gmail security testing

Quote:

---

Originally posted here by xierox
I don't understand how they would fit an ISO on Gmail because there's a 10MB cap on attachments. :confused:

Regards,
Xierox

---

That's more than enough for me to start uploading MP3s.

I never asked for a Gmail account because I thought that the begging looked a little pathetic too me. Then I checked my mail about two days ago and saw Zombie sent me an invite, so I was like OK I'll try it.

Then I changed a few numbers and letters around in the invite link, and signed up for another account, which worked. Heh, maybe I should report that? Anyway, I got two but sadly it did take away another invite from Dave, which I didn't know about until he messaged me on AIM, so I had to stop so he didn't lose all of his invites.

You can ask him and he can tell you I did in fact get two accounts out of it, and he's mailed me at both of them.

Anyway, I have to do a paper on Man in the Middle attacks for my security + class, so I'll see you Google loving Geeks later.

Quote:

---

I don't understand how they would fit an ISO on Gmail because there's a 10MB cap on attachments

---

Knowing is half the battle (TM)

Quote:

---

Originally posted here by lumpyporridge
http://www.maileet.com/ is one answer. Same stuff as usenet.

---

Except Gmail will work on something other than Windows NT based OSs.

Quote:

---

End of Jokes.....but have we had any "How do I hack Gmail?" questions yet...

---

So how do you hack gmail?

j/k

Hey its gore! AO's PFY :p

Ahem!

You are MY PFY hoe!

:rofl:

Yeah buddy, I got your hoe... :flip:

<edit> Sorry for running off topic here everyone, I just couldn't help myself, gore just seems to bring out the worst in me... gore you are a bad influence </edit>

Aww, looks like lumpy's feelings got hurt. He didn't like that people argued against him and so he did the most mature thing possible, and signed me up for millions of porn emails and junk spam.

:) Adorable. And the funny thing is, is that he think he can get away with it. Now, what he didn't think is that most spam companies now require email confirmation before subscribing anyone completely. This email confirmation usually involves sending the name of the person registering (in this case, someone forged it as pooh) and then the email address to register (my gmail account) and then finally the IP address of the person who requested it.

That's right, the IP of the person who requested to be signed onto the list. Guess what? It isn't my IP :)

So guess what I'm going to do? I'm going to personally call the ISP of this person and let them know what is going on. And then when they ask for proof I am going to zip up a good 30 or 40 peices of the SPAM that has the IP number of this moron, and they will do their work from their. What you commited is fraud, especially since your ISP is routing through the United States, and can be confirmed that it is not a proxy.


So, you can either own up to it, publically, or I'm going to turn all of this information over to your ISP and let them deal with your account, while I exersize my right to ream your ass to the full extend of the law :) At least take pride in knowing that gmail has sent every single peice of spam you sent straight to my spam folder, and thus it never had the chance to bother me like you hoped it would.

Quote:

---

notes:

IP slightly changes, but not as often as a dialup so it must be highspeed based. Same ISP, thus assumed to be same user since they -all- started at the same time and belond to the same ISP netrange. All emails are confirmed around similar times even on different days, indication possibly same user because of similar time patterns.

IPs
68.146.180.129
68.146.235.9
note: Same ISP, different suffixes.

ISP: Shaw Communications Inc, for both ISP's.

And plenty of ways to contact the ISP for them to follow up not only my investigation, but my report to EFF.

http://www.shawcable.net/narrowband/contact_cable.html
http://www.shawcable.net/narrowband/..._internet.html

---

Is this how you treat everyone who sends you presents? geeeez, inviting everyone to send you stuff and then get grouchy :) (if one had really worried or cared about privacy a proxy would have been used)

Quote:

---

geeeez, inviting everyone to send you stuff and then get grouchy

---

I invited people to test my account for security, not send massive amounts of spam because you didn't like the way an argument was going :) You can't even set pride aside long enough to just apologize.

Quote:

---

Originally posted here by pooh sun tzu
I invited people to test my account for security , not send massive amounts of spam because you didn't like the way an argument was going

---

I did, its called enumeration now i have acertained that it is truly your account. (step one is complete), you see i am very methodical. It was out of humor not out of spite and well you didn't seem to mind at the time ---&gt; "Would it matter? The more junk you send my way the more I can add to the "This is Spam" button of gmail, and thus building up their spam filtering database. Don't make me turn threats into opprotunities."

I decided to give you the opportunities how can you be mad;), you have even helped me by bettering gmails spam filtering and i thank you for the valiant effort involved. Use the force pooh


I have had my laugh now, and i am sorry if it raised your blood pressure but the mischief was just tooo tempting.

Quote:

---

I did, its called enumeration now i have acertained that it is truly your account. (step one is complete), you see i am very methodical.

---

lol I'm calling you on your bullshit again. One would not send SPAM and give away their IP through enumeration because it blows their cover. Unless of course your ability in security is so incredibly bad that you would think your IP would be 31337 invisible with SPAM. You knew what you were doing.

Quote:

---

It was out of humor not out of spite and well you didn't seem to mind at the time ---&gt;

---

So wait, it wasn't out of security testing? It was out of humor. Right :) Now you have two different stories.

Quote:

---

I decided to give you the opportunities how can you be mad, you have even helped me by bettering gmails spam filtering and i thank you for the valiant effort involved. Use the force pooh

---

Thank you for the opprotunity and I'm sorry you think I'm mad about this. I mean, I put smiling faces on these posts because I'm furious, yeah.. that's it. I sure will use the force. :) I'm calling your ISP as soon as I finish replying here.

Quote:

---

I have had my laugh now, and i am sorry if it raised your blood pressure but the mischief was just tooo tempting.

---

Once again, I'm sorry you think you upset me, but at least this way without an internet account you will be able to read about network security before claming "sending spam is enumeration". Have fun!

Quote:

---

Originally posted here by gore
Having your IP posted to a forum of computer security people and saying mischief is fun is rarely a good thing. Then again, you have me on ignore, so what's it matter? ;)

---

its not my ip

Then, if it ends up not being you, I guess you are scott free while this user (which the ISP I just called confirmed it does indeed belond to their netrange) is going to get reamed.

Oddly enough, the company is actually based in Canada, and oddly enough, they have verified it's from the same user switching over after an IP renewal (usually automagic). They have, as I predicted, asked I send the origonal emails where it shows your IP address with unmodified headers to their abuse admin (with whom I spoke with over the phone) and will begin an investigation.

Canadian company and ISP.. and only from the same ISP as the one person who threatened to send me spam in the first place.... nah.. couldn't be you.

Pooh:

Your right, lumpy doesn't know what he is talking about when he calls what he did "enumeration".....

Anyone worth their salt can tell that you were just "socially engineered"...... ;)

I guess the Canadian education system is lagging behind the American now..... :D

Aww, cute :D Now he wants to try and reset my google password, for about the 5th attempt.

Quote:

---

To initiate the process for resetting the password for your
poohsuntzu(((at)))gmail.com Google Account, visit the link below

XXXXXXXXXXXXXXXXXXXXXXXX


Thank you for using Google.

For questions or concerns regarding your account, please send mail to
[email protected].


This is a post-only mailing. Replies to this message are not monitored
or answered.

---

Guess who I'm going to have to call next so they can contact your ISP, lumpy? Sure, go ahead and deny it. Why should I believe you? Your stories on this thread have changed more than Senator Kerry's stance on US issues, and contained more false statements and incorrect facts than in President Bush's speeches.

No, pooh, the last attempt was me and I'm going to try to get access... don't blame him for the last one.

Ah, got it :) Thanks for owning up to it ;TT. I'm perfectly fine with you attempting to break into my gmail account, because that was the origonal offer.

If you happen to break in, please do not delete anything and let me know via PM. I would love to dicuss your methodology used in the penetration of gmail's security.


You are off the hook on this one, lumpy.

[brute force honesty post]

You must own up when I get it.......

Your password is pooh
Your password is Pooh
Your password is pOoh
Your password is poOh
Your password is pooH
Your password is tsun
Your password is sun
Your password is Sun
Your password is sUn
Your password is suN
Your password is tzu
Your password is Tzu
Your password is tZu
Your password is tzu
Your password is p0oh
Your password is po0h
Your password is P0oh
Your password is Po0h

Ok... I give up....

What's your password???? PM me, ok.... ;)

[/brute force honesty post]

Does this _really_ matter?

Erm,one teensy weensy doubt....since pooh's asked everyone to have a go at his gmail account...and AFAIK pooh doesnt own gmail in any way...wouldnt such an attack represent an attack on gmail...and the attacker be liable to prosecution by gmail in any way?
just a thought....

therenegade-

Yup!

Lumpy-

You could have just sent him a friendly note to verify his addy :hello:


edit
We need dodgeball smileys!
Because I'm sore from dodgeball. :mad:

well iam no security expert but

https: means kinda secure ,doesn'it (hyper text transfer protocol SECURE)

if you do get in to gmail the i guess then you can get into mail server ( or even a bank ) i don't think that you will be able to get into gmail with a brute force. you will need a loop or a crack in the server (like we had HOBO for hotmail,did it ever work?) so getting into pooh gmail account is like impossible as per me

Quote:

---

Originally posted by: Lumpyporridge
I did, its called enumeration now i have acertained that it is truly your account. (step one is complete), you see i am very methodical. It was out of humor not out of spite and well you didn't seem to mind at the time ---&gt; "Would it matter? The more junk you send my way the more I can add to the "This is Spam" button of gmail, and thus building up their spam filtering database. Don't make me turn threats into opprotunities."

I decided to give you the opportunities how can you be mad, you have even helped me by bettering gmails spam filtering and i thank you for the valiant effort involved. Use the force pooh

I have had my laugh now, and i am sorry if it raised your blood pressure but the mischief was just tooo tempting.

---

Mischief my ass, you are an unethical moron.

Quote:

---

Originally posted here by pooh sun tzu
Oddly enough, the company is actually based in Canada, and oddly enough, they have verified it's from the same user switching over after an IP renewal (usually automagic).

---

Oddly enough, I knew that yesterday when I did a whois on the IP and it came up cg.shawcable.net, so oddly enough, you're a whiny idiot.

Quote:

---

They have, as I predicted, asked I send the origonal emails where it shows your IP address with unmodified headers to their abuse admin (with whom I spoke with over the phone) and will begin an investigation.

---

All he's going to do is point them to this thread, where you basically already said "have at it", and it will be end of discussion. For someone acting so haughty, you sure are clueless about what ISPs actually care about. He's not likely to be kicked off his 'net access, at worst he will get a "warning".

Quote:

---

Originally posted here by Tiger Shark
Your right, lumpy doesn't know what he is talking about when he calls what he did &quot;enumeration&quot;.....

---

The quoted italicized comment applies to many of the participants in this thread. Now that it's degraded into a bunch of namecalling, maybe a mod will come close it. This thread outlived its usefulness on the first page.

This thread has indeed hit the nelson/shepherd cutoff.