----- Our chat on Wed, 7/7/10 2:53 PM -----
Iftach(2:34 PM):  hey man
Iftach(2:34 PM):  mind if a ask a couple of questions?
fadzilmahfodh(2:34 PM):  okey
Iftach(2:35 PM):  cool. I'm doing this research on security tools and their 
authors...
fadzilmahfodh(2:35 PM):  okey
Iftach(2:35 PM):  saw your tool and wanted to hear about how you got to write 
it, how well is it distributed in the community etc...
Iftach(2:36 PM):  does that activation thing a common practice with free tools?
fadzilmahfodh(2:36 PM):  yes see, we need to maintain our website thus we need 
supporter
fadzilmahfodh(2:37 PM):  everyday there are at least 500++ people asking for 
code
Iftach(2:37 PM):  I see.

fadzilmahfodh(2:37 PM):  i no longer able to provide for free
fadzilmahfodh(2:37 PM):  too time consuming and i need to be compensated for my 
time and effort
Iftach(2:38 PM):  that's a lot of people! do you by any chance do any 
demographics on them? I'm trying to do a piece on the "hacker profile"...
fadzilmahfodh(2:38 PM):  hope you understand
fadzilmahfodh(2:38 PM):  50% traffic from usa
fadzilmahfodh(2:38 PM):  about 30% from europe countries
fadzilmahfodh(2:38 PM):  others 20%
Iftach(2:38 PM):  interesting
fadzilmahfodh(2:38 PM):  generally speaking
Iftach(2:39 PM):  any strange requests that you got from ppl?
fadzilmahfodh(2:39 PM):  yes. 
fadzilmahfodh(2:39 PM):  they usually ask for credit card, paypal account and 
ssl hack
Iftach(2:39 PM):  hmmm, typical cracker stuff...
Iftach(2:39 PM):  interesting
fadzilmahfodh(2:40 PM):  You are from Indiana , aren't you?
Iftach(2:40 PM):  now, about the tool - that's a linux binary obviously (thought 

it was a shell script at the beginning). Did you base it on something existing 
or write yourself?
Iftach(2:40 PM):  yes
fadzilmahfodh(2:41 PM):  i wrote it by my self then scramble the code
fadzilmahfodh(2:41 PM):  Fort Wayne far from your place?
Iftach(2:41 PM):  hence the activation i see...
fadzilmahfodh(2:42 PM):  i can afford to give 'free lunch' to everybody. Hope 
you understand
Iftach(2:42 PM):  pretty far from Richmond...
Iftach(2:43 PM):  sure, i understand.
Iftach(2:43 PM):  and you? from the US?
fadzilmahfodh(2:43 PM):  Well, my tracking need fine tunning..
Iftach(2:43 PM):  
fadzilmahfodh(2:43 PM):  So you interested in the software?
Iftach(2:44 PM):  more from a research point of view - for an article I'm 
writing
Iftach(2:44 PM):  so, the installer you use, I see that it contains some 
additional code that is being compiled on the client.
fadzilmahfodh(2:45 PM):  Yes. The purpose is the code will be unique to user 
hardware
Iftach(2:45 PM):  and I saw that there were some FTP connections made? Is that 
to verify that the client is a registered one?
fadzilmahfodh(2:46 PM):  Well, that is another story...
Iftach(2:46 PM):  I'm listening
fadzilmahfodh(2:46 PM):  maybe some other time huh
Iftach(2:47 PM):  OK. Last question - do you get a lot of account passwords 
through that keylogger that sends the data to your FTP?
fadzilmahfodh(2:47 PM):  sorry, no comment unless i am in court 
Iftach(2:48 PM):  aha, and it's part of the installer because? just to make sure 

people can send the activation email correctly?
Iftach(2:48 PM):  Back to statistics, out of the average 500 ppl asking for 
activation - how many passwords do you manage to grab?
fadzilmahfodh(2:49 PM):  well, the ftp is to confirm that software match with 
data in server
fadzilmahfodh(2:49 PM):  if it does not match, it will fail to run
fadzilmahfodh(2:49 PM):  or i can just change the data/activation code in the 
server
fadzilmahfodh(2:49 PM):  then everything will not run
Iftach(2:49 PM):  and how does that relate to the keylogging?
fadzilmahfodh(2:50 PM):  well, that i another story...
Iftach(2:51 PM):  I mean - the keylogger data is sent to that FTP. Is that part 
of the verification or is this a separate process?
Iftach(2:51 PM):  So, on average, how many accounts you manage to get on that 
FTP server per day?
fadzilmahfodh(2:51 PM):  well, you do not even support my website and how the 
hell am i going to tell you
Iftach(2:52 PM):  Let's just get it straight - I'm not going to "support" the 
site... I'm just doing some research on security tools.
fadzilmahfodh(2:52 PM):  bye
Iftach(2:53 PM):  You are free to tell, or not if you don't want to. But I'm 
publishing the story as it is...
Iftach(2:53 PM):  With your acknoledgment that you use a keylogger to steal your 

site visitor passwords. Unless you want to be quoted otherwise in the story...