This is a cautionary tale about a two-minute conversation I had earlier this week.

For those of you who don’t know, my husband and I moved to Portugal 5 months ago, so calls coming in on my US phone number (technically a NY area code, but we moved from SoCal) are unusual. I’d normally just ignore them but this one came in with caller ID from Mexico.

Huh.

I have some friends in Mexico. They wouldn’t normally call me, but, sure. Okay.

When I answered, a man who spoke very good English but with a clearly Mexican accent responded to me with a deep sense of urgency. (Caveat: this all happened very quickly, so I might have missed some stuff from memory. Please forgive me.)

It went something like this:

Them: “Yes, hello – ma’am. I am an EMT in Mexico. Do you have a sister?”

I do, in fact, have a sister – and she does visit Mexico quite often, since she lives in Yuma, Arizona, right across the border from Mexico.

Me: “Uhm, I do, yes.”

Them: “Okay, your sister has been in a very bad accident. She’s bleeding a lot.”

This already feels scammy, especially since they didn’t ask for me by name, but anyone who knows me knows that I protec, so…

Me: “Okay, can you tell me her name. Does she have ID on her?”

Them: “Ma’am, she has no ID. She was in a terrible accident. She was hit by a car and is covered in blood. If you don’t have a sister, I’ll just keep calling until I can find someone who knows her. She’s unresponsive and is in really bad shape.”

Me, thinking – wait, if she has no ID, where did you get this number? Keep calling? Keep calling whom exactly? Where are you getting that list of people to try to call? But still, maybe my sister had my business card on her? That would be a little weird, but maybe not that weird. Maybe.

Me: “I do have a sister.”

Them: “What is your sister’s name?”

Me: “Why do you need to know that?”

Them: “Ma’am, I need to know her name so I can calm her down. She’s very disoriented right now.”

Wait, I thought she was unresponsive. Now she’s suddenly hysterical? Still, my sister, so…

Me: “I do have a sister, but… what does this person look like?”

My sister has a pretty specific look – weird hair, a particular build, etc.

Them: “Ma’am, she’s covered in blood and we’re running out of time. She’s going into shock. I need her name, and I need to know if she’s your sister so you can come here.”

If her head was covered in blood, I could see how they couldn’t have given me a hair color. At this point I should have asked for height/approximate build, etc. I didn’t.

Also, bro, I live in Portugal. While I’d definitely be on the first plane, that’s still 20 hours away.

Me: “Sir, I’m in Portugal. I can’t get to you or her quickly.”

I still don’t believe this is legit, but again, it’s my sister, so I’m still talking to him.

Them: “Please ma’am, just give me her name so we can calm her down.”

So, again, unresponsive or hysterical? Which is it?

I finally gave him her first name – which BTW is not exactly a national secret. I speak of her often on social media, in conference talks, etc. She had a TV show, after all. And she does the same about me.

Immediately after I told him her name, his tone completely changed, and he screamed at me that he worked for the “fuckin’ mexican mafia”, that if I hang up now I’d never see her alive again, and that if I tried to text her, he’d know because he had her phone and he’d kill her immediately. Every other word at that point was peppered with expletives – which, I mean, whatever, I’m a NJ Italian. That’s not threatening language, that’s just a regular Tuesday.

While I was talking to him, I texted her quickly, asking if she was okay. I hadn’t yet remembered that she was about as far away from Mexico as someone in the U.S. can be without being in Alaska or Hawaii. I also didn’t hear my text tone in the background (and my sister annoyingly always has her sound turned up for every little notification), so at this point I’m pretty sure this is complete bullshit.

While risky, a kidnapper wouldn’t actually kill the one piece of leverage they have, and if it really were her and he saw the text message, he’d just move the goalposts, since killing her would mean he gets nothing. (Rational brain knows this, but it’s still scary af in the moment.)

Funny thing tho. Time zones are a bitch. I remembered during this very brief (2 minutes!) convo that she had just texted me 7 hours before, telling me she was in Green Bay, Wisconsin for a welding competition, and she was headed to Virginia soon after for a different welding competition. Mexico was not on the agenda. It wasn’t her, and this was very much a scam.

Yes, this is mental math I’m doing on the phone with a stranger who claims to have kidnapped my sister and is threatening to kill her. This is what working in infosec does to your brain, for better or worse. Worse yet, I actually do know people who have had family members kidnapped in Mexico.

He screamed at me one more time that he’s “with the fucking Mexican mafia”, to which I laughed at him, saying “My sister is not in Mexico. You’re not with the Mexican mafia, you piker” and hung up.

I admit my hands were a little shaky.

This all happened really, really fast, and I was caught on my back foot, for sure. And because enough things were plausible (unlikely, but plausible), even the skeptic I am had to consider it might be real. I was legitimately scared for my sister, the entire way through until I hung up. I’m also thousands of miles (and an entire continent) away.

Imagine the guilt I’d feel if it were real and I wrote it off, and my sister died on the side of the road somewhere in Mexico.

THAT is what they’re counting on.

Once she finally answered me, my sister said she was still in Green Bay, stuck at the airport for hours, her flight to Virginia delayed. The most danger she was in was being overcharged for airport bar drinks while waiting for her flight.

This is not a new scam, just a more urgent, updated version of an old one that worked often enough for it to be worth the time of the criminals behind it.

TLDR of the old version is: you get a call from a (likely spoofed, but probably sometimes not) Mexican phone number where they claim to have kidnapped a family member, and they often demand other family contacts so they can extort them as well.

Normally it’s just a run of the mill kidnapping call, where they don’t actually have your family member, but they often have someone screaming in the background “just give them what they want!!!!” amid fake sobs.

The new twist is a bit more of a social engineering aspect – which, hey, nice job guys. Way to evolve.

The soft-open – “I don’t know your sister, I’m just trying to help” – gains trust and lowers guard.

The “I don’t know, but we’re running out of time” gives them plausible deniability for not immediately knowing things you’d expect someone to know, because they’re, y’know, trying to save someone’s life. It also adds a sense of urgency which will cause the victim to potentially ask less critical questions, react impulsively, etc.

It’s a clever twist on an old trick, and I almost have to respect the evolution of the game.

It’s abhorrent and vile and if I ever, ever meet one of these pieces of unmitigated shit, expect a bail gofundme for me to happen shortly after, because I will show no mercy to these monsters. People who prey on grief are the worst of the fucking worst.

Going with the premise that she’s incapacitated also takes away the best tool they would have had – proof of life from her own voice. Deepfakes are everywhere now, but I don’t think this was targeted, so they wouldn’t have known what she sounded like. In a targeted situation, this would have been a lot harder to detect and would have been way scarier.

Things I Should Have Asked

In the heat of the moment, this stuff is always really hard. You’re trying to stay calm, trying not to panic, maintain a healthy level of skepticism, but this is also a visceral, real emotional situation.

In this particular situation, some things I could have asked that would have defeated the “Ma’am we have no time, she’s going to die on the street narrative”:

• What is her build? You’re an EMT, you can give me a basic weight/build description. How tall is she? Is she fat or skinny? 50/50 chance on that last one, but I’d know for 100% certain it was BS if they guessed wrong.
• What city in Mexico are you in? (I know where she’d normally be if she was there.)

That wouldn’t have gotten me there that much faster – it was a two minute interaction after all, but it would have made it clearer a little sooner that this guy was full of shit.

So, how do you safeguard yourself?

Nothing is going to be foolproof, for sure, but there are some small things you can do with the friends and family you have to at least be able to confirm whether or not the threat is real.

Set up “danger” words. My sister and I have had safeguards in place for years. We have a “danger word”, which is a normal english word that if we ever utter it to each other in private or public, we know that things are Officially Not Good. In this case, that word would have been defeated by the premise that she was disoriented, confused, unresponsive, etc because of the alleged car accident. If that were true (which it was not), it would be plausible that she wouldn’t remember or respond to that word or phrase. That wouldn’t have saved us in this case, but it’s generally a good policy and will help more often than not if you need it.

Set up fake names. Have a specific fake name that you would call yourself in a danger situation to someone who would know that 1) it’s really you and 2) you are in actual danger. My sister and I have them. If they really had her and they really didn’t know her name, we would be able to communicate that we both acknowledge the danger without making it more dangerous.

If it would be too confusing to try to remember a first name, settle on a middle name that’s definitely not correct. Middle names don’t come up much, so it would stick out if it were present where the person had none, or was just flat out wrong.

Ask what tattoos/piercings they have to identify them. This may or may not work, depending on the situation, but could potentially be a canary. If the “abductor” says “none” or “I can’t tell, there’s too much blood”, suggest a tattoo you know they don’t have that would be obvious outside of intimate areas, and try to get them to tell you. They won’t have an answer, so they’ll either lie (which outs them immediately) or they’ll keep stalling, which an EMT who is genuinely trying to find family members wouldn’t do.

Make some shit up. “Did you find her prosthetic leg? What about her glass eye? I heard those can shatter – oh my god did it shatter?? Is it in her brain??” My sister does not have a prosthetic leg or a glass eye, but back to the 50/50 chance, if you let them believe you believe them, you can sometimes catch them in their own game.

Tell your family your travel plans. This one seems obvious, but my sister travels constantly for her work and hobbies. Usually on big, international trips, she’ll email me flight details just in case, but for domestic flights, she doesn’t always tell me, especially since I’m 7 time zones away now. Thank god she did this time, or this could have gone worse.

Obviously, these types of scams are scary as hell, and they’re counting on the urgency they convey to cause you to misstep, even if you’re normally very savvy and skeptical about this type of thing. A little pre-planning can go a long way.

Stay safe out there everyone. <3

The post Mexican Mafia Scams: A New Twist On an Old Trick appeared first on Snipe.Net.

The post Fuck Cancer appeared first on Snipe.Net.

Even though Composer itself gives you a warning about not running it as root, lots of people disregard this warning and run it as root anyway. We run into this issue a lot on my open source asset management project, Snipe-IT, so I figured I’d write up how to fix this if you inadvertently (or advertently) ran composer as root.

“Installing Composer” vs “Composer Install”

Many people run Composer as root because they misunderstand how Composer works. If you installed Composer globally, it wouldn’t be odd for you to have to install it as root – meaning the Composer binary itself.

But, and here’s the tricksy part, installing Composer is not the same thing as composer install.  Installing Composer means that the Composer dependency management tool is now installed on your server, while composer install is a specific command you send to Composer to have it actually pull down those dependencies, based on the composer.lock file that was (usually) provided by whatever software you’re trying to set up. If you install Composer globally, you can use the same Composer binary to manage dependencies for many projects – but each project will have its own composer.json and composer.lock, which Composer uses to figure out what it needs to download for you.

Let’s look at some common files and commands you might encounter when using Composer, as I think that might help clear up a few things:

• composer.phar – This is your Composer binary. You will install this only once, though it may prompt you to update it occasionally. The easiest way to use Composer is to install it globally, that way it’s available anywhere in your system via the composer command. If it’s installed locally, you’ll have a composer.phar in your project root, and if you want to install any other PHP projects that use composer, you’ll have to download it to each project’s directory.
• composer.json – This file tells Composer what libraries are required, and what version the developer of the PHP project intends for you to use, similar to the Gemfile in Ruby or the package.json in node.
• composer update – Unless you are a developer, you should almost never run this command. This tells Composer to grab the most recent versions of libraries specified in the composer.json file, and generate a new composer.lock file that locks down those library versions.
• composer install – As a non-developer who is just trying to install dependencies, this is the command you typically want. composer install tells Composer to use the composer.lock file that the developer provided, and download the specific versions of each library. This is important, because sometimes older or newer versions of a library might not work with the PHP project. The developer’s composer.lock file makes sure you’re downloading the version of each library that they have tested and confirmed works with the project. The libraries will be downloaded into a folder (usually called vendor or vendors) in the PHP project root.

You might install the Composer binary as root (and then move it to /usr/local/bin so it’s available globally), but you pretty much never want to run composer install as root.

Composer tries to prevent you from running composer install as root/admin by throwing up a big fat warning, but if you’ve already run it as root once, you may end up with some permissions errors if you try to run it as non-root, which makes some people give up and just always run it as root.

If you’re seeing permissions errors when trying to run composer install as a non-privileged user, someone somewhere probably ran it as root at some point, which means root owns some of the generated files. That’s a pain in the ass to fix, but not impossible.

I wish to repent and make amends for my past transgressions and no longer run Composer as root

Great! It’s not actually that hard to make things right if you ran Composer as root, but it can be a little tricky to find all of the weird caches and config directories it hides within your system.

When you installed Composer, it created a .composer directory somewhere in your system, usually in your home directory. So for example, on a Mac, I’d look in /Users/snipe/.composer. On linux, I’d look in /home/snipe/.composer. Remember that it’s a directory that starts with a dot, which on many operating systems means it’s a hidden file.

The contents of the .composer directory usually look something like this:

For the sake of this example, let’s say my non-privileged user is snipe. This user is part of the apache group, so it can read, write and execute any files where the group is permitted to do so – for example, error logs, file upload directories, etc.

We want to make sure that the vendor directory within the project root is owned by snipe, not by root, otherwise if I try to run composer install as snipe, I’ll get permission errors, since root owns those files and directories.

Then we also want to make sure that .composer directory we mentioned is readable and writable by snipe, since that directory gets updated with new cached vendors every time you run composer install.

As we mentioned above, if you initially ran Composer as root, that directory might be in /home/root. The easiest thing to do is to delete the .composer directory altogether – a new one will be generated when you run composer install again, and this time, since you’re running it as snipe, it will have the correct permissions.

So our fix would look something like this:

sudo chown -R snipe.apache /var/www/html/vendor
sudo rm -Rf /home/root/.composer
cd  /var/www/html/
composer install

Once your .composer directory and your vendors are owned by the correct user, you should be able to run Composer as a non-root user. You may also need to delete or chown the files in bootstrap/cache (if you have any there) as they will also be owned by root.

The post So you ran composer as root… appeared first on Snipe.Net.