Conrado strikes again

Another fraud victim has sent me an email with this:

It has the same quality as Conrado Davila's previous fraud: he modified my code a bit (removing the GPL license, attributions, etc.), claiming this time that it can calculate Toshiba unlock codes, and sold it to some guy for $460. Interesting, the payment went to "Luis Eugenio Davila de Garate". He probably has burned his personal paypal account and is tapping into the account of a relative now.

In other news, here are some of his clumsy attempts to advertise on youtube, and here is a fan site which he created with all of his skills in a pretty lame attempt to extort me to retract all the information about his scams...

Update 11/1/12: Conrado's getting desperate:

Update 7/5/12: Another victim...

Shmuck of the Week: Alexis Toledo / novatec / biosremoval

Here's another guy selling passwords to people for ludicrous prices: $35 for 2 minutes of work - not bad. You'd think that he can afford a nice website by now, but it still looks like the final project of a community college web design class in the nineties:

Thankfully, his apparent lack of discernible technical knowledge made it very easy to find docs:
alexis toledo 
422 mystic ave
somerville, MA 02145
US
781-330-1378

Another address of someone who is involved with this is: 
Edisley Sousa
6xx American Legion Hwy
Rosindale, MA 02131 
US


There's a bunch of websites and accounts he operates under:
biosremoval.com
novatecdirect.com
revertendotecnologia.com.br
palmastec@gmail.com
hi5geeksolutions@gmail.com
biosremoval@gmail.com
youtube.com/user/alexisakaedisley

I've been collecting his stuff long ago, but never had the time to award him properly until he sent me this reminder:

Guess what...

If you ever have been foolish enough to send this guy money, please contact the paypal fraud department.

Update 1: I just love emails like that.

 

Update 2: Alexis resorts to empty threats in LARGE LETTERING. I won't be able to sleep tonight :(.

Update 3: Another victim has come forward...

Shmuck of the Month: Sony

Two types of companies exist: those which are growing and those which are dying. Sony clearly belongs to the latter for over a decade now. The high level of engineering that once made their products excel has been replaced by bland mediocrity and delusional control ideas that are manifested in recent Sony products such as Bluray, the PS3, etc. In their latest act of desperation, they are suing a couple of guys who have successfully hacked the PS3 to bring Linux back to the console after it has been illegally removed in a firmware update. The flaws they used to obtain access to the multi-millon dollar security system can almost solely be attributed to crass design blunders that would have been completely avoidable in the first place.

Sony has a line of laptops ("Vaio") which compete mainly in the high value market segments. They implemented a master password bypass which is rather sane in comparison to the rest of the bunch:

• The randomly generated master password is only stored in RAM, e.g. it's lost after the next reboot ("one time password").
• RSA is used for encrypting the password which is then converted to a human-readable form (4x4 characters/8 bytes/64 bits).
• Their customer support apparently allows for one free password generation per device which is pretty decent by the industry standard.

However, they screwed up by choosing a key length that is just 64 bit and hence too small: an unoptimized python implementation of a general number sieve yields the factors of the key in less than a minute. With these, writing the generator script is an easy exercise:
python pwgen-sony.py
Master Password Generator for Sony laptops (16 characters otp)
Copyright (C) 2009-2010 dogbert

After entering the wrong password for the third time, you will receive a code from which the password can be calculated,
e.g. 73KR-3FP9-PVKH-K29R

Please enter the code:
D63K-XFVF-TK7H-RJKX
The password is: 43878945
 
I'm not the first one who discovered this: hpgl also reversed this scheme quite a while back. There are even some idiots on eBay who sell these master passwords. 

Update: released here

Shmuck of the Month: Conrado Davila / laptoprebirth.com

Among the many contestants for this award, there are always some who stand out as exceptionally smug. Conrado has successfully gained access to this select class of people. This is an email from the first time he tried to contact me:

By stating that he is "involved in the world of laptop hacking", he actually means that he defrauds people by selling them my stuff for only 40-50 $/password on his website:

Among the clusterfuck of typographical mistakes and perspective errors in his graphics, he has thankfully put his full name and address in the whois record of the domain:

laptoprebirth.com #17036
conrado davila (conradodav@hotmail.com)
eugenio sue 1279 colinas de san jeronimo
Monterrey
,41600
ES
Tel. +34.955842323

respectively

NAME: Conrado Dávila de Gárate
ADRESS: La Luisiana #3
CITY: ARAHAL (SEVILLA)
COUNTRY: SPAIN
POSTAL CODE: 41600

I'm sure that the local DA has an extensive record on him.

The icing on the cake, however, is his sale of my GPL'd code to some gullible sucker for big bucks. That guy actually wanted to buy a generator for the Sony one-time-password stuff from him, so Conrado just modified my 5dec script to the effect that it seems to generate the password from the Sony one-time key. Suffice to say that it doesn't work at all since he has no technical expertise whatsoever. The other thing that he conveniently removed is my authorship of the script. Here's his delivery email:

So this month, the prestigious "Shmuck" award goes to Spain. Congratulations - you earned it!

Shmuck of the Week: 3_2_1_4you / bluechip82

Here's another gem from eBay that a reader has sent me:

3_2_1_4you's apparent lack of technological knowledge ("dos box tools" etc.) is just the icing on the cake. The epitome of his chutzpah, however, is the price at which he's trying to sell my stuff: $85 - just wow. That easily earns him the glorious "Shmuck of the Week" award.

Update: Apparently, he's now going with the username "bluechip82".

Shmuck of the Week: Jason Smith / mastermindit.biz

Here's a screenshot of Jason's awful site:

Designed like it's hosted on Geocities in 1995 - check. Shitty ads - check. Asking for donations without mentioning my site for the extremely hard task of running my stuff - check. So the Shmuck award goes to you, Jason - congratulations, you earned it!

Shmuck of the Week: jebishere

Among the many, many, many douchebags who just want to make a quick buck from the work of others, a reader of my blog found this gem on eBay:

This is outstandingly presumptuous, and so the 'Shmuck' award goes to jebishere - congratulations!

Shmuck of the Week: mrkhangba

Among the many, many, many auctions put up by people who are trying to make a buck from the stuff on my blog, I found this gem:

mrkhangba has hence won the prestigious 'Shmuck' award - congratulations!

Shmuck of the Week: reda

From: reda (mmaimouni@hotmail.com)
To: dogber1@gmail.com
Subject: pleez help
Date: 04/29/2010 01:59:28 PM

hi ,iam interested in what u do, it is very helpful for us, this is why i ask u , i need a dell password generator for all the latest editions 2a7b and a95b, and if possible the hp 10 digits pass.pleaase help me.ur my only chance.thanks

Translation:

I shamelessly use the results of your free work to generate parts of my income. I ask you to perform work for which I am both too stupid and lazy. I am not willing to pay you a dime, but I am actually planning on using it for my personal financial gain.

Mhhh... no.

More crap from Martech.pl

I gotta admit, they have been incredibly fast at stealing the stuff this time:

Martech SBS Tools V3.2.5.0 - DELL FREE

What's new:

- Bios & HDD for DELL 595B, 2A7B, D35B free for users
You can unlock 5 per day without needed payments.

Application is payable, it cost 39 EUR / 52 USD

Download it: SBS Service Tools


Be ready! For next updates :)
Martech Team

That news item is dated one day after I published the previous blog post and two days after I completed the source code for the keygen on a known forum.

Shmucks of the Week: Martech.pl & Kulankendi.com

This time, the "shmuck of the week" goes to Poland: in a rather shameless fashion, the idiots from Martech.pl and Kulandkendi.com have literally stolen my GPL'd password generators: Martech has implemented them into a shitty piece of software called "Martech SBS Service Tools" which they are trying to sell. They didn't even bother to hide their theft: the message in the screenshot below is copied verbatim from one of my scripts:

Kulankendi.com are trying to sell the passwords themselves for 50 USD each:

Shmuck of the Week: Felix Hernandez

Felix runs a shady business by basically selling the results my GPL'd work to naive people. Since I'm such a dandy fellow, he wants me to help him fill his pockets some more by reverse-engineering the password schemes used in Sony and Dell laptops:

From: Felix Hernandez (felixlapbios@gmail.com)
To: dogber1@gmail.com
Subject: HELP BIOS PASSWORD TO DELL THANKS
Date: 02/22/2010 08:46:55 PM

Hello Friend I'm Mexican and my truth because just like you I like the
community help me ah been very helpful all you've developed programs to
generate the master passwords
That's why I want to give the link to unlock the sony vaio to send the
disabled system error

Only need the last serial number of the laptop to come on back

http://hpgl.googlegroups.com/web/SONY_Form1.rar?gda=73_AtUAAAADBratxJI3TcN2SnEOtgI52Or9i_fMM3dcP7Nz297qKnGJHTKS9woYaVuufKj-4-9ttxVPdW1gYotyj7-X7wDON

 Hear also want to see if you can help me learn how to unlock sony vaio
onetime password and dell 595B 2A7B A95B

HELP ME PLEASE TO UNLOCK BIOS TO DELL THANKS

Guess what, Felix...

Shmucks of the Month

So I stumbled across these sellers on eBay who seek to gain financial profit from my work:

• petrachesimona
• transgression
• biosdepot
• laptopunlock
• amazanj2010
• repairsales2011
• and lots of others....

I get emails every now and then which strongly suggests that the eBay stuff is merely the tip of the iceberg. For instance, one guy complained that he paid a substantial amount of money to obtain the scripts which I have released under the terms of the GPL for free. Apparently, I'm fueling a small industry.
That being said, I want to make clear one thing: I'm not interested in financial profit, but merely in the technical challenge which lies in breaking these security systems (or rather 'obscurity systems').

Shmuck of the Week: biosrepair.com

Looks like the award goes to china once again:

Shmuck of the Week: rebios.net

The sneakiness of some low-life deadbeats never ceases to amaze me - I've just stumbled across this:


Observe the conveniently removed name after the copyright notice of the script and the lack of any attribution whatsoever.

So, the shmuck of the week goes to rebios.net - congratulations!