Jeff's bloÿg on networking, security and all things groovy

My first sale on eBay (aka Do you ship to Nigeria?)

2008-08-21T08:41:00Z

I was one of the lucky few who lined-up at 6 am in front of the Apple store in Seattle and got an iPhone 3G on the first day of it’s release. Boy, it is a sweet phone. I am loving the applications, the quickness of the 3G and the new Microsoft Exchange ActiveSync for my corporate email / calendar. I am not having any of the reported “reception problems”. The battery life is the only actual issue. 3G sucks the battery like RC car on Christmas day!

I wasn’t quite sure what to do with my original iPhone (that I paid $599 for, long before Steve lowered the price). I heard rumor that people were getting upward of $400 for their iPhones on eBay. Apparently, the old AT&T rates are still available for the original iPhone, and of course if you jailbreak it, you are free to do anything.

Since eBay started I have never had any interest in it. The idea of someone else's junk has never appealed to me. As bad as it sounds, I just prefer retail. I decided to give it a whirl though. How tough could it be to sell something?

I created my first ever listing in 10 minutes, wired-up PayPal, the whole deal. It sat without any bids for 90% of the auction. The last day is when it gets interesting. Actually, the last 10 minutes the thing went from $200 all the way to $488 (the winning bid in the last 5 seconds). Here’s where it gets really interesting.

Minutes after the auction closes, I get a couple emails from the eBay system telling me it had sold, for how much, and to whom. I also get the mail below, sent through eBay from the “buyer”. The only thing that seemed strange to me was conflicting email addresses from the “buyer”. It didn’t match up with the email address on file with eBay from the buyer’s account.

On 7/18/08 10:37 PM, <checkout@ebay.com> wrote:

Dear Jeff,

hi
i will make the payment right now you can mail me the invoice to this mail <email removed> and for my quick respond

hope to read from you.

============================================================
Item #/Item Title Qty Price
============================================================
220256449209 1US $488.00
------------------------------------------------------------

<name & address removed>
Sacramento, CA 95831

I emailed both addresses, the one in their eBay profile as well as the one mentioned in the mail above. I was offering free shipping (just feeling nice). It shouldn’t be much to ship it to Sacramento anyway, right? Shortly after I send my mail, I get a couple replies.

On 7/18/08 10:50 PM, <email removed> wrote:

hello i am making the payment via ebay link sent to me when i am through i will back to you and i will like you ro get the item shipped as soon as you the payment confirmation i prefer Global Express Mail USPS (EMS) i will make the addition shipment amount

hope to here from you

On 7/18/08 11:02 PM, service@paypal.com <paypal@pay-palauctionsupport.com> wrote:

Dear Jeff,

This email confirms that, <email removed>, have paid you the total amount of US $600.00 using PayPal.

Payment Details
220256449209 US $500.00
Shipping & Handling US $100.00
Total: US $600.00

This PayPal? payment has been deducted from the buyer's account and has been "APPROVED" but will not be credited to your account until the shipment reference/tracking number is sent to us for shipment verification so as to secure both the buyer and the seller.

Send tracking number to us or email us through this mail paypal@pay-palauctionsupport.com and our customer service care will attend to you.

Shipping Information
Olalekan Apalowo
P.O Box 985 Sapon
Abeokuta, Ogun 110011
Nigeria
+2348077608144

I read these mails over and over. I kept noticing more and more things wrong. I went over to eBay and PayPal and it seemed really clear to me they never keep funds from showing up in your account. They will always show up when someone funds you. Finally, I looked a little closer at the HTML behind the email, and then I was 100% sure this was a complete sham. PayPal would never use some cooked-up URL (http://pay-palauctionsupport.com). When you go to the site, it is a default page from Microsoft Office Live Small Business (ha!).

I took a while deciding what to do. In the end, I decided to report it to eBay security and risk the bad eBay feedback (since I was so certain this was complete crap). Here was my exchange with the guy.

On 7/18/08 11:17 PM, Jeff Sigman wrote:

I’m afraid that’s not how it works. PayPal is able to tell me when my account gets money, it doesn’t wait. I will only be shipping this to a US address, per the auction details.

Please fund my paypal account and supply me a US address. I will then gladly ship it to you for free.

Jeff

PS – I will be contacting eBay if this doesn’t start to sound more legit in your next email to me.

On 7/18/08 11:23 PM, <email removed> wrote:

i have already add more funds to the shipment cost and my shipping address is with the PayPal confirmed and verified so don't be afraid about your money
the money is already in PayPal database ready to delivered into your account as soon as you send the shipment tracking number to them

This was just started by PayPal to stop those who receive Payment and never ship any anyitem

hope to hear from you soon and nice doing business with you.

On 7/18/08 11:35 PM, Jeff Sigman wrote:

I have contacted eBay as I believe this to be fake transaction. I also believe that you have compromised someone’s account. Best of luck to you.

Jeff

On a hunch, I google’d (that’s right, not only do I use an iPhone, I also google) some of the things from the email and found this isn’t that uncommon with phones and small easily black-market-able electronics.

The fun didn’t stop. Another hunch of mine was correct. The guy had penetrated, through some means, a real person’s account in California to gain my “trust”. That is partly what was throwing me. The person had OK buying history on eBay.

On 7/19/08 6:00 AM, "ended@ebay.com" <ended@ebay.com> wrote:

-----------------------------------------------------------------
MC143 A29 TKO NOTICE: Secure your computer
-----------------------------------------------------------------

We recently learned that someone was using an account to bid on items without the account owner's permission. All associated fees have been credited to your account. Please note that we're working with the account owner to prevent any additional unauthorized activity.

He didn’t give up. Persistent fellow. Check it out.

On 7/19/08 6:21 AM, moreinfo@ebay.com <accounmonitored@consultant.com> wrote:

MC033 A26 Account Security Notice: eBay Bid Item #220256449209 Cancellation Now Re-Activated (Proceed With The Transaction)

Hello Jeff Sigman,

This message was originated from the eBay and PayPal team. We appologise for the cancellation of your eBay Item, it was formally canceled due an Error 908 on the eBay Data Base. The eBay & PayPal Team has both agreed to erase the cancellation and re-activate the item from the eBay Data Base. We have confirmed that (<email removed>) is the rightful owner of the eBay account,which was accessed by an unauthorized person. So we gladly urge you to complete the transaction with him/her so as to receive your funds into your PayPal account and PayPal inform us after we contact them the payment is been made by the the seller so ship the item out and get back to us with the shipment tracking Number OR email the shipment tracking Number to PayPal.

We have been informed by PayPal Authority that the money will not be transfer into your PayPal account until they confirm the shipment details of the item. You are request to proceed with the shipment of the item within the next 12 - 24 Hours and get back to PayPal with the shipment tracking number for shipment verification so as to receive the funds into your PayPal account. Please Do not in anyway send the reference/tracking number of the item to the BUYER for the safety of your money.

On 7/20/08 1:41 PM, service@paypal.com <paypal@pay-palauctionsupport.com> wrote:

It is important we know the status of the item bought otherwise, LEGAL ACTION may be taken against you since you have not replied to the confirmation of payment made to your account by (<email removed>) over time.

We believed you entered into bidding agreement by requesting money through PayPal,and by non response to the payment confirmation made to your account you have violate the eBay and PayPal agreement. However the buyer has already contacted us in other to make report about your non response.We are ensuring to make PayPal a safer place, therefore we need to set confidence on our users. Although, an error occurred while processing your payment as an error came upon our transaction machine in which we sent you two transaction payments but this has been taken care of and everything is now in place.

We request for the Scanned Receipt and the Tracking Number to prove postage of the item in less than 24hours and we will fund the money into your account or face the consequences of LEGAL ACTION.

Oh no! Legal action! I better respond or be sued! Here is how I ended it. I never got any more mail.

On 7/20/08 2:14 PM, Jeff Sigman wrote:

I am sorry that your situation on Earth has lead you to a life of crime. Damn shame. Better luck next time!

Love,

Jeff

I am afraid this story has a happy ending. I sold the iPhone (again) some days later for $415. The guy paid me in 2 minutes and I shipped it to him. He even gave me an A+ rating. What fun!

eBay survivor,

Jeff

My head makes a ZDNET appearance

2008-05-23T21:42:00Z

The folks at ZDNET has started streaming videos from the TechNet Edge library. This is a video I made with Adam Carter (IT Pro dude) and Brent Atkison (Microsoft IT NAP dude) which first appeared on Channel 9 in October 2007. Pretty cool.

{Jeff Sigman}{Senior Program Manager & NAP Hero}{Enterprise Security Group}

{NAP Blog, FAQ, Forum, MSDN, Site and my bloÿg}

Auto-NAP spotted in Europe

2008-05-02T00:58:00Z

A NAP {HERO} in Germany, Philipp Kuhn, contacted me when he spotted NAP in a space he wasn’t quite expecting. Yes, it’s true, we have NAP running in select cars throughout Europe as a part of a pilot program. If you do/have anything "non-compliant" in the car {use your imagination here}, it will simply start driving itself to the nearest police station while honking incessantly. Pretty cool eh? :->

{Jeff Sigman}{Senior Program Manager & NAP Hero}{Enterprise Security Group}

{NAP Blog, FAQ, Forum, MSDN, Site and my bloÿg}

NAP World Tour rocks RSA 2008 San Francisco

2008-04-15T06:48:00Z

I was out all last week in San Francisco for the RSA Conference. Wow, what a week! I really love visiting San Francisco. Great weather, great food and amazing views. I wanted to share some photos and a video from the trip.

I arrived Sunday April 6th in the early afternoon. Trying something new, I took the BART (Bay Area Rapid Transit) directly from the airport terminal to just a few blocks from the W Hotel. It was only $5 and took about 30-40 minutes, you can't beat it!

As I just recently gave up daily coffee (gasp!), I went in search of a nice tea shop. I found Peet's Coffee & Tea. I got a nice rare jasmine and soaked up the view.

I checked in to my room at the W Hotel San Francisco. I had a direct view of the Moscone Center where the conference was hosted.

I had a nice early dinner in the XYZ Restaurant adjoined to the hotel. They allowed me to order something not on the menu. The hotel / restaurant service was impeccable for the duration of my stay!

Man, I do love a nice sparkling water with lime. They kept it coming. :->

Guess I should actually get to work. I headed over to the Moscone Center early on Monday morning to find the NAP Partner Pavilion (a separate booth from the main Microsoft booth that the NAP team ran) less than half complete! To my surprise, my 802.1x NAP showcase racks seen below were nowhere to be found! I quickly walked all over the show floor (it was huge) and located them next to the main Microsoft booth. Whew! Three weeks worth of effort, and I thought it might be lost.

The folks setting up the booth got on the biggest ladders I have seen (not on a fire truck) and put up our cool NAP World Tour banners. They are a very nice red, even though my iPhone shows them a bit orange-ish below.

We gave away around 6 Zunes a day at the NAP Partner Pavilion. Giveaways at tradeshows bring out a strange and interesting side of some people. If you know what I am talking about it, let's just say we had fun fighting off the wolves trying to get a Zune.

Ah, success! Everything is working by late Monday afternoon. I have 8 wired 802.1x switches below all working flawlessly with Windows Server 2008 NAP (HP ProCurve, Nortel, Juniper, Cisco, D-Link, Extreme, Enterasys and Foundry). It was an amazing educational experience to work with each switch. They are each a universe of configuration unto themselves. I am very willing to share config; if you are interested just shoot me an email!

The hippy hackers parked right in front of the W. I had to get a shot of this bus. The police ticketed it for some reason or other. I bet they never pay that ticket (and I bet the city "forgets" it ever issued one). :->

The show floor was packed. I learned a lot this show about how our NAP Partners are enriching the NAP/NAC ecosystem. Check it out below!

We hosted a "happy hour" in the NAP Partner Pavilion each day. We had free wine and beer "on Bill" as I told each person. Kara, seen below, ended up handing the bartending torch over to me. I have to admit, it was the best part of the show for me. :->

Goodbye San Francisco! I will miss you!

Getting closer to Seattle, can you tell? :->

Well, hope you enjoyed this post. It is MVP Summit this week on the Redmond Campus. I am speaking with three groups of MVPs about NAP today and tomorrow. Wish me luck!

Cheers!

{Jeff Sigman}{Senior Program Manager & NAP Hero}{Enterprise Security Group}
{NAP Blog, FAQ, Forum, MSDN, Site and my bloÿg}

"The beginning is a very delicate time."

2008-02-29T07:42:00Z

It is almost two years ago that I launched the NAP blog with these words. I now consider it a tradition to start blogs with this opening line from the movie Dune (1984).

As I type this I am sitting in a friend’s apartment in Hollywood relaxing after the Windows Server 2008 Launch Extravaganza, which exploded upon the world yesterday in Los Angeles. I am super excited that NAP is SHIPPED {finally} and is publicly available for the world to evaluate and use.

I am writing a mini-journal of my launch experiences as well as a super-cool video to give you a flavor of the event. Wow is all I can say. I will get it posted ASAP.

My next 12 months is all about getting NAP DEPLOYED out in the world! More details on that in the weeks to come.

Here is a shot of Todd Hooper (CEO/Founder of Napera) and I on the show floor:

Jeff Sigman
Senior Program Manager

Network Access Protection (NAP)

Please check out the NAP Blog, FAQ, Forum, MSDN, Site and even my Personal Blog.