[00:00.000 --> 00:05.220]  Also, he's going to be speaking about finding hidden gems in temporary mail services.
[00:05.220 --> 00:09.620]  His name is Ben Bergkahn. He's a pen tester and red teamer.
[00:09.620 --> 00:13.140]  Previously, he has worked in many things.
[00:13.140 --> 00:19.040]  Now, I will get him on the stage and let him enjoy the presentation.
[00:19.760 --> 00:21.960]  Let's give him a round of applause!
[00:30.440 --> 00:33.960]  So, thank you everyone for coming to this session.
[00:33.960 --> 00:36.800]  I'm really excited to be here at DEF CON 2021.
[00:36.800 --> 00:40.520]  So, in this session, I'm going to talk about temporary mail services
[00:40.520 --> 00:44.200]  and how we can find good gems in those services.
[00:44.580 --> 00:48.640]  And before that, I want to thank my teammate, Berat Gokartislar.
[00:48.640 --> 00:52.280]  He's one of the other idea fathers of this project.
[00:53.400 --> 00:57.640]  My name is Berk, and I'm a penetration tester and a red team entry assist.
[00:57.840 --> 01:01.520]  And I'm currently working at SecArmy Ltd. as a security consultant.
[01:01.900 --> 01:05.660]  I'm also a member of Cobalt's core team and a signer grade team.
[01:05.660 --> 01:08.160]  And I'm a festival fan and a gym rat.
[01:08.880 --> 01:12.720]  So, let's talk about the main topics of my presentation.
[01:13.440 --> 01:18.100]  Temporary mail services, also known as disposal email services,
[01:18.100 --> 01:21.400]  are generally free email services that allow you to receive emails
[01:23.660 --> 01:28.640]  at a temporary address that self-destructs after a certain time elapses.
[01:28.720 --> 01:32.980]  While some temporary mail services are public and open for everyone,
[01:32.980 --> 01:37.860]  and others offer paid private services.
[01:38.660 --> 01:41.760]  So, what are the pros for temporary mail services?
[01:41.760 --> 01:45.580]  So, it's a short lifespan, automatically delayed email addresses
[01:45.580 --> 01:49.380]  and all associated messages after a set of time,
[01:49.380 --> 01:51.140]  and no long-term commitment.
[01:51.140 --> 01:55.520]  Users don't have to sign up or provide any personal information
[01:55.520 --> 01:58.240]  to use a temporary email address.
[01:58.580 --> 02:02.120]  And anonymity, they allow users to receive emails
[02:02.120 --> 02:05.940]  without revealing their personal email addresses.
[02:06.800 --> 02:15.800]  But it should be noted that the mails are hosted on the servers on these services.
[02:15.800 --> 02:20.840]  So, the mails you receive can be accessible from the service providers
[02:20.840 --> 02:25.800]  and we don't know if they actually destroy the emails really or not.
[02:25.860 --> 02:27.740]  So, this is up to them.
[02:30.400 --> 02:33.240]  Cons about spam avoidance.
[02:33.240 --> 02:38.300]  So, according to the services, incoming mails are said to be safe
[02:38.300 --> 02:41.420]  because they pass through the spam filter of their own.
[02:41.620 --> 02:45.540]  But this protection can be okay for newbies, but for the experienced hackers
[02:45.540 --> 02:48.800]  or the red teamers, it's not working well.
[02:49.280 --> 02:50.980]  And public accessibility.
[02:51.380 --> 02:55.460]  Many temporary mail services reveal inboxes to the public.
[02:55.460 --> 03:03.080]  This means that anyone can access all the emails that have been received by that inbox.
[03:03.480 --> 03:08.360]  While these features provide ease of access, it also poses significant privacy risks
[03:08.360 --> 03:11.840]  if sensitive information is sent to this address.
[03:12.160 --> 03:15.960]  And this title is going to be our main target in this presentation.
[03:16.300 --> 03:18.340]  So, story about this presentation.
[03:19.060 --> 03:26.780]  Just another day, just for a silly application, in a regular time, I tried to get an email
[03:26.780 --> 03:29.060]  and I used temporary mail.
[03:29.100 --> 03:34.020]  And I noticed that someone had linked an account from a shopping website.
[03:34.020 --> 03:41.580]  And after I received this password from email, I realized that there's money inside this user.
[03:42.040 --> 03:45.100]  And there's live orders inside it.
[03:45.100 --> 03:51.840]  So, I wondered if such things were common, and I realized that there are tons of similar situations.
[03:51.840 --> 03:56.080]  Then I wanted to dig deep about the situation and start my research.
[03:56.580 --> 04:05.520]  So, most temporary mail services, the most popular ones, are temper.email, mailplus, mailend, disbustable.
[04:05.560 --> 04:12.320]  These are all the public inboxes, and you can just access these inboxes.
[04:13.100 --> 04:15.440]  And what are these gems?
[04:16.060 --> 04:23.000]  So, people use these temporary email services for business emails.
[04:23.000 --> 04:30.400]  In addition to that, Spotify, Netflix, Facebook, Twitter, Instagram, YouTube, Amazon, Aliexpress, Discord,
[04:30.400 --> 04:37.800]  AT&T, Grammarly, TikTok, OnlyFans, Bitcoin accounts, and even porn accounts, and lots of public information.
[04:37.800 --> 04:44.900]  And patients, of course, and many, many more, they are using these services to get these services.
[04:45.940 --> 04:51.360]  And also, I noticed that the marketing emails from numerous Viagra sellers and dating apps,
[04:51.360 --> 04:55.840]  additionally, there were emails from pornographic sites.
[04:55.880 --> 05:01.600]  Also, in pornographic emails, the IP addresses from which a user logged in can be leaked.
[05:01.600 --> 05:08.500]  So, I hope that the users who use temp mail services in their private life also use VPNs.
[05:10.200 --> 05:23.100]  And you just need to go to one of these email boxes and just type A, double A, triple A, or 1 to see what mail is coming there.
[05:23.100 --> 05:24.460]  So, it's easy.
[05:24.460 --> 05:34.800]  In this case, people are lazy, so they just press A and press Enter and just get the inbox and just use these inboxes.
[05:36.000 --> 05:49.780]  And the example accounts for that, there's a Spotify account, a Steam account, and for some specific web applications, it's about a dancing application.
[05:49.780 --> 06:01.200]  And this user is using a temporary mail service, so I can reset the password, enter the account, and there's different kinds of information in this account.
[06:01.200 --> 06:07.000]  Also, saved credit cards, and studio information, etc.
[06:07.800 --> 06:13.040]  And also, Canopay and Temi accounts. Also, as you can see, someone uses Canopay.
[06:13.160 --> 06:19.120]  And inside the mail, they inform the user about the Cashcard Reserve account, and Temi is a shopping website.
[06:20.280 --> 06:31.180]  Also, I found a Discord account, but unfortunately, the user who uses this temporary mail service has a multi-factor authentication.
[06:31.360 --> 06:36.940]  I just tried for one account, but if you are lucky, you can find another one.
[06:38.040 --> 06:44.340]  Instagram addresses, so Instagram accounts, you can just reset the password, get into the account.
[06:45.340 --> 06:54.540]  And also, AT&T prepaid cards here, Facebook accounts, Amazon Web Services.
[06:54.720 --> 07:00.610]  And this is interesting, so I found hospital records in this temporary mail services.
[07:00.610 --> 07:16.610]  So, there's a patient who is living in the United States, and you can see their diseases and why their applicant is rejected,
[07:16.610 --> 07:23.150]  and which location they are going to, which hospital they are going to, which date, rejected date, etc.
[07:23.150 --> 07:27.630]  You can see, this is all public, you can find in temporary mail services.
[07:27.630 --> 07:39.230]  There's more, you can see in this mail, they added attachments, and I opened, and there's a lot of patient information here, as you can see.
[07:39.230 --> 07:44.970]  A lot of secret information in public email services.
[07:45.730 --> 07:48.930]  And more, yeah, you can see.
[07:50.890 --> 07:57.970]  And also, I found Paxful. Paxful is a Bitcoin buying and selling application.
[07:58.490 --> 08:07.430]  But, I'm suggesting you, if you want to hunt these accounts, like this, be sure that don't take over the account in the beginning of the registration.
[08:07.710 --> 08:17.550]  Just note the email, for example, someone registered for Amazon AWS, just don't change the password immediately.
[08:17.550 --> 08:23.190]  Just wait, note, and be sure about deleting the mail.
[08:23.190 --> 08:28.250]  So, there's an option in the mail deletion, in the temp mail service.
[08:28.250 --> 08:33.830]  So, delete the mail, note the email address, and wait maybe one week, maybe one month.
[08:33.830 --> 08:43.050]  And then, just reset the password, get the account, and you can see there's maybe good gems inside this account, maybe money, or maybe servers.
[08:43.050 --> 08:47.530]  But, if you do this in a registration part, there's nothing inside.
[08:47.530 --> 08:51.270]  So, just be patient for that account.
[08:52.210 --> 08:57.810]  And also, I found an OnlyFans account here, Premium.
[08:58.050 --> 09:01.870]  Yeah, I don't prefer to use, but you can find Premium if you want.
[09:01.870 --> 09:03.490]  And then, there's another one.
[09:04.730 --> 09:11.350]  And someone just bought something, and there's an invoice in this mail services.
[09:11.350 --> 09:21.530]  And in that invoice, you can see there's just name and surname and address information here, location information.
[09:21.570 --> 09:23.450]  You can all find from here.
[09:23.450 --> 09:29.290]  And if you are a good, skilled pen tester, you can just social engineering these people.
[09:29.290 --> 09:33.510]  So, hey, Abdul, for example, this victim name is Abdul.
[09:33.670 --> 09:39.030]  And you can say, hey, Abdul, these items, blah, blah, blah, that you ordered will be sent to this address.
[09:39.030 --> 09:40.350]  You also know the address.
[09:40.810 --> 09:42.830]  Blah, blah, blah, stuck in the custom.
[09:42.930 --> 09:46.010]  So, you need to pay and bump payment link.
[09:46.010 --> 09:48.810]  And all this information is verified, because we know that.
[09:48.810 --> 09:51.910]  Name, surname, items, as you can see.
[09:52.770 --> 09:55.130]  So, it's a good social engineering example.
[09:57.210 --> 10:04.990]  You can see there's an example social engineering mail that you can just include a payment link,
[10:04.990 --> 10:06.830]  maybe fake custom website.
[10:06.830 --> 10:10.590]  The choice is Abdul attacker and depends on the scenario.
[10:10.910 --> 10:15.170]  Alternatively, you can get other information with that type of attacks.
[10:15.450 --> 10:20.270]  This method is very effective, because you have all the details about the order.
[10:20.270 --> 10:21.410]  It appears legitimate.
[10:22.950 --> 10:26.510]  And this is one of the interesting mails that I found.
[10:26.590 --> 10:29.170]  It says, nice to see you, I'm glad to meet you.
[10:29.170 --> 10:30.270]  I'm not married and have children.
[10:31.210 --> 10:36.710]  Maybe you can find your perfect match in all these mail services.
[10:36.710 --> 10:38.090]  It's up to you.
[10:38.770 --> 10:41.250]  And also, still there's a lot of accounts.
[10:41.250 --> 10:50.610]  So, as you can see, there's someone just signed up for the dynaxy.com as a BTC address, I guess.
[10:50.610 --> 10:55.430]  And you can see the IP information and new password, Facebook account still.
[10:56.330 --> 10:58.690]  There's tons of accounts in there.
[10:58.690 --> 11:02.670]  You can get anything you want.
[11:02.750 --> 11:09.670]  Also, there's another invoice thing from the right group, Financial Limited.
[11:09.810 --> 11:13.270]  And it's about positions between Euro and Canadian dollar.
[11:13.550 --> 11:17.090]  And as you can see, there's a previous ledger balance, something like 5K.
[11:17.090 --> 11:18.850]  I never even imagined it was 4K.
[11:18.850 --> 11:19.770]  I don't know.
[11:19.770 --> 11:25.870]  Maybe there's inside money in this account, but I didn't want to go in this account.
[11:25.870 --> 11:27.470]  Also, Netflix account.
[11:28.530 --> 11:31.530]  And I found an application that did buy.
[11:31.670 --> 11:36.930]  And when I entered, it said, you have nearly 69 Bitcoin.
[11:37.510 --> 11:40.730]  Probably a fake website, but good one.
[11:40.730 --> 11:42.970]  I will be very sorry if it's legit, by the way.
[11:44.370 --> 11:48.930]  And PlayStation Plus accounts, maybe TikTok accounts.
[11:49.170 --> 11:53.910]  And also, I found an information mail about the Temi website.
[11:54.990 --> 11:57.890]  Your order has been canceled due to payment.
[11:57.890 --> 11:59.590]  And I just wonder.
[11:59.650 --> 12:02.310]  And I reset the password and go into account.
[12:02.950 --> 12:06.470]  This is the reset password section.
[12:06.470 --> 12:08.490]  And I get the OTP, just reset the password.
[12:08.490 --> 12:12.150]  And I found the man called James Konda.
[12:12.650 --> 12:15.250]  And there's a live order inside this account.
[12:15.250 --> 12:17.330]  So I said, order in it.
[12:17.330 --> 12:21.850]  And also saved credit card information and the address information.
[12:21.850 --> 12:22.790]  Everything you need.
[12:22.790 --> 12:24.070]  Just a live.
[12:25.590 --> 12:32.170]  And about statistics, nearly 18,000 mail.
[12:32.610 --> 12:36.890]  Most of the emails come from TikTok, Intelliverse, and Supercell.
[12:36.890 --> 12:40.550]  However, as you can see, there are many other applications not listed there.
[12:40.550 --> 12:44.010]  As including them will require numerous slides.
[12:44.010 --> 12:48.210]  In summary, you can find all kind of accounts you want here.
[12:50.810 --> 12:55.130]  And in these days, every information is invaluable.
[12:55.310 --> 13:02.550]  And the software used by blue teams and cyber intelligence units for gathering information has now become highly advanced.
[13:02.670 --> 13:15.610]  And for example, if your password has been leaked on any dark website or a public forum, the websites just notify you about your password as leaked.
[13:15.610 --> 13:16.670]  Please change your password.
[13:16.670 --> 13:21.610]  Even some websites are not waiting for a permission and change your password.
[13:21.710 --> 13:23.210]  They generate a random password.
[13:23.210 --> 13:27.810]  And after that, they say to you, I changed your password because your password is leaked.
[13:29.950 --> 13:37.130]  And for my presentation, I wrote a Python script that's called Temple Mail Spy.
[13:37.130 --> 13:41.410]  It just continues to recording and monitoring Temple Mail services.
[13:41.950 --> 13:44.950]  And it can be used with the Telegram and Slack notification API.
[13:44.950 --> 13:46.990]  It's fully customizable config.
[13:47.070 --> 13:50.070]  And this has different modes.
[13:50.430 --> 13:55.310]  This script can get all mails or just grab for a specific keyword.
[13:56.050 --> 14:02.330]  For now, it's only using two mail services because these two are the most popular ones, Yelp Mail and TempMail.
[14:02.330 --> 14:05.130]  But I will add more in the future.
[14:05.130 --> 14:10.670]  Also, I will add proxy specification because some TempMail services has rate-limiting issues.
[14:12.570 --> 14:15.190]  And as you can see, there's a customize option.
[14:15.190 --> 14:19.370]  So, you just need to set a keyword here.
[14:19.370 --> 14:20.910]  So, what do you want to know?
[14:20.910 --> 14:25.130]  For example, Facebook or you want Amazon or maybe you are hunting Bitcoin wallets.
[14:25.130 --> 14:30.770]  You just enter a Bitcoin and my script is going to monitoring continuously.
[14:30.770 --> 14:35.970]  And if there's a mail that shows up like Bitcoin and you just grab the Bitcoin,
[14:35.970 --> 14:38.610]  they just notify you from Slack or Telegram immediately.
[14:38.610 --> 14:41.610]  There's an email here you can find.
[14:42.310 --> 14:45.490]  So, these are the notification sections.
[14:46.730 --> 14:55.910]  After the script is over, it saves you what the mails save you as output.
[14:55.910 --> 15:04.730]  Mail link, mail sender, which mail service, from which mail service, get that mail, etc.
[15:06.250 --> 15:15.870]  And now, I have an enjoyable and classified example about my presentation.
[15:19.950 --> 15:26.010]  And just a regular day, I finish my script and I just run my script.
[15:26.010 --> 15:29.890]  And my script just found an invoice, invoice link.
[15:30.110 --> 15:33.090]  And I go to invoice, you can see here.
[15:33.510 --> 15:39.450]  And in the invoice, in the left bottom, there's a PHP debugger icon.
[15:39.450 --> 15:42.630]  And after I click that icon, I found a debugging page.
[15:42.630 --> 15:48.750]  And I found some important credentials inside that one.
[15:48.750 --> 15:51.030]  And I found some endpoints.
[15:51.610 --> 15:57.070]  And I do more recon about the website.
[15:57.070 --> 16:00.410]  And I found a slash admin endpoints.
[16:00.490 --> 16:07.530]  And when I go there, also thanks to PHP debugger, I found a credential and I go to admin panel.
[16:08.990 --> 16:16.570]  So, can you imagine that some guy just uses a temporary mail service for his admin panel.
[16:16.590 --> 16:21.490]  So, I just enter the credential and it asks me OTP, but no problem.
[16:21.490 --> 16:24.770]  So, it's temporary mail. So, I got the OTP from the temporary mail.
[16:25.070 --> 16:28.750]  And I enter it and boom, I got the admin page.
[16:28.750 --> 16:34.770]  Only I looked the temporary mail service and I got some interesting websites admin page.
[16:34.770 --> 16:44.150]  Okay. And I recon more and I realized that nearly 95% of the employees are using temporary mail services.
[16:44.150 --> 16:45.690]  That's very interesting.
[16:45.750 --> 16:48.590]  Everyone has a temporary mail. Yeah.
[16:49.190 --> 16:52.670]  And also, this company has a client.
[16:52.670 --> 16:55.710]  And you know that also this client uses temporary mail services.
[16:55.710 --> 16:59.310]  So, they assign their clients a temporary mail.
[16:59.310 --> 17:01.630]  Wow. Nice privacy.
[17:01.630 --> 17:06.910]  And I recon more. I found server information in there.
[17:06.910 --> 17:14.810]  And I access the database and get more information from here.
[17:14.810 --> 17:20.610]  I found a mail username and password and API stuffs.
[17:20.610 --> 17:24.130]  And I, as you can see, there's a mail username and password here.
[17:24.130 --> 17:30.730]  And I just enter their mails live thanks to temporary mail services.
[17:30.730 --> 17:36.130]  There's a lot of important stuff going on there.
[17:36.130 --> 17:43.050]  For example, there's a Kenya export pronunciation and branding agencies.
[17:43.050 --> 17:47.290]  Classified information I found here.
[17:47.290 --> 17:51.330]  Some employee names, social security numbers, etc.
[17:51.710 --> 17:56.610]  Government papers here I found.
[17:57.690 --> 18:00.570]  I hope there's no FBI here or something.
[18:01.330 --> 18:03.650]  This is educational purpose only.
[18:06.270 --> 18:10.170]  And I use every user's information.
[18:10.170 --> 18:13.350]  Company uses information and mail addresses.
[18:13.810 --> 18:16.710]  And I go to some client's mails.
[18:16.710 --> 18:19.050]  And there's invoices, live invoices.
[18:19.050 --> 18:21.390]  Money is there.
[18:21.390 --> 18:29.770]  And somehow I get a shell from that educational purpose company.
[18:32.290 --> 18:38.490]  But you need to know that the relevant vulnerability has been reported to the company and has been remediated.
[18:38.490 --> 18:44.350]  And during this research, no actions were taken that would harm the company's service and disrupt their operations.
[18:45.670 --> 18:48.670]  And this is my shell. I'm passing this quick.
[18:48.670 --> 18:50.710]  A lot of websites in it.
[18:50.770 --> 18:53.230]  And every website is a different database.
[18:53.290 --> 18:55.650]  As you can see, this is live.
[18:56.010 --> 18:58.610]  Different environments, lots of information.
[18:58.610 --> 19:00.950]  Database names, database passwords.
[19:01.310 --> 19:07.150]  Also, JVT secrets and SSL case.
[19:07.150 --> 19:08.110]  Everything.
[19:08.790 --> 19:11.690]  More password, email name.
[19:12.210 --> 19:13.670]  More temporary mail service.
[19:13.670 --> 19:15.890]  Because everyone is using temporary mail service.
[19:15.890 --> 19:20.810]  And I find someone in the database using another temporary mail service.
[19:20.810 --> 19:21.890]  And I go there.
[19:21.890 --> 19:22.930]  I get his account.
[19:22.930 --> 19:24.230]  And I get a different website.
[19:24.230 --> 19:26.810]  I just go to another admin panel.
[19:26.810 --> 19:29.110]  I go to a different website.
[19:29.170 --> 19:31.870]  Because everyone uses temporary mail service.
[19:32.850 --> 19:33.610]  Yeah.
[19:33.610 --> 19:39.830]  And this one is also another website that I found from the database.
[19:40.870 --> 19:43.070]  And more logging applications.
[19:43.070 --> 19:44.230]  This one is also different.
[19:44.230 --> 19:46.070]  More tracking caches.
[19:46.350 --> 19:48.310]  More information here.
[19:48.310 --> 19:51.930]  There's also email username and password in it.
[19:51.930 --> 19:54.550]  So, more emails.
[19:54.550 --> 19:57.390]  More good stuff.
[19:58.130 --> 19:59.510]  Payment links.
[19:59.510 --> 20:01.030]  There's a live payment link.
[20:01.030 --> 20:02.410]  Payment transactions.
[20:03.170 --> 20:04.930]  API keys.
[20:05.210 --> 20:07.110]  PayPal secrets.
[20:07.110 --> 20:08.330]  Everything.
[20:08.350 --> 20:10.330]  Credit card numbers.
[20:10.330 --> 20:17.590]  And I just get this from just looking around some kind of temporary mail service called Yelp mail.
[20:17.590 --> 20:18.710]  And I just found an invoice.
[20:18.710 --> 20:20.670]  And this comes to here.
[20:20.690 --> 20:22.490]  So, it's very interesting.
[20:22.970 --> 20:24.290]  And more information.
[20:24.290 --> 20:26.750]  See, I'm passing this fast.
[20:26.930 --> 20:29.150]  More tracking caches.
[20:29.150 --> 20:31.750]  And more temporary mail service.
[20:31.750 --> 20:36.090]  And now I'm in a conclusion in this research.
[20:36.770 --> 20:39.390]  I obtained hundreds of personal accounts.
[20:39.390 --> 20:41.150]  Shopping accounts with money inside.
[20:41.150 --> 20:42.350]  Patient information.
[20:42.350 --> 20:43.390]  IP details.
[20:43.390 --> 20:44.130]  Premium accounts.
[20:44.130 --> 20:45.510]  Company information.
[20:45.510 --> 20:47.170]  Company accounts.
[20:47.170 --> 20:48.330]  Compromised accounts.
[20:48.330 --> 20:50.030]  Compromised email accounts.
[20:50.030 --> 20:51.270]  Credit card information.
[20:51.270 --> 20:53.750]  Dozens of web applications.
[20:53.750 --> 20:56.210]  Numerous databases containing live data.
[20:56.210 --> 20:59.150]  Private and confidential API keys.
[20:59.190 --> 21:00.710]  Passwords.
[21:00.910 --> 21:03.190]  A little government document.
[21:03.470 --> 21:04.970]  Email correspondences.
[21:04.970 --> 21:07.050]  Secret payment system APIs.
[21:07.290 --> 21:09.070]  Company bank accounts.
[21:09.070 --> 21:10.910]  And SMS sending APIs.
[21:11.250 --> 21:13.230]  Customer accounts with money in them.
[21:13.230 --> 21:15.170]  And maybe more things in this.
[21:15.170 --> 21:17.450]  But, I don't know.
[21:17.450 --> 21:20.110]  I just report to them.
[21:20.110 --> 21:23.650]  And I just finish the shell part.
[21:24.010 --> 21:25.610]  Everything is remediated.
[21:25.610 --> 21:27.240]  And there's a bonus part here.
[21:28.000 --> 21:32.440]  So, I think maybe...
[21:32.440 --> 21:34.260]  I'm looking for this...
[21:34.260 --> 21:37.060]  I'm hunting this account.
[21:37.060 --> 21:40.880]  And maybe there's more guys like me who are hunting this service.
[21:40.880 --> 21:46.440]  So, I think that maybe I can create a phishing email for them.
[21:47.020 --> 21:47.920]  Something like...
[21:47.920 --> 21:52.380]  You can look your Bitcoin account here.
[21:52.380 --> 21:56.640]  And I just write a BBC script here.
[21:57.640 --> 22:00.760]  That's inside an Excel.
[22:00.760 --> 22:02.520]  There's a macro in it.
[22:02.520 --> 22:04.970]  And when someone opens that macro and allows...
[22:05.220 --> 22:07.640]  Opens the Excel and allows the macro...
[22:08.240 --> 22:16.560]  This script is just getting some environmental informations to my server.
[22:16.560 --> 22:19.740]  And I have a domain called moobitcoin.com.
[22:19.740 --> 22:22.060]  I just get domain for research purpose.
[22:22.060 --> 22:30.140]  I'm saying that because I signed some papers that I bought from this domain.
[22:30.140 --> 22:33.020]  Because they banned me in the first.
[22:33.100 --> 22:35.820]  And I said, hey, I'm just using this for research purpose.
[22:35.820 --> 22:38.120]  They sent me a paper and please sign.
[22:38.120 --> 22:39.440]  Okay, I sign.
[22:39.620 --> 22:42.800]  I'm not getting any credit card information from it.
[22:42.800 --> 22:49.040]  I'm just getting some, for example, hostname, username, and external IP, internal IP, etc.
[22:49.840 --> 22:52.560]  And then I create a phishing template.
[22:52.560 --> 22:53.940]  So these are the addresses.
[22:53.940 --> 22:56.020]  And as you know, these are the temporary mail addresses.
[22:56.020 --> 22:58.000]  The most used ones.
[22:58.160 --> 23:01.140]  Because, as I said, people are lazy.
[23:01.140 --> 23:02.920]  And they just press A or B.
[23:02.920 --> 23:05.600]  They just don't write their names.
[23:05.620 --> 23:08.020]  For example, I'm not writing my name.
[23:08.020 --> 23:10.960]  I just press A and look for the inbox.
[23:10.960 --> 23:13.740]  So I just put these ones, seven ones.
[23:13.900 --> 23:17.580]  And I create an example email template here.
[23:17.580 --> 23:18.520]  For example, hi, James.
[23:18.520 --> 23:21.600]  Thanks for buying blah, blah, blah Bitcoin from here.
[23:21.600 --> 23:23.760]  Your final balance here, please.
[23:23.880 --> 23:27.840]  We change your password for security purpose because you buy a Bitcoin.
[23:27.840 --> 23:33.240]  And you can find these credentials inside Excel file.
[23:33.240 --> 23:35.500]  And I zip that Excel.
[23:35.740 --> 23:39.360]  Because maybe there's a spam filter in here.
[23:39.360 --> 23:42.840]  And some spam filter just opens Excel.
[23:43.100 --> 23:45.040]  And look at the documents inside it.
[23:45.040 --> 23:46.100]  I know that.
[23:46.100 --> 23:49.020]  And because of that, I just password the Excel.
[23:49.020 --> 23:51.480]  And I write the PDF password to mail.
[23:51.760 --> 23:53.260]  Maybe. Why not?
[23:53.600 --> 23:56.040]  As you can see, there's an accountcredentials.zip.
[23:56.100 --> 23:57.520]  There's an attachment.
[23:58.300 --> 23:59.500]  And I send it.
[23:59.500 --> 24:02.500]  And it's just delivered.
[24:02.500 --> 24:03.580]  No spam.
[24:03.580 --> 24:05.600]  This does not look like a spam.
[24:05.980 --> 24:13.340]  And also, the other temporary mail services accepted this mail.
[24:13.660 --> 24:15.200]  So there's no spam.
[24:15.200 --> 24:16.560]  No spam filter is working.
[24:16.780 --> 24:21.900]  As I said in my previous slides, no spam filter is working.
[24:21.900 --> 24:25.360]  So don't believe everything you see in this mail services.
[24:26.180 --> 24:26.820]  Just...
[24:26.820 --> 24:32.280]  If there's something free, just don't click that one so fast, please.
[24:33.280 --> 24:40.420]  And if someone just opens my Excel, this request comes to my server.
[24:40.420 --> 24:47.700]  And I get an information about what is user name or host name, internal IP and external IP, et cetera.
[24:49.400 --> 24:51.320]  And this is my end of presentation.
[24:51.320 --> 24:52.600]  Thank you for listening to me.