Journal Entries By Tag: #hacking

Assorted journal entries with the tag #hacking.


My Cyberdeck

TL;DR — My custom "computer" from a future that never was...

👓 6 minutes

Posted: August 14, 2043

After spending the last few months collecting parts, I was finally able to piece together my new cyberdeck over this weekend, and I must say, Iā€™m pretty pleased with the result. Most of the equipment I used is vintage (or, as some might call it, ā€œoutdated junkā€), but it supports a number of different data formats and interaction modes, making it handy for a variety of uses.

The main unit is a Tec<Net Walkabout T4 portable terminal with an upgraded Sino-Logic 16 processor (replacing the original 12-core version). Additionally, I ripped out the old port interface module and replaced it with a new one from OdaCom that supports USB-6X, SimStims, about 12 different kinds of ISO-chips, TriD, and even HDMI-Classic (so I can plug it in to any of the old displays in my workshop). Unfortunately, the original display on the Walkabout was cracked, and since I wanted it to be portable, I had to replace the screen with a 20-year-old (pre-merger) Samsung Android that I hardwired into the display adapter. I mean, itā€™s only a Super AMOLED screen (so, only 2D content), but itā€™ll work for now (maybe Iā€™ll have better luck the next time I go to the E-Cyc center).

The cyberdeck, running a shell.

Software-wise, I decided to stick with what I know, and that was EncomOS. Iā€™ve been using that particular flavor of GNU/Linux since the Meta / Microsoft merger and the Zuckerberg Affair, and since I already had root access to the Walkabout, it was an easy update to make.

As I said, Iā€™m very happy with the end result, but I honestly I donā€™t know if Iā€™m finished yet. I was going to put a GPL Stealth Module in it, But I may wait until I actually need it (especially since the crypto-cops tend to hassle anyone carrying one anymore). Likewise, I could replace the display with a short-throw holoview, or even plug a set of Thompson Eye-Phones in to the Hub, but Iā€™m comfortable enough in both shell and 2D GUI to get by without VR for most activities (plus, since the optical data cord is hot swappable, I can always plug in the Eye-Phones in when I want the full XR experience).

Iā€™ve embedded some more images below, in case you want to see more. As I said, Iā€™m quite happy with the finished product, and have already started thinking about what to add to the next version.

Iā€™ll keep sharing updates on any future improvements I make to it.

The cyberdeck, booted into self-test mode.

OK, it obviously isnā€™t 2043 (yet), but the images above are real, and I really did ā€œbuildā€ a cyberdeck (several years ago, in fact).

At present, the ā€œbrainsā€ of the device is a Samsung Galaxy s23 smartphone, connected via USB-C to a hub. The hub, in turn, is connected to a TeckNet Heavy Duty back-lit keyboard via a USB cable and is physically attached to it via silicon and Sugru. A 2600 mAh power bank that I picked up cheap a few years ago is also glued to the keyboard, and a metal brace is attached to both the keyboard and power bank, giving it some stability, as well as a place for the phone mount to attach (via magnets).

Middle view showing power bank and USB modem.
Left side-view showing the modemā€™s phone jack.

The hub has 2 USB-3 ports (one of which is dedicated to the keyboard, but thatā€™s OK), a TF card slot, an SD card slot, a USB-C charging port, and an HDMI port. Overall, the device is lighter than a notebook but more tactile than a glass screen, and sits very easily on my lap.

Right side-view showing USB hubs, one with an HDMI out, and the other with an ethernet port.

I had originally intended to attach both the USB hub and phone mount to the keyboard via some kind of tab-and-slot sliding mechanism (not unlike how Joy-Cons attach to the Nintendo Switch), but I couldnā€™t find the hardware I would need to implement it. Still, if I do another one, Iā€™d like to explore that as an option, making the whole device more modular (being able to swap out different USB hubs for different needs, and maybe alternate mounts, so I could use a tablet instead of my phone).

I built it over the past couple of years, and actually went through several updates along the way (improving the hubs and phone holster).

Early prototype build.
WIP on the 'deck.

Iā€™m sharing it now because Iā€™m entering the Hackaday Cyberdeck contest (my entry). This post is mostly the same info thatā€™s over there.

Of course, itā€™s not perfect - itā€™s not as durable as Iā€™d like it to be, and itā€™s not exactly easy to carry. My hope had been to mount the whole thing to either some kind of metal frame or plate (a la a hiking backpack, but smaller), providing some much need structural support (and stable grips to hold on to), but I could never find what I was looking for. Plus, I built it before my current obsession with mechanical keyboards, so while the keyboard is nice, it doesnā€™t have quite the desired click.

But, all-in-all, it was a fun project to put together, and itā€™s come in handy more thana few times (when I was between machines, or waiting on repairs).

How well does it work?

Overall, I think it works well. Although the small screen limits some of its functionality, the relative simplicity of a phone-based system does lend itself to certain tasks, like journaling and shell-based interfaces (like MOSH), two things I like to use it for. A previous iteration of this design was powered by an S9 which even ran a web server (a virtual machine running nginx and nodeJS), and the keyboard was useful for direct access to the shell.

At the end of the day, the phone is a very powerful device in-and-of-itself, and the added functionality that comes fromt he hubs (whether for extra memory, peripherals, or even an external monitor

Plus, because itā€™s a Samsung phone, plugging it into a monitor activates DEX mode, a Desktop-like EXperience (see what they did there?) with multiple windows, background apps, and touchscreen controls (or support for an external mouse, if thatā€™s your thing).

[picture of the keyboard hooked up to an external monitor, running dex]

Running DEX on the 'deck.

Of course, it still has some practical issues - running the external monitor drains the battery from the phone, even when plugged in.

But the overall experience, as far as Iā€™m concerned, is quite #cromulent.

I even wrote most of this post on it.

Cyberdeck as writing machine.
WIP on this blog entry.

Does it support VR?

It does, or it did, sort of, but not for long.

Given that the phone is the brain of the ā€œdeviceā€, any USB-C compatible phone can be plugged into it. The previous brains for the device were a Samsung Galaxy S9 and S10, each of which could plug into a Samsung Gear VR.

Unfortunately, Samsung discontinued it, so it doesnā€™t work with the s20 (the current brain) or later. I keep hoping that these devices will somehow get ā€œopened upā€ with later non-standard firmwares and enable something like the failed Project DayDream to live up to itā€™s full potential.

Conclusion

In the end, I havenā€™t used it much - itā€™s too unwieldy to take anywhere, and if Iā€™m honest, I donā€™t do alot of mobile computing where it would be useful. I had planned to address the first issue by mounting the device on a metal frame, and maybe I will if I ever work on a v2, but for now, it remains sans handle or reinforcing structure.

And so it mostly sits, collecting dustā€¦ just a souvenir from a future that never was.

Atari BASIC Colleen (an 8-Bit emulator) running on the cyberdeck.
Termux (a shell emulator) running on the cyberdeck.

Hacked - Extortion Wall of Shame

TL;DR — I've received even more emails telling me that I've been hacked. Since I still don't believe their empty threats, I'm posting their bitcoin addresses.

👓 2 minutes

Since my last few posts about script-kiddies and the fake extortions they try to commit, Iā€™ve received upwards of 50 such emails, each with a different bitcoin address, and many with slight differences in text, style, or form, but all basically the same: an email from myself (gasp) claiming that I have been hacked, that some nondescript OS or ā€œdeviceā€ I own has some magical virus installed on it, and that, if I donā€™t pay the hacker a ransom in bitcoin, my life will be ruined.

However, I know from past experience that these messages are little more than spam, sent out en masse in hopes that they can rope in some poor sucker who falls for this. I know most of these are bogus from the beginning because the email I use for my phone is completely unrelated to the ones that keep receiving these messages. Other times, the email will make vague references to programs I donā€™t even have installed, again betraying their carbon-copied nature. In truth, I have never paid ransom, even though Iā€™ve personally received dozens of these messages, and my life has yet to be ruined by these lamers.

So, as a public service, I have included the bitcoin addresses for these script-kiddies, in hopes that some other would-be victim finds this page (possibly through a web search) and learns that they, too, can ignore this BS.

All addresses listed here have been reprinted as they were received.


====== BEGIN WALL OF SHAME ======
====== UPDATED: 2024-01-02 ======
1DYfqwqz7Tq93Fau61YFXBAoogQv56FvJz
1LbbzFmNMMFMwsketCSzxAur6yinXBSiQQ
185kB82fakN7BCDpcS9tfzbDc8uytm5Wo
13g3WtdxuoB9AVyy54QW9xxbDtFjE2iNHk
17WhVHdWCW3yNNAo4LXsPRpTCnhN8wVtG8
15NCWERN56DQNf4WiPLR2txgiEF2np5Q2g
bc1qvcsx0sjzqc9yy69qumjaa2jz57rr480a89tpxl
1Pp5DTCTRSzoFyaHbrSEWGDWZZRp3rMsWv
1DxrzqzwqDBw1jcHUZv1Qb9eFFfYzdiXCY
1MQj3F Sm2kcent MBiDfNZj AMP4VYf QRriC
12aJgkbT9o zAZnVwiKDg76 FNpS6FcCeVvS
19yaJM8qhsyXnwoQP7zQbMkqJStoMYxPmE
1EPeB1Ea1v1XAg7L2yFFuhifFsX1sswDKG
12nEVuGNtRFMVjeVmLtD4nt2sHX68S47yH
1M6WbcKrAu3WtyTSUz1hk4eaHRD3oUNKtp
15mSqySLsJ8MZqNQ7RfXiq54HGyt7uh3Cn
bc1qkudmdasfmlhkesgqxy7f3jtt22665wwgfsqrmq
1GwaVJAdZHQEJFdD1tpDw4KvYas1XAJyic
bc1q47rckymrjwrrld5gtpps2tshx429z2w4elwspn
1GyYujUxs2eJpECpYu3Ns6F4RvZqsp8NT6
1GdVKgGS8iXeSSrynTfHyDugrpchwVDmdZ
1AsRkzQSorZAc66fdXof9NHTNJdU4T8nC8
1FmKjxWybWDuoD17pKvKaVH81gb5HGBpyP
bc1qgfef9nlwffftl6m5qet95yxa0x7arah0h580gs
1GfBNY2DfHRQRuCHLRP1vNFUjGGLCtgTab
1DxxqP5uWPWsGgfaYwJ47wRYp1NH9tj1G2
1LzA9kzQkGDTYSfbbLE8gK5RAJ5ke32ntC
1771s891APz1wNKdn5fe3Vknmf5pN18cWu
12vuAcRSYDWuGHEVNVtQaEjBCBevps3ZcE
bc1qvksfej36d72yl46f4726yrpj9kjcgqq783ypl8
bc1qezg9c02afe3xadp9qqr0u7n8j7hlfjngv8d2f5
1GjZSJnpU4AfTS8vmre6rx7eQgeMUq8VYr
18eBGkYam1wjz1S77jz3VmADuYYFzhA3vB
376XVFQ2GDHow9kBDJ49Q3vRW7TC35L2Hx
142e8SgyTLnkvwkDkNNon9jMtKY4UDvQqr
14aFMWfDdBW9FpWxu8myFsXY7Pfy9fBp5C
17qQSJatXXj5DnjMLjNGXx9BT7NUhqimRx
1JRfE57ZF8Eaqa7DktHmVCoAneA8q4fpP2
17hMTFUWqa1oHKj7PHA361qjpZoBaChTWY
15tGbgpiksnzBY1tef2LgUbJ9pZvoDjCbs
1HUHBgNHYCz9Djy9z615adkgd2NYQNMVUd
1C242L8qAXRxudv6KBAahi81GHS5wpc8cF
1GRHyZf18sQ65CdG66YCYs7vhrzUEV1HVs
1LAWGnA2K5njVSshERU9bcUSrW2YWwtXs1
1MZsUfERBoQp6PJW4Gcx9PvgH2S6WcLiyv
1PLfzxybxkTKbcxRwhRw23TxcYDJ9wsphS
13rkwLUVuWeLtnB1JdxJGo4vin15V2poS5
1Hxkqd6fib8ZrXyYj2iqQVfDxw8vjrc1aA
14qpWY7GxcimEVbPe7x6vnbV6qDaALr7Nb
1Cboy74YFQy1pLJTRrnibYfqiVo3FXv9fe
1QEkESQ8xR13P54vt8QKBHvhKjkrCBybzk
163qcNngcPxk7njkBGU3GGtxdhi74ycqzk
1GoWy5yMzh3XXBiYxLU9tKCBMgibpznGio
1Je9xULKJK191a1JV68QuMiPgHJduSpYf6
34ZQ4zk5ep53LdTdsikrKBVn2egPa7N1NA
3MmuobsivmP6SBwdX9b2X4vs8SKBrLvRFt
14DvFghvkzQujf5Kd5AL2VKjxaYm5KidxR
14tfS3yWL2cABhXVJZ97XRhuDXC69aWH6Y
1FzjogU6vMPcJAsTgc7Fw7tMu7nmwom6QD
1CHXVoouz5b8YykXr6T1t5y4rv6enPLKjS
16j8quu5c51swAN6QUdeMEcSidxD4JdtoS
19Vok4UYuig3XC9ixoASteqXUvB378qAUR
1DEjEBAsw7rLaKnKj2mthpwPDXy6f6rXMh
15iiic5PmfGvE3TyMP1JyYh1W9KxQLGQL6
1DDRvdiUZMeF9c4zjMLHWvacJYhPcbzumf
15pY2U8WBZBJRVxGhh8WRXsdkXQbMKD8k9
1FQBA6LYwjFYfSgrHTwizV6aLPUuG3cMBa
1KiY2X9tww3zDgZmuoFRvZ7ssWx1b4moC9
1H1K8MfLEJgjCCfDEkTJmv9GJjD3XzEFGR
163qcNngcPxk7njkBGU3GGtxdhi74ycqzk
3616S7LW7c4rPpoS44eAb74gVvcY1nHo2w
18js3UK28bD11rwP1RJPjZUT93z3s3s77k
1K5gLeGFrhbsKXBQQK23TPGfqrAwgqgPkC
ļ»æ3Npm2ipM11TYyMymJhMW3jhmMVR91fNaod
14LYbckmC9gKJ6LR1JAWaKSsCojZfURbzH
1KE1EqyKLPzLWQ3BhRz2g1MHh5nws2TRk
36QKFL786hVNqEfkPHqvu47ZvzkXrokPSK
3KAjh4JnH2eWo7yXkMMXz5Nnf4mr13RNpr
1Ji2K8EVzxDRnpuXts1kKAjMwTrV2LTnRS
18i5utJSShwVTGdtSrmi2M3XpyRBfnpdPw
3JRHity7zbykme4uriFnroxWj0VhML780lhIC9taBjdmYd5LcVIy9N1P8UeSn1F9pAYfKV59ET0RyoiJgxWucM
MBV4M5vH2W519JEJ9T4yvqVhNaaYECxaTS
35xURRetkiCKCZNjWtlJ21sm3dWxmV48cKtIV1ygfJU7thXjc1r
1KVX9hCnQ9MfSoEFyxqAXGFXdTFNyzD22n
1KJ3ZrhrkXBVjGyAU635sapjLpLSFgpqYe
342yJ6g29rQQVehf1nbPX5UDquKUSKw4ev
19p63VSjmRLPNP34ASWPEixUDYhvGQxTFK
17z8ACS2tJouyxuoqEBoDDmaEZzFTzQg1Z
17cPvTgQ4vsG9D6iZqTL3JChjd8ApFYTPA
12ELWfXgRgqhtt8KenQbAfuBbAb1Rd3GJ7
19PRxthVN1P9hsXcStqc2Kp8Yy4hXyXVau
1BwDYXp1YCa2NLfGiF5Gfnkmgf61MqupHb
15KquhG7RGkyXvEVT1aXLgPt4qgBEVe8rN
bc1qznsh6ahq9h05pgekemygh7mdvc4egkvfvf3ltc
19Ya5oeV6zqsHa9TSyurpeF1LpYJqm84Yv
15DMMwLTqV4RmYpJZDoNUZvzNikX1m6j4R
bc1q4s9vnxa7a008rxcuus0fqk94dyc0r2z88cs6c4

======= END WALL OF SHAME =======

Again, if you received an ominous email about your device being hacked and it uses one of these bitcoin addresses, just know that I received one of those messages, too, and I never paid. Since Iā€™m still here, posting this, obviously none of their doomsday prophecies came to pass - no mass email to my contacts, no embarassing footage, no ruined lifeā€¦ and no hacked device.


Hacked!? Again!?

TL;DR — I've received some more emails telling me that I've been hacked. Since I still don't believe them, I thought I'd make fun of another one instead.

👓 3 minutes

Since my last post about script-kiddies using spam to try and commit fake extortion, Iā€™ve recevived plenty of other threatenting emails from lamers, so hereā€™s another one from the (spam) vault:

From: [redacted-address]
To: [redacted-address]
Subject: Security Warning. Third party accessed to [redacted-address].

Hello!

Iā€™m is very good coder.

Just not much of a writer, apparently.

I am known by my nickname finn29.

Look, man - Iā€™ve known The Finn since 1984. And you, sir, are not The Finn.

I hacked this mailbox more than six months ago,
through it I infected your operating system with a virus (trojan) created by me and have been spying for you a very long time.

Somehow, I find this hard to believe.

I understand it is hard to believe, but you can check it yourself.
Iā€™m sent this e-mail from your account. Try it yourself.

No, ā€œyouā€™reā€ didnā€™t send this email from my account. In fact, if I had to guess, you tried to send it from your parentsā€™ basement (which I have the IP for, by the way), but my SPF rules caught it, flagged it, and dumped it into my spam folder. As they should have.

Even if you changed the password after that - it does not matter, my virus intercepted all the caching data on your computer
and automatically saved access for me.

I think youā€™ve been watching too much CSI: Cyber.

I have access to all your accounts, social networks, email, browsing history.
Accordingly, I have the data of all your contacts, files from your computer, photos and videos.

Oh noes, all of the contacts stored on my computer? What is this, 1998?

I was most struck by the intimate content sites that you occasionally visit.
You have a very wild imagination, I tell you!

I do, actually, but not in the way you want.

During your pastime and entertainment there, I took screenshot through the camera of your device, synchronizing with what you are watching.
Oh my god! You are so funny and excited!

I donā€™t even know what to say to that.

I think that you do not want all your contacts to get these files, right?
If you are of the same opinion, then I think that $643 is quite a fair price to destroy the dirt I created.

$600 to erase the pictures and videos you donā€™t have? What a bargain!

Send the above amount on my BTC wallet (bitcoin): 19kXyFbvetft819v4QV5g9vzrjwNqRtvgA
As soon as the above amount is received, I guarantee that the data will be deleted, I do not need it.

Well, you seem trustworthy, so Iā€™m sure I can believe your ā€œguaranteeā€.

Otherwise, these files and history of visiting sites will get all your contacts from your device.
Also, Iā€™ll send to everyone your contact access to your email and access logs, I have carefully saved it!

Iā€™ve spent the last 10 minutes trying to figure out what heā€™s saying here, but I just canā€™t make sense of it.

Since reading this letter you have 48 hours!
After your reading this message, Iā€™ll receive an automatic notification that you have seen the letter.

Doubtful, since itā€™s now been 96 hours since you sent the message, and my contacts still havenā€™t received anything from you. I mean, me. Whatever.

I hope I taught you a good lesson.
Do not be so nonchalant, please visit only to proven resources, and donā€™t enter your passwords anywhere!
Good luck!

Indeed, you have taught me a lesson: how not to extort money from someone.


Hacked!?

TL;DR — I recently received an email telling me that I've been hacked. Since I don't believe it, I thought I'd make fun of it instead.

👓 6 minutes

A couple of weeks ago, I was lucky enough to receive an #email telling me how one of my email accounts (and the devices associated with it) had been hacked. Whatā€™s more, this email appeared to be ā€œFromā€ the hacked accounts, a feat designed to help me understand just how serious of a threat this hacker is.

And I do understand - theyā€™re a joke.

Now, I am not disrespecting ā€œrealā€ #hackers , the kind who are perfectly capable of destroying my bank account, doxxing my children, and generally ruining my life, so please, donā€™t take this as some kind of a challenge. Instead, Iā€™m disrespecting a ā€œscript kiddieā€, someone who canā€™t actually hack, and instead spends their time trying to fake it by scaring people who donā€™t understand the shiny magic boxes we commonly call computers (or, more generally, ā€œdevicesā€).

If you really wanna be a fake hacker, this book will tell you how!

Unfortunately for this lamer, I do understand these magic boxes enough to call their bluff, and have decided to post their weak-sauce attempt at extortion here (along with some commentary of my own). Although Iā€™ve redacted the addresses that I received these messages from, Iā€™ve kept most of the actual text of the messages intact, in hopes that someone searching for this text may come across this post and save themselves a truly unnecessary extortion payment.

The Email

From: [redacted-address]
To: [redacted-address]
Subject: [redacted-address] - this account has been hacked! Change all your passwords!

Hello!

Hi!

I have bad news for you.

Uh-oh.

19/07/2018 - on this day I hacked your operating system and got full access to your account [redacted-address]

Oh, noes! You hacked my operating system to get access to my email address?

Wait, how does that work?

It is useless to change the password, my malware intercepts it every time.

Wow, thatā€™s some magical malware.

How it was:
In the software of the router to which you were connected that day, there was a vulnerability.
I first hacked this router and placed my malicious code on it.
When you entered in the Internet, my trojan was installed on the operating system of your device.

After that, I made a full dump of your disk (I have all your address book, history of viewing sites, all files, phone numbers and addresses of all your contacts).

Iā€™ve always wondered how it was, so thanks for telling me.

By the way, I like how you use the generic term ā€œdeviceā€ - that must make it easier to mass-send bogus emails like this. I mean, which device associated with this email did you hack?

I only ask becauseā€¦ well, letā€™s not ruin the fun yet. šŸ˜‰

A month ago, I wanted to lock your device and ask for a small amount of money to unlock.
But I looked at the sites that you regularly visit, and came to the big delight of your favorite resources.
Iā€™m talking about sites for adults.

I want to say - you are a big, big pervert. You have unbridled fantasy!!!

You know, I used to play bass for Unbridled Fantasy back in high school.

After that, an idea came to my mind.
I made a screenshot of the intimate website where you have fun (you know what it is about, right?).
After that, I made a screenshot of your joys (using the camera of your device) and joined all together.
It turned out beautifully, do not doubt.

Both my favorite intimate website and my ā€œjoysā€, together in one picture? I gotta see this!

By the way, thanks for telling me how beautiful my ā€œjoysā€ look, itā€™s not often that I get a complement like that.

I am strongly belive that you would not like to show these pictures to your relatives, friends or colleagues.

And I am strongly belive that youā€™re not much of a writer. Or a hacker.

I think $741 is a very small amount for my silence.
Besides, I spent a lot of time on you!

OK, this just got weird.

I accept money only in Bitcoins.
My BTC wallet: 1H9bS7Zb6LEANLkM8yiF8EsoGEtMEeLFvC

But, what if I donā€™t know to replenish a Bitcoin wallet?

You do not know how to replenish a Bitcoin wallet?
In any search engine write ā€œhow to send money to btc walletā€.
Itā€™s easier than send money to a credit card!

I donā€™t know, send money to a credit card is pretty easy.

For payment you have a little more than two days (exactly 50 hours).
Do not worry, the timer will start at the moment when you open this letter. Yes, yes ā€¦ it has already started!

After payment, my virus and dirty photos with you self-destruct automatically.
Narrative, if I do not receive the specified amount from you, then your device will be blocked, and all your contacts will receive a photos with your ā€œjoysā€.

Well, itā€™s been over a week since I opened the ā€œletterā€ (approximately 168 hours, by my math), and so far, no ā€œjoysā€.

I want you to be prudent.

  • Do not try to find and destroy my virus! (All your data is already uploaded to a remote server)
  • Do not try to contact me (this is not feasible, I sent you an email from your account)
  • Various security services will not help you; formatting a disk or destroying a device will not help either, since your data is already on a remote server.

Yeah, hereā€™s the thing about the email you ā€œsentā€: you didnā€™t actually send it, you just tried to send it (and you didnā€™t even bother to hide the source IP!), but my email handling rules caught it, flagged it, and dumped it into my #spam folder, which is why it took me over a week to notice it.

P.S. I guarantee you that I will not disturb you again after payment, as you are not my single victim.
This is a hacker code of honor.

Well, you sure seem trustworthy, so Iā€™m sure I can believe your ā€œguaranteeā€. And your haxx0r ā€œcode of honorā€.

From now on, I advise you to use good antiviruses and update them regularly (several times a day)!

Donā€™t be mad at me, everyone has their own work.

Sure, if by ā€œworkā€ you mean ā€œscaring technophobes from your parentsā€™ basementā€.

Farewell.

Bite me, lamer.

The Truth

Now, you may be asking yourself, ā€œhow does he know that his devices havenā€™t actually been hacked?ā€ Well, in addition to all of the reasons raised above, there is one more I neglected to mention: the email account that this master haxx0r allegedly compromised isnā€™t even associated with any devices. Itā€™s just a email address, plain and simple, and isnā€™t used for logging into any application or device anywhere on the #internet . Whatā€™s more, Iā€™ve been sending out and posting resumes with this address for a few weeks now, and suspect that this is how this wannabe got their hands on it.

So, in the end, how can one try and minimize their exposure to hacking threats (especially fake ones)? Well, IANAHOSE, but these are some of the ways that I do it:

  • For years, Iā€™ve tried to diversify my accounts, using different emails for different sites, and keeping those email addresses separate from the accounts I use on actual devices.
    • To make this work, I had to buy a domain name (which costs about $10 / year) and setup a catch-all (or ā€œwildcardā€) address. That way, I can use anything I want for the ā€œlocal-partā€ of the email address (aka the portion before the ā€œ@ā€ symbol), and Iā€™ll still get it at my main address (which I donā€™t typically share).
  • Likewise, I diversify my passwords, using a different password for each site / device. The easiest way to do this is with a good password manager.
  • I also try to keep good backups, so if my devices do get hacked, I can wipe and restore them (relatively) easily.
  • Finally, as alluded to above, I have Sender Policy Framework (SPF) rules setup to work with my domain, which helps to prevent others from sending unauthorized emails from an account I own.

Always try to remember: No matter how scary an email may look, donā€™t believe everything that you read. Many (if not most) are from fakers just like this one, and are nothing more than poorly-weaponized spam. And, just like with regular spam, the only proper (and safe) way to react is to ignore it completely.


The People vs. John Deere

TL;DR — John Deere argues that farmers don't own their tractors, and this does not bode well for our IoT future.

👓 less than 1 minute

Over at Wired, iFixitā€™s Kyle Wiens (@kwiens) points out that #DMCA abuse extends well beyond preventing you from jailbreaking your PS3 and into the world ofā€¦ farm machinery?

In a particularly spectacular display of corporate delusion, John Deereā€”the worldā€™s largest agricultural machinery maker ā€”told the Copyright Office that farmers donā€™t own their tractors. Because computer code snakes through the DNA of modern tractors, farmers receive ā€œan implied license for the life of the vehicle to operate the vehicle.ā€

Itā€™s John Deereā€™s tractor, folks. Youā€™re just driving it.

I find this particularly worrisome with regards to the #InternetOfThings, and the possibility of forced vendor lock-in on even the most trivial of items (ā€œIā€™m sorry, sir, youā€™ll have to call a certified Moen plumber to fix your leak.ā€)

Welcome to the future. Fight to make it better.