Archive for the ‘on-line’ Category

Neat eBay scam I discovered

Sunday, October 18th, 2009

Here’s a good scam!

Very nicely done, they only messed up in a few places.

Normally when you get a phishing attempt, from “ebay” or whoever, the fastest way to tell is to hover on the URL and see that it really links to “www.scammerhome.net”. This one avoids that, by using a cleverly crafted ebay “About me” page.

You can see it live at:

http://members.ebay.com/ws/eBayISAPI.dll?ViewUserPage&userid=Inssommia&JBR_W0QQitemZ26036QQssPage36QQssPageNameZWDVWQQrdZ1QQcmdViewItem&item=28011654654

DO NOT TYPE YOUR real DETAILS IN! Make something up. ;-) Take a look at the top bar of the browser page, and then do a ‘hard refresh’ (Ctrl-F5 in Firefox) and watch the slightly freaky way the page reloads.

It’s been very neatly done using a set of images and looking at the source, there is no javascript used at all!

The log-in (enter fake details) takes you to an ebay themed page, where they forgot to re-write the URL to ebay – it goes to http://plymouth.rtcubed.net/.download/secure/ which tries to get you to download some file with the name referenced in the email.

If anyone wants to take a look and report back what the payload is, I’d be interested.

(Bonus points for anyone who knows what the Google search you can still see was about!)

LockCon #2, at HAR

Tuesday, August 18th, 2009

Got back yesterday from a sort of Busman’s Holiday. We took 6 days off and visited a really brilliant technology and security festival, held every 4 years in The Netherlands. The event is called Hacking At Random, and, as the name suggests, involved a lot of people sat behind computers in a field! However, it wasn’t just hacking servers and sniffing traffic in the virtual worlds, it also included a large section on the physical world, including the latest developments with rapid prototyping, UAVs and, of course, locks. Not forgetting a free toasti with a free domain name and socially-engineered T-shirt!

For me, highlights included the talk about breaking the key control on the EVVA MCS, possibly the world’s most secure magnetic lock, for less than the cost of one of the locks, and the use of a rapid prototyping machine to create a physical plastic copy of the Dutch & German police handcuffs. (If you know what this means, you can get the STL file from http://ke.y.nu and then 3D print your own!)

I gave my talk on British lever locks, which was well received, and a Dutch locksmith did a short hands-on picking session to demonstrate just how insecure the local 4 lever locks are. Ray gave his lecture and hands-on about handcuffs, which is always very popular, whilst many others learned that the basic first level of home security, the 5 pin cylinder lock, was, for the cheaper locks, not very secure at all.

Most mind-blowing, however, was the impressioning championship won by Jos. Impressioning is the art of making a key to an unknown lock. This is tricky but once you know how, do-able. It took me 63 minutes, and only half the competitors finished within the hour time limit. The winner, however, came in with a time of just 87 seconds! Put into context, that’s about 12.5 seconds per cut depth! To put it another way, once set up, I take about half that time to copy a key on my key machine, whilst Jos was using a hand file and did not know the key cuts, only the lock. You can see the video at BlackBag.

So, a great time was had by all. There were also some private learning sessions, covering various things, which I will not be mentioning here. But if you gave them, thanks! We all learned a lot.

A new threat rises, in the (near) East

Thursday, June 25th, 2009

According to this week’s New Scientist, there is a new threat to our credit cards from Russia, which the banks and everyone else totally overlooked. Yet it is obvious, even without hindsight.

The why is obvious – millions of dollars there for the taking.

The how is very neat – a card is used to extract a printout of the other cards used, and their PINs, and it even encrypts the info so that the boss doesn’t have to get his hands dirty, and the foot soldier can’t steal the info for himself. Perhaps the funniest element is the fact there was also a way to have the cash machine eject the cash cassette! Surely anyone with a brain would see that as an obvious issue?

Windows is known to have many hundreds of thousands of viri, malware and trojan bits of software installed on the millions of machines in use, so how come did no-one at the banks think about how it might be an issue to use an ATM based on Windows?

These scams show that not only were most banks useless at their expert field of not going bankrupt, but they also messed up badly when working outside their chosen specialist subjects.

You can read the article in full here (though in a few weeks it will be subscribers only for the full article.)

Who are you telling you are going away?

Tuesday, March 31st, 2009

My advice to you last time about going away is to be circumspect in public and specific with those you know and trust. Especially be aware of systems like Twitter and Facebook, where your updates will often make it clear that you are not at home, and for how long.

Just in the last few days, the papers reported that a rather unpopular figure in the UK was targeted for a visit late at night, the “Fat Cat” banker Sir Fred. He was, and still is, out of the country – he left immediately after the scandle about his £13 million pension arose – and this was widely reported in the news. Once someone tracked down his address, which is a mater of public record and findable for a few pounds online, they could enter it into Google Maps, and, perhaps, StreetView. This gives them a very high resolution map of where they are targetting, along with, in StreetView, good enough photography that they can determine alarm box positions, paths, letterboxes, etc. without ever needing to go near the target address.

How close can we get? Well, the ever-useful Daily Mail published a nice aerial shot of his house, plus a map, and some high-res pictures of it, as well as the fact that his street is “something road, Edinburgh” in a peice decrying StreetView. This isn’t going to happen for most people, though. Generally, you’ll have to either find your own details to hide them, or someone else will find your details to victimise you (perhaps).

Here’s 240 Poplar High Street. I picked it at random. I know it would take me half a day to get to it from Bromyard, and that when I got there, I could park for up to 4 hours between 8:30 and 5:30, but not if I’m in a lorry, because I can clearly read the road traffic sign.
View Larger Map This level of detail means that very little that can be seen from the street is now safe from (remote) prying eyes.

Of course, for a very long time people have done “reccies” of targets. It’s what you do – you go and look around and work out what you want to steal, how to get in, where to run away to, where to park a car. The difference is that now, the CCTV at the site cannot find you, because you were never there. Google logs everything, of course, so you could in theory be tracked down, even if you use a proxy or two, but the odds are far lower than someone recalling a guy peering in the window two days before.

What to do? Well, re-assess, or have an expert re-assess, your security. I’d recommend an ICL member, as we are all reputable and know what we are doing. Some things will be trivial, others will be more expensive, and you will have to determine how much you feel you can justify to yourself for your security. However, for under £100 most places can have their general level of security massively improved. Give us a call!

Who do you tell you are going away?

Monday, March 30th, 2009

I’m back, refreshed from a week away, my first proper holiday for some years. Yet I left no online message on the blog to tell our customers. The reasoning is obvious, though some would argue there is no harm, it only takes a few moments to work out where we are based – click the “Contact us” page! – and, indeed, pull up my house on Google Earth (though not yet on StreetView)

From a security point of view, my answering machine simply said that everyone was busy, and to leave a message if we could be of further assistance. This didn’t prevent the phone from ringing at odd hours – three calls around 3am alongside the many others – but when it wasn’t always answered at least people knew most of the story.

Of course, all our large clients were informed, and most of our large clients remembered. :-)

Anyway, my advice to you about going away is to be circumspect in public and specific with those you know and trust. Especially be aware of systems like Twitter and Facebook, where your updates will often make it clear that you are not at home, and for how long.

Pickbuster authorised agent for Birmingham and the West Midlands

Friday, January 30th, 2009

Discreet Security has just signed up as the linked provider of the Pickbuster anti-bumping solution.

You can view our new microsite on the Pickbuster website to verify this: http://www.pickbuster.co.uk/Discreet Security

Pickbuster is a relatively simple and low cost solution to the problems presented by lock bumping. Lock bumping has been known for nearly 100 years in the close-knit locksmithing community, but with the growth of sites allowing user content to be easily added, this cat has truely gotten out the bag.  Google returns plenty of results, and a few videos, including mainstream news reports such as this one from the USA.

So, which locks are at risk? In the UK, every single white plastic uPVC door you see is a target, and over 99% of them are vulnerable. A few aren’t, because they are either broken, have unusually high security locks (as even most high security locks are easily beaten with this technique) or they have been treated with Pickbuster already. Perhaps more worryingly still, one “universal” bumpkey freely available online for a few pounds will open about 95% of all of these doors!

Wooden doors aren’t quite so vulnerable, as long as you are locking the mortice lock when going out, and dropping the snib when inside. Lever locks can be bumped, sort of, but it is a technique that has been de-fanged for any modern lever lock with a security rating. They are also far stronger than the latch alone, so do remember to turn that key on your way out!

If you are worried, and would like some free advice, have a read around this site, have a look online (that Google link above is a good start, as is the Pickbuster website) and feel free to leave a question in the comments or send us an email. Remember, we can treat your locks fairly quickly, and stop this threat, and also take a look at your properties security to see what other, often small, changes would enhance your security.

Site Updates

Sunday, February 17th, 2008

Finally we have had time to stop locksmithing and sit down to update the Discreet Security main website, following our move from the North West to the West Midlands. We also now have tenburylocksmiths.co.uk and bromyardlocksmiths.co.uk as well, which should help with the search engines and getting our new area more aware of our services.

We will try and fit you all in! :-)

Social engineering in action

Sunday, June 10th, 2007

A site I frequent, Lockpicking101.com, recently had a small competition, wherein one member challenged the rest to find out his first name, for prizes based on the time it took. He doesn’t use his firstname, and goes by his second name at all times, even on legal stuff.

So a lot of people started trawlling through the 1500+ posts he had made on the board, and the like. However, the challenge post included his place of work. But you could hardly just call him up and ask him his first name, though, could you? The challenge was only 2 hours old, and he’d never fall for that.

You could. Listen to this.

We’ve arrived!

Wednesday, April 25th, 2007

Ah! Fame at last! We have arrived on teh intarweb!

Just deleted 395 spam comments. All from the last two days! Some form of CAPTCHA shall be added forthwith.

Edit: Some form of CAPTCHA is in place already, but the bots seem to have wised up to it! Or else they learned basic maths… Time to hack it.

Hacking google maps revisited

Wednesday, April 11th, 2007

Turns out you can put a lat/long into Google maps. You need to use the following format: http://maps.google.com/?sll=53.616%2C-002.816

sll tells Google it is Lat/long, and then you enter it with  xx.xxx,yy.yyy format, same as usual. (%2C is the URL safe version of a comma)

When you press go, you will see a map of your grid reference location.