14 ms·

Operation Luigi: How I hacked my friend without her noticing

728 points by adamch 9y ago

deleted 9y ago
[deleted]
devwastaken 9y ago
This is the best commentary on a real-life social engineering hack I've seen. Whats really interesting is how he was able to be undetected mostly, because services like linkedin only had an optional requirement for forcing all devices to re-login when a password was changed, and that the hacked individual wasn't using 2FA on her email.
- albertgoeswoof 9y ago
  Agree this is excellent, and demonstrates how straightforward phishing really is. 2FA wouldn't save you here either, as that can easily be phished at the same time (except for U2F tokens).
  - jethro_tell 9y ago
    right the point of u2f is the physical token
    - albertgoeswoof 9y ago
      Sort of - the point of u2f is challenge-response on the key, which is tied to the URI or https session, which makes it impossible to phish without a browser exploit
    - vertex-four 9y ago
      The "point" of U2F instead of HOTP/TOTP is that the code you send to evilhacker.com can't be used on google.com - so getting a usable token by phishing is impossible. HOTP/TOTP are flawed in that you can send the generated code to evilhacker.com and they can use it to log in to google.com with you being none the wiser.
  - EGreg 9y ago
    How would you phish 2FA "at the same time"?
    - albertgoeswoof 9y ago
      You ask for the token as well and login with it at the same time. It'll trip you up later if it asks again (e.g. When changing a password or setting up mail forwarding) but your session cookie will be valid for quite some time.
- carroccio 9y ago
  Alex kuza55
- lemoncucumber 9y ago
  As I read the part about LinkedIn not mandatorily logging out all your devices, all I could think was that it wouldn't make a difference, because who actually engages with LinkedIn often enough to expect to remain logged in? Maybe I'm assuming too much that other people are like me, but I interact with Facebook as many times per day as I do per year with LinkedIn.
  - pmontra 9y ago
    There are people with the app installed on their phones. They are logged in all the time.
    - lemoncucumber 9y ago
      Naturally, of course there are. But the whole article was written about hacking a typical internet user, and my point was that the percentage of people who a) have the LinkedIn app installed on their phone and b) actually open it with any regularity is small enough not to be representative of a typical internet user.
_d4bj 9y ago
If there was no salt in the database, it looks Tumblr used a secret "pepper" (https://en.wikipedia.org/wiki/Pepper_(cryptography) https://en.wikipedia.org/wiki/Pepper_(cryptography))? Why wouldn't they include a salt as well? Or did the database dump just not have the salt column?
- IncRnd 9y ago
  > If there was no salt in the database, it looks Tumblr used a secret "pepper" It's absolutely clear that Tumblr did not use a pepper to create the dumped hash values in the article. Multiple users had the same hash, and most of those users had the same password as each other on another site.
  - ameliaquining 9y ago
    A pepper is shared among all users of a site. That's what makes it different from a salt. Or are you saying that the exact same hash was found in multiple separate database dumps? I didn't see any indication of that in the article.
    - IncRnd 9y ago
      That is not the cryptographic definition of a pepper.
      - ameliaquining 9y ago
        It seems to be how it's typically handled in practice. Example: https://blogs.dropbox.com/tech/2016/09/how-dropbox-securely-stores-your-passwords/ https://blogs.dropbox.com/tech/2016/09/how-dropbox-securely-...
        IncRnd 9y ago
        I understand your point, but a close reading of the dropbox article shows a qualified pepper they term "global pepper."
iiv 9y ago
While slightly enjoyable (for the first few paragraphs) I couldn't finish reading it. The author is trying _way_ too hard to be funny. I suppose it is written to another audience, perhaps the people that use tumblr find this funnier.
- philbarr 9y ago
  I ended up reading it like I read man pages. By which I mean, I skim through it really quickly and then do something else.
- jwilk 9y ago
  TL;DR: phishing
- rsoto 9y ago
  Agree, that could have been a great article, but the cool bro attitude and writing style is just too much for me. It's hard to read if I'm rolling my eyes every 3 sentences.
- irl_zebra 9y ago
  Yeah, I got to the first "this isn't her real name but that's what journalists do..." and rolled my eyes. I thought that was a one time thing, but it continued. I'll look for a summary in the comments here.
- MBCook 9y ago
  That's what I thought at first but as I kept going I ended up enjoying it more and more as it was so blatant at poking fun at terrible hacker/script kiddie tropes. I will mention that with the number of footnotes Marco Arment's little in-place footnote pop-up script he uses on his blog and Ben Thompson uses on Stratechery would have been appriciated. I forgot how useful that was compared to 'true' footnotes on long articles with lots of them.
  - yoz-y 9y ago
    I think that they are using Bigfoot. Personally I prefer the jQuery-less version littlefoot.
deleted 9y ago
[deleted]
westmeal 9y ago
The part that perturbed me the most about his account is he didn't even backtrace the IP floppy disk log via the DHCP authenication backtrace. It's a rookie mistake, but so is misspelling 'nothin personnel kid'.
sleazybae 9y ago
my notes from this article: * don't use linkedin * don't use hotmail * always use 2FA * use complicated and different passwords * security questions matter * avocado toast? * change passwords periodically
- web-dev-123 9y ago
  avocado toast!
- PhasmaFelis 9y ago
  > avocado toast? A couple of Australian doofuses said that it's millenials' own fault they can't afford homes, because some of them buy expensive meals sometimes. http://time.com/money/4778942/avocados-millennials-home-buying/ http://time.com/money/4778942/avocados-millennials-home-buyi... The internet has had a lot of fun with it. https://www.washingtonpost.com/news/food/wp/2017/05/15/dont-mess-with-millennials-avocado-toast-the-internet-fires-back-at-a-millionaire/?utm_term=.199c5f071b93 https://www.washingtonpost.com/news/food/wp/2017/05/15/dont-...
  - fgandiya 9y ago
    I found it rich the millionaire said that given that his grandfather gave him $34k to buy as house(0). (0):https://www.cnbc.com/2017/05/16/millionaire-tells-millennials-to-stop-buying-avocados-to-afford-a-home.html https://www.cnbc.com/2017/05/16/millionaire-tells-millennial...
    - Sleeep 9y ago
      Steps to becoming a millionaire: 1) Family gives you money. 2) Don't squander the money on hookers and blow. 3) Use life opportunities that having wealth brings to create more wealth.[1] 4) Congrats, you're a millionaire. Anyone can do it! [1] They say "you need money to make money" and speaking as someone who has both lived with no money and now lives with lots of money, it's sooooooo true. The more money you have the easier it is to acquire even more money.
  - 9y ago
raybb 9y ago
This post was at bit hard to read with the buzzfeed-esque jokes and writing style. Here's my summary: 1. Someone gets permission to hack their friend 2. They find their email / phone number online 3. They lookup old password leaks for the email (passwords don't work) 4. They end up setting up a fake page to phish their friend (it works) 5. They wait until their friend falls asleep to reset the twitter password 6. They make their friend follow a bunch of fake Mario accounts on Twitter 7. Friend notices, they meetup to swap stories (the friend doesn't follow the fake Mario accounts)
- TeMPOraL 9y ago
  I think the details were pretty interesting, so let me expand your summary: 1. Someone gets permission to hack their friend 2. They find their email / phone number online 3. They lookup old password leaks for the email 3.1. They find their password hash (salted) in the Tumblr dump 3.2. Tumblr turned out to use the same hash for everybody, so the author finds other accounts with the same hash, follows them to a LinkedIn leak (unsalted), and successfully recovers the password 3.3. The password turns out not to work (changed some time ago) 4. They end up setting up a fake page to phish their friend 4.1. First phishing attempt produces... the old password that is already known through point 3. 4.2. Second attempt is modified to reject user input a few times, producing another password, which happens to work 4.3. The victim grows suspicious of the phishing e-mails, but another message puts those suspicions to rest 5. They wait until their friend falls asleep to reset the Twitter password and (later, in the same way) capture their LinkedIn account 6. They photoshop their profile pictures to subtly include a Mario character, and they make their friend follow a bunch of fake Mario accounts on Twitter 6.1. When that doesn't get noticed, they redo the trick in a much less subtle way 7. Friend notices, they meetup to swap stories (the friend doesn't follow the fake Mario accounts)
  - GunlogAlm 9y ago
    I appreciate you summarising the article, thanks! I really couldn't stand the writing style the author used — I understand peppering your writing with jokes, but there were far too many attempts at 'humour' for my taste.
deleted 9y ago
[deleted]
Jonnax 9y ago
Social Engineering is a thing to watch out for. I've learnt to never answer honestly when they're asking stuff like "Where were you born?" "What's your first pet" etc. Instead I've made up some answers that I'll never tell anyone else. However that doesn't really make those details secure. 2FA is where it's at.
- StavrosK 9y ago
  > Instead I've made up some answers that I'll never tell anyone else. You should make up some answers like ighe9Chik9oorooy. That's what I do.
  - greenshackle2 9y ago
    Yes. My first girlfriend is ntnOFT(#9TNSONROe. I'll never forget you, ntnOFT(#9TNSONROe. We had such good times together.
  - Sleeep 9y ago
    A (random) English word is a better answer. Otherwise you can be phished by someone communicating with a phone rep. "For security what's your pet's name?" "I don't have a pet, I just put a bunch of random characters." -- Due to implementation these questions are actually sometimes hard to answer truthfully sometimes. My fav teacher has a . in her name but "special characters" are not allowed in answers. My pet's name is 4 characters, too short. How did I answer my first car? Year, make, model? Make? Year and model? Just model? Who can remember?
    - manmal 9y ago
      Only, how is the phisher supposed to know that I used a randomized password?
      - Sleeep 9y ago
        1) Guess 2) The HN post I replied to.
- 9y ago
jchw 9y ago
This has been posted 3 times in the past 24 hours. And so has the last thing this person has posted.
tomxor 9y ago
Hacked? cool, so what new unintended abilities has you friend gained?... yes i'm futilely rejecting the twisted definition perpetuated by the media and co.
chefandy 9y ago
"Hello and welcome to a blog post. I am writing it and you are reading it. It’s amazing what we can do with computers these days." Ugh. And I'm closing the tab. Appreciate the effort with humor, but you really should concentrate on being able to write something that's informative and enjoyable to read, and THEN try your hand at making your writing funny. The first sentence/paragraph needs to be a hook to get people interested, not some meta jokey blurb that doesn't have anything to do with anything.
- deleted 9y ago
  [deleted]
- ng12 9y ago
  The blurb did its job -- I can assure you that you wouldn't have enjoyed the rest of the post. It's not really about cutting-edge social engineering. It's just a funny story.
- TeMPOraL 9y ago
  > The first sentence/paragraph needs to be a hook to get people interested, not some meta jokey blurb that doesn't have anything to do with anything. The first sentence/paragraph needs to be the first sentence/paragraph. I'm personally sick of people optimizing things to "hook" their "audience". I much prefer when people simply write honestly and to the point. Not everything in life has to be a sales pitch. (This post was definitely not "to the point", but that's a stylistic choice of the author; I can respect that even if I don't like it.)
adtac 9y ago
Quite long ago, I read a fairly similar article (without this ridiculous commentary, of course). It went something like this: - a friend asks author to try and hack him - author tries a bunch of things in vain, finally decides to use a rogue wireless AP and does a MITM - identifies that notepad++ has automatic updates turned on and that it's over HTTP - creates a custom executable and writes a script (or something) to serve this payload when notepad++ tries to download a EXE - fakes an update (by returning true when notepad++ queries an HTTP endpoint for the latest version on startup) I'd be really thankful if someone could link me to this post. My usually powerful google-fu has let me down this time (I tried all _sorts_ of things). Notepad++ and MITM are the only things I strongly remember.
- svenfaw 9y ago
  This one looks like a good match: https://null-byte.wonderhowto.com/how-to/hack-like-pro-hijack-software-updates-install-rootkit-for-backdoor-access-0149225/ https://null-byte.wonderhowto.com/how-to/hack-like-pro-hijac...
  - adtac 9y ago
    While that uses a similar exploit, it's not the one alas! The article I'm referring to used a rogue AP where the author essentially created a pineapple-like device (or something; I'm probably misremembering this part). Thanks anyway! :) Edit: this was also more of a story than a how-to like guide.
taiar 9y ago
I had no problems with the humor parts. Good article.
saae 9y ago
It is just… great. Did you write that as it happened? It really unfolds like a novel.
shalmanese 9y ago
One of my favorite low key social engineering hacks is that I used to have a keylogger installed on every machine I own. Whenever a friend needs to hop on my machine to show me something, they'd log into an account they own and I would have their password. Then I'd do the same Luigi-like low key messing with them for a while. My favorite was when a friend had a VNC server running on their machine with control capabilities. I would sit next to them and subtly jerk the mouse pointer right before they were about to click on something and it drove them mad for a good 20 minutes before I couldn't hold onto the giggles anymore. edit: To add a bit of context, this was in the Windows 98 era, before the age of social media where we started putting all of our secrets onto our machines. And it was among a group of friends where everyone was trying to hack everyone else and pretty much anything was considered fair game. All of us were high school kids so there wasn't some super serious reputation we had to protect.
- anotheryou 9y ago
  You could easily see something you shouldn't want to see. Not cool.
  - phkahler 9y ago
    You can never un-see or un-know something. If you wonder just what kind of spot that can put you in, just keep hacking your own friends... I suspect any one of us would eventually see something we'd rather not have.
- ada1981 9y ago
  So you steal passwords from people who trust you and consider you a friend? If you were befriending someone with the sole intention of getting their passwords, that might be considered social engineering. If you are just exploiting the existing trust of friends and family for fun, that's sociopathy.
- mylons 9y ago
  what part of this is social engineering and not you just being a piece of shit?
- 9y ago
misingnoglic 9y ago
This is the same guy who did a great blog post about finding his friends tinder accounts by spoofing a new tinder service. They're absolutely hysterical, and I hope he keeps doing more.
- arprocter 9y ago
  https://defaultnamehere.tumblr.com/post/147747146865/stalking-your-facebook-friends-on-tinder https://defaultnamehere.tumblr.com/post/147747146865/stalkin...
apathetic 9y ago
> I use the incredibly cutting edge “Inspect Element” feature of the popular hacking software, Google Chrome, to edit the text of the email but keep the look. I used do this to fake screenshots as well. People assumed I edited them with Photoshop!
nsnick 9y ago
So phishing?. He did it with phishing.
callesgg 9y ago
Can help it but i find the article kind of creepy. Is he hacking her cause of romantic interests? Is he hacking her for the thrill? Is he hacking her to be able to write the article? Is he hacking her to show her that he can?, or to show her that it is possible, or to show her the world she is living in?
- Raphmedia 9y ago
  "I’m [...] with my friend Diana. [...] I ask her if it would be okay for me to try and hack all her stuff. She’s instantly visibly excited. I explain how this could result in me seeing everything she’s ever put on a computer ever. She tells me she thinks this is going to be “so good”. "
  - callesgg 9y ago
    "I ask her if it would be okay for me to try and hack all her stuff." Why would he ask that? It is strange. It is also strange how he tries to trivialize what he is doing. From his perspective it is trivial, but for some people it will not be trivial, why would he write an article about something that he believes is generically trivial. Another alternative is that he does not understand that it might not be trivial to some people. I did read the article... just quoting is probably not going to answer my question.
    - Raphmedia 9y ago
      > Why would he ask that? It is strange. To make a blog post about it. His blog title is The hacker known as "Alex" and his previous articles are similar to this one. See a discussion about one of his previous articles https://news.ycombinator.com/item?id=11130688 https://news.ycombinator.com/item?id=11130688
- Sleeep 9y ago
  Same reason lock picking is a hobby, because people enjoy solving "puzzles." The author got permissions of the target.
- 9y ago
peterwwillis 9y ago
So basically we've learned that the best defense to getting hacked is to not become a target of bored script kiddies, because those bastards are as ingenious as they are terrible writers.
- fenwick67 9y ago
  Really it's "look at the address bar".
  - peterwwillis 9y ago
    Pop quiz: without investigating, is https://www.capitalonecredit.com/sign-in/ https://www.capitalonecredit.com/sign-in/ a valid URL owned by Capital One? Second quiz: Without investigating, can you tell me when this domain expires, if it is registrar locked, if anyone can purchase this domain once it expires, what the mechanism used to verify a request for certificate for an existing domain is, if anyone can use a free TLS certificate service to create a valid signed site once they own it, and how much time it would take for this to happen if it was automated? (spoiler alert: the address bar will not tell you any of this)
    - TeMPOraL 9y ago
      > (spoiler alert: the address bar will not tell you any of this) Related: who on the Chrome team had that "bright" idea to dumb down the website security popup that shows when you click on the padlock next to the address bar? All the relevant info seems to have moved somewhere to Security tab in the Chrome Dev Tools...
pepelondono 9y ago
I actually found this post really good. The buzzfeed-esque jokes are made this way with the only purpose of helping raise awareness about online security and how anyone with a minimum knowledge of the Internet can easily breach into your accs.
rlglwx 9y ago
Even with her permission he is still breaking the law. Unlawful access to a system is not the user's prerogative but the system operator's.
djvdorp 9y ago
This has gotta be the funniest blogpost in years, yet so legit that it makes one sad how easy it is to pull this off.
megamindbrian 9y ago
I like the personality here.
TazeTSchnitzel 9y ago
An opsec screwup in that post has told me what's possibly the real first name of “Diana”. Opsec is hard.
- deleted 9y ago
  [deleted]
- deleted 9y ago
  [deleted]
- mihaitodor 9y ago
  He screwed up big time. You can google her tweets :|
nobleach 9y ago
>There are entire criminal industries built on the idea that people use the same password all over the place because nobody cares enough to remember more than a few passwords because they’ve got things to scroll on their phone okay. Or... because having to remember more than 3 random combinations of arbitrary letters, numbers, and a subset of extended ASCII, is not a tenable solution. Of course people use things like l33tspeak. We can remember words. I wouldn't say laziness has anything to do with it.
deleted 9y ago
[deleted]
darth_mastah 9y ago
I found it really enjoyable and rather funny. I really liked the attention to detail as well, e.g. replicating last 5 searches in order to stay stealthy. I imagine that lots of effort went into the hacking exercise and the write-up. Nicely done.
h2onock 9y ago
I really enjoyed this despite it being veeeeeeerry long, nice work!
kutkloon7 9y ago
I don't know if I'm in an especially good mood today, but it's quite a while ago I read something that I found as amusing as this. I'm actually really impressed by the phishing approach.
refrigerator 9y ago
If you liked this, the same guy has also written other stuff in the past - https://defaultnamehere.tumblr.com/post/139351766005/graphing-when-your-facebook-friends-are-awake https://defaultnamehere.tumblr.com/post/139351766005/graphin...
cwkoss 9y ago
I hope they tried '3ertyui'.
fiatpandas 9y ago
It's possible to discover this girls full name, twitter, Instagram, Linkedin, etc (full identity) based on a few careless clues left by the author. Very irresponsible considering he has revealed her password habits and other personal vulnerabilities. Loved the write up though.
- brad0 9y ago
  I didn't believe you at first but you're right. It's so easy to leak information these days :S
- sesqu 9y ago
  The author acknowledged as much in the footnotes: > If you really tried you could probably find Diana’s Twitter from these. You would then be a hacking genius, binary flowing through your veins, and have a CVE number assigned to your personally. I, a humble wannabee, am relying on your strict ethics to prevent you from, uh, stalking the friend of some guy whose blog post you read. You can do it. I believe in you. > Having said that, I don’t really have an overwhelming amount of faith in the idea that someone won’t try to do that. You can stay chilled out, dear reader, since before this blog was published Diana and I had a nice chat and fixed up her personal security.
mihaitodor 9y ago
Google cache is unforgiving: https://webcache.googleusercontent.com/search?q=cache:RzU97rMfqbQJ:https://twitter.com/i/moments/885059758667051009+&cd=1&hl=en&ct=clnk&gl=us https://webcache.googleusercontent.com/search?q=cache:RzU97r...
sauronlord 9y ago
What a loser. Clearly he has been friend zoned and he is playing a game. Lame.
cypher303 9y ago
Hey, I use inspect! I've run untrusted code every computing day of my life, so I guess that makes me a script kiddie. My advice, keep on script kiddie'ing, because it will definitely pay off.
T3RMINATED 9y ago
Nothing new I've done this about 200 times so far... heck there is even a database you pay some bitcoin and you can search all hacked db dumps.
AJRF 9y ago
VZerbst
trustworthy 9y ago
Well I enjoyed reading it, a little bit too much cringe, but still interesting articel!
sarahnagy 9y ago
just trying to let you guys know about my good experience online here, i got a little problem about my home and a close freind who try to go around trying shit talking to my man whenever aint home or busy at work, she's trying to ask him out and make sure we got divorced and she could claim my man.... I don't really buy the idea of recommending professionals online but I need the world to know n hear of a great man Martin (spy4me.leonard@ gmailcom) this is recommendation for a job well done for me and my friends by him, he's one of the best private investigator/hacker out there, he's trust worthy and a man of his words...., He's an Ex DETECTIVE n formerly work for the FBI..I was having issues with my spouse and businesses associate,my spouse was cheating while my business partner wanted to blackmail me, I was worried until I saw leonard on here...we talked a few times and he promised to help me and under 12 hour I was seeing their messages and also deleted conversations...I'm really glad I got in touch with him....he's into jobs like Whatspp,viber,Fb, clearing of criminal records ,Text,cal logs iCloud,bank hacks and so on.....get in touch with SPY4ME.LEONARD@ GMAIL..COM you can also contact him on TEXT +1(201) 373-6859...
amai 9y ago
Reminds me strongly of the hacking as shown in https://en.wikipedia.org/wiki/Mr._Robot_%28TV_series%29 https://en.wikipedia.org/wiki/Mr._Robot_%28TV_series%29

728 points by adamch 9y ago

deleted 9y ago

[deleted]

This is the best commentary on a real-life social engineering hack I've seen. Whats really interesting is how he was able to be undetected mostly, because services like linkedin only had an optional requirement for forcing all devices to re-login when a password was changed, and that the hacked individual wasn't using 2FA on her email.

albertgoeswoof 9y ago
Agree this is excellent, and demonstrates how straightforward phishing really is. 2FA wouldn't save you here either, as that can easily be phished at the same time (except for U2F tokens).
- jethro_tell 9y ago
  right the point of u2f is the physical token
  - albertgoeswoof 9y ago
    Sort of - the point of u2f is challenge-response on the key, which is tied to the URI or https session, which makes it impossible to phish without a browser exploit
  - vertex-four 9y ago
    The "point" of U2F instead of HOTP/TOTP is that the code you send to evilhacker.com can't be used on google.com - so getting a usable token by phishing is impossible. HOTP/TOTP are flawed in that you can send the generated code to evilhacker.com and they can use it to log in to google.com with you being none the wiser.
- EGreg 9y ago
  How would you phish 2FA "at the same time"?
  - albertgoeswoof 9y ago
    You ask for the token as well and login with it at the same time. It'll trip you up later if it asks again (e.g. When changing a password or setting up mail forwarding) but your session cookie will be valid for quite some time.
carroccio 9y ago
Alex kuza55
lemoncucumber 9y ago
As I read the part about LinkedIn not mandatorily logging out all your devices, all I could think was that it wouldn't make a difference, because who actually engages with LinkedIn often enough to expect to remain logged in? Maybe I'm assuming too much that other people are like me, but I interact with Facebook as many times per day as I do per year with LinkedIn.
- pmontra 9y ago
  There are people with the app installed on their phones. They are logged in all the time.
  - lemoncucumber 9y ago
    Naturally, of course there are. But the whole article was written about hacking a typical internet user, and my point was that the percentage of people who a) have the LinkedIn app installed on their phone and b) actually open it with any regularity is small enough not to be representative of a typical internet user.

_d4bj 9y ago

If there was no salt in the database, it looks Tumblr used a secret "pepper" (https://en.wikipedia.org/wiki/Pepper_(cryptography) https://en.wikipedia.org/wiki/Pepper_(cryptography))? Why wouldn't they include a salt as well? Or did the database dump just not have the salt column?

IncRnd 9y ago
> If there was no salt in the database, it looks Tumblr used a secret "pepper" It's absolutely clear that Tumblr did not use a pepper to create the dumped hash values in the article. Multiple users had the same hash, and most of those users had the same password as each other on another site.
- ameliaquining 9y ago
  A pepper is shared among all users of a site. That's what makes it different from a salt. Or are you saying that the exact same hash was found in multiple separate database dumps? I didn't see any indication of that in the article.
  - IncRnd 9y ago
    That is not the cryptographic definition of a pepper.
    - ameliaquining 9y ago
      It seems to be how it's typically handled in practice. Example: https://blogs.dropbox.com/tech/2016/09/how-dropbox-securely-stores-your-passwords/ https://blogs.dropbox.com/tech/2016/09/how-dropbox-securely-...
      - IncRnd 9y ago
        I understand your point, but a close reading of the dropbox article shows a qualified pepper they term "global pepper."

iiv 9y ago

While slightly enjoyable (for the first few paragraphs) I couldn't finish reading it. The author is trying _way_ too hard to be funny. I suppose it is written to another audience, perhaps the people that use tumblr find this funnier.

philbarr 9y ago
I ended up reading it like I read man pages. By which I mean, I skim through it really quickly and then do something else.
jwilk 9y ago
TL;DR: phishing
rsoto 9y ago
Agree, that could have been a great article, but the cool bro attitude and writing style is just too much for me. It's hard to read if I'm rolling my eyes every 3 sentences.
irl_zebra 9y ago
Yeah, I got to the first "this isn't her real name but that's what journalists do..." and rolled my eyes. I thought that was a one time thing, but it continued. I'll look for a summary in the comments here.
MBCook 9y ago
That's what I thought at first but as I kept going I ended up enjoying it more and more as it was so blatant at poking fun at terrible hacker/script kiddie tropes. I will mention that with the number of footnotes Marco Arment's little in-place footnote pop-up script he uses on his blog and Ben Thompson uses on Stratechery would have been appriciated. I forgot how useful that was compared to 'true' footnotes on long articles with lots of them.
- yoz-y 9y ago
  I think that they are using Bigfoot. Personally I prefer the jQuery-less version littlefoot.

deleted 9y ago

[deleted]

westmeal 9y ago

The part that perturbed me the most about his account is he didn't even backtrace the IP floppy disk log via the DHCP authenication backtrace. It's a rookie mistake, but so is misspelling 'nothin personnel kid'.

sleazybae 9y ago

my notes from this article: * don't use linkedin * don't use hotmail * always use 2FA * use complicated and different passwords * security questions matter * avocado toast? * change passwords periodically

web-dev-123 9y ago
avocado toast!
PhasmaFelis 9y ago
> avocado toast? A couple of Australian doofuses said that it's millenials' own fault they can't afford homes, because some of them buy expensive meals sometimes. http://time.com/money/4778942/avocados-millennials-home-buying/ http://time.com/money/4778942/avocados-millennials-home-buyi... The internet has had a lot of fun with it. https://www.washingtonpost.com/news/food/wp/2017/05/15/dont-mess-with-millennials-avocado-toast-the-internet-fires-back-at-a-millionaire/?utm_term=.199c5f071b93 https://www.washingtonpost.com/news/food/wp/2017/05/15/dont-...
- fgandiya 9y ago
  I found it rich the millionaire said that given that his grandfather gave him $34k to buy as house(0). (0):https://www.cnbc.com/2017/05/16/millionaire-tells-millennials-to-stop-buying-avocados-to-afford-a-home.html https://www.cnbc.com/2017/05/16/millionaire-tells-millennial...
  - Sleeep 9y ago
    Steps to becoming a millionaire: 1) Family gives you money. 2) Don't squander the money on hookers and blow. 3) Use life opportunities that having wealth brings to create more wealth.[1] 4) Congrats, you're a millionaire. Anyone can do it! [1] They say "you need money to make money" and speaking as someone who has both lived with no money and now lives with lots of money, it's sooooooo true. The more money you have the easier it is to acquire even more money.
- 9y ago

raybb 9y ago

This post was at bit hard to read with the buzzfeed-esque jokes and writing style. Here's my summary: 1. Someone gets permission to hack their friend 2. They find their email / phone number online 3. They lookup old password leaks for the email (passwords don't work) 4. They end up setting up a fake page to phish their friend (it works) 5. They wait until their friend falls asleep to reset the twitter password 6. They make their friend follow a bunch of fake Mario accounts on Twitter 7. Friend notices, they meetup to swap stories (the friend doesn't follow the fake Mario accounts)

TeMPOraL 9y ago
I think the details were pretty interesting, so let me expand your summary: 1. Someone gets permission to hack their friend 2. They find their email / phone number online 3. They lookup old password leaks for the email 3.1. They find their password hash (salted) in the Tumblr dump 3.2. Tumblr turned out to use the same hash for everybody, so the author finds other accounts with the same hash, follows them to a LinkedIn leak (unsalted), and successfully recovers the password 3.3. The password turns out not to work (changed some time ago) 4. They end up setting up a fake page to phish their friend 4.1. First phishing attempt produces... the old password that is already known through point 3. 4.2. Second attempt is modified to reject user input a few times, producing another password, which happens to work 4.3. The victim grows suspicious of the phishing e-mails, but another message puts those suspicions to rest 5. They wait until their friend falls asleep to reset the Twitter password and (later, in the same way) capture their LinkedIn account 6. They photoshop their profile pictures to subtly include a Mario character, and they make their friend follow a bunch of fake Mario accounts on Twitter 6.1. When that doesn't get noticed, they redo the trick in a much less subtle way 7. Friend notices, they meetup to swap stories (the friend doesn't follow the fake Mario accounts)
- GunlogAlm 9y ago
  I appreciate you summarising the article, thanks! I really couldn't stand the writing style the author used — I understand peppering your writing with jokes, but there were far too many attempts at 'humour' for my taste.

deleted 9y ago

[deleted]

Jonnax 9y ago

Social Engineering is a thing to watch out for. I've learnt to never answer honestly when they're asking stuff like "Where were you born?" "What's your first pet" etc. Instead I've made up some answers that I'll never tell anyone else. However that doesn't really make those details secure. 2FA is where it's at.

StavrosK 9y ago
> Instead I've made up some answers that I'll never tell anyone else. You should make up some answers like ighe9Chik9oorooy. That's what I do.
- greenshackle2 9y ago
  Yes. My first girlfriend is ntnOFT(#9TNSONROe. I'll never forget you, ntnOFT(#9TNSONROe. We had such good times together.
- Sleeep 9y ago
  A (random) English word is a better answer. Otherwise you can be phished by someone communicating with a phone rep. "For security what's your pet's name?" "I don't have a pet, I just put a bunch of random characters." -- Due to implementation these questions are actually sometimes hard to answer truthfully sometimes. My fav teacher has a . in her name but "special characters" are not allowed in answers. My pet's name is 4 characters, too short. How did I answer my first car? Year, make, model? Make? Year and model? Just model? Who can remember?
  - manmal 9y ago
    Only, how is the phisher supposed to know that I used a randomized password?
    - Sleeep 9y ago
      1) Guess 2) The HN post I replied to.
9y ago

jchw 9y ago

This has been posted 3 times in the past 24 hours. And so has the last thing this person has posted.

tomxor 9y ago

Hacked? cool, so what new unintended abilities has you friend gained?... yes i'm futilely rejecting the twisted definition perpetuated by the media and co.

chefandy 9y ago

"Hello and welcome to a blog post. I am writing it and you are reading it. It’s amazing what we can do with computers these days." Ugh. And I'm closing the tab. Appreciate the effort with humor, but you really should concentrate on being able to write something that's informative and enjoyable to read, and THEN try your hand at making your writing funny. The first sentence/paragraph needs to be a hook to get people interested, not some meta jokey blurb that doesn't have anything to do with anything.

deleted 9y ago
[deleted]
ng12 9y ago
The blurb did its job -- I can assure you that you wouldn't have enjoyed the rest of the post. It's not really about cutting-edge social engineering. It's just a funny story.
TeMPOraL 9y ago
> The first sentence/paragraph needs to be a hook to get people interested, not some meta jokey blurb that doesn't have anything to do with anything. The first sentence/paragraph needs to be the first sentence/paragraph. I'm personally sick of people optimizing things to "hook" their "audience". I much prefer when people simply write honestly and to the point. Not everything in life has to be a sales pitch. (This post was definitely not "to the point", but that's a stylistic choice of the author; I can respect that even if I don't like it.)

adtac 9y ago

Quite long ago, I read a fairly similar article (without this ridiculous commentary, of course). It went something like this: - a friend asks author to try and hack him - author tries a bunch of things in vain, finally decides to use a rogue wireless AP and does a MITM - identifies that notepad++ has automatic updates turned on and that it's over HTTP - creates a custom executable and writes a script (or something) to serve this payload when notepad++ tries to download a EXE - fakes an update (by returning true when notepad++ queries an HTTP endpoint for the latest version on startup) I'd be really thankful if someone could link me to this post. My usually powerful google-fu has let me down this time (I tried all _sorts_ of things). Notepad++ and MITM are the only things I strongly remember.

svenfaw 9y ago
This one looks like a good match: https://null-byte.wonderhowto.com/how-to/hack-like-pro-hijack-software-updates-install-rootkit-for-backdoor-access-0149225/ https://null-byte.wonderhowto.com/how-to/hack-like-pro-hijac...
- adtac 9y ago
  While that uses a similar exploit, it's not the one alas! The article I'm referring to used a rogue AP where the author essentially created a pineapple-like device (or something; I'm probably misremembering this part). Thanks anyway! :) Edit: this was also more of a story than a how-to like guide.

taiar 9y ago

I had no problems with the humor parts. Good article.

saae 9y ago

It is just… great. Did you write that as it happened? It really unfolds like a novel.

shalmanese 9y ago

One of my favorite low key social engineering hacks is that I used to have a keylogger installed on every machine I own. Whenever a friend needs to hop on my machine to show me something, they'd log into an account they own and I would have their password. Then I'd do the same Luigi-like low key messing with them for a while. My favorite was when a friend had a VNC server running on their machine with control capabilities. I would sit next to them and subtly jerk the mouse pointer right before they were about to click on something and it drove them mad for a good 20 minutes before I couldn't hold onto the giggles anymore. edit: To add a bit of context, this was in the Windows 98 era, before the age of social media where we started putting all of our secrets onto our machines. And it was among a group of friends where everyone was trying to hack everyone else and pretty much anything was considered fair game. All of us were high school kids so there wasn't some super serious reputation we had to protect.

anotheryou 9y ago
You could easily see something you shouldn't want to see. Not cool.
- phkahler 9y ago
  You can never un-see or un-know something. If you wonder just what kind of spot that can put you in, just keep hacking your own friends... I suspect any one of us would eventually see something we'd rather not have.
ada1981 9y ago
So you steal passwords from people who trust you and consider you a friend? If you were befriending someone with the sole intention of getting their passwords, that might be considered social engineering. If you are just exploiting the existing trust of friends and family for fun, that's sociopathy.
mylons 9y ago
what part of this is social engineering and not you just being a piece of shit?
9y ago

misingnoglic 9y ago

This is the same guy who did a great blog post about finding his friends tinder accounts by spoofing a new tinder service. They're absolutely hysterical, and I hope he keeps doing more.

arprocter 9y ago
https://defaultnamehere.tumblr.com/post/147747146865/stalking-your-facebook-friends-on-tinder https://defaultnamehere.tumblr.com/post/147747146865/stalkin...

apathetic 9y ago

> I use the incredibly cutting edge “Inspect Element” feature of the popular hacking software, Google Chrome, to edit the text of the email but keep the look. I used do this to fake screenshots as well. People assumed I edited them with Photoshop!

nsnick 9y ago

So phishing?. He did it with phishing.

callesgg 9y ago

Can help it but i find the article kind of creepy. Is he hacking her cause of romantic interests? Is he hacking her for the thrill? Is he hacking her to be able to write the article? Is he hacking her to show her that he can?, or to show her that it is possible, or to show her the world she is living in?

Raphmedia 9y ago
"I’m [...] with my friend Diana. [...] I ask her if it would be okay for me to try and hack all her stuff. She’s instantly visibly excited. I explain how this could result in me seeing everything she’s ever put on a computer ever. She tells me she thinks this is going to be “so good”. "
- callesgg 9y ago
  "I ask her if it would be okay for me to try and hack all her stuff." Why would he ask that? It is strange. It is also strange how he tries to trivialize what he is doing. From his perspective it is trivial, but for some people it will not be trivial, why would he write an article about something that he believes is generically trivial. Another alternative is that he does not understand that it might not be trivial to some people. I did read the article... just quoting is probably not going to answer my question.
  - Raphmedia 9y ago
    > Why would he ask that? It is strange. To make a blog post about it. His blog title is The hacker known as "Alex" and his previous articles are similar to this one. See a discussion about one of his previous articles https://news.ycombinator.com/item?id=11130688 https://news.ycombinator.com/item?id=11130688
Sleeep 9y ago
Same reason lock picking is a hobby, because people enjoy solving "puzzles." The author got permissions of the target.
9y ago

peterwwillis 9y ago

So basically we've learned that the best defense to getting hacked is to not become a target of bored script kiddies, because those bastards are as ingenious as they are terrible writers.

fenwick67 9y ago
Really it's "look at the address bar".
- peterwwillis 9y ago
  Pop quiz: without investigating, is https://www.capitalonecredit.com/sign-in/ https://www.capitalonecredit.com/sign-in/ a valid URL owned by Capital One? Second quiz: Without investigating, can you tell me when this domain expires, if it is registrar locked, if anyone can purchase this domain once it expires, what the mechanism used to verify a request for certificate for an existing domain is, if anyone can use a free TLS certificate service to create a valid signed site once they own it, and how much time it would take for this to happen if it was automated? (spoiler alert: the address bar will not tell you any of this)
  - TeMPOraL 9y ago
    > (spoiler alert: the address bar will not tell you any of this) Related: who on the Chrome team had that "bright" idea to dumb down the website security popup that shows when you click on the padlock next to the address bar? All the relevant info seems to have moved somewhere to Security tab in the Chrome Dev Tools...

pepelondono 9y ago

I actually found this post really good. The buzzfeed-esque jokes are made this way with the only purpose of helping raise awareness about online security and how anyone with a minimum knowledge of the Internet can easily breach into your accs.

rlglwx 9y ago

Even with her permission he is still breaking the law. Unlawful access to a system is not the user's prerogative but the system operator's.

djvdorp 9y ago

This has gotta be the funniest blogpost in years, yet so legit that it makes one sad how easy it is to pull this off.

megamindbrian 9y ago

I like the personality here.

TazeTSchnitzel 9y ago

An opsec screwup in that post has told me what's possibly the real first name of “Diana”. Opsec is hard.

deleted 9y ago
[deleted]
deleted 9y ago
[deleted]
mihaitodor 9y ago
He screwed up big time. You can google her tweets :|

nobleach 9y ago

>There are entire criminal industries built on the idea that people use the same password all over the place because nobody cares enough to remember more than a few passwords because they’ve got things to scroll on their phone okay. Or... because having to remember more than 3 random combinations of arbitrary letters, numbers, and a subset of extended ASCII, is not a tenable solution. Of course people use things like l33tspeak. We can remember words. I wouldn't say laziness has anything to do with it.

deleted 9y ago

[deleted]

darth_mastah 9y ago

I found it really enjoyable and rather funny. I really liked the attention to detail as well, e.g. replicating last 5 searches in order to stay stealthy. I imagine that lots of effort went into the hacking exercise and the write-up. Nicely done.

h2onock 9y ago

I really enjoyed this despite it being veeeeeeerry long, nice work!

kutkloon7 9y ago

I don't know if I'm in an especially good mood today, but it's quite a while ago I read something that I found as amusing as this. I'm actually really impressed by the phishing approach.

refrigerator 9y ago

If you liked this, the same guy has also written other stuff in the past - https://defaultnamehere.tumblr.com/post/139351766005/graphing-when-your-facebook-friends-are-awake https://defaultnamehere.tumblr.com/post/139351766005/graphin...

cwkoss 9y ago

I hope they tried '3ertyui'.

fiatpandas 9y ago

It's possible to discover this girls full name, twitter, Instagram, Linkedin, etc (full identity) based on a few careless clues left by the author. Very irresponsible considering he has revealed her password habits and other personal vulnerabilities. Loved the write up though.

brad0 9y ago
I didn't believe you at first but you're right. It's so easy to leak information these days :S
sesqu 9y ago
The author acknowledged as much in the footnotes: > If you really tried you could probably find Diana’s Twitter from these. You would then be a hacking genius, binary flowing through your veins, and have a CVE number assigned to your personally. I, a humble wannabee, am relying on your strict ethics to prevent you from, uh, stalking the friend of some guy whose blog post you read. You can do it. I believe in you. > Having said that, I don’t really have an overwhelming amount of faith in the idea that someone won’t try to do that. You can stay chilled out, dear reader, since before this blog was published Diana and I had a nice chat and fixed up her personal security.

mihaitodor 9y ago

Google cache is unforgiving: https://webcache.googleusercontent.com/search?q=cache:RzU97rMfqbQJ:https://twitter.com/i/moments/885059758667051009+&cd=1&hl=en&ct=clnk&gl=us https://webcache.googleusercontent.com/search?q=cache:RzU97r...

sauronlord 9y ago

What a loser. Clearly he has been friend zoned and he is playing a game. Lame.

cypher303 9y ago

Hey, I use inspect! I've run untrusted code every computing day of my life, so I guess that makes me a script kiddie. My advice, keep on script kiddie'ing, because it will definitely pay off.

T3RMINATED 9y ago

Nothing new I've done this about 200 times so far... heck there is even a database you pay some bitcoin and you can search all hacked db dumps.

AJRF 9y ago

VZerbst

trustworthy 9y ago

Well I enjoyed reading it, a little bit too much cringe, but still interesting articel!

sarahnagy 9y ago

just trying to let you guys know about my good experience online here, i got a little problem about my home and a close freind who try to go around trying shit talking to my man whenever aint home or busy at work, she's trying to ask him out and make sure we got divorced and she could claim my man.... I don't really buy the idea of recommending professionals online but I need the world to know n hear of a great man Martin (spy4me.leonard@ gmailcom) this is recommendation for a job well done for me and my friends by him, he's one of the best private investigator/hacker out there, he's trust worthy and a man of his words...., He's an Ex DETECTIVE n formerly work for the FBI..I was having issues with my spouse and businesses associate,my spouse was cheating while my business partner wanted to blackmail me, I was worried until I saw leonard on here...we talked a few times and he promised to help me and under 12 hour I was seeing their messages and also deleted conversations...I'm really glad I got in touch with him....he's into jobs like Whatspp,viber,Fb, clearing of criminal records ,Text,cal logs iCloud,bank hacks and so on.....get in touch with SPY4ME.LEONARD@ GMAIL..COM you can also contact him on TEXT +1(201) 373-6859...

amai 9y ago

Reminds me strongly of the hacking as shown in https://en.wikipedia.org/wiki/Mr._Robot_%28TV_series%29 https://en.wikipedia.org/wiki/Mr._Robot_%28TV_series%29