Category Archives: Uncategorized

Two-step authentication hacks through AT&T Messaging

A while back there was a bunch of noise on the net about single letter twitter handles getting blackmailed and how @h lost his.  Since I have a single letter twitter handle (@x) and know quite a few of the other single letter folks, I’ve noticed lots of random password reset notices and @ replies asking for my handle.

This isn’t something new, but one of the things recommended for security is to use two-step authentication.  Often this is done by having a code texted to you so when you log into a site, you use your username, password and that code to log in.  However, hackers have found it easy to hack AT&T Messaging and used that to view the text messages and thus could gain control to any accounts that might use two-factor authentication (so much for that!).

@j first had this happen and it happened to me at about the same time.  @j contacted AT&T support and didn’t have much luck getting the situation resolved and I had the same problem.  @t helped to get the word out about this vulnerability and @a had contacts at twitter that helped expedite both @j and I getting our accounts back.

For me the whole process started with some mysteriously random texts from those five digit text message return addresses reserved for notices.  They said something about AT&T Messaging, and it looked to me like they wanted me to sign up, so I just kept deleting them and thought nothing of it.  This was around May 19th, 2014 or so.

Around May 20th suddenly while I was out, when I tried checking twitter to see what was going on, it asked me to log back in and I couldn’t.  I thought it weird but didn’t do anything about it until I could check later on when I noticed my account wasn’t mine any more (screen shot below from May 20, 2014).

2014-05-20 22.08.40

 

Twitter was pretty responsive and I got my account back pretty quick with most of my account intact, but unfortunately @j lost all her info (although somehow she was still following me).  Contacting AT&T was much tougher and I got the runaround although they did their best to help, but the support folks didn’t really have a way to get the actual situation cleared up.  Through twitter I did get to talk to AT&T Customer Care, who provided one link that seemed to help.  Going back and forth to set up a AT&T Access ID was a pain but finally today I got ownership of the AT&T Messaging account and things seem to be back in order.

The most stressing thing about this is how easy it was for the hackers to get access to your text messages through AT&T Messaging.  This pretty much makes two-step authentication worthless and is a pretty serious security vulnerability.  At AT&T it seems that the way the accounts are set up between your actual AT&T account and the messaging account is not super well integrated either.  The fraud dept. couldn’t help me at all and their response was pretty much ‘not our department’ so luckily I was mostly able to get control back on my own.

Tue June 15, 2010: In-N-Out Burger #27 – Double Double genex Style (correctly made) – Mill Valley, CA

Tue June 15, 2010: In-N-Out Burger #26 – Double Double genex Style (correctly made) – Mill Valley, CA

Heading back up to Napa means a visit to In-n-Out – this time the Mill Valley location, where I was foiled by a bunch of high school kids backing up the line out the door.  I shook my fist in anger but waited it out.  My “genex style” burger came out correctly although the receipt and order input was unique with them marking it as Onions Instead of Pickles. Since there’s some random background stuff in the pics from this meal, I was reading about the BP Oil Spill during my meal, and the receipt was shot on the back of the current issue of PDN (I am pretty sure that’s a Profoto ad with a Bruce Springsteen ad in it).

Continue reading Tue June 15, 2010: In-N-Out Burger #27 – Double Double genex Style (correctly made) – Mill Valley, CA

getting off mailing lists – save the environment through less junk mail waste

This is taken from ecocycle and is great information on how to reduce junk mail and related waste:

Stop the Junk Mail Monster!

More than $56 billion was spent on the production and distribution of 41.5 billion pieces of mail advertisements in the U.S. in 2005, according to the Worldwatch Institute. Each year, the junk mail industry destroys about 100 million trees to cart its promos, pleas and promises to and from incinerators, garbage dumps and recycling centers. The production and disposal of junk mail consumes more energy than 3 million cars.

Each of us will spend an average of eight months of our lives dealing with junk mail. It’s time to reclaim our resources, our time and our mailboxes by stopping junk mail early and often by following these ten easy steps:

1. Remove your name

2. Know the magic words

3. 1-800-NO-THANKS

4. End credit card solicitations

5. Stop junk promo products

6. Catalogs, charities & contests

7. Cover your tracks with all the direct marketers

8. Dial out of unwanted phone books

9. Hire the experts.

10. Support legislative action against junk mail.

Step 1: Remove your name

Contacting the Direct Marketing Association (DMA) and registering with their Mail Preference Service provides an effective way for you to fight the junk mail glut. The DMA does not provide marketers with consumer mailing lists or do consumer mailings. They provide their Mail Preference Service to marketers for the sole purpose of removing consumer’s names and addresses from their prospect mailing lists. To add your name to the do-not-mail list, register online at www.dmaconsumers.org/cgi/offmailinglist or download a mail-in form. Be sure to list each name receiving mail at your address, including misspellings. You can also send a letter, along with $1, with your name(s) and address to the DMA asking to be removed from their mailing list. Note that mail addressed to “resident” or “occupant” cannot be stopped through the DMA.

Direct Marketing Association
Mail Preference Service
P.O. Box 282
Carmel, NY 10512
Stop junk mail, help the environment and support Eco-Cycle with a subscription to 41pounds.org. Click here to learn more. 212-768-7277
www.dmachoice.org

If your business is receiving mail for an employee who no longer works there, visit the EcoLogical Mail Coalition to remove the person’s name from direct mailing lists. For more information about their service, call 1-800-620-3975.

The DMA is not the only marketing racket in town. Keep reading to find more effective tools to reduce your junk mail. Or, if you don’t have the time for the do-it-yourself approach and would rather hire an expert to do it for you, Eco-Cycle recommends 41pounds.org.

Step 2: Know the Magic Words

Avoid getting on even more mailing lists by taking precaution whenever you submit your name and address to anyone. If you’re filling out a form such as a warranty, subscription, raffle, customer info card, credit card application, membership for an organization, etc., add the phrase “please do not rent, sell, or trade my name or address” next to the other information you provide. (Be advised that it is not necessary to fill out a warranty card to benefit from the warranty on your purchase. The warranty card is usually just a way to get consumer info from you.) Repeat these same magic words every time you’re giving a company or organization your name and address over the phone or internet, such as when ordering a catalog, magazine, or making a purchase. The sales rep will then flag your name in their computer.

Information from warranty and registration cards is often sold to direct mailers. Read the fine print to see if you are required to return the card to validate the warranty. Registration may be important if the product you are purchasing is found to be defective and the manufacturer institutes a product call-back or upgrade. If you return the card, all you need to include is your name, address, product information and, if requested, the date of purchase and a copy of the receipt. It is not necessary to answer personal questions other than your name and address. No matter what you choose to fill out on the card, make sure you include the magic words, “please do not rent, sell, or trade my name or address.”

Step 3: 1-800 No Thanks

As soon as you receive an unwanted publication in the mail, call the 1-800 number located somewhere on the piece and ask to be removed from the mailing list (they will need information from the label on the catalog). Businesses and organizations are glad to hear from you if you’re not interested in receiving their advertising — it reduces their costs. Remember too that if you actually buy something from a mail order catalog, it increases the likelihood your name will be shared with other similar businesses because you’ve just proven yourself an interested customer. So when you order, don’t forget those magic words: “Please don’t rent, sell, or trade my name and address.”

If you cannot find a phone number, return the label portion of the mailing to the solicitor’s address with a note requesting the removal of your name and address. You can also use one of the catalog removal services listed in step 6.

Step 4: End Credit Card Solicitations

If you’ve ever filled out a product warranty card, purchased a new home or auto, supplied your credit information to a lending institution, or simply carried a credit card, you can be sure your name and address is being circulated among an array of credit card companies hungry for your business. Don’t despair — there is help. To eliminate credit card promotional mailings, call 1-888-567-8688 (that’s 888-5OPT-OUT) or visit www.optoutprescreen.com. You will have the opportunity to choose either a five-year removal or a permanent removal.

For your personal credit cards, ask the company to place you on their “in house” list that is not sold or traded to other companies.

Step 5: Stop Junk Promo Products

If you’ve had it with companies sending you products or disks in the mail that you don’t want, there is an option. First, look for any of the following phrases:

  • return service requested
  • forwarding service requested
  • address service requested
  • change service requested.

If you find any of these phrases, write “refused, returned to sender” on the unopened envelope.

Mail sent to “Resident,” “Current Resident,” or “Current Occupant” can be refused if it contains one of the above endorsements, or is sent First Class.

When you receive unsolicited products in the mail such as those from charities, you can mark the envelope “Return to Sender” and put it back in the mail, throw away the product or use it. You are under no obligation to send money. If the product is a sample, it must be marked as such and the same options apply. It is illegal for a company or charity to send you a bill for items that you did not order.

If you receive unwanted pornographic or sexually explicit mail, there is a powerful legal tool in your corner called Form 1500. By filling out the form and attaching the specific piece of junk mail you want stopped, a company becomes criminally liable if it continues to send you unwanted mail. You can get a copy of Form 1500 by visiting your post office, calling the U.S. Postal Service, or downloading the form at www.usps.com/forms/_pdf/ps1500.pdf.

Step 6: Catalogs, Charities & Contests

Catalogs: Call your catalogs to request only as many issues as you want. Cancel unwanted subscriptions.

Catalog Choice is a free website that allows you to opt out of unwanted catalogs. Once you register with the site, you can choose the catalogs you wish to stop receiving, and opt-out requests will be sent to those catalogs on your behalf. Catalog Choice is a sponsored project of the Ecology Center in Berkeley, CA.

Greendimes also offers a free catalog opt-out service in its basic subscription.

Charities: If you contribute once a year to a charitable organization, ask them to send you only one donation request per year. The American Institute on Philanthropy offers a sample letter that you can send to charities and other organizations to reduce mail and phone solicitations that request donations.

Contests: Watch out for contests and free offers. Their purpose is often to obtain your name for mailing lists or to sell you something.

Step 7: Cover Your Tracks with All the Direct Marketers

There are several smaller list brokers and direct marketing firms in the U.S. besides the DMA. Just as you did with the DMA in step one, send or phone in all the variations of your name and address to the list brokers and direct marketing firms listed below. Start saving the labels of all the variations of the names and addresses which come to your mail box. Every variation, no matter how small (or comical), is another name on a list which gets sold to literally thousands of businesses. Cut and paste actual mailing labels onto a sheet, make 4 copies, add your signature beside each name variation on each sheet, and send them off to each of the 5 addresses below. Indicate the following: “Please remove my name and address from your mailing lists and do not rent, sell or trade my name or address.”

  • R.L. Polk & Company
    Name Deletions, List Compilation Dept.
    6400 Monroe Blvd
    Taylor, MI 48180-1814
    1-800-873-7655

    By recording your name and address on their automated system, you are requesting that the consumer credit reporting agency Equifax not share your information with other parties.

  • Val-Pak Direct Marketing Systems
    8605 Largo Lakes Drive
    Largo, FL 33773
    1- 888-797-1896
    www.valpak.com
    Click on “contact us” and then “mailing list.” You can request to be removed from sweepstakes and ValPak coupon mailings. If you like coupons but don’t want to receive all that mail, go to their website to choose and print coupons by geographical location.
  • Valassis Direct Mail, Inc.
    Consumer Assistance
    PO Box 249
    Windsor , CT 06095
    1- 888-241-6760
    http://www.advo.com/consumersupport.html

You can request removal online at the above website, by phone, or by downloading a form to mail. ADVO sends out the “Mailbox Values” advertising pieces.

  • Opt Out
    InfoUSA
    Attn: Consumer Requests
    1020 E. 1st St.
    Papillion, NE 68046

    888-633-4402

Send a letter with all the variations of your name and address asking to suppress your name from their lists. They are a large provider of marketing lists.

  • Epsilon Data Services
    Abacus Cooperative Databases

    P.O. Box 1478
    Broomfield, CO 80038
    303-410-5100
    [email protected]

Send an email with “remove” in the subject line and your full name, including middle initial, and address in the message. If you changed your address over the past six months, include your previous address as well.

You can also write to the above address. Abacus compiles statistical information that is sold to catalog companies.

Step 8: Dial out of unwanted phone books

Even though phone books are recycled in many communities, more than 660,000 tons still end up in the trash every year. This waste could be stemmed by first eliminating the delivery of unsolicited or unwanted phone books. Call the numbers below to remove your address from phone book delivery lists:

  • DEX: 1-877-243-8339
  • Yellow Book: 1-800-929-3556
  • Verizon: 1-800-555-4833

Stop junk mail, help the environment and support Eco-Cycle with a subscription to 41pounds.org. Click here to learn more.

Step 9: Don’t have the time? Hire a junk mail removal service.

Eco-Cycle has partnered with 41pounds.org to help you reduce junk mail, preserve the environment and raise money for Eco-Cycle. For $41 (just 2 cents a day), the 41pounds.org service will contact 20-35 direct mail companies to remove your name from their distribution lists. This includes almost all credit card applications, coupon mailers and magazine offers, plus the catalogs you specify.

41pounds.org does all the legwork to reduce your junk mail by 80-95% for five years — and donates $15 to Eco-Cycle! Learn more and get started today!

Step 10: Support legislative action against junk mail and other unwanted solicitation

Many states are considering legislation to create do not mail registries similar to the current do not call lists. Find updates on proposed state do not mail registry bills.

For more information on junk mail and its effects, check out:

China and Trees

timber, china, mother jones, ikea

TIMBER LINE

China’s timber exports, about 40 percent of which goes to the United States, exceed $17 billion. But while some furniture and building-supply stores have agreed in theory to buy only wood certified by the Forest Stewardship Council as sustainably and legally harvested, implementation is another story.

Ikea: The chain buys a quarter of its furniture stock from China, which imports wood from Russia. A recent Washington Post investigation found that even though about half the wood from Russia is illegally harvested, Ikea employs only two foresters in China and three in Russia to track the origins of its wood. A company official acknowledged that the expense of guaranteeing its wood’s legality is prohibitive. Ikea has a goal that by 2009, at least 30 percent of its wood will be certified. Currently, only 4 percent of the wood used in its Chinese factories passes that test.

Home Depot: Only 5 percent of its wood products are made from certified timber.

Armstrong Floor Products: Sells endangered Indonesian merbau, and declines to join the certification plan.
J.L.

The Jan/Feb 2008 issue of Mother Jones magazine has a great article on China and what’s happening over there. One of the things I didn’t realize was the effect on trees that China is having as a result of the country being the ‘manufacturer to the World.’

Since they’ve already harvested as much timber within China they now have to get it elsewhere and that is involving a lot of intentional arson and other things to get timber in whether it harms the environment or not. There’s a chart that shows what three of the largest companies Americans are familiar with and probably buy wood products from: Ikea, Home Depot and Armstrong – and shows how much wood is sustainably harvested.

My crazy Thursday

My weird Thursday night in LA
So I woke up somewhere I didn’t expect this morning and little did I realize that was just the beginning of a typically crazy LA day for me. After finally getting motivated to get out of bed and having some breakfast around brunch time, I gathered my stuff and finally left in the afternoon and headed out to either check out the taping of American Gladiators since three of my friends are on the new show (Jamie Reed, Beth Horn and Tanji Johnson). Well, I heard it took forever during the tapings and I wasn’t feeling particularly motivated so I decided instead to check out the Museum of Jurassic Technology which I had heard about sometime before and always wanted to check out.

Well, after arriving I realized that it’s really quite huge inside and packed with amazing exhibits. They range from the educational to the bizarre – some are real and some are absurd, but they are almost all enjoyable. You have to really give yourself time here and if you are not 100% sober, you can literally get lost inside (as I did when I realized I needed to leave to meet my dinner date).

So needless to say, I was disappointed that I had to jet without the full experience, but the good news is that I’ve got a good reason to come back!

Well, dinner was with my friend Kristy Hawkins who is actually the 2007 NPC Women’s Bodybuilding National Champion. She won the national title about two weeks ago so was still looking fantastic. We got a wild hair and decided to go to Red Lobster of all places. That’s the crayon coloring image on the strip at left where she got to draw her own trophy which of course was a female bodybuilder.

Continue reading My crazy Thursday