, 4, 7, *
- 6, 9, #, 0

Madness! Well that's how it looks to an outsider like me, but Nokia aren't the only ones to do this so I guess they must know a reason for this complication. It does leave me with some 36 wires coming from the arm box to the hand box for splitting up. Gah! Somehow this "simplified version" has exploded from innocence to a world of detailed electronics and colour coding of everything to maintain sanity.

Some pics of components:


The tactile switches used on the fingers (pen for scale)


The armbox getting a lick of paint. It's going to be metallic when finished.



The SIM card holder (all the way from Slovakia).

Progress is slow but steady...

So the parts are arriving and assembly has begun. The two time consuming / fiddly bits that I am yet to do and rather actively avoiding are:
i) Soldering the wires to the phone's PCB (I've managed to break a phone in the past on this bit).
ii) Cutting and stitching the leather. Leather is rather hard work and I need to get the fingers just the right size and shape to contain the tactile buttons and wires.

Other parts are coming along. I have created a rather novel way to turn on the phone using a key lock and then a pair of tactile buttons that must be "squeezed" to operate and power up the phone. I still love the idea of using an analogue meter, but they are just too big and cumbersome to be worthwhile.

The boxes have been painted, but I'm not happy with the colours (they look too bright and happy; not the sombre, rusted copper of many other steampunk gadgets).

The vibrate feature needs to be finalised. I like the idea of the vibrator sit against a cat bell, which should make it ring like an old phone (or closely approximate it).

I'll put some preliminary photos up here soon.