We live in a regular neighborhood in Anytown, USA and that neighborhood had many wonderful things that make it a wonderful place to live. This includes very neighborly neighbors that are just trying to help.
This morning I awake to find an envelope taped to my front door. It was blank, and I briefly peek around and see that the rest of the neighborhood has the same thing waiting.
I go ahead and open it, expecting to find a local resident selling mowing, painting or any other service but find something slightly different. Close, but different. In part below:
“Neighbors:
Since we don’t have a homeowners association everyone has done their own thing in regards to trash removal. I thought it would be nice to have one garbage truck come through each week instead of three so I contacted [REDACTED] who I was inquiring about a special. I have attached their letter….
… If everyone thinks this is a good idea we can all have matching barrels put out at one time per week…
…Again, we dont have an association, but we can all act together if we choose. Their number is on the attached paper if you would like to use them.”
Ok, so whats the problem you ask? Well nothing really, I think it was a nice gesture, and think he was just trying to help his fellow neighbor.
HERE is the problem.
On the “Attached paper” was a browser printout of an email that was sent to his gmail account. He made an effort to hide his gmail address and thats about it. The nice little feature gmail provides to show the last account activity was in plain view. The IP address was in tact.
Being the curious minded person I am, I couldn’t help myself and put in the IP into my browser. Bingo. “Welcome to Windows Small Business Server 2003″
I’d better close it right away… nah, Of COURSE I clicked on “Remote Web Workplace” and of COURSE I got:
“The site’s security certificate is not trusted!”
and of COURSE I was in a VM and so on and so for and moved forward. I was presented with a company name, and a logon prompt. So a quick tally of what we have so far.
I have his full name, IP address of a machine I know he used, probably was logged into the SBS web desktop. I have his address (duh), place of employment and the phone number and address of his work place. Oh well.
What I DON’T have
I dont have HIS email address, remember he redacted it. I NEED that email address now, so when I call him I can send him an email as well.
This was an easy one, the “Attached paper” had the persons name, phone number and email that he contacted about a special. I had all the info I needed to just socially engineer my neighbors email address out of them. I called the number and received the front desk. I was informed the person I needed was out, but she could help me. She could take my name and number and get back to me. Stop. That wasn’t really going to work for this little experiment. I simply gave her some more details, like the my neighbors name and guess what. She has access to the mailbox that contained the email address. After helping her troubleshoot a bit, she gave it to me without hesitation, and I even asked her to spell it again and asked if I couldn’t reach him by email If I could call her back because she has been “so helpful and really got me out of a pickle”. Another win for me . FAIL for them. They mindlessly handed out information about another customer.
Additionally, all of his gmail labels were in view on the print out. Pretty organized too, I know his church, hobbies and the fact he uses his gmail for work, Well, I’m assuming thats what the “Work” label meant. Wow. This is awesome.
What was the point of even bothering with this?
To help educate my neighbor that something seemingly harmless could have been bad.
I have contacted him, but haven’t heard back. I will update this post as soon as I do. Remember, own your information folks.
Update: I spoke to my neighbor and he was very thankful that I wasn’t malicious. I think he understood why it was a bad idea, and mentioned “you got all of this from a note on your door about trash…different world we live in” 
Protecting people, one neighbor at a time.