Fun sending an MD5 checksum by phone

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Wed Jul 10, 2013 4:32 pm

An 128-bit MD5 checksum or hash

http://en.wikipedia.org/wiki/MD5

is normally written as 32 hex characters - e.g.

Code:

9e107d9d372bb6826bd81d3542a419d6

(numbers in the range 0 to 9, letters in the range A to F)

Well my lad needs to take a code on the phone to release the money. I decided to give him an MD5 checksum.

Without me even trying to confuse him, it took us more than 10 minutes to get 30% of the release code done, and I've no idea if he has any errors. We got about 25% of the way after 5 minutes, at which point his money run out. Next time it is clear the cost of the phone calls is really eating into him, as he even got off the phone before he got even half the checksum, and said he would look at finding a cheaper way to call me!!

In my case. the senior member of the plot (Nick) has to generate a code on his phone, which allows the asset manager (Dolly Parton) to make a payment to him. But Nick has no email access, as he is on holiday and his wife would not let him take a computer, so the only way to send the code is via phone. And his wife wont let Nick ring any women, so Nick has to send the checksum via the scammer.

I offered to call him back, since I'd already forced him to not withhold his number. But when he said to ring him back, I said I would add the international code for Spain, which is where he claims to be. Once it was clear I'd looked up the code for spain, and was not going to just dial him directly in Nigeria, he gave up with that idea.

So if you fancy a laugh, try to get a Nigerian to get a 32 character release code on the phone.

wasname

Posted: Thu Jul 11, 2013 12:05 am

Nice! This works for me.

Master Baiter Joined: 21 Jun 2013 Posts: 143

You should check out SHA-512 https://en.wikipedia.org/wiki/SHA-2
http://hash.online-convert.com/sha512-generator
The output is longer than MD5

Posted: Mon Jul 15, 2013 9:26 am

I thought I'd upload the audio recordings of some of the telephone calls, as as the scammer tries to get the MD5 checksum, which is

2b3f7e439faa9fbeef6a1bad0af2a02e

These recordings were obtained by setting the recording facility on using Flextel.

Getting him to understand the md5 checksum using the usual characters of 0-9 and A-F was a real struggle. I think next time I will suggest we send it in binary! It will be an interesting exercise to see if sending 256 0's or 1's is easier than sending 32 characters which which from 0 to 9 and A-F.

Here are a few bits of audio of the scammer getting the checksum.

1) This one is not so intersesting, but here the scammer says he is stressed, and gets part of the code.

http://members.419eater.com/~wasname/Andy_Martin/Scammer-says-he-is-stressed-and-nick-generates-the-code.WAV

2) Here he does not even try to get the code, despite Nick tells him he has the code. The scammer does not have enough money to take the code!

http://members.419eater.com/~wasname/Andy_Martin/Scammer-running-out-of-money-and-nneds-to-find-a-way-to-call-Nick.WAV

Finally he gets a checksum, but it is very wrong, with lots of letter X's and I's, neither of which appear in an MD5 checksum.

http://members.419eater.com/~wasname/Andy_Martin/Finally-the-scammer-has-the-code-to-release-money-but-it-is-wrong-of-course.WAV

Once advised he has the wrong code, he finally gets the right code

http://members.419eater.com/~wasname/Andy_Martin/After-saying-fuck-so-he-gets-the-letter-F-we-have-got-there.WAV

Unfortunately for him, I'd already transposed two digits of the IBAN, which he confirmed were right, so when Dolly Parton tries to make the payment, it fails. Oh what a shame Smile

I was a bit silly in one of the calls, as I asked him to confirm the number of digiits, which he said was 31. But he had already been told there were 32 digits, so I should have let him send the 31 digits to someone, then delay as she found there were too few digits.

Of course, I should have tried to slow things down, but in fact even with me doing the best I could to get the code, he still makes a big mess of it.

Enjoy, and add any comments on how to improve it. The obvious problem is I tried to make him get the code correctly, rather than try to mess him around. But it shows the difficulty that could be had, even without screwing him around.

The code I gave him was one from the "digest" command on a Unix system. Next time I give him one, I will make a few substitutions so letters are harder to get, such as a number of B, D and E, all of which sound quite similar. I'll try so obscure words to use them phonetically. He claims to be a radio ham, so should understand the phonetic alphabet, but seems to fail at that. Perhaps I should send it in morse to him.

wasname

Posted: Mon Jul 15, 2013 9:55 am

You have come up with some great modalities for time wasting and lad confusion. Thank you!

Posted: Mon Jul 15, 2013 2:33 pm

I'm glad you like it. I think next time I send it, I will do it phonetically, but use the name of Spanish towns, as he claims to be in Spain.

A=Alcaucín
B=Benadalid
C=Carratraca etc

But I'll also have some French towns, as he claims to be originally from France. I expect the French and Spanish names will confuse me a bit, but I know it will confuse him more than me! Confusion is just what is needed when it comes to getting codes which release money!

wasname.

Posted: Mon Jul 15, 2013 2:52 pm

You could also use base-32 code, which is used for Torchat IDs, and have him mix up cows and donkeys.

Fun sending an MD5 checksum by phone	View next topic View previous topic