Interrobang's Journal: Perfessor Multigeek Update: Hinky Shit

I just got off the phone a while ago with Rustin, sharing some information I found doing research on what he told me last night... Late last night, he told me that he got this strange CD in the mail, and he thinks it's someone trying to pull off some nasty shit. It came addressed to him in a generic white disc mailer with a hand-cut, laser-printed label on the outside, with no note, and it's a home-printed CD made to look like an "official" Hewlett-Packard data CD. (From his perspective, he says it's more likely "Intel Inside.") The label has a few cryptic numbers on it, with "hp" in lower-case letters appended to it. The return address is 1931 N. Court St., Rockford IL (more on that later), but the actual mailer was postmarked from Palatine, an even smaller town in Illinois, which looks to be some 250km to the east (ie. not just " going to the post office in the next town"). The mailer was postmarked the day after he went to the DMV and got his ID back.

I Googled the return address, and it seems to be the home of someone named Rebecca Venrooy who vaguely exists at recipecd.com. Apparently she's actually got a couple of phone numbers (which I've already given Rustin) and is an interpreter for the deaf... She also lives around the corner from someone named William Boykin (the same name as the US Lt. General who got in all that trouble for making those rather intemperate Christian-supremacist remarks)...

I had to find most of that out by some fairly circuitous means.

Anyway, Rustin says this looks like classic stuff from the '70s and '80s, and I said, "What are you doing now that's making whom nervous?" He said the only thing he can think of is he's discussed a proposal for a Constitutional Amendment regarding transparency in intelligence-gathering with me and a few other people. (I can't vouch for the other contacts, but at least with me, he was talking about it on the telephone.) Keep in mind that this is not the first time Rustin's been tangled up with this sort of thing, because he had some peripheral involvement back in the 1980s when he was a teenager interning with Polysoft and working on a demonstration of a technique for tapping fibre-optic lines, something he came up with himself.

Fortunately, Rustin's got a safe environment in which to run the CD, happenstantially. We shall see...

Interestingly enough, Rustin's been having some small amount of trouble with his POTS line (Verizon, of course) for some time, but that's nothing unusual...except that today, when he was talking to me (I called him to share the information I'd dug up hacking and slashing around with telephone directories, reverse lookups, and Google), he got an automated notification message from Verizon saying that his long-distance service carrier had been switched, which is not something he asked for. (I said, "Someone slammed you!")

All of us Reed&Wrighters are going to be just a little bit more careful about our "security of the person" from now on, including me. With luck, this is a statistical anomaly, and/or someone playing a nasty practical joke. On the other hand, better safe than sorry. (Yes, I realise that there are jurisdictional issues, but precisely when has that ever stopped a determined governmental agency before?)

wow

[robi2106]

Very interesting..... I don't have any experience or comments.... just keep us posted of events especially the contents of the CD unless it start giving out too much info.

jason

Rustin!

[AntiFreeze]

Hey, I've been trying to get in touch with Rustin for over a year now. We met up a while back, and I still have a couple of books I borrowed from him, but his cell stopped working and his email mailbox has been full for ages (the dataomnivore one at least).

Let him know to give me a call, all my contact info is in my user page.

Hope you're doing well too #! ;)

Trojans via CDs

[NaveWeiss]

This is how the trojan horse from Israel was spreaded - using the AutoPlay information in the CD.

It's always good to disable AutoPlay. To do that in XP:
1. Run "gpedit.msc"
2. In the left pane of the program that appears, navigate to "computer configuration" > "administrative templates" > "system".
3. Double click on the right pane: "Turn off autoplay". and choose "enabled" in the dialog box that appears.

Voila!

Re:Trojans via CDs

[Interrobang]

Thanks for the information. Rustin's using a Mac, though (as always), so information about XP isn't useful to him. Since he has at least one totally clean Mac, he's planning on disconnecting the HD, booting from the internal CD-R drive, and putting the suspicious CD in his external CD-R drive, and testing it that way. It's nice, clean, neat, and there's no possible way that it could plant stuff on the hard drive, run malware, or write anything to the HD, because there won't be one for it to use.

I'll ke