Soundtrack is “november” by “raja_ffm” via ccMixter.org.

PS: wish you could see the big version on a big screen …

Within minutes after retrieving the letter from the mailbox I cancel my old Visa card and Chase is not going to see me again.

And in case you are interested: I had my account for eight years. I never had a balance on the card; always paid it off at the end of the month. My limit was upwards of $30K. My credit score (based on information obtained during the last refinance) is in the upper 700s, low 800s.

Something in the credit card business is seriously broken …

I had a few desktop systems that were collecting dust in the garage for months already. I had stripped those systems earlier on and had removed all disks, memory and other usable items. On Saturday at noon I packed the whole lot into the car and went over to the drop-off on Siler Road. That place was packed. Tons of old computer hardware was piled up in a huge parking lot and there was quite the line of drivers waiting to drop-off more hardware. When it was my turn, a bunch of volunteer teenagers grabbed the stuff from my trunk faster than I could say “Thank you!”. Hardware was flying through the air and landed with a nice, loud crashing sound on the pile.

I also had a couple of CRT monitors, which were still in working condition and instead of throwing them out, I put them up on Craigslist in the “for sale / free” section. The ad had a note that those items were free, in working condition and for pickup only. Not an hour later I had the first responses to the ad. And that’s were things got weird. Of the first few people who claimed they would come and pick up the stuff, nobody showed up when they said they would. I tried to be fair and respond to people in the order that I received responses, meaning I put the later ones on hold until I heard from the first ones. That was a mistake – I should have just said whoever comes here first is going to get the stuff.

And then there’s also this one guy, who I exchanged 12 (!) emails with. “Are they free?” – “yes!” – “Can you drop them off here?” – “no!” – “Do they work?” – “yes!” – “Are they going to work with my graphics card?” – “no idea – give it a try!” – “Can I return them if they don’t work?” – “ARRRGGGGHH – no!” – and so on and so on … I ignored his last two emails where he asks for even more information.

We have this saying in Germany, which translates to “Don’t look a gift horse in the mouth”. Some people don’t seem to get that …

PS: And there’s really some interesting stuff you find on craigslist these days, like this one …

Where was this thing 2 years ago when Pia was born?

That was a good laugh this morning. See full photo here and zoom out here. (via http://waxy.org/links/)

The Vonage package arrived soon after I had ordered the service. It contained a manual, some cabling and a Linksys RT31P2 broadband router with two phone ports.
Now with the setup in my home office it was difficult to place the router close to the phone. I had only one Ethernet cable go from the Netgear FVS318 router to my PC. And the phone was right next to the PC. So it would make sense to place the router next to PC and next to phone. Unfortunately the manual does not cover the case where you want to place the Linksys RT31P2 inline *and* still have access to the PC in the same way you had before adding the router.
Here are the before and after scenarios:

I use static DHCP entries on the Netgear router, which means that the PC is still using DHCP to get an IP address, but the Netgear has a MAC->IP address table that always assigns the same IP address to the same MAC address. A poor man’s name server, sort of.

So I connected the Ethernet cable that used to go to the PC to the WAN port of the Linksys and plugged the PC into the first port of the router. I instructed the Linksys to use DHCP to get the WAN IP address:

I used the Linksys’s MAC address in place of the PC’s MAC address on the Netgear router. And finally I enabled the DMZ feature of the Linksys router:

This way all traffic arriving at the Linksys is being forwarded to the DMZ host (my PC).

So far everything is working as expected and all systems on the network can still access the PC as they did before.

I decided to collect the information and make sure that everybody who comes here will detect the same scam in the future …

So here comes the first piece of evidence. This email (screenshot) arrived at 10:59pm last night in my inbox. I downloaded it this morning at 6:00am

This all looks very official: it has common ebay links, the logo, the little “TRUST-e” logo, etc. The embedded link also looks like something you’ve seem to have seen on ebay’s site already. Well, so let’s click on it:

Again, something that looks very much like an original ebay-page. Logo, common links, design, everything looks like it is the real thing. However there are three things that should make you suspicious:

1) ebay would never ask for account verification through an email
2) ebay would not use unsecured pages (non SSL, not showing “https:”) for this kind of information

and, most importantly

3) there is no ebay server at 62.94.123.19

Look carefully at the URL for the page (marked with red ellipse). You can see that it starts of with “http://www.ebay.com” however it continues with “@62.94.123.19″. This “@[number]” means that the page is really coming from the server with the address “62.94.123.19″ and not from “www.ebay.com”. This is a common trick by scammers to make people believe that they are looking at the page of a particular service when in fact they are looking at the page of some other system.

Be very, very careful whenever you see the “@” sign in the host portion of your a URL

And just for the heck of it, let’s dive a bit deeped into this particular scam.

1) Email headers.
Most Email programs have the ability to look at “Email Headers” (Outlook Express for example does it via “CTRL-F3″, Outlook does it via “View->Options” and Eudora shows you the headers when you press the “Blah Blah Blah” icon when viewing a particular message).

Here is a section from the headers that made me suspicious:

Received: from 10.0.0.4 ([62.139.244.252])
	by smtp-relay-2.adobe.com (8.12.9/8.12.9) with SMTP id h5K4wXpK027898
	for
; Thu, 19 Jun 2003 21:58:35 -0700 (PDT)
Message-Id: <200306200458.h5K4wXpK027898@smtp-relay-2.adobe.com>

This basically says that the first system inside Adobe (smtp-relay-2.adobe.com) which saw this message received it from a system with the ip-address “62.139.244.252″, however the contacting system claimed that it’s ip-address was “10.0.0.4″. Hmm, that’s a small mismatch, isn’t it?
So, let’s see who and where “62.139.244.252″.

There is an excellent little tool at http://visualroute.visualware.com/ which I can only highly recommend. This tool allows you to enter an ip-address (or the name of computer on the internet) and then trace the packets from the visualware-servers to the address/name you entered. Similar tools are available on Unix (traceroute) and on Windows (tracert).
However the “Visual Route” server adds a little spice to it. It has location information for lots and lots ip-address and ip-blocks. So whenever a packet goes through a place where it has location information for, it will plot it on the world map below. This is quite entertaining, but not always 100% accurate.

After entering “62.139.244.252″ I see this:

Egypt? ebay is sending email via a system in Egypt? Don’t think so.

This seems to indicate that some poor guy had an “open email system” in Egypt which allowed spammers and scammers to abuse his server for mass distribution of email. By the time I check, the system is down. Most likely somebody noticed the abuse and shutdown the server.

2) Who, Where, What is “62.94.123.19″?

So let’s examine the address we found in the ebay verification email a little bit closer. First, plug it into the “Visual Route” server again:

Whoa – ebay is clearly a global company, sending emails from Egypt and doing address verification in Italy. Again, don’t think so.

Using a second tool at http://grove.ufl.edu/~bro/cgi-bin/wp.cgi, the WHOIS proxy, I look up who owns this IP-address (who registered it). Here’s the output:

 inetnum:      62.94.123.16 - 62.94.123.31
 netname:      MEDAINFORMATICA-EDT
 descr:        Meda Informatica
 country:      IT
 admin-c:       DM1720-RIPE
 tech-c:        DM1720-RIPE
 status:       ASSIGNED PA
 mnt-by:        EDISONTEL-MNT
 changed:      ipadmin@edisontel.it 20030216
 source:       RIPE
 route:        62.94.64.0/18
 descr:        EDISONTEL
 origin:       AS15589
 remarks:      Milan Core
 notify:       ipadmin@edisontel.it
 mnt-by:        EDISONTEL-MNT
 changed:      ipadmin@edisontel.it 20010129
 source:       RIPE
 person:       Daniele Metelli
 address:      Meda Informatica
 address:      Via Cortevazzo  13
 address:      I-25136 Palazzolo Sull'Oglio (BS)
 address:      Italy
 phone:        39 030 7403184
 nic-hdl:       DM1720-RIPE
 changed:      ipadmin@edisontel.it 20030216
 source:       RIPE

So – this looks like it’s owned by a small company in Palazzolo Sull’Oglio in Italy’s Lombardia region.

3) What does the web page do?

The web page above asks for “account verification” information. This includes your ebay userid/password, your credit card information, address information and even Social Security numbers, drivers license information.

Think about it: With this information at hand somebody could not only empty your bank account pretty quickly, but even steal your identity and “become you”. Or sell the information to parties that would be interested to assume somebody else’s identity.

After entering the information on the web-page and clicking the “Continue …” button at the end of the page, your data will be sent to a script called “form2mail.php” on the same server. “form2mail.php” will take all the information you entered and send it off to some other party on the internet via email.

And this is where the bad guy really hides. Looking through the web-pages I can see one piece of evidence that points to this guy. In the form definition it says:

    <INPUT type=hidden value=yernadop name=userid>

The “form2mail.php” script will use this value to determine where to send the data you just entered to. However this is not a full email address and the full address is most likely hidden somewhere else. Most likely it will point to some @yahoo.com or @hotmail.com email address where the bad guy just waits for information to come in.

Also turns out that “yernadop” is not unknown out there. Take a look at those links on Google: http://groups.google.com/groups?q=yernadop. Scary …

To sum up the story:

* Those guys in Egypt started the mess with an open SMTP server that allowed unindentified parties to send email to the world through their server.
* Poor guys in Italy got their server hijacked and bad guys installed all the necessary stuff to make the system work. Most likely poor system security has to be blamed.
* Bad guy has received hundreds of responses by now and is using the credit card information to purchase whatever he wants. He’s probably also looking for a buyer for all those SSNs.
* And the sadest thing: I tried to be a good citizen and report it to ebay to make sure that at least the “account verification” page is turned off as quickly as possible. After searching for an hour on their web site, I still have not found a place where I can report this kind of issue.

Well, I hope at least you who read this story will not fall for a similar scam any more!