I was a new employee in a company, working as a security specialist. My first assignment was a brand-new encryption solution that I was asked to evaluate. My manager wanted me to tell him if this product was worth investigating further or not. I was given a production presentation pamphlet. It was something you don’t hear every day: a Swedish company offering a totally new encryption solution. It was one of those startups that had gotten a healthy injection of cash from a “corporate angel”. In short, they were given money to realize a new solution. It was presented as something brand new and never seen before. It didn’t need any keys, passphrases or other information that could give away the secrecy of the data. Also, it was based on a security protocol that the inventor of the solution had invented herself. And it also boosted that it was patented and the patent registration number was printed in the pamphlet.

It was easy for me to get the patent document from the patent office. It read as the same “marketing fluff” that the pamphlet did with the addition of a generic diagram and some text talking about quantum encryption. Most of the statements raised red flags for me. I will explain shortly why. Then I thought that “maybe there is something to download to test it?”. No download links and no instructions on who to contact at sales to get a trial version. Checking their website and other sources gave me no further information. I started doubting that they had some sort of software solution ready. This was weird. The company was at the time a few years old. “They got to have some sort of beta”, I thought. But nothing came up anywhere. I noted to my manager that I didn’t recommend going any further with this solution. My manager wasn’t a bit surprised. He had read the marketing text and didn’t think it was interesting to pursue further. Fair enough, not all things on the market are worth the effort. There’s nothing strange about that.

A few years later I read a popular Swedish magazine where a reviewer had gone through the solution. The most interesting part of the article was when he commented on the claim about “quantum properties”. The marketing text stated that the solution through quantum properties could detect if someone was eavesdropping the encrypted data. Not hacking or trying to decrypt it. Just watching the packet stream would set off an alert. This was claimed to work on any kind of connection. The reviewer noted that an ethernet connection as opposed to a fiber optic connection doesn’t have quantum properties. The claim was wrong as this feature could not work. It was physically impossible.

Years passed and in 2018 me and a friend decided to start a podcast together. We both worked at the same company at the time and in the IT security industry. So, it was clear we would cover the IT-security field. That’s a story for another day, though. A few months later we were offered a sponsorship by a large security organization in Sweden. This included that they sent interesting IT-security and info security lecturers for us to interview. We started doing regular interviews during the spring and it continued.

In the summer the other host went on vacation, and I decided to take the reins of the podcast myself during his vacation. I ran the show, covering the events in the IT-security field during each week. One of the last podcasts I made before he came back was about the inventor and her company. I was careful not to mention her name or the name of the company. But I talked about the claim that she had invented an encryption protocol herself. This is generally a very bad thing to do. Especially if you don’t make the solution open. Her encryption, if it existed at all, was closed source. Microsoft made this mistake in the 90s when they released Windows 95. It had the passwords of the users stored in passwordlist-files. Those encrypted .pwl-files were built so no one got to know how they worked and that was supposed to be secure. It was not. Not by a long shot. Hackers had a field day with the solution and what little security Windows 95 could offer was lost. The .pwl files were properly hacked and became useless. A new encryption format must go through years of vetting and attacks before getting trusted for implementation in standards. Some encryption standards that were considered secure, have been broken over the years and then stopped being used. This is the harsh reality and the reason why this was a red flag for me. I noted this on the podcast.

This is where it got interesting. What happened next was something I would never have seen coming. Our contact in the organization suggested another guest for our podcast. He said she was a bit controversial but may be interesting. We had to decide ourselves if she fit the podcast. She had invented her own encryption. You guessed it, it was her and it was the very same solution that I had evaluated previously. Who would have thought? What was the likelihood of our paths crossing? Me and the other host agreed to allow her on. It was a bit of risk taking, but a self-made inventor could be interesting to have on. I silently wondered if we knew what we had gotten ourselves into. We had no idea…

It was a nice day in autumn when she arrived at our work office. We led her to a conference room we had been allowed to use. She told us she had just come back from a large company nearby. She had been presenting her product to them, and she seemed to be very hopeful of it leading to some business for her company.

 The recording went off to a bad start. It wasn’t her fault. It was mine. She spoke about prime numbers, and I explained what that was. Got the explanation right but also suggested a few numbers that were prime numbers. Among them was 9, which is not a prime number at all. It’s divisible by 3. I got to hear that a number (haha!) of times from listeners and thought there was no end of it. What happened next was worse. She claimed that her cryptography did not use mathematics and pointed to a matrix with binary numbers she drew on the whiteboard. Listeners could not see that, but if they had, they would probably have drawn the conclusion I did: a matrix, a mathematical thing. At least I learned to use them in math class in school way back when. Either way, I have never heard about cryptography not using math. I tried a conversation starter by telling her that her solution reminded me of the Kerberos protocol. That did not sit well with her. I started worrying that she might stand up and walk out on us if we asked the wrong questions. It was probably not what we should have done. She was kind of worked up from my question. We really didn’t know how to challenge her different views on how encryption was to be done. In the end, she told us her point of view without much intervention. We thanked her for her time and then stopped recording.

What she said later totally should have gone into the recording but didn’t. It was interesting and unexpected. The first thing was that she was going to teach herself Microsoft C#, a popular programming language, to be able to build the software solution. I could hardly believe that I heard her right. At this time, her company was 10 years old. It confirmed what I suspected from the beginning: there was no functioning solution. They basically had an unrealized idea that yet had to materialize. This is kind of the most long-standing “vapor ware” I have ever heard of. What could she really sell to an interested customer if she had no solution ready? Then came the next thing she said. She told us of her quantum computer that she had in her cellar. Some background: quantum computing is bleeding edge research technology. Companies like Microsoft, IBM and Google pour loads of money into their projects to create the first quantum computer capable of reaching the goal of being powerful enough to bring massive parallel computing to this world. This technology advances but is many years away from being done. Back when this interview was conducted there were just a handful of quantum computers in the world. Somehow, she had one in her cellar. Such statements are impossible to verify unless you look in her cellar, I guess. This left me wondering exactly why she said something like that.

We went home to our respective homes, and the episode was uploaded and spread though the podcast services on time and to a waiting community. The response came a few days later.

Someone posted a message in a Swedish Facebook group specializing in IT-security. This message was about the interview, and it was surprisingly respectful for an angry take on our podcast. The people posting in the thread called us out and wondered why we had put her on the show. They also wondered if we knew anything about cryptography, given that we didn’t question anything she said. And few days later someone posted a new post without knowing about the first one. There were the same critical questions about the interview. We responded the best we could.

Something good came out of it. A man working with cryptography in a Swedish university offered himself as a guest on our show. We let him on, and it became a good introduction to cryptography and quantum computing. The calmness began to come back to our world. This is the end of the story, right. Nooooo… Not by any stretch of imagination.

Time passed and we continued producing podcast episodes. Months passed, but one day I got an email from a listener. It was addressed to me and asked me if I believed in her solution. At this time, I had to be careful what to respond. I didn’t want to be too negative about it. I noted that all I had to do was to say it like it was. I responded something like “there is no product to test in order to evaluate its capabilities. Until such a solution exists and can be tested, I do not believe it works. If I ever get to test it, it’s unlikely I will believe in it. But let me at least try”. I felt pretty good about that answer.

20 minutes later, I stood outside the building I work in, so I could get some fresh air. Then the phone rang. It was her and she wanted to talk to my manager. It was a moment of “ouch, dammit!”. It wasn’t just my direct manager she wanted to talk to. Not even the CEO of my company. Nope, she wanted to talk to the CEO of the company group. I thought I was going to get into some hot water. But she was nice and polite. I gave her his number. Then I went back to the office and sent him a message. I asked him to be a bit on the skeptical side with her. I got no response from either of them. It later struck me that it was probably just a coincidence she called me at the time she did. She most likely wanted to do a sales pitch. It was not her with a fake name I had mailed back to. A sigh of relief later it was all forgotten.

More time went on. Months later I got a message from her. She wanted to come again as a guest of our show. I didn’t have the heart to tell her no. I asked her to come back to her later. Time passed and I didn’t hear from her at all and forgot about it.

This story has a sad ending. One day I saw a message from her daughter on social media telling us that the inventor, her mother, had passed away recently.

There is an old saying: “Don’t speak ill of the dead”. I really don’t want to do that either. Remember that my first experience with their security product was before I even met her. My whole point is to tell a story about working in the IT industry. We must be hard on security companies, because so much of our society will be entrusted to their protection. It’s nothing personal really.

Back in the 90s, I learned about the term “Netizenship”. I learned it from Usenet, as Internet wasn’t a thing (at least for me) back then. It is a portmanteau of the words “Citizenship” and “Net”. If you access a local- or global network with more users on it, you’re a Netizen. As in “you live as a member of a village”. Yes, it harkens back to the days of the “Global village” discussion, and its come back in the 90s. I won’t bother you with the details. Suffice to say this: netizenship was important. It’s the computer equivalent of “Above all, cause no harm”. In short: as a network user you must not become a problem for others.

A true netizen (not that Scotsman fallacy!) must act in a proper, non-aggressive and secure manner. I found out that there is an old, but oddly useful RFC called RFC1855, describing among other things how to “Be conservative in what you send and liberal in what you receive.”. That’s not a political statement, but a rule that truly fits today. In short don’t blow a fuse when people write stuff that is dumb or hateful and choose your own words well. Just imagine everyone applying that on Twitter, and I don’t think Elon Musk would have bought the company. Yes, I wrote that! Twitter is what it is DUE to the raging wars, no despite it. And social media builds on this divide. “Digital divide” used to mean those with access to Internet vs those without. Today, it’s a false dichotomy of “angry left” vs “raging right” or “whatever” vs “whatever else”. We don’t need that. It’s like going to a bar, meeting some drinking buddies, and then starting a fight over soccer teams or political parties. Please don’t. It was nice when it was just drinking beer and talking about everything and everyone.

But my main intent of this text is not just social issues and proper behavior. IT-security must now be in the driver seat. A modern netizen MUST consider his or her presence when online and offline. A good netizen should always know that lax security on their part, can, and probably WILL constitute an emergency on someone else side of the net. I mean, if your work or private account gets hacked, because you have bad password discipline, that account can be used in your good name to send malicious email to others. That’s just an example. There are many ways this can play out against you and others. Back in the naughties, we had the “security triad” of “Firewall, patching and antivirus”. It was a mantra, that we were told. Was it a bad idea? No, absolutely not. That was a part of netizenship even when the term was long gone. But it’s 2022 today, and the list of obligations to stay secure is growing and changing fast.

I think, as the headline said, that we should take the term back. Internet has been libertarian since its popularization in the 90s. But it never was meant as an anarchy. Self-governing and making ourselves and others into informed users was what it was meant to be. If we want that to be true now, we’re probably out of luck. But Internet is still somewhat free. In some parts of the world. And this puts the responsibility on YOU and me! We must keep your equipment safe, our manners at least somewhat decent and educate ourselves in being observant. A citizen should “trust but verify” and so must a netizen. In short, we must understand better than to Google for what we already believe in, stop helping in spreading unverified rumours, cease and desist connecting insecure stuff directly to the Internet because “who cares?” and remember where we came from. I saw texts from 1979 on one of the first Swedish bulletin board systems and it had a lot of disagreements. And, yes, drama and nasty comments. This has not changed a bit. BUT. The SCALE of things has. Everyone and their dog are a netizen (ever heard about electronic dog collars?) today.

If we intend the Internet to be more of a positive than a negative force in this world, we must bring netizenship back! Not regulate it – foster it! Inspire it – not force it. Talk about consequences for others when you’re not acting properly rather than forbidding certain words, views, and ideas. Laws still apply, that will not change. The Internet does not give you the right to do illegal stuff (which jurisdiction, btw?) or to harm others. But if we cannot get our act together, a lot of things that are acceptable today, may be illegal tomorrow.

How to become a netizen, summed up in a few points, that will not form a complete list:

• “We hold these truths to be self-evident” does not mean “Hey, it does not specifically forbid that dumb thing I want to do, so I will”.
• “Free speech” means that the government (if you’re lucky to live under such a government) cannot censure you. You still cannot spew racist comments on a cat pedigree forum if the admins don’t want you to (they won’t!).
• You may have a right to speak, but I have no obligation to listen. Same is true in reverse.
• Writing dumb and incendiary stuff is probably legal – but you will face a backlash if you make that a habit. A Swedish proverb: “Angry cats get their skin torn”.
• Fox Mulder “wanted to believe”. A netizen needs to get in the know.
• Learn to observe and place your naivete outside the Internet connection.
• Netizens inform others when needed, try to understand who they’re communicating with when doing so and say something when they see something.
• It’s not mandatory to be a netizen, but it may be what keeps the Internet from becoming a controlled zone where you cannot voice some opinions.
• If your opinions are always controversial to large groups of other people, nurture the thought that those people may not be the problem.
• If it feels wrong or bad in a conversation, disconnect! Pull the plug or the better yet, the mains circuit breaker.
• Trustno1 is a poor password, but a decent way of navigating the Internet until you have unlooked the “Trust but verify” skill in your netizen skill tree.
• Microsoft once wrote something like “If someone controls your computer, it’s no longer yours”. Given their track record when it comes to IT-security, that is hilarious. It’s also very true.
• Unique passwords and multi-factor authentication. That’s where it’s at today. I’m not selling running shoes but must still say this: “Just do it”.
• It’s advisable not to be an arse. That is the beginning of the road to true enlightenment, netizenship and maybe one day getting married.
• Open your mind a bit and close the firewall a lot.
• The internet is not the Twilight zone. That would be the dark net.
• OSSINT is a word you MUST understand and consider when on the Internet. Google for it if you don’t know what it means. Just don’t Bing for it, then you will never find it.
• Authentication is meant to make sure that you know who you’re really talking to. It does not work. Always been that way.
• If you try to be anonymous, you will shine like a beacon. Try to be like everyone else, it works better.
• Make sure your brain is connected, before checking the keyboard cable.
• If keyboard is not found, please press ‘F1’ to proceed. If brain is not working, don’t press any key.
• ”Cool app. I can age my face 40 years. I gotta check it out”. Great, soon you will wonder why the airport security in the banana republic you travel to immediately recognize you.
• Looking at cat videos on YouTube for a whole day every now and then, causes no harm. Cats are cool and you won’t have time to vent your frustration about some dumb stuff some celebrity did, when you are on Twitter. Dogs are also nice.
• Create stuff because you love to. Not because you want to be famous. That place is already taken. And not by you or me.
• If you write tweets, short posts on Facebook or show your lunch on Instagram all the time, you’re draining your creativity pool. This way, you are content enough not to write the great novel, the scary radio drama, the great software, mixing up that strange new mint-flavored Whiskey or maybe writing a new secure communication protocol. Some of that would be sad if not ever created.
• Don’t get angry. Don’t get even. Go somewhere else.
• Being agreeable leads to Netizenship. Want to learn more?

Links:

http://cybra.p.lodz.pl/Content/1081/issues/issue3_7/preface/index.html

https://datatracker.ietf.org/doc/html/rfc1855

May 25 20:17:06 molly kernel: [  372.984627] audit: type=1400 audit(1527272226.649:102): apparmor=”DENIED” operation=”capable” profile=”/usr/lib/firefox/firefox{,*[^s][^h]}” pid=7437 comm=”firefox” capability=21  capname=”sys_admin”

May 25 20:17:06 molly dbus-daemon[2062]: apparmor=”DENIED” operation=”dbus_method_call”  bus=”session” path=”/org/gtk/vfs/Daemon” interface=”org.gtk.vfs.Daemon” member=”ListMonitorImplementations” mask=”send” name=”:1.7″ pid=7437 label=”/usr/lib/firefox/firefox{,*[^s][^h]}” peer_pid=2161 peer_label=”unconfined”

May 25 20:17:07 molly kernel: [  373.458709] audit: type=1400 audit(1527272227.121:103): apparmor=”DENIED” operation=”file_lock” profile=”/usr/lib/firefox/firefox{,*[^s][^h]}” name=”/home/erza/.cache/fontconfig/a41116dafaf8b233ac2c61cb73f2ea5f-le64.cache-7″ pid=7437 comm=”firefox” requested_mask=”k” denied_mask=”k” fsuid=1001 ouid=1001

May 25 20:17:07 molly dbus-daemon[2062]: apparmor=”DENIED” operation=”dbus_method_call”  bus=”session” path=”/org/freedesktop/DBus” interface=”org.freedesktop.DBus” member=”RequestName” mask=”send” name=”org.freedesktop.DBus” pid=7437 label=”/usr/lib/firefox/firefox{,*[^s][^h]}” peer_label=”unconfined”

May 25 20:17:07 molly dbus-daemon[2062]: apparmor=”DENIED” operation=”dbus_method_call”  bus=”session” path=”/org/gtk/vfs/Daemon” interface=”org.gtk.vfs.Daemon” member=”ListMonitorImplementations” mask=”send” name=”:1.7″ pid=7505 label=”/usr/lib/firefox/firefox{,*[^s][^h]}” peer_pid=2161 peer_label=”unconfined”

May 25 20:17:08 molly dbus-daemon[2062]: apparmor=”DENIED” operation=”dbus_method_call”  bus=”session” path=”/org/gtk/vfs/Daemon” interface=”org.gtk.vfs.Daemon” member=”ListMonitorImplementations” mask=”send” name=”:1.7″ pid=7567 label=”/usr/lib/firefox/firefox{,*[^s][^h]}” peer_pid=2161 peer_label=”unconfined”

May 25 20:17:24 molly dbus-daemon[2062]: [session uid=1001 pid=2062] Activating via systemd: service name=’org.gnome.Terminal’ unit=’gnome-terminal-server.service’ requested by ‘:1.77’ (uid=1001 pid=7611 comm=”/usr/bin/gnome-terminal.real ” label=”unconfined”)

May 25 20:17:24 molly systemd[2035]: Starting GNOME Terminal Server…

May 25 20:17:24 molly dbus-daemon[2062]: [session uid=1001 pid=2062] Successfully activated service ‘org.gnome.Terminal’

May 25 20:17:24 molly systemd[2035]: Started GNOME Terminal Server.

When I searched through the logs 30 seconds later, almost everything above was gone, leaving only the inconspicious entries. Now, that’s a very professional hacker group at work.

(2021-08-06 – Just started this page. Will add more lines, shortly!)

Inspired by John Baez “The Crackpot index“.

Right, we can all screw up or say stuff that is wrong. But we learn and we strive to correct ourselves. But among us walks the IT-security mavericks that don’t abide by common rules such as making their statements possible to test or that you actually must accept critisism without calling the other person names.

They commonly sell stuff, software and ideas that may or may not work, actually exist, improve security at all or just plain do anything at all. So, no, they’re not necessary incompetent. They may be snake-oil salesmen or just have a pompous ego and no idea as to the mind set and spirit of the IT-security field.

Score someone you want to understand and remember: racking up points is not a good thing. Above all, enjoy!

1. They start at -5 points for calling themselves an “IT-security expert” or something like that. We’re currently cautiously optimistic as we need more people in this field. Then add:
2. 1 point for every statement that’s widely believed to be false.
3. 1 point for every time a statement is wrong, that should have had been easy to actually verify before stating it.
4. 1 point for every statement that sounds about right until actually someone checks it up.
5. 2 points for every “as everyone knows” that actually is something that no one really believes or that is incorrect.
6. 5 points for complaining about this list and feeling it attacks them personally or refers to something they wrote or said (Most likely it did not).
7. 5 points for calling everyone who disagrees with them “Orthodox thinkers”, “Troglodytes”, “Unimaginative”, “Sheeple” or just plain “idiots”.
8. 10 points for writing articles/books/posts that are basically stolen from others and then badly rewritten to obscure this fact.
9. 10 points for spraying the speech/articles with every abbreviation, initialism and acronym known to mankind as long as they (may) relate to the IT-security field.
10. 10 point for taking a pride in inventing new language as a selling point. “armor clad security shielding”, “cloaking mode”, “security arbitration” and “synergi-based security tracking”. (Ok, I made those up. Or did I?)
11. 10 points for getting “original research” stamped on contributions on Wikipedia.
12. 20 points for whole Wikipedia-articles written getting removed.
13. … an additional point for every “WTF” comment on their articles in the “Talk” section.
14. 10 points for taunting their “exceptionally high IQ”, “extreme skills”, “Hacked the global liberation army”, “being trusted by NSA/CIA/MUST/GRU/Whatever” or anything else you have no way of actually verifying.
15. 10 points per work experience they state that is not possible to check or that is purposefully vaguely written. E.g., “20 years of experience with IT-security research in the intelligence community”.
16. 20 points for pointing to other experts “supporting” what they’re stating/selling/proposing, when said expert’s statements are taken out of context or is not applicable.
17. 20 points for adding buzz words and claiming to use/support/provide/understand “Artificial intelligence”, “Heuristic analysis”, “Data lakes” when it isn’t clear that those technologies even would make sense in that context. E.g., “Our firewall features artificial intelligence based search engine optimization to provide synergy between the total cost of ownership and the customer experience”.
18. 20 points for claiming to have big companies as customers, while ignoring to mention that they just got them to accept a sales pitch and then never called back.
19. 20 points for ridiculous statements that makes you wonder how much they actually understand. “It was a command-driven movement on the Internet”, “Plugged the hard disk into the Internet”, “Our firewalls cannot be hacked”, “Since this cannot happen, it really didn’t”.
20. 20 points for suggesting “Security by obscurity” as a main security design. (E.g., setting a service to listen to an uncommon port)
21. 20 points for every year passing after the promised solution’s/product’s initial release date.
22. 20 points for predictions that a vulnerability they found “will bring down the Internet”.
23. 20 points for using sales lingo to pitch their research like “It’s beautiful and perfect” or “It will change the whole world”.
24. 20 points for invoking Godwin’s on anyone opposing them.
25. 40 points for comparing themselves to any historically or currently oppressed people and thus losing all contact with reality.
26. 40 points for inventing their own cryptography without disclosing how it works.
27. 30 more points for stating that “it can’t be expressed as an algorithm”, “doesn’t use common mathematical rules” or “is based on quantum physics”.
28. 40 points for going full mad scientist “YOU WILL ALL SEE WHEN THE INTERNET CRASHES! You will regret not listening to me! And not buying my super-perfect software!”
29. 50 points for vaguely suggesting you invented/were instrumental in the development of a famous protocol/software/system. Points will not be “awarded” if it’s actually true (It never is!).

Note

The list is a mix of things I’ve heard a number of people say, commonly said stuff that boggles my mind, proof of a mind set that totally misses the target and a few I’ve done myself over the years (not telling you which!).

The original “crackpot-list” does not tell you what score you need to be seen as a crackpot. I don’t know when you become an “IT-security Maverick” either. It’s more a list for some laughs than anything.

Viruses are no fun, but we have had to contend with them since the 70s. The Amiga had its share of them like SCA, Bytebandit, Saddam Hussein, Lamer exterminator and some others. Some just wrote cute messages, whereas others deliberately or by mistake destroyed your data. Let DJ Daemon take you back to the 80s and guide you through the less popular parts of Amiga history.

00:00​ Amiga Flashback – show intro
00:13​ DJ Daemon – introduces the episode
00:35​ Firage – Buns and Guns
02:40​ DJ Daemon – speaks about Amiga computer viruses
03:32​ Radix – * CoLoUrS *
08:45​ DJ Daemon – speaks about the SCA virus
10:06​ Reed Richards – Devoted
14:56​ DJ Daemon – speaks about the ByteBandit virus
15:58​ CRD – Chordian remix
17:51​ DJ Daemon – speaks about the Saddam virus
19:20​ Finwave – Just Do It (F/U)
23:47​ DJ Daemon – concludes by saying it’s not an Amiga-thing
25:10​ FearofDark – SurfingOnASineWave
30:01​ DJ Daemon – discusses viruses destroying hardware
31:42​ Elwood – After Hours
35:07​ DJ Daemon speaks 29s
35:36​ Maikel Yeremy – The Wayfarers Arrive
38:34​ DJ Daemon speaks 34s
39:07​ JaseChong – Kingdom Skies
43:41​ DJ Daemon speaks 37s
44:17​ Maikel Yeremy – Teller 1
46:30​ DJ Daemon speaks 39s
47:09​ Nescio – Dreaming of you
49:36​ DJ Daemon speaks 33s
50:08​ AceMan – Vintage Groove
53:57​ DJ Daemon speaks 28s
54:24​ Velvet of Amb and Tdr – Sternzeit
56:41​ DJ Daemon speaks 11s

TLDR; Don’t log in to Pastbook or use it in anyway! They steal pretty much all of your data and will sell it to god knows who. If you do: get ready to be bombarded with mail telling you to buy the photoalbum from them… Or else… Really nasty site.

As I was idly surfing on Facebook, a post told me that my 10 year photobook was ready. I should have known better (with a site like you) and NOT clicked on it. I thought it was one of those Facebook memory slide shows where you’re shown pictures with a random friend on Facebook.

When I clicked on it, an authorization dialog came up and told me to login with my Facebook account. This is a clear warning that it wasn’t Facebook I was going to. Being tired and unfocused I stupidly logged in by clicking the link. Terror struck me when I realized what I had done five seconds later. My photos were already spreading accross their site. I unauthorized them, but it was too late.

Their name (too live forever in infamy): www.pastbook.com.

So as to what they want from your Facebook account? Pretty much everything.. No surprises there… And Mark O’ZuckerIsBorn doesn’t care.

SCREW FACEBOOK! PIECE OF GARBAGE SITE! MENTAL BLOODY DOPAMIN-RELEASE DRUG!!!

… And just when you thought it was safe to pop out of your bunker…

I was working from home one Friday as Dnov sent me an email asking for my participation in the FOI 20/20 CTF. I thought about it, and decided to join him and his crack (haha!) squad of elite haxx0rs. A “capture the flag” or CTF is simply a hacking competition, where you work as a team to solve tasks that require you to “hack” something. It does not necessary mean rooting a system, but you have to subvert a service, program or system in order to prove your skills in breaking its security.

FOI – Totalförsvarets forskningsinstitut

FOI is a Swedish governmental organisation tasked with aiding the Swedish armed defence with technology research and support things like disarmamernt and international security. In a typical Swedish manner, doing a lot of things that looks like they’re contradictionary.

On the 26th of September the 20/20 CTF started with a bang as the virtual doors flung open at 2 pm and we worked until 10 pm that same evening.

Meet 0xDEADBEEF

In the Atrocity archives, supernatural hacker/sysadmin/government agent Bob Howard destroys the content of a hard drive by writing the hexdecimal string DEADBEEF over and over again on all the tracks. This is as far as I know an old hacker joke and it fits. 0xDEADBEEF is also the name of our team. We’re at this moment five guys employed in the IT-security field. So let’s talk about us.

dnov
The principal leader of the team. He’s like that white haired old man who likes a good plan coming together in the A-team TV-series. With a broad knowledge in infosecurity, it-security and working with our Swedish defense effort, he is really the right man for the job.

CrashOverride
Ok, so we’re doing A-team references here? This is clearly Mr T. The heavy hitter, who managed to come up with solutions to many different tasks and worked all over the board mostly with cryptograhy and reversing. He has an academic background “in something cyber”. That’s his story, and I’m sticking with it. So there…

StripeCAT
Enough references to the old TV-series, as I really don’t remember it all that well. But StripeCAT is my nome de guerre and I’m a good supporting role, with plenty of experience with web hacking and network (in)security. Know my way around Kali Linux and Burp suite and Metasploit.

FX
Working in the same company as dnov and specializing in webhacking and security analysis.

Zaffner
General profile with experience in a number of different areas.

A journal of sorts… Because, why not?

Saturday, the 26 th of September

10:00 woke up late and spoke to my mother over the phone. Got on an uber to a music store in Järfälla to get my new mixing console. An errant soldering job had swiftly killed the one I had.

12:00 connected the new mixing console and patched the compressor into it. This made it possible to get sound to my rig. A good thing when you’re in a teleconference. Due to Corona, I decided not to go to the location where the others were gathering.

Made contact with the team on Slack. CrashOverride offered to come and get me into the building, until I pointed out I’m working from my home.

12:30 updated Kali Linux on my main PC as a virtual machine. Also had a real laptop with Kali on standby. “All events random favor the prepared” and all that.

13:00 ordered some food and made sure everything worked. At this time everyone in the team had arrived, with FX being the last to enter the room.

14:00 dnov was frantically smashing the “F5”-key to reload the CTF website, waiting for it to start. And sure enough, the challenges appeared on time.

We all started working. Zaffner took the first flag. Just a few seconds before I did. This is not a good thing, as it meant he missed that I was working on it. But dnov soon started coordinating the challenges so we would not work on the same ones unless cooperating. Doing so would otherwise make us lose valuable time.

The first tasks went down easy.

I fed a total list of all existing breeds of dogs into Burp suite and solved a very weird flag involving trying to figure out how to get a web app to give out information to some kind of dog collar that a normal user should not be able to get. It worked and I got a good laugh out of it.

The others worked through cryptography and reversing. One task spewed out simple aritmetic questions that had to be solved with in a few seconds. CrashOverride and Dnov quickly wrote a script to do so and the flag was caught.

FX and Zaffner looked into the arguably convoluted mess of a Javascript that held the secret to one of the flags.

I wrote a script to recursivly open encrypted ziparchives, but CrashOverride mistakenly solved it before I was done. Having lost two flags because of the others failed to note that I was on them made me a bit irritated, so I told them in no unclear terms to start keeping track on who is doing what. No more incidents after that, but my outburst probably rendered this choice of emoji representing me on Twitter from dnov:

… I find that highly amusing…

The afternoon went on and we steadily captured the flags. At one point we were ranked as number nine among the 152 competing teams and this energized us even further.

The remaining tasks were harder and it was pretty clear that the tasks on the right side of the list were the really hard ones. Each flag gives the team and the member points. The points decrease over time as others solve them as well. So looking on tasks that still have the full score you will see that no one else have been able to solve them either…

In the evening we ordered pizza and the team took a short break.

9 pm The night was looming and we were frantically trying to solve the last challenges. The final minutes had me and CrashOverride fighting with a very obfuscated javascript mess to find a flag.

10 pm All is over and the final score is in. We did quite well, but no prizes coming our way. 17th place, that rocks!

The aftermath

So… Did we do it well? Heck, yeah! But we also had fun and learnt a lot along the way. Much obliged.

The good

• A brand new team that had no problems getting into high gear.
• We hit the ground running.
• No real technical problems on our side. Except maybe with Zoom.

The bad

• Took a while before we started helping each other on a regular basis. At first everyone was focused on their tasks.

The ugly

• The test environment provided by FOI was a bit flaky at times.

The links

CrashOverride’s own write-up (In Swedish):
https://github.com/dansarie/FOI2020CTF/blob/master/README.md

(Updated at 2020-09-19 19:13) – Good news, everyone. bxsmail.com is not responding anymore. Could one hope Telia booted mr Spammer off the net? Probably just a minor setback until he finds a news place to send his crap from. Pyrobee.com is, alas, still up and running. Why, oh why…?

How the journey begun….

On Friday the 11th of September I found an email in my junk mail folder. That in itself is nothing special, but this particular spam stood out. It was in Swedish, without the usual auto-translated mess that those are wellknown for. It simply said (translated from Swedish):

Hi

Thanks for the last time, here are the statistics you wanted. I hope you’ll receive this mail before going home for the day.
<Link to what looks like tillvaxtverket.se, but really sends you to a malicious site>

[I] believe it rather clearly shows what we though from the start and that is that there is a large lack of available talent in the rural communes. The quiestion is what could be done about it on a regional level.

The Swedish original:

From: Magnus notification@bxsmail.com
Sent: den 11 september 2020 21:35
To: Erik Zalitis erik@zalitis.se
Subject: Jag tror det var detta du ville ha

Hej

Hoppas du hinner få mailet innan du går hem idag.

hxxps://tillvaxtverket.se/statistik/vara-undersokningar/kompetensforsorjning/2020-04-24-kompetensforsorjning-i-landsbygder.html

Tror den visar ganska klart det vi trodde från början att det är stor brist på kompetens i de större landsbygdskommunerna.
Frågan är vad man skulle kunna göra åt det regionalt.

/Magnus

I racked my brains trying to remember ever having spoke to someone on Tillväxtverket about something that would warrant this response and came up empty handed. I quickly Googled and what I found made me suspect it was some kind of fraud or spam. I posted my preliminary findings on “Säkerhetsbubblan”, a Facebook group dedicated to IT-security discussions.

At this time I was quite curious about what was going on and started tracing the sending system down. The mailheaders were clear on the matter.

The IP was recognized almost immediately by me, as I used to work at Swedish telecom provider Telia back in the day, and sure enough, it was them.

The post code is easy to put on a map:

A typcial war zone in Sweden. A few day care centers for children and small suburban housing. This is where the hacker roams freely…. or maybe not. Seriously though, it’s probably located on someones home network, directly connected to a consumer Internet broadband connection operated by Telia.

One click on this link and you’re toast…

Let’s take a look on the seemingly innocent email (you should know better now, though):

Hovering over the link in the email, shows you where it really goes. The link leading to the Tillväxtverket-site uses an old trick, where the displayed link does not correspond to the one you’re actually are clicking on (Se picture above!).

Weirdly named proxy “Burp suite”, shows exactly what happens over the wire when you click the evil link like there was no tomorrow.

This fake link instead leads to a server for the domain pyrobee.com which is located in Germany. The reply-to address in the mail also points to info@pyrobee.com. The ip-information for this site is as follows.

If you somehow doubt they are malicious, note the abuse-link provided in the mail:

OH!! They have a Facebook presence too… How “I’m just a serious business owner” of you.

And for my final trick, I going to pull a rabbit out of my hat. Or rather, disclose the identity of the spammer. He seriously has his REAL name on the FaceBook-group above. A fast check shows that he lives in the exact same area and in the same Zipcode as the bxsmail.com-server is located.

This links him to the Pyrobee.com-server AND the bxsmail.com-server. So it’s a wrap then? We’ll see.

What about them servers?

So, back to the server in Sweden, server.bxsmail.com. What is it running? Quite a lot actually.

We can go no further as this would constitute an intrusion, and I’m strictly a white hat.

Analysis

Given what we know:

• The link in the email takes the user clicking on it on a detour to pyrobee.com, a server in Germany, and then automatically bouces the unwary user to Tillväxtverket. This way, it will look legit. This link has, what looks to be a identifier, that is most likely connected to the email-adress the mail was sent to. Thus the Pyrobee.com-server will know who clicked on the link.
• Most likely this gives the hacker a list of people that clicked on the link and who can now be further investigated and targetted for phishing attacks in the future. Caveat emptor: don’t click the link! (Unless you’re like me, curious and want to see what happens..)
• It’s impossible to say if this attack was aiming to target Tillväxtverket in any way or capacity, or if they were selected to give the attack itself a semblance of credibility.
• The server sending the email is barely configured at all and only the services needed to send the emails seem have anything more than just minimal “dial tone”-setup.
• It’s likely not to be secured in any meaningful matter. I cannot, as I stated, investigate this any further
• The server in Germany uses a template that teases with stuff like podcasts and a blog, but in reality does not exist. It’s kinda a good thing to remove services featured on the template by default, if you don’t intend to offer them. Looks more serious like that.
• Real advertising campaigns often work exactly like this, but they generally don’t use badly built servers running on someones home broadband connection and then redirect you to another, barely setup server in Germany. Also, they DO NOT SEND spam that tries to fool you that the message is an answer to a previous discussion with the sender that obviously did not happen.

Time line

2020-08-07 – The domain bxsmail.com was registered. It’s probably around this time the mails started appearing.

2020-09-11 – I noticed the mail, that was sent to my private email address, in my junk folder and started to investigate the matter. Had to stop due to needing to sleep.

2020-09-11 – Asked Telia to shut the server in Sweden (bxsmail) down.

2020-09-12 – Sporadic work in spare time during a trip to another city in Sweden.

2020-09-12 16:12 – completed the report after some questions were asked and then added new stuff I found.

2020-09-12 16:23 – reported Pyrobee.com to their upstream provider’s abuse department.

2020-09-12 17:xx – reported spam to spamcop.

2020-09-13 19:xx – They have now created more domains with servers: ettmoln.com and merkurex.com. Probably not a complete list, but I will update as soon as I learn more… Their weak point is pyrobee.com. Take that down and they will have nothing going on.

2020-09-12 22:31 – The identity of the owner of all the servers has been found. He wrote it on Pyrobee’s FaceBook-page. The name is Magnus, but I will not write his whole name here as to stay within the Swedish law. He lives exactly in the same postal code (zip code) area where the bxsmail.com server is located. I have a hard time believing this… Really takes the cake.

2020-09-14 – Right, I was told by the German abuse-department that they will not process the report unless they can tell the owner about it. That will effectivly send this link to the guy behind all this. Who said life should not be interesting?

Evidence and other material

The spam mail, complete with all headers:
https://erik.zalitis.se/files/spam.txt

Thanks

Malin Ekström for spotting a thing I missed.
The rest of the “Säkerhetsbubblan“-Facebook group for aiding me in my research… You guys and gals rock.

Update 2020-09-28: Answer from Burp suite support:

Is it just me, or is this a common thing? It kinda makes my pentesting experience quite dull. The only resolution is to restart the program if you can find out how and then you lose a lot of your progress. Thanks a bunch…

What’s happening here? Well, this problem occurs after a few minutes or hours. The window seems to “break apart” and the different pieces move around as you move your mouse or …. worse… click around.

When you stop the program, it sometimes seems to corrupt the saved file and you could easily lose days of work.