Social Engineering on Social Networking…

Its been a long while since I’ve posted anything, but in todays news how many of you out there are on Facebook and how many of you like to respond to these little gems:

“Red mushroom burger”

Or perhaps statuses that ask you to cut/paste in your answers:

Thursday Night fun… Six names.

Real Name: Michelle Sullivan

Soap opera name (middle name and street you live on): Isabelle Hemel

Star Wars name (first 3 letters of your last name, first 2 of middle, and last 2 of first): Sulisle

Superhero name (colour of shirt and item to your right): Grey mouse

Goth name (Black and pet name): Black Melody Pond

Rapper name (Lil and last thing you ate): Lil mushroom burger

Copy, paste and change if you wish to play too!

 

Both of these two things together often give enough information to people like me to enable me to steal from you, like stealing your Facebook account or your Hotmail account, or perhaps your iCloud account which then gives me access to your phone, location and photos… Maybe even your bank accounts….

Consider how many sites you visit and put in a load of details to ‘sign up’ and how many of those sites ask for additional security questions incase you forgot your password, then consider how much information you put in your Social Networking accounts that others can view…

One of the favourite questions always used to be ‘What is your mothers maiden name?’, and still is for many banks.  Here’s the problem in a nutshell: many people now have Facebook accounts and the parents of those people usually have Facebook accounts as well and how many of you have seen friends’ parents with names on Facebook such as, “Mary Johnson (nee Knowles)”.  Then how many look at the profile under the ‘About’ and see, “Sister, Dad, Mum” entries… because by default this information is viewable by fiends of friends….

Now taking all that in above along with friends posting “Happy Birthday, 40 today, can’t believe how old we all are now, congrats mate” etc (‘today’ being 24/2/2017) and that the ‘picture questions’ when shared from a page the answers are shared with the people on the page… consider what most people can see about you.  In the example I have written/posted above lets recap:

  • Real Name: Michelle Isabelle Sullivan
  • Date of birth: 24 Feb 1977
  • Favourite Colour: Red
  • My Address: Triq il-Hemel, Swieqi, Malta
  • My pets name: Melody Pond
  • What sort of pet: Cat
  • Mother’s Maiden name: Knowles
  • Brother’s Name: Stephen

Sound familiar?  What a bank might ask you on the phone for ‘confirming your identity’ by any chance?

How did I get all this you might ask… because not all is that obvious, well

“Name” is an easy one, but hey, need to know the full name, so my “Soap Opera name” gave me two details “Isabelle Hemel”, one of which was middle name.  That was verified because we also asked, the “Starwars Name” which use initials from each part of our name.

“Date of Birth”, easy but you might have missed it, I said I got wished a “Happy 40th Birthday” today (and probably got several hundred best wishes) all of which are posted with the permissions of the poster, *NOT* what permissions you have on your ‘Timeline’.  So being that I said “today” is 24th Feb 2017 and I’m getting “Happy 40” wishes that makes my Date of Birth 24 Feb 1977.

“My Favourite colour”, trivial, what was my “wand’s magic name” again? Oh that’s right, “Red mushroom burger“.

Social Engineering tip: ask other irrelevant details with the detail you want, people don’t spot they are giving something away that they might otherwise not, how many of you would answer truthfully if a stranger came up to you in the street and asked you, “What’s your favourite colour, and how old are you?”

“My Address” little more tricky this one, I’m sure you got the first one, my ‘Soap Opera name’ is “Isabelle Hemel but how did I get to “Triq il-Hemel, Swieqi, Malta”..?  Simple take a look at your timeline and look for the location information on most posts, on mine it says, “Swieqi” on a vast number of posts, if you look at Google maps and search for “Hemel Swieqi” that will give you the rest of the address (and even the postal code in many cases.)

How many of you have seen the “What’s your pet’s name?” as a ‘security question’ … well guess what… My “Goth Name” was “Black Melody Pond” and that just gave it to you!  How did I get to the pet being a “cat” though?  Well just go look at my photos, especially for ones with pets in them and you find I own a cat, and it takes very little to tie “Melody” to “a Cat“.

Mother’s Maiden name and Brother’s Name – well I told you that already, it’s on the “About” page of Facebook, not to mention that many people have mums that interact with them on Facebook and usually by sharing posts.  For example, how many of you have photos of you and your mum?  How many of those photos did you “tag” your mum in?

You might be asking, “But what about the ‘Rapper Name’ where does that fit in?” .. well remember what I said about, “ask other irrelevant details”.  It is bogus information, but it makes you feel better about giving me details you wouldn’t normally share…

Some of these details Facebook encourage setting better permissions on, but even with these ‘security checkups’ often the details are already leaked or are available to ‘Friends of Friends’… A study a while ago found most people in the world are 7 people away. What that means is if you go down 5 levels of ‘Friends of Friends’ (ie “Friends of Friends of Friends of Friends of Friends of Friends”) you will be linked to most people in the world

2015 Now that’s done, what happened and where to now?

So at the beginning of last year I made some resolutions… well not so much resolutions but goals (New Year’s resolutions tend to last only a few hours-days so I don’t do that…)

The …umm.. goals:

  • To cut down on Facebook usage.
    • Wish a ‘Happy Birthday’ personally not using Facebook.
    • Not to sit reading ‘Newfeeds’.
    • Not to post when I’m going to the toilet, or blowing my nose.
  • To cut down on helping others before looking after myself.
    • In past years I have run myself to the point of getting sick taking photos, helping people out, etc.
    • This year only doing stuff for people that look after me and are concerned with my health.
    • To allow people to join me in my life (share my life) rather than follow everyone else in theirs.
  • To treat everyone with the respect and attitude that they treat me (for better or for worse.)
  • To cut down the amount of time that I work (for my employer) to something closer to resembling the actual times/hours I am supposed to work (using the hours to look after my family and friends.)

So how did it all go?  Well a mix of both success and failure, the easier ones were a complete success, the more difficult and controversial not so much. ie Facebook a no brainer, some took offence, some didn’t realise, some followed suit.  Some people treated me with complete disrespect and bad (awful) attitude, but I couldn’t bring myself to return the feelings no matter how much I wanted to.

2015 In Review…

Michelle Proposes to Gabie
The proposal…

The beginning of the year began with a proposal just a few seconds into the new year…  I tried to make it the stroke of midnight but this in reality was never going to happen, so it happened with the first minute of the new year.  This I think is how everyone should start a new year…  Not a proposal of marriage, but to start it with a happy note: Start in the way which you intend on going on.

I find in my life that no matter how hard you will try to keep everything on a positive note, there will always be those who try and spoil things, there will always be a negative, 2015 was no different.  Within a few weeks we (Gabie and I) lost a bunch of friends.  Some closer than others.  Some didn’t like the fact we were getting married.  Some didn’t like to see us happy. Some people just have to ensure everyone else is as miserable as they are in their lives.  Some people are just unfathomable and are just better left to wallow in their own self pity.  The result was after a great deal of stress and angst Gabie changed jobs to avoid someone who was poisonous in our lives, not to forget she hated the job.

After that little upset was dealt with, Gabie set her heart, with my full support, on pursuing an ambition of hers… To teach again.  For this she needed a TELT (Test for English Language Teachers) course to begin the process and in February she took the course, she thoroughly enjoyed it, at least until the exam and the early start preceded by an anxious and therefore sleepless night.  We found later, as I expected, she had passed it.  We booked the TEFL (Teaching English as a Foreign Language) course so that she may continue with the dream.

Michael, his lovely wife Anna, and the two beautiful children with us in their garden at Easter.
The family… Michael’s.

Easter was the next point in the year when things happened and fortunately it was also good.  We headed to the UK to visit my family, first my mother in Great Yarmouth, Norfolk, then later my brother and his family in Mirfield, Leeds.  My sister came for Easter Sunday dinner with Mum so Gabie got to meet her then.

The Easter trip was a really good one as we found a great hotel, the Holiday Inn, Leeds-Brighouse… definitely on the list of places to stay!  (In fact we went back there at Christmas 2015 – more on that later.)

Next event was Gabie’s course, the May 2015 TEFL course and the resulting certificate (for those successful.)  A potentially stressful time, but  with the exception of Wedding plans I had managed to remove as many as possible sources of stress for Gabie, and this paid off as she also aced the course and got her certificate.

Attacked by a bouncer..

You’ll note at this point I haven’t mentioned a lot about me or what I have done, well that’s because there is not a lot to tell.  After a number of court events the case against the bouncers that had attacked me  was dropped because I couldn’t identify him as the attacker (when you’re attacked from behind and kicked in the back of the head it’s a tad difficult to identify the attacker) and it was obvious that he had friends as none of the witnesses – even the police witness – stepped up to identify him and the CCTV footage was mysteriously absent… apparently for the hour when the attack happened… apparently the system malfunctioned… as is often observed when its the staff being prosecuted.

On the work side of things I was not following my goal and was doing many many hours fighting to get things working correctly at the OS level, leaving me to blog a warning about FreeBSD particularly for production use…

So towards the end of May we had good news and bad news in the papers, first was Ireland who became the first country to approve same sex marriage by popular vote.  The local papers reported on the problems in Swieqi started happening again, this time not only vandalism but also thieves… and again it was my CCTV video that resulted in the capture…  Much to the annoyance of some people, but the residents were very happy which is all that matters.

July would mark one of my few photographic events of the year where I covered XMA 2015, it also marked the ‘full steam ahead’ on the wedding plans.  It also made for a trip to Edinburgh, Scotland to visit the good people from ‘Your GP‘ who wrote medical reports that resulted (eventually) in me obtaining my GRC (Gender Recognition Certificate) which also gave me my new Birth Certificate…. all of which was a pre-requisit to getting approved for marriage in Malta.

August went with a blur, and was marred by an insult or two.  Won’t go into the details of who here, but suffice it to say, if you’re invited to someone’s Wedding it is polite to either attend or at least say that you can’t.  Similarly if you’re invited to a stag or hen night and you don’t want to deliver one of the biggest insults in Malta, you tell people you can’t make it, you don’t just not show up.  Lastly for the wedding you don’t tell people you never received the invite “a week before and it was too late” if you’re going to show it to other people who might actually tell the happy couple two-three weeks before!!!  Weddings in Malta are a personal thing and the bride side of the event is very very personal.

So September and the wedding itself, well what more is there to say…?

The vows captured by The Malta Independent.
The vows captured by the photographer from The Malta Independent on Sunday.

Well quite a lot, but not for this post.  Things didn’t go according to our desire, but according to the wedding planners design, despite our being quite specific.  The important thing though was we got married, and most of those people important to us were there to witness it.

Our honeymoon took us to Iceland, mainly chosen as a location as its spectacular and very difficult/expensive to get to if you live in Australia.

Panoramic View of Iceland on the way back to the Airport
Panoramic View of Iceland on the way back to the Airport

Iceland was rather different and brought some disappointments, it was very expensive for a lot less… especially considering it is ‘part of Europe’ .. the year before I spent less money on our holiday for more days in the Seychelles than our fleeting visit to Iceland where we seemed to spend all the time driving from place to place.  What topped off the whole experience was getting back to Malta and having Europcar Iceland try and accuse us of putting a massive dent in the roof of the car and try to charge us an addition €3500 to have it repaired….!  Worst part of the whole ordeal is that we had already read about various rental companies trying this on in Iceland, so we went with Europcar because we figured “Big well known name, will be reputable” … how wrong we were.  Result was we informed the bank they had no permission to make such a withdrawal and told them to take us to court.  They no doubt figured with me having photos of the vehicle before and after they would end up with a fraud charge in court and I haven’t heard from them since.  My advice in all such cases, always get evidence, and always stand your ground.  In most countries if you are innocent you can claim all costs associated with a lawsuit (legal fees, flights, hotels etc)…

So skipping to Christmas 2015, for the first time in many years, I did not put up the Christmas decorations, we knew we were going away and the house was a bit of a mess with everything that has been going on renovations wise so figured ‘why bother’.  That said, lights went up on the outside of the house, though in a diminished set.

So at the end of 2015, despite haven attended court several times against both defendants, “Sean Borg” and “Xelinu” nothing has progressed, every time the case has been adjourned, quite literally. So I am no further forward in reclaiming either my truck or bike, though I have a new lawyer on the team.  For those who have forgotten what this is about… A previous blog entry…

The ARMS saga is still going on, they finally just 3-4 weeks before our wedding decided they want to talk to me about the rates.  They had to wait until I got back from honeymoon as I was way too busy to deal, and they agreed I should be on commercial rate but insisted only from the point of the March 2012 telephone call… some 18 months (and €15,000 later.)  They have told me that if I supply paperwork on older forms than I have currently found then they will reconsider… I have so far found 8 forms of various different revisions (though plenty from 2011 and 2013) .. and have 3 more boxes of paperwork to review.  The problem being there, is that there is half a tonne of concrete slabs in front of the boxes which was supposed to have been removed already.. didn’t stop them threatening to cut the power over Christmas, or adding nearly €300 in ‘other charges’ which in the fine print was for ‘legal services’… next thing for me is to charge them for the legal services relating to the fact they *still* are billing me on the incorrect rate and charging me interest on the invalid bill, and without a credit contract or credit control…. and they have the audacity to threaten me when they are illegally charging fees against an account they have failed to bill.  (Note: a judge confirmed my case as stated in December 2013, they are trying to negotiate a change to that judgement.)

Anyhow so there you go 2015 in a nutshell, the only thing I haven’t covered is I’ve changed from doing 70(ish) hours per week for my employer to more like 45 hours per week this has had a *massive* difference… nothing new has been developed by me, my paperwork has been done when other things have gone the wayside, and visa versa.  Finally with all the failures of the network most of the time I have had has been wasted trying to fix other peoples’ problems just so I can actually do my job.  Good job the service I am responsible for is in my control and not the control of others or the entire service would be long dead and gone by now.

Here’s hoping 2016 will bring more success.

Musings on Copyright theft… well Torrenting and other things…

So here I am in Malta, where the local channels on TV are mostly in Maltese, all two of them (unless you want to include the political ones)… The DVDs and Blu-Ray available are a small selection of what is out there (and none of what I want)… So what’s a girl to do..?

Well 4 years ago I got a Dreambox and pointed the dish at Astra (28.2E)… and got British TV… well until they put Astra 2d up then I had to move to Sky channels (also British) but upon trying to get a Sky card to legitimately pay for what I was watching I was refused… point blank… so I upgraded to a motorised unit and a 1.2m dish and had a look at Europe….. Oh the channels it opened up.. I continued….

Fast forward to Sept 29, 2013 and Astra 2e was launched, and predictably in early 2014 channels started getting migrated to the new satellite… Of course I still can’t buy a card without a UK address (as if I would want to live there with the current political climate!)… So I did the next best thing… Meet “Colossus” my 48T storage server… I started torrenting…..

Not something I wanted to do, but it fit the bill, I was able to watch my favourite TV programs in English, when and where I want… I still watched FTA British TV with the 2.4m dish “upgrade” I treated myself to along with a number of Sky channels including the movie channels using card-sharing…. something I don’t actually want to do, but it is the only option.

Fast forward to March 2015, Astra 2e is put into full service and movie channels and most of the FTA channels are now on the Northern footprint and “sex hotlines” seem to be the order of the day for the European footprint, so now I am virtually completely reliant on Torrents for all my TV and Movies… Guess I finally succumbed to the dark side (well is it really “Dark”? given that I wanted to pay, and I was denied, then after I found a solution, that has been denied now, I went to the “Dark Side” and joined the P2P cloud and now with my 100M Ethernet to the ‘Net’ I share and share alike to see the programs I’m happy to pay for….n Is that really “Dark”…?)

So what’s this post about, well some (DMCA/MPAA idiots) will consider it a confession of a criminal….? Really is it though?

I want a service, I was denied that service, so I found the next best thing, and because it is a “soft” target “illegal” service it was also denied to me by technical means (I’m not going to put a 4.3m dish on the roof!).. so I went to do what everyone else does (you know what they say, “If you can’t beat them, join them!” not because I want to but because it’s my only option… and guess what… it’s better than the “Sky” service I was willing to pay some £70+ per month for!

Now when I want something, I just download it, because it’s a hell of a lot less hassle than flying to the UK to go watch it.

So my message:

Take note DMCA/MPAA/Sky and other providers, if you want to stop the pirates stop making more of them by blocking those who would pay for the service!

Oh and Foxtel, take note: Limiting Grimm and the likes to those who get “Full Subscription” is doing the same thing, people will download it because they *can’t afford* to pay you for your top subscription (and in reality if they only want one particular program, why the f**k would they pay for it?)

Give the people what they want for a reasonable price and pirating will go away… Screw every last $0.01 in profit and people will find alternatives they can afford.

(even Microsoft worked out they couldn’t stop the pirates and in the end it was causing them more trouble than the lost revenue through reputation issues!)

Comments welcome!

Thoughts on the “Spring Hunting” vote..

Lets preface this with the line: I hunt and shoot and would vote “NO” if I could vote…

I will still hunt and shoot even if the “NO” vote wins. Hunting and Shooting as I do takes a lot of skill and is very demanding. My weapon of choice is different from the average hunter though (which is what makes it a lot harder)… Here’s the results of my shooting:

Maltese hunters target passage Spoonbills

Mark Sultana also shot a few and the Times of Malta posted the results of his hunting… (which if you click the photo you’ll see more and you will see the skill level is so high that when in flight getting the results is significantly more difficult.)

Spoonbills shot, BirdLife to protest to EU after Spring hunting decision

Oddly enough it seems there are many like me that enjoy hunting and shooting, and we can quite legitimately and legally hunt and shoot protected birds as well as non protected birds…

Pity the “YES” vote chooses to show people crossing fields with not a bird in sight, after all isn’t that what they are in favour of?

Pity the “NO” vote feels the need to post all the blood and gore of birds that have been blasted out of the sky being carried by tree huggers and the likes.

Pity the church (which seems to play politics here in Malta on items like Same-Sex marriage whenever it feels like it, yet) don’t seem to care that a “YES” vote means legitimising the killing of God’s Creations FOR FUN….

When it comes to voting on 11 April, don’t vote how people tell you to vote, don’t allow people to tell you how to vote, vote with your conscience… i.e. what you really feel is right, if that means vote “YES” then do it without worry, if that means “NO” then vote “NO”, the point of a referendum is to allow *YOU* to choose for yourself!

(And for those people whom their family and/or friends are being pressured into voting “YES” or “NO” just remember when it comes to voting, it is your choice, tell them what they want to hear, then when you get into the booth, tick the box *YOU* want to vote for. Remember, it’s YOUR vote not THEIRS!)