Facebook Filters

I worked on the 2nd part of a project to try and automate signing up users for Facebook accounts. I can successfully do this when Facebook is playing nice. Unfortunately, Facebook doesn't always play nice and asks you to verify that the user signing up is a real person. Facebook also will filter out e-mails that it doesn't like, which just so happen to be the e-mails I want to use because you don't have to sign up for them. I found a couple like YopMail and MailTrash that work. The real issue is that Facebook will randomly (probably not randomly but I haven't seen a good pattern) ask you to verify through a phone call that you are a real person and you can't use the same number for different people. Its possible it tracks accounts being made from the same IP but I tried using Tor for some testing on this and still had problems. My program does work when this doesn't happen and if it was just a CAPTCHA like I've seen happen before than I can just prompt the user to fill it out. I have a few users made now so I can try some things with the 3rd part of the program which is actually the spamming engine. If I come up with a solution I will update this. I will also work on getting up a GitHub to share this project's code.

Generating People

Got a new project I've been working on to try automate the process of making fake Facebook accounts. The first step was to make a bunch of fake people. I got some lists of popular first names from Social Security Administration website and a list of common last names for North America from Wikipedia. Depending on the generated sex it will pick from either a girl's name list or a boy's name list. All birthdays are in the range of 18-80 years of age. The email and passwords are just randomly selected alphanumeric values. I then save each generated person to an XML file. Here's an example of what gets generated:

<person>
<firstname>Michelle</firstname>
<lastname>Green</lastname>
<sex>0</sex>
<birthday>1989-02-25</birthday>
<email>TLOG9THWMKb1lTHX</email>
<password>2sQ2GWn8fnorhG28fEGcEMjxMSEjTEoA</password>
</person>

Some of the next steps for this project include automating the Facebook signup process, which involves using Selenium WebDriver. Then after all the fake people have a Facebook account I am going to try and spam someone with 100 invites or something silly.

Sophos Puzzle 2013

So one of my friends sent me a link to the Sophos puzzle which was a cryptogram to be solved. The rules are below or you can go here:

 So you can solve this year's AusSHIRT #sophospuzzle straight from the shirt, using nothing but pencil, paper and intellect. Of course, you can still throw some home-hacked scripts at the problem if you want: a little bit of brute force goes a long way, and you can leave your scripts running while you attend the conference parties.

How to get started

The puzzle is a cryptogram, which means that the letters on the cube have been scrambled using an encryption algorithm.

Encryption algorithms usually rely on a mixture of substitution, where one letter is changed into another, though not necessarily always into the same one, and transposition, where two letters are switched around, like an anagram.

The easy part in this puzzle is that the substitution always replaces each decrypted letter with the same encrypted letter.

And the letters in the answer appear in the same left-to-right, top-to-bottom order that they do on the cube.

The only transposition you need to worry about is to put the three faces in the right order, so there are only six possible combinations to worry about.

Usually, a straight letter-for-letter substitution is called a Caesar cipher.

The cipher gets its name because it was considered state-of-the-art back in 55BC, when J. Caesar first invaded Britain. He just shifted every letter two places along in the alphabet, writing C for A, D for B and so on. At the end, he wrapped round, so Y became A and Z turned into B.

Caesar ciphers are easy to solve because of repeated letters: the encrypted text shows the same bias (e.g. in English, that ETAOIN are more common than JKXQZ) as normal text.

So we've made this slightly harder than that, as follows:

Letters appearing more than once in the puzzle are all shifted by the same fixed amount (obviously, the shift is somewhere from 1 to 25). Each letter that appears just once in the puzzle is shifted by a different amount, with one letter shifted by 9, another by 8, and so on down to a shift of 1. By the way, the Sophos Shield icons are just for decoration - they don't count as letters in the puzzle.

How to get hints

Follow @Sophos_ANZ on Twitter, and keep your eye on the hashtag #sophospuzzle.

Oh, and bear in mind that a dictionary attack probably wouldn't hurt, so you might like to start out by trying to guess at text that is likely to appear in the solution.

I solved it by first brute forcing the key space of 26 to find out what key shift the multiple letters were using. After finding that out I pen and papered it to find out the solution. I decided to script the ability to give every possible combination for the single letters which then could be sifted through to find the correct solution. Both the solution and code can be found after the jump or you can go here to read the nakedsec solution.

SSID Switcher

I am taking a wireless security class and one of the projects I was working on is to defend a wireless network. I thought it would be cool to create some program that would switch the SSID of the router at a set time interval. This combined with not broadcasting your SSID should make it hard for a hacker to break your WLAN. I used a pool of 5 SSID's and had them already loaded on my computer to see how practical this would be. It seemed to be fine with longer time intervals, but I think a designated computer would need to have a physical line to the router to run the program. Anyway the code and a better write up are given after the break.

I'm a Tweeting Robot

Or at least I have a tweeting robot. I've had the idea to automate a twitter account for a while now after seeing other various robotweeters such as the one that tweets poetry. It doesn't do much right now (as a matter of fact its offline right now) other than tweet out a number every hour. I have been working on writing some additional functionality to tweet out the weather in the morning, a word of the day in the afternoon, and a picture of the day at night. As with all my projects this is still in its beginning stages. The program was written in Python and uses the Twitter API to tweet. Maybe someday I'll actually complete something, but until then you can follow my robot @RoboCWOOD. Below is the code I use to do it excluding my access keys and such.

Follow @RoboCWOOD

I HAZ ALL THE VOTES

I'm living in the DC area for the summer and am a huge NBA fan. Not having cable forced me to watch the NBA playoffs on the Internet. The Western Conference Finals were hosted on TNT's website where you could vote for a fan cam to follow a player from each team. I wanted to put two unlikely players on the fan cam so I wrote a little program with the help of Selenium WebDriver to repeatedly vote for me. The expected results were for Tony Parker and Kevin Durant to be the leading vote getters. Instead it was to bench warmers. The script is after the jump.

OINK OINK

Some progress has been made on the Snort GUI including the general template of the GUI as well as the ability to make a rule and save a list of rules. For the first version I just want a simple edit rules interface that is clean and usable with the ability to save and load the rules as needed. Below is a picture of how it looks right now. I need to clean some of it up, but I think you will get the idea of what goes where if you've ever written a Snort rule.