Robbed in London : New email scam

Recently I came across a new email scam strategy. It's like you will get a mail from your friend's email address that your friend went to some place (London preferably) for vacation and got mugged in the hotel. She lost everything except the passport. Now she needs money to pay the hotel bills and come back to her place. So she requests you to loan her some money (mostly around $1000) which she promises to pay back once she will be back. Also the money has to be transferred through Western Union Money Trasnfer. Following is the exact content:

"From:YOUR FRIEND

Sent: Wednesday, March 03, 2010 11:15 PM
Subject: Sad News!!!

I'm writing this with tears in my eyes,my fam and I came down here to London,England for a short vacation unfortunately we were mugged at the park of the hotel where we stayed,all cash,credit card and cell were stolen off
us but luckily for us we still have our passports with us.

We've been to the embassy and the Police here but they're not helping issues at all and our flight leaves in less than 3hrs from now but we're having problems settling the hotel bills and the hotel manager won't let us leave until we settle the bills.

Am freaked out at the moment.."

Seems like they first hack the email account, change the password so that the victim won't be able to access her account. Then send mails to the people in the contact list. Though it's new to me but seems similar stuff already happened through Facebook. Details of the earlier incidents were reported here. Also here is a funny discussion of the hacker and a person to whom the hacker was seeking help after compromising a facebook account.

But this time in case of my friend it was not facebook but msn. So seems like they are now spreading their access over the accounts. Now once your are victimized what should you do???

Well, following are few things you could do to prevent your friends from falling prey of the trap:

1. Firstly make sure you have a strong password for your account containing upper case and lowercase letters, digits and at least one special symbol like #, $, & etc.

2. Better to change your password every 3 months or so.

These reduces the probabilities of being hacked. But still there is a chance and if that happens and your friends start getting scam mails from your account, do the following:

1. Try to login to the compromised account. If you are lucky enough to get into the account change the password immediately. You can also try "Forgot Password" option if that is working.

2. If you could login to the account, mail all your contact stating that your this account was hacked and do not reply to any mail from this account.

3. Also if you have any other accounts (facebook, orkut, linkedin etc), please update your status with the same information so that others will be informed about the same.

4. If you have any other email account, log in to that and inform everybody in you contact. (Luckily you might have the same set of contacts that the compromised account has.)

5. If you are using the same password in your other accounts change it immediately.

6. Also you can try reporting the incident to your email service provide and request them to block or reset the account and give it back to you. This process varies for different email service providers. For gmail try this, for hotmail/msn try this, for yahoo this could be helpful.

7. If you want to go further, you can contact the corresponding law and enforcement agency who deals with cyber crime for further investigation.

8. Incase of investigation, email headers of the scam mails could be useful as that could gives the ip addresses of the hacker which could lead to her location. So better ask your friends who got the mails to keep the mails/capture the email header and store for further investigation.

9. Also using ReadNotify you can trace the hacker and give that information to the law and enforcement agency.

10. Last but not the least, it could be possible that the hacker was using some sort of trojan or keylogger in your computer to get the account information. So scan your computer by antivirus/antitrojan software to ensure that your machine is clean.

Also keep yourself always updated with the knowledge of various scams and let others know.

Nmap using TOR

Got a good video about how to do a scanning using nmap and TOR. It increases the anonymity factor.

For further reference, refer here. Also this could be useful.

Send gmail from command prompt

Recently I was just playing with telnet, ssl etc. Reason being, learning how to check http web server on port 80 using telnet. It is a faster approach than opening a browser and type url and wait from the page to load, blah blah.... Specially when your intention is just to verify and not bothered about the content much and you are doing it frequently and multiple times.

telnet www.your_website.com 80
(Enter)
GET /index.php HTTP/1.1
host: www.your_website.com
(Enter)
(Enter)

And you should be able to see the content there in the command prompt. Then this thing came to my mind, can I also send mail or receive mail from the command prompt. Well yah, very much.... So here is how did I send mail from my gmail account:

Steps:

1. You need to get into the SMTP server via telnet if it is not encrypted, or via SSL/TLS (encrypted), gmail uses encrypted communication.

2. You need to authenticate yourself using your gmail username and password.

3. Specify the sender's and receiver's address.

4. Type in the subject and content.

5. Send it.

Generally for an unencrypted custom SMTP server, it is quite simpler and explained here.

But this uses SSL/TLS. So here is it:

1. Login to gmail smtp server

openssl s_client -crlf -connect smtp.gmail.com:465

It will reply a lot of test and at the end of it you should seee

220 mx.google.com ESMTP 14sm2559253gxk.11

220 code means OK.

2. Authenticate yourself:

You need to encrypt your username and password first:

perl -MMIME::Base64 -e 'print encode_base64("\000My_EMAIL\@DOMAIN.com\000MY_PASSWORD")'

Once you give your username and password there properly, you should get an encrypted test in response. Copy that. Go back to your SMTP server prompt and type the following:

AUTH PLAIN your_encrypted_password_from_previous_step

235 2.7.0 Accepted

3. Specify the sender's and receiver's address.

mail from:

250 2.1.0 OK 14sm2559253gxk.11

rcpt to:

250 2.1.5 OK 14sm2559253gxk.11

4. Type in the subject and content: It starts with the "data" keyword.

data

354 Go ahead 14sm2559253gxk.11

subject: test

(enter)

(enter)

hello, This is my content

5. Send it: Once you are done writing the content, type "." (dot) and it enter twice to send it accross.

.

(enter)

(enter)

250 2.0.0 OK 1267453152 14sm2559253gxk.11

The last "." in the command signifies the end of the mail and sends it across. And!!! Trinnnn, youv'e got a mail....