Singapore Airlines Free First Class Tickets WhatsApp scam

Lately, I kept receiving the following message from contacts on my business WhatsApp number:

Hello, Singapore Airline is giving away 2 Free FirstClass Tickets to celebrate 45th anniversary, Now you can get your tickets too ! go here to get it: http://www.singaporeaır.com/firstclass Enjoy your flight!.

singapore air free business class tickets whatsapp scam

It is surprising how careless people can be when forwarding such messages around. There are a few things in the message above that clues one in on its authenticity:

  1. The English. Singapore Airlines was spelled without an “s” at the back, Inconsistent and unnecessary capitalisation of letters, inappropriate spaces and punctuation.
  2. The hyperlink might appear to be singaporeair.com but if you take a closer look, you will notice that there’s something wrong with the letter “i” in the word “air”. We’ll elaborate below.

So what happened to the dot in the “i”? Turns out that the letter is actually:

ı

The letter i without a dot above.

Source: Wikipedia

This is a visual trick used by people with malicious intention to lower the guard of people who have learned to be suspicious of obviously dubious URLs. These people will go “Hey the URL looks legit” and proceeds to click on it.

By the time I found some time to write this post, the site has been taken down. However, I still want to explain more about the web technologies used to bait people to the site.

How did the scammer do it?

Scammers have been using internationalized domain names (IDN) to create resemblance to leigitimate domain names for some time now. But because DNS servers cannot handle the unicode characters of IDNs, Punycode is used to convert the unicode back to ASCII characters. For the above domain, www.singaporeaır.com actually converts to www.xn--singaporear-8zb.com. And if you were you look up the domain name, it claims to be registered in the Bahamas:

Domain Name: XN–SINGAPOREAR-8ZB.COM
Registry Domain ID: 2182998491_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.internet.bs
Registrar URL: http://www.internetbs.net
Updated Date: 2017-11-04T05:16:54Z
Creation Date: 2017-11-04T04:45:22Z
Registrar Registration Expiration Date: 2018-11-04T04:45:22Z
Registrar: Internet Domain Service BS Corp.
Registrar IANA ID: 2487
Registrar Abuse Contact Email: abuse@internet.bs
Registrar Abuse Contact Phone: +1.5167401179
Reseller:
Domain Status: clientTransferProhibited – http://www.icann.org/epp#clientTransferProhibited
Registry Registrant ID:
Registrant Name: Domain Admin
Registrant Organization: Whois Privacy Corp.
Registrant Street: Ocean Centre, Montagu Foreshore, East Bay Street
Registrant City: Nassau
Registrant State/Province: New Providence
Registrant Postal Code:
Registrant Country: BS
Registrant Phone: +1.5163872248
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: xn--singaporear-8zb.com-owner-ysp5@customers.whoisprivacycorp.com
Registry Admin ID:
Admin Name: Domain Admin
Admin Organization: Whois Privacy Corp.
Admin Street: Ocean Centre, Montagu Foreshore, East Bay Street
Admin City: Nassau
Admin State/Province: New Providence
Admin Postal Code:
Admin Country: BS
Admin Phone: +1.5163872248
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: xn--singaporear-8zb.com-admin-85n9@customers.whoisprivacycorp.com
Registry Tech ID:
Tech Name: Domain Admin
Tech Organization: Whois Privacy Corp.
Tech Street: Ocean Centre, Montagu Foreshore, East Bay Street
Tech City: Nassau
Tech State/Province: New Providence
Tech Postal Code:
Tech Country: BS
Tech Phone: +1.5163872248
Tech Phone Ext:
Tech Fax:
Tech Fax Ext:
Tech Email: xn--singaporear-8zb.com-tech-qfid@customers.whoisprivacycorp.com
Name Server: ns-canada.topdns.com
Name Server: ns-uk.topdns.com
Name Server: ns-usa.topdns.com
DNSSEC: unsigned
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2017-11-07T06:47:31Z <<<

Registrar: Internet Domain Service BS Corp
Whois Server: whois.internet.bs
Creation Date: 2017-11-04T04:45:22Z
Updated Date: 2017-11-04T05:16:54Z
Expiration Date: 2018-11-04T04:45:22Z

Nameserver: NS-CANADA.TOPDNS.COM
Nameserver: NS-UK.TOPDNS.COM
Nameserver: NS-USA.TOPDNS.COM

The profile of the registrant has been anonymised as part of a value-added service provided by the registrar but even then, we should take the above information with a pinch of salt. One important point to note is that the domain was only registered 3 days ago and we don’t know what else this person plans to do.

Be very careful even if the link was sent by someone you know

Whatever you do, please be very careful even when friends forward links to you via WhatsApp, Facebook or any other platform. There are two main possible scenarios:

  1. Your friend/contact knowingly forwarded the link to you but didn’t know that the link is fake
  2. Your friend/contact’s device sent the link to everyone in the contact list without his/her knowledge. This can happen to a compromised device.

Do your friend/contact a favour and alert him/her about the link instead of just clicking on it. Together, we can foil the plans of these scammers.

[Solved] Intel Compute Stick Wi-Fi broke after Windows 10 Creators Update!

I currently manage a small cluster of 25 Intel Compute Sticks (STK1AW32SC) as a small part of my day job. I allowed Windows 10 to do its regular Windows Update as part of security best practice to protect my devices from unpatched vulnerabilities.

Windows 10 Creators Update came a little late for me, trickling in between July and August 2017. During this period, privacy review dialogues kept appearing on my machines’ displays. After I’m done with all these privacy reviews, the nightmares begun.

Upon reboot after the Windows 10 Creators Update, each and every Intel Compute Stick did not have internet connectivity!

Intel Compute Stick Wireless AC 7265 can't start after Windows 10 Update

I checked and found that the wireless network adapter had disappeared from the Network Connections page!

Intel Compute Stick Wireless AC 7265 can't start after Windows 10 Update

Intel Compute Stick Wireless AC 7265 can't start after Windows 10 Update

Going to Device Manager, I found that the wireless network adapter Intel Dual Band Wirelss AC 7265 has an error on it. On some sticks, the wireless network adapter is totally missing from Device Manager! For this, go to the end of the post to see how you can perform a Network Reset to get back the device entry. For those who can see the Intel Wireless AC 7265 with a yellow triangle, double click it and go to the Driver tab.

Intel Compute Stick Wireless AC 7265 can't start after Windows 10 Update

Intel Compute Stick Wireless AC 7265 can't start after Windows 10 Update

Click Update Driver and then Browse my computer for driver software because you’ll want to rollback to the last version of the driver.

Intel Compute Stick Wireless AC 7265 can't start after Windows 10 Update

Choose Let me pick from a list of available drivers on my computer since the older driver would still be on your computer. Intel Compute Stick Wireless AC 7265 can't start after Windows 10 Update

When you get to this point, make sure you click on any older driver i.e. anything but the driver with the newest date.

Intel Compute Stick Wireless AC 7265 can't start after Windows 10 Update

Intel Compute Stick Wireless AC 7265 can't start after Windows 10 Update

There you go! Wi-Fi fixed. You don’t (usually) need to even restart the PC!Intel Compute Stick Wireless AC 7265 can't start after Windows 10 Update

As shared earlier, I encountered a strange situation on some of the sticks whereby the wireless network adapter cannot be found in the Device Manager. For such a situation, you will need to perform a Network Reset as shown in the following screenshot. Warning! You will lose ALL saved Wi-Fi networks/passwords. Once done, you will need to restart your computer and go back to Device Manager to do the driver rollback described above.

Intel Compute Stick Wireless AC 7265 can't start after Windows 10 Update

I’ve informed Intel about this but they kept referring me to Microsoft. I give up. Microsoft is NOT going to care about someone like me. What I can do is to share this fix on my blog to help as many people as I can. This is quite obviously a case of Microsoft bundling a faulty driver for this device as part of a major update! How careless!

Cheers!

Recording IP Camera Footages onto NAS or local storage

In my previous post, I shared about my overhaul of IP Cameras in my home. I ditched the 3 cheap D-Link DCS-930L and went for 2  D-Link DCS-5222L IP Cameras. One great feature of this camera is the ability to do RTSP streams. Cheaper IP Cameras usually stream in Motion-JPEG format which I personally find the quality crappy and may not have the audio stream available.

After a few days of research, I concluded that I need to get a camera that streams H.264 via RTSP so that I can capture them natively as mp4 files. D-Link DCS-5222L does that and the price was pretty reasonable for its RTSP support, 720p resolution, PTZ feature and good viewing angle. The hardest thing to do is to choose software that will:

  • Stream from the cameras via command line
  • Dump the video stream as H.264 Mp4 files
  • Save the audio stream in the same file container
  • Segment the footages at my chosen interval with appropriate file naming
  • Reasonably crash-resilient (I’ll explain why later)

I’ve tried many off-the-shelf products and the best one out there appears to be Webcam 7 Pro. It is reasonably stable but captures mainly MJPEG streams only without audio. It does a good job segmenting files and you can even make it auto delete footages that are X days old. Enough of this lest I sound like I’m promoting the software.

I found that VLC is a good candidate as it has robust command line features and can be used to relay a media stream as a fresh broadcast or dump a stream to file with real-time transcoding i.e. you can transcode a H.264 stream into a mpeg file for storage (but you don’t want to do that of course because mpeg files are larger). The problem with VLC that I face is that it crashes easily and that seems to be a bug which caused a stream to be decoded to some raw format causing my disk space to fill up overnight. In the end, I use VLC as a monitoring tool as I can easily launch the RTSP stream by passing the IP Camera URL, port, credentials and the fullscreen parameters via command line.

Here’s how I did it for my camera:

vlc rtsp://admin:[password]@[ip address]:[port]/live1.sdp –fullscreen

Remember to replace [password], [ip address] and [port] with your own values.

Moving on to the next candidate, FFmpeg. 

FFmpeg has been around for many years and many video conversion / broadcasting software including VLC make use of components from FFmpeg! As mentioned above, I needed something that can save both video and audio streams, segment files (so that you don’t get a huge 100GB file after a few weeks) and be able to use timestamps as the filename.

After tinkering for a day or two, I decided that this will work for me:

start “Door Cam” “ffmpeg.exe” -i rtsp://admin:[password]@[ip address]/live1.sdp -c copy -map 0 -f segment -segment_atclocktime 1 -strftime 1 -segment_time 1800 -segment_format mp4 -vcodec copy -acodec aac -strict experimental -ab 64k “.\Recordings\DoorCam-%%Y-%%m-%%d_%%H%%M.mp4”

The above command (yes I know it probably contain redundant flags because I whippped this up with much trial and error) will:

  • start reading the video and audio stream as defined in the SDP file of my D-Link DCS-5222L
  • copy the video stream “as-is” and convert the audio (from PCM mu-law) to AAC @ 64Kbps and mux them into a mp4 container
  • segment the files (chop up the files every 1800 seconds (30 minutes)
  • synchronise the next segment on the clock (i.e. 12:30pm, 1pm, 1:30pm, etc)
  • Give each segment a meaningful filename (e.g. DoorCam-2016-12-4_1030.mp4)

The results:

door-cam
Don’t worry about the errors. It happens a lot with live streaming devices such as an IP Camera

cam_pic

And of course, if you mapped your NAS to your operating system, FFmpeg can dump the files there.

That’s it for now!