Phishing...or What to Call It? (a curious attempt at remote compromise) Presented by Dave Mawdsley, DACS Member, Linux SIG Leader April 15, 2015

A Look at My Web Calendar 1 A Look at My Web Calendar At http://madmod.com/calendar.html a customer can click a date—say the 22nd.

The Resulting Form 2 What appears is form with boxes to fill in. (I've filled them in somewhat.) Then clicking on Submit Request sends an e-mail to my account with the data.

What the User Sees Next 3 The form is posted to a cgi-bin Perl script which sends an e-mail to me. The webserver for my website takes the data and uses a sendmail script internally. This has worked properly for years and my customer continue to use it.

So What's This in my E-mail? 4 It has the look and feel of a phishing or denial of service incident. Unfortunately, emails such as this have appeared for a number of days recently.

A Look at the Full Header 5 I was looking for the originator of the e-mail address. I found an IP address that I could use, namely 46.161.41.199 . Using Network Tools I looked up 46.161.41.199 using the whois feature and found a useful e-mail address.

Email #1 6 My first e-mail to complain@bulletproof-web-ru :

E-mail #1 Reply 7 A good response from BulletProof Web Abuse

E-mail #2 Reply 8 A hopeful reply.

E-mail #2 Reply 9 A good response from BulletProof Web Abuse

Phishing...or What to Call It? (a curious attempt at remote compromise) This Presentation 'phishing.odp' can be downloaded from http://madmod.com/freebies.html