Summertime is also time for some extortion scamming... this one just in:

Hi. How are you?

I know, it’s unpleasant to start the conversation with bad news, but I have no choice.
Few months ago, I have gained access to your devices that used by you for internet browsing.
Afterwards, I could track down all your internet activities.

Here is the history of how it could become possible:
At first, I purchased from hackers the access to multiple email accounts (nowadays, it is a really simple thing to do online).
As result, I could easily log in to your email account

One week later, I installed Trojan virus in Operating Systems of all devices of yours, which you use to open email.
Frankly speaking, it was rather straightforward (since you were opening the links from your inbox emails).
Everything ingenious is quite simple. (o_0)!

..

Here is my bitcoin wallet provided below: bc1q82tvkvmzjzyqf60guqpxhcn2tuapqup35a9ldr

You should complete the abovementioned transfer within 48 hours (2 days) after opening this email.

The following list contains actions you should avoid attempting:
#Do not try calling police as well as other security forces. In addition, abstain from sharing this story with your friends.
After I find out (be sure, I can easily do that, given that I keep complete control of all your devices) – your kinky video will end up being available to public right away.
#Do not try searching for me – there is absolutely no reason to do that. Moreover, all transactions in cryptocurrency are always anonymous.
#Do not try reinstalling the OS on your devices or throwing them away. It is pointless as well, since all your videos have already been uploaded to remote servers.

As always: don't fall for these scams.

Earlier items about bitcoin extortion scams: Earlier, earlier, earlier, earlier, earlier, earlier, earlier, earlier, earlier (although I think bitcoin is generally a really bad idea and a huge scam)

Someone reported to me my PGP key was expired and whether I was still using it or I gave up on PGP/GPG.

I have an expiry date on my key, but I do update it from time to time when expiry nears. I now notice just doing a gpg --refresh doesn't update the expiry moment. The solution is to hard fetch the key. In the case of my home pgp key:

$ gpg --keyserver pgp.surf.nl --receive-keys 0x5BA9368BE6F334E4

This updates the expiry date(s) and the uids. If you have my key and it looks expired and/or still has an old e-mail address with kzdoos in it please do this now. Complete data at pgp.surf.nl: Search results for '0x5BA9368BE6F334E4' where you can see all the details including the revoked bits. Those revoked bits won't show up in normal use.

I know gpg and other pgp related software has to be designed to be really really secure up to the last bit, but some attention to user friendlyness could be a good idea if it's possible to confuse even experienced pgp users.

After I visited earlier Dutch hacker events HEU, HIP97, HAL2001, WTH2005 I missed HAR2009, OHM2013 and SHA2017. I can only say 'life happened' because my son was born in the interim and my interests changed.

In the beginning of this year I heard about the new planning for May Contain Hackers as the original plan was for 2021 and it was postponed due to covid-19. I started thinking about attending and when the opportunity to get a free ticket arose due to my links with Surf I got serious.

Life is still happening so I coordinated with the rest of the family whether I could be missed at home and for how long. The result was that I would go Friday evening until Tuesday afternoon and I would go there by recumbent bicycle with the luggage trailer so the rest of the family could use the car.

The people from Surf set up our own village Village:SMRF next to Village:OS3. I slept in my own tent because I really want my rest at night and I want that rest at a somewhat normal schedule (not really a hacker schedule). I brought a 1-person tent, a sleeping bag, clothes, gear to make breakfast with tea and coffee, a smartphone with charger and a handheld radio with charger. Having to move all my luggage myself on the recumbent bicycle made me very selective in what to bring.

I went to several talks spoke a number of well-known people, got to know new ones, saw people there I didn't expect and had a good time.

What I really enjoyed was the friendly atmosphere. One aspect of that caught my attention: besides people with non-traditional clothing and hairstyles I saw several people who looked like they were somewhere in a gender transitioning process. They felt free at MCH to be themselves. One person responded to me when I shared this observation: "I saw more LGTB flags here than at Pride in Amsterdam".

Also MCH was really non-commercial. Mentions of the sponsors were minimal and never in-your-face.

The weather cooperated a lot! It might have been quite different with bad weather. There was some rain before Friday so I saw mentions of "Mud Contains Hackers" on twitter. Saturday and Sunday were hot, Monday was cooler. Tuesday started with rain and some more showers, so my tent wasn't completely dry when I packed.

Cycling the 45 kilometers was fine. I used google maps for navigation (but with the smartphone not visible, just the instructions on my earbuds). I had to stop several times to check the screen to check the instructions and sometimes google came up with weird things. I had it set up for cycle navigation but it still said to take three-quarters of a roundabout to go left while the roundabout allowed me to go from one cycling path on the left of the road to the other. It took me about 2 hours 45 minutes including stops for navigating and stops for drinking, eating and adding some water to nearby trees.

All in all I had a great time. I had my moment of "I am getting too old for this" but that faded and I really enjoyed myself.

List of talks I attended, with links to the place to view it online:

• Everything is an input device (fun with barcodes)
• Honey, let's hack the kitchen: attacks on critical and not-so-critical cyber physical systems
• Radio Amateurism via commercial satelite (no video available), workshop with a demo of the QO-100 broadband transponder
• A Brief History of Automotive Insecurities
• Hacking COVID: Hackers helping the government
• Finding 0days in Enterprise Web Applications
• Audio networks and their security implications
• drand: publicly verifiable randomness explained
• The War in Ukraine: Cyberfront
• Cyber crises and what you can do to face the challenge
• Around the world in 80 networks, Hacking Universities Worldwide. ( ...lessons learned at age 15. ) - Rob Coleman (no video available)
• Payment terminals as general purpose (game-)computers
• A Smart Light Hacking Journey
• Sensor.Community - Global Open Environmental Data Platform
• How do GPS/Galileo really work & how the galmon.eu monitors all navigation satellites

My todo-list for hobby projects has had an entry 'redo maps in sites using leaflet' for a while and on an otherwise calm evening I got around to it. The first thing to upgrade was the recent contact map for PE4KH which shows an overview of places where I had the last 150 contacts plotted on a map, with some details per contact.

I'm not good at javascript programming at all so I just look for examples that come close to what I want and I adjust them until they do what I want. Luckily I found some good geojson examples and I managed to get the points on the map. After a bit of massaging, trying and reading I managed to add the popup with the location. The next and harder bit was adding default and non-default icons. Eventually I got my brain wrapped around the bits needed for that too. After that the test version got deployed to production and you can look at it now.

Documentation and code snippets used:

• Getting started with leaflet
• Getting started in geojson and leaflet
• How to use a custom marker on a geojson layer
• Custom icons in leaflet
• Leaflet reference

The main reasons for switching to leaflet are that google maps was limiting free access to maps although they seem to have mostly reverted this plan and I wanted to promote openstreetmap.

The general conclusion is that sites with maps do need regular maintenance, if hosted leaflet goes away or stops this version, if the rules for using hosted openstreetmap tiles change or if something else happens I have to adapt the site, maybe even quite fast.

De laatste dagen was een deel van de tijd de VDSL weer instabiel en verbrak soms om de 5 minuten. De kabel tussen ISRA punt en modem is wel de verdachte op dit moment.

De standaard oplossing zou natuurlijk zijn om die kabel korter te maken, maar het ISRA punt zit helaas in de kruipruimte en daar wil ik mijn VDSL modem echt niet. Dus er is ongeveer 4 meter kabel nodig van ISRA punt naar meterkast. Op een bepaald moment heb ik daarvoor het bruine aderpaar van een CAT5E kabel gepakt, omdat ik ergens gelezen had dat de twist van dat aderpaar het dichtst bij telefoonkabel komt. Deze kabel heeft wat last van oxidatie, ik heb eerder er ook al een stukje afgehaald vanwege vergaande oxidatie. Misschien moet de hele kabel vervangen worden door een echte KPN telefoonkabel. Ik heb voor de test een keer even een platte kabel zonder twists gebruikt, maar daar werd de uploadsnelheid lager van.

Als tijdelijke oplossing heb ik in de draytek vigor 130 ingesteld dat ik extra 'SNR margin' wil met vdsl snr 10.

Updates 2022-07-18: De instabiliteit bleef vandaag en als we proberen thuis te werken is dat heel gauw heel irritant. Een tijdelijke andere kabel tussen ISRA punt en modem gaf ook geen verbetering, dus rond de lunch maar gebeld met de internet provider Freedom Internet. Die als volgende stap aangaven om de firmware van het modem te upgraden (er was inderdaad een nieuwere versie) en nog eens een factory reset te doen. Bij een draytek Vigor 130 is dat laatste vrij makkelijk door een firmware met .rst extensie te uploaden. Helaas was de recovery procedure Draytek modems weer eens nodig na de eerste upgrade via de webinterface. En het duurde even voordat ik doorhad dat ik het belangrijke woordje binary in die procedure vergat, en dat leverde geen startend modem op. Uiteindelijk gelukt en weer verder...

Maar na een verdere set onderbrekingen was het duidelijk dat het niet verbeterd was en heb ik weer teruggebeld naar Freedom Internet. Na veel ruggespraak, nazoeken en overleg met collega's was de volgende stap dat er nu een monteur gaat komen van KPN Wholesale Broadband Access. Eerste optie op donderdag 21 juli.

Updates 2022-07-21: De KPN monteur heeft uitgebreid gemeten en het ISRA punt vervangen omdat de draadjes in het ISRA punt niet ideaal er in gezet waren. De monteur heeft geprobeerd het ISRA punt te verplaatsen naar de meterkast maar daarvoor is de grondkabel helaas net te kort. Na het vervangen heeft de monteur nog uitgebreid gekeken naar alle lijnstatistieken, zag dat DLM niet aanstaat op deze lijn terwijl hij dat wel verwachtte maar dat kan een keuze zijn van de provider.

Een van de dingen die de monteur zich nog afvroeg was wanneer er glasvezel zou komen naar dit adres. Dat vraag ik me ook regelmatig af, maar ik hoor niets over plannen. Open Dutch Fiber is aan de overkant van het spoor bezig in Tuindorp. Maar geen van de fiber aanbieders laat iets weten over toekomstplannen tot dat er een echt project is om een bepaalde wijk aan te gaan sluiten.

Updates 2022-07-22: De volgende ochtend blijken er toch weer vergelijkbare onderbrekingen te zijn. Freedom mailde pro-actief dat ze van hun kant ook de problemen zagen. Een optie is nog om het te proberen met een ander modem.

Updates 2022-07-28: Terug van MCH2022 blijkt alles sinds de avond 22 juli stabiel en zonder onderbrekingen te werken. De tellers voor fouten blijven sinds de 25e stilstaan. Pas nu ik zelf actief ben op de radio is er weer een korte onderbreking.

Friday I had the day off and a plan together with Kees PA5Z to visit the location Trintelhaven again, just like we visited the location Trintelhaven in the summer of 2019.

This time the plan was to test some different antennas and make morse contacts. Driving there wasn't too big of a problem although you really have to use navigation to get through Lelystad, it's like through-traffic from the main highway (A6) to Enkhuizen isn't really promoted.

We got there fine, looked for a nice spot, found all the work machines we saw on the previous visit gone so there was a nice spot again. We selected a secluded field not to close to someone working on a boat, far away from everything else.

Endfed antenna set up at Trintelhaven

We set up my endfed antenna with one end up in the trees and the other end supported by a metal pole. On testing this antenna worked fine again. I redid all the soldered connections in it after it failed me a few weeks ago.

I called CQ in the 20 meter band in a spot where one can usually find slow morse and got some contacts with nice people in the log. One with SM6RWJ in Sweden, one with WB2YVY Kurt in the state of New York in the US and one with LA9FG Nol in Norway near Aalesund.

Kees PA5Z en Koos PE4KH behind the radio

Kees also made some contacts. His nicest contact was with SK6SAQ the amateur radio station at the World Heritage Grimeton radio station. After a few morse contacts the radio Kees brought stopped working, it switched off and restarted when trying to transmit morse. It wasn't very clear what caused this.

As planned we took turns on the antenna sending morse, while both listening for answers and writing down the callsigns and the replies that came, including first names and weather reports: it was cloudy in Norway.

A nice day out. Sending standard messages and writing down what was coming back is getting easier after all our morse training!

More than 11 years ago I wrote about the Magna Carta card systems for access / payment and the use of the mifare classic (in Dutch). I found a strong statement on the Magna Carta website back then that using mifare classic for stored value was a really bad idea, since the encryption on the card is broken.

It's now 2022 and I read MIFARE Cracking about a company using a mifare classic for stored value which shows the steps from discovering what type of card that company uses to the option of manipulating the stored monetairy value on the card.

Found via Travis Goodspeed on twitter - A practical article on cloning a Mifare Classic employee badge to tamper with the snack machine.