Navigation

JCI

Lijit

 Subscribe in a reader



Add to Technorati Favorites


My LinkedIn Profile:

View Kai Røer's profile on LinkedIn

how-to

Discovering spoof email

Discovering Phishing and other attempts to empty your pockets may not be the easiest thing to do.

Most of us regularly receives emails asking us to verify our bank account, eBay, PayPal and other services by clicking a link. And unless you are on the alert all the time, it is easy to end up with empty pockets.

eBay has produced a nice tutorial where you are told how to spot a fake, and how to deal with it. The tutorial is eBay focused, but the actual methods are the same.

If in doubt - look at the tutorial!

HOW TO: Use Facebook for intelligence work, Part 1

This how-to describes in detail how to collect live, real email addresses from live, real people around the world. Most importantly, it will show you how you can collect 10 000 e-mails in less than 5 minutes work!

In addition, this How-to will help you collect additional information about your target: like photo; full name; list of friends; and potentially also mail address; phone numbers and list their favourite books.

So let’s get on with it!

 

1. Set up an email box on Yahoo, Google or similar tool

This is easy. Just pop on over to; Yahoo Mail; Google Mail; or any other free web based e-mail services out there. I know you are able to set up the account without my help.

Get back here and move to step two when you are done!

Set the e-mail to automatically forward all e-mails to a different account, preferably on a system you can control – either directly, or by POP/IMAP. You want to do this to save you some work later one!

You do not want to use your own name, though, but you knew that, right?

 

2. Get a Facebook (or pick any other social networking site) account

Just register with a plausible name (Jim Johnson, Donna James or similar). This is free, and typically available to anyone, and this is where you will meet your victims. Consider using the same name as in step one, this adds to credibility.

TIP: You may consider using a western name, preferably a woman name, as it sounds less daunting and more secure.

Now, it is out of the scope of this How-to to discuss how to set up your account. So, I just skip on to the next part, and you do too as soon as your Facebook account is up and running!

 

3. Set up a group on Facebook

And yes, you guessed it; how to set up the group is out of the scope of this group. But believe you me, it is plenty easy!!

Give it a winning title - Free gift! Or: Free trip to Dubai!

Why you need it? This is where you will plant your seeds of seduction – where you will promote your give-away, and where your victims will understand why it is so important to give you their e-mail address for free – no strings attached!

So, now you got a group on Facebook. Time to use it!

 

4. Add a prize!

When you want something, you should always offer something. The bigger, and more realistic, the prize, the better it is! Here is one example:

Image: The teaser!

Yes, I noted more realistic above, I know…But – the purpose is to offer something that is realistic to your victims – and they are not as smart as you are, obviously. Thus, this one count as realistic.

And, unless you really want to do so, there is no need to actually give away the prize. I would strongly suggest you do NOT give it away, and use it yourself instead. Or spend your cash on something else. Your victims will never know they did not win.

Period.

 

5. Ask for something simple/cheap compared to the prize

By asking for something that is perceived as not dangerous to give you – like an e-mail address – you are more likely to succeed. But we do now that most anyone will be happy to share their favourite password if you give them a chocolate, so do as you like. On the other side, when you get the e-mail, you got plenty of opportunity to ask for more later on too.

 

So go ahead and ask for it! Make sure you add your collecting e-mail box where they can send their request for the prize, giving away their name and e-mail. Put it out there – like this:

And voila – now you got a large amount of e-mail addresses available. Addresses you can use to send nice offers of pills, travels and other stuff your customers pay you to offer to your list!

 

6. Collect and use

Now you have a large amount of e-mails on your account, it is time to download and put them to work. By installing any kind of e-mail harvesting tool on your e-mail client (many available, find your favourit), you are now able to take the e-mail addresses and their corresponding names from your in-box, and into a database tool.

And as e-mails keeps coming in, your database grows. High quality e-mails with real people on the other side. A great value to spammers.

So start selling it to the highest bidder!

And if someone complains about getting spam? Well, that is not what you are doing, of course. You only provide your customers with fresh e-mail addresses with real people on the receiving side!

The emails are collected, and you may now use them to send out outrages offers of pills, lottery winners and other nice-to-have stuff. But, why stop there?

Get back tomorrow to read about how to build a complete profile of your targets! That part is a Bonus – where I tell you how to collect more than only the e-mail and name of your victims – where I tell you how you can build a full profile of your victim!

Parents securing children - 10 points to secure your kids use of the Internet

Children tend to be extremely adoptive and great learners. They are innovative and they dare to try. Their whole being seems to be based on one thing only – to try out new stuff. Thus, there is no chock to any parents out there that most children outdo their parents when it comes to using computers – on- and offline.

The interest children (of all ages) put forward sometimes also turns in a bad direction. Children use Facebook and similar services to ditch out negative comments of classmates and friends. Comments like “You look like shit on that picture” may easily be perceived just a negative as a blow in the stomach out in the courtyard.

The question arises – what can we as parents do to avoid this? Three things come to mind:

  1. Avoid all exposure to the ‘net and computers. Doable? Probably, but will be tough. Smart? Sure, if you want your kids to be left outside. Desirable? Not unless you enjoy sticking your head in the sand.
  2. Leave the kids do whateva. Doable? Sure, just look the other way. Smart? Sure – just don’t act surprises when the police, child molesters and other visitors knocks on your front door. Desirable? Not if you care.
  3. Be an active part of the experience. Doable? Might be hard, but absolutely! Smart? Obviously – it will require some investment in time on your part, but you will learn a lot of computers and the ‘net in general, you will learn a lot about your kid(s), and you may be able to share your opinions and common sense. Desirable? Well, if you need ME to answer for you, you may want to review the two other options…

 

So how can you take active part in the experience? In the workshops I run for parents, I make the parents come up a few simple rules. Usually these rules follow these lines:

  1. Take active part – by asking questions and being interested. Try to follow the use of technology – even though it seems abstract and difficult. Some possible means:
    1. weekly/monthly meeting to discuss what is going on
    2. Contracts – kids love contracts – add some control, and make sure you include incentives!
  2. Dare to ask questions if you do not understand what is going on. Also involve other parents.
    1. “Do you know the real names of your friends on MSN?” This question gives you an idea if your kid chats with friends, and may help you determine that “Jon” really is a 45-year old child molester in your neighboring county.
    2. How do you use “x” (insert Facebook, MSN, MySpace, or whatever you wonder about)? This question may help you understand what is going on, and how these tools are used – in positive and negative ways.
    3. Do you know if anyone at your school/class/group has received any negative comments/mails/threats? This question may help you determine if harassment is taking place.
  3. Take control. Make sure you and your kid understand that there are some rules, and that those rules are to be followed.
  4. Allow for privacy. Make sure your kid (and yourself) realizes that although you need to have a certain control, he/she has rights to privacy. Thus, build a relationship based on trust. (See point 1.b above).
  5. Encourage your kids to actively use the technology. Even if you do not understand it all (I know I don’t), you may still help your kid get the most of the ‘net by encouraging the use. Learn a few basic rules, like source control (i.e. the higher the number of sources on the ‘net, the higher the likeliness of the accuracy of the information), and that nothing is certain even if it says so on the Internet.
  6. Be aware of privacy rights, copyright notices and user licenses. Many services are free in monetary terms, but you have to give up some rights (information, use of images etc).
  7. Not only Gold is glimmering. Particularly true for younger kids – but the ads gets better every day. The point is to teach your kid to be critical, and not click on everything that seems cool/nice/shiny etc. Many security threats are installed simply by a click.
  8. Keep updated. Make sure that your computer, your software and yourself is updated at regular intervals. Your computer and software have patches – very often automatic updates that you only need to enable. To update yourself, take active part. Spend some time every week to read and study the technology, discuss with other parents and teachers.
  9. Use the technology – make sure to install and use the security software necessary. Firewalls, Antivirus, Antispam and similar tools are the bare minimum.
  10. Enjoy! Have fun! This may seem opposite to the other rules – but if you are not having fun, what is the point?

 

Please contact the author with your comments – and feel free to add your own ideas and rules.

Recent comments

Recent blog posts


The blogger is Kai Roer, a European Information security professional.

View Kai Roer's profile on LinkedIn
My status

Resources

Proud member of Security Bloggers Network, a FeedBurner Network.





As Featured On Ezine Articles