Kidimbo Grace, hard drives and a bad cheque

My friend Jonathan at Wrightway Computers recently had an interesting order from Uganda (no stores locally huh?), for 80 hard drives. Needless to say he had a bit of fun with them, especially when it was instantly noticable that it was a scam.

The covering letter they sent with the cheque should make it instantly clear to everyone;



To be honest, this comes as absolutely no surprise, bad cheque and all, as it's rather typical of the 419'ers to try and scam as much as they can, without getting noticed. Alas their Ugandan counterparts are a little less savvy, so are even easier to spot.

He doesn't have the original cheque anymore as the bank obviously wanted to keep that for investigation. They did however, give him a photocopy;



The e-mail addresses they used to contact him are;

payments@fsmail.net
kidimbograce@gmail.com

He did send them the following (amongst others), asking for proof of identity in the form of a video clip, but disappointingly, they never sent one, instead opting to stop dealing with him and "Just faxed the copy to bank not to cash it" (how nice).

Hi Grace
Thanks for the reply, I now have your address.

We do have 2.5” USB Drives in stock both 160GB @ £36.82 and 320GB @ £57.31 This is a special discount price as you are now a returning customer. We have just received a delivery of these items direct from the manufacturer and we are looking to move them quite quickly. If you are interested we have 200 of each item you can order them all or just a few.

Send payment as before if you like.

I still haven’t had a chance to go to the bank with your cheque and I really need that photo to verify your credentials, if you send me a video clip of you with a bowl of fruit on your head while dancing to the Macarena I will know it is from you.

Kind regards

Jonathan Wright

Alas poor Kidimbo didn't know what he meant, and was perplexed to have been asked for a video clip (claimed he/she had tried sending one but it hadn't worked), so my good friend Jonathan, being the helpful fellow he is, sent them the following to clarify;

Hi grace

I hope you enjoyed your time out of the office, it is nice to be able to spend your time out and about. When I get out I like to go diving up around the Scottish isles just off the coast of Muff. I also enjoy Haggis hunting, they are tricky little devils to catch with there odd size legs they can run round the hills quite quickly.

I should be able to bank your kind cheque by the middle of next week.

I realise the video clip is a strange request but my business partner Steven is demanding you send it. (his real name is actually Mr Ivor Biggin but he likes to be called Steven, well apart from Saturday nights of when he likes to be called Shirly) I am sure you understand and you will send the video clip very soon.

We are looking forward to do more business very soon.

Regards
Jonathan Wright

I must admit, I've had my share of fun with scammers, but this particularly ticked me. Excellent work Jonathan, and a good lesson to the rest of you, especially on how to spot them (and of course, which of their e-mail addresses to avoid ;o)).

PDF Vulnerability Now Exploitable With No Clicking

Sometimes a piece of malware can execute without even opening the file. As this is the case with the /JBIG2Decode vulnerability in PDF documents, I took the time to produce a short video showing 3 ways the vulnerability can trigger without even opening the PDF document.

The first 2 demos use a “classic” /JBIG2Decode PDF exploit, the third demo uses a new PoC /JBIG2Decode PDF exploit I developed. This PDF document has a malformed /JBIG2Decode stream object in the metadata instead of the page. All PDF documents used have just a malformed /JBIG2Decode stream object, they don’t include a payload (shellcode), neither a JavaScript heap spray.

Read more
http://blog.didierstevens.com/2009/03/04/quickpost-jbig2decode-trigger-trio/

Kudos to Celtic Ferret @ CoU for the heads up

Yipee, more e-mail problems

Just a note folks, it seems I've got sporadic problems with people sending me e-mails that are not getting through. I'm going to get in touch with my provider to find out whats causing it, but in the meantime, if you've sent me an e-mail and I've not responded, or send me an e-mail in future and I don't respond in 48 hours, it's not because I've ignored you - it's likely I've not received your e-mail, in which case, I can be contacted via the TeMerc forums at;

http://temerc.com/forums

PCWorld "reviewer" has their turn at talking bollocks

We all know we can't trust the bad guys, but it seems over the past few years, there's more and more so-called good guys you can't trust either - now including PCWorld who, instead of providing unbiased reviews, decide to falsify results to peddle their advertising partner (Symantec, surprise surprise), instead of allowing their users to have unbiased facts.

When are these idiots going to learn, they are supposed to be providing services/software based on their USERS NEEDS, and not based on earning a fast buck.

and now, PCWorld joins the ranks:
http://www.pcworld.com/reviews/product/44056/review/premium_security_suite_82.html

they vote their advertising partner, Symantec, top place. Avira did better overall, so they lower Avira's score based on a "poor" interface including -- hang on, folks! -- Avira is the only one of the eight tested software suites without the convenience of (groan) A TOOLBAR! Now Joe Plumber knows exactly what to look for in his security software's interface!

What irks me tremendously is that in their zeal to sell Norton by discouraging people from considering Avira, they erroneously state that the only support available for Avira is by emailing Germany & waiting for a response. So let me inform everyone that Avira maintains a very active and responsive forum IN ENGLISH. In fact, when I trialed Avira's Antivir Premium, I was so impressed by the level of support that I received at the forum, as well as with the antivirus software itself, that I purchased a license.

Read more
http://www.calendarofupdates.com/updates/index.php?showtopic=16253&st=50&#entry75363

Scams Target You - Protect Yourself

It’s Fraud Awareness Week here until the 9th of March, so plenty is going on in regards to helping people educate themselves, and report scams to protect others.

ScamWatch New Zealand has provided some useful examples of people being scammed which is always worth reading.

If you aren’t much of a reader, here’s the short version.

There are no guaranteed get-rich-quick schemes – the only people who get rich are the scammers.

1. DON’T respond to offers, deals or requests for your details. Stop. Take time to independently check the offer.
2. NEVER send money or give credit card, account or other personal details to anyone who makes unsolicited offers or requests for information.
3. DON’T rely on glowing testimonials: find solid evidence from independent sources (not those provided with the offer).
4. NEVER respond to out of the blue requests for your personal details.
5. ALWAYS type in the address of a website of a bank, business or authority in which you are interested - it’s safer.
6. NEVER click on a link provided in an unsolicited email as it will probably lead to a fake website designed to trap you.
7. NEVER use phone numbers provided with unsolicited requests or offers as they probably connect you to fakes who will try to trap you with lies.
8. ALWAYS look up phone numbers in an independent directory when you wish to check if a request or offer is genuine.

And if you want some further advice, here’s what I would add.

Read the full article
http://www.firetrust.com/en/blog/chris/scams-target-you

... and remember, just because you aren't in New Zealand, doesn't mean this does not apply to YOU!