Hehe, moments after we put the new missions up, an email caught our attention:
an anonymous source (thx kevin) sent us JD Nunes' mailspool. How nice! Well, let's see
together what are security professionals talking about all day long. Would you
think it's about new security techniques or measures? OMG, you're so naive...
Better take a look!
WARNING: John D. Nunes mailbox is extremely boring. He deserves to get rm'd!
PHC comments are marked with %%
%% Dear God, this small talk is offensive to my eyes!!!
%% But I *MUST* keep reading and commenting..
From ckrpps@earthlink.com Wed Jan 26 09:58:20 2005
Return-path:
Envelope-to: jnunes@defensivethinking.com
Delivery-date: Wed, 26 Jan 2005 09:58:20 -0500
Received: from [207.217.121.170] (helo=pop-a065b10.pas.sa.earthlink.net)
by core1.needhosting.net with esmtp (Exim 4.44)
id 1Ctocd-000516-AV
for jnunes@defensivethinking.com; Wed, 26 Jan 2005 09:58:20 -0500
Received: from kermit.psp.pas.earthlink.net ([207.217.78.241])
by pop-a065b10.pas.sa.earthlink.net with esmtp (Exim 3.33 #1)
id 1Ctoce-0000y1-00
for jnunes@defensivethinking.com; Wed, 26 Jan 2005 06:58:20 -0800
Message-ID: <26627974.1106751500106.JavaMail.root@kermit.psp.pas.earthlink.net>
Date: Wed, 26 Jan 2005 09:58:19 -0500 (GMT-05:00)
From: Chris Rankin
Reply-To: Chris Rankin
To: jnunes@defensivethinking.com
Subject: Re: European EP contact
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Mailer: Earthlink Zoo Mail 1.0
John,
Thanks for the info. When will you be heading back?
Give me a call and we can have a beer. GO EAGLES sorry about your Steelers.
It would have been great to have a PA Super Bowl.
Chris
%% It would've been greater to have you killed, you homo!
-----Original Message-----
From: JD Nunes
Sent: Jan 24, 2005 4:09 PM
To: ckrpps@earthlink.net
Subject: European EP contact
Hi Christopher,
John Nunes here from TGI Fridays. Sorry it took me a while to get in touch
with you but I had to verify the email address for my friend in Norway. His
name is Petter Tetli and he lives in Trondheim, Norway. His email is
petter@tetli.org. I've worked with him and his people and they are a great
group of guys/gals and also a class act. I am going to pass your
information to him also. I hope you guys can work together.
%% See how the whitehat octopusse is spreading? Norway is the root of all evil!
%% They exchange emails and talk about gay sex (as you see, there are lesbians
%% too. way to go!)
Hope you are enjoying your trip!
John Nunes
From orders@culturejunkie.com Wed Jan 26 14:57:55 2005
Return-path:
Envelope-to: jnunes@defensivethinking.com
Delivery-date: Wed, 26 Jan 2005 14:57:55 -0500
Received: from [216.168.254.21] (helo=benicia-w2-inf30.verisign.net)
by core1.needhosting.net with esmtp (Exim 4.44)
id 1CttIZ-0005Q7-Bh
for jnunes@defensivethinking.com; Wed, 26 Jan 2005 14:57:55 -0500
Message-Id: <200501261957.j0QJvvfC011825@benicia-w2-inf30.verisign.net>
Content-type: text/plain
Date: Wed, 26 Jan 2005 11:56:57 -0800
From: orders@culturejunkie.com
Subject: Order Confirmation
To: jnunes@defensivethinking.com
X-Loop-Check:
Your order has been placed.
%% And your dox been pulled. Thanks!
Merchant: Culture Junkie
Order ID: VDME38185231
Order Placed: 26-Jan-05 11:56 AM
Amount of Transaction: $199.00
Payment Type: VISA
CustID: 9873314953819071
%% Tadaa! Isn't this his home address? And his phone #?!
BILL TO
--------
John D. Nunes
2101 Wilkes Ct. #405
Herndon
VA
20170
USA
703-471-1275
jnunes@defensivethinking.com
SHIP TO
--------
John D. Nunes
2101 Wilkes Ct. #405
Herndon, VA 20170
USA
ORDER DESCRIPTION
--------------------------------
1 - ShmooCon 2005 Registration;
--------------------------------
Thank you for buying Culture Junkie!
%% Thank you for your docs!
From tbrennan@datasafeservices.com Wed Jan 26 15:25:02 2005
Return-path:
Envelope-to: jnunes@defensivethinking.com
Delivery-date: Wed, 26 Jan 2005 15:25:02 -0500
Received: from [68.236.207.242] (helo=mail.datasafeservices.com)
by core1.needhosting.net with esmtp (Exim 4.44)
id 1Cttin-0005zj-Ly
for jnunes@defensivethinking.com; Wed, 26 Jan 2005 15:25:02 -0500
X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0
Content-class: urn:content-classes:message
Subject: RE: March 7th - 11th
MIME-Version: 1.0
Content-Type: text/plain;
charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Date: Wed, 26 Jan 2005 15:30:09 -0500
Message-ID: <1DA2AD8042527B4199C09042CFC0A94D074489@jinx.datasafeservices.net>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: March 7th - 11th
Thread-Index: AcUD4pD2meTu0bDMS3+AAdmJDd9jAwAAknSA
From: "Thomas Brennan"
To:
CC: "Kevin Reiter" ,
"Mike Esposito"
We are staying at Wardman Park Marriott Hotel, lets plan to meet at the
bar Friday night after the CON looks like it ends at 1900 see:
http://www.shmoocon.org/schedule.html .=20
%% "Dude, let's go to the bar! Maybe we can impress them rich chicks
%% with our "I would pentest you for free" t-shirts!"
I wonder how big this event is going to actually be?
%% You groupie! You'd better ask how big is JD's cock
%% Hint: asian in the cold!
Concerning dates other than ISC2 doing the CISSP March 7th - 11th and
then we have it booked on the 23rd for another event (www.nitix.com)
seminar. So if you want to recommend/pencil dates for the future that
is food for thought.
I would be VERY interested in your thoughts concerning marketing the
event to be successful as well based on your past experiences and
insight.=20
Look forward to talking to you next week and seeing what you have
-tom
-----Original Message-----
From: JD Nunes [mailto:jnunes@cox.net]=20
Sent: Wednesday, January 26, 2005 3:04 PM
To: Thomas Brennan
Subject: RE: March 7th - 11th
Hi Thomas,
Well, It doesn't look like I'll be billable next week so I should be at
ShmooCon.
I'm working on the final contract to have my own material to use. This
is just taking forever. Also, I think I have my schedule worked out
through April now. Did you want to hammer out a date now or wait till
the con?
Talk at ya later.
John
-----Original Message-----
From: Thomas Brennan [mailto:tbrennan@datasafeservices.com]
Sent: Saturday, January 22, 2005 1:28 PM
To: Thomas Brennan
Subject: March 7th - 11th
FYI wanted to relay that we're now officially a seminar location for
ISC2 for the upcoming CBK Review March 7th - 11th (see attached or visit
the ISC2 website.)
%% Isn't this over yet? It's all about CON's. I was expecting some neat
%% advisories. Oh, I forgot whose mailbox is this...
Looking forward to working with you as soon as next week on dates for
you to conduct training at our facility in 2005/2006. Once we have
dates, we can start marketing the events and get RSVP's.
Enjoy the snow ;)
Thomas J. Brennan, CISSP
Data Safe Services
O: 1-888-663-0079
D: 1-973-795-1046 x 111
F: 1-973-428-0293
W: www.datasafeservices.com
%% No shit?! Man, this warning got me scared! You mean, I am
%% not allowed to view JD's mailspool?! But he'z my bud!!!
DATA SAFE SERVICES: This email message is for the sole use of the
intended
recipient(s) and may contain confidential and privileged information.
Any unauthorized review, use, disclosure or distribution is prohibited.
If you are not the intended recipient, please contact the sender by
email or telephone and destroy all copies of the original message.
%% Now we know why security professionals are so easy to own: they are
%% too busy with con's, ppt presentations, beers, etc.
From ralph.echemendia@gmail.com Wed Jan 26 20:58:41 2005
Return-path:
Envelope-to: jnunes@defensivethinking.com
Delivery-date: Wed, 26 Jan 2005 20:58:41 -0500
Received: from [64.233.184.204] (helo=wproxy.gmail.com)
by core1.needhosting.net with esmtp (Exim 4.44)
id 1Ctyvg-0007hr-75
for jnunes@defensivethinking.com; Wed, 26 Jan 2005 20:58:41 -0500
Received: by wproxy.gmail.com with SMTP id 55so232476wri
for ; Wed, 26 Jan 2005 17:58:37 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=beta; d=gmail.com;
h=received:mime-version:in-reply-to:references:content-type:message-id:content-transfer-encoding:from:subject:date:to:x-mailer;
b=te21ykymgiVaL6jIa1xOTtdDLmX1Ro6qdXwtcL0XNugDdJ07EyH00j1gncq0V/9uVsKncHozuFXVP52OhLT1pk91Wkws8x8GXxlCoOOj1piXb1sC/CFtxiYRbg6BV
nHhdh1dTnHMiLDmzKctT6QGfbv4xDA/qNENgI/rZzoJQFE=
Received: by 10.54.29.22 with SMTP id c22mr31253wrc;
Wed, 26 Jan 2005 17:58:37 -0800 (PST)
Received: from ?192.168.1.100? ([24.172.104.225])
by smtp.gmail.com with ESMTP id 43sm47035wri.2005.01.26.17.58.37;
Wed, 26 Jan 2005 17:58:37 -0800 (PST)
Mime-Version: 1.0 (Apple Message framework v619.2)
In-Reply-To:
References:
Content-Type: text/plain; charset=US-ASCII; format=flowed
Message-Id:
Content-Transfer-Encoding: 7bit
From: Ralph Echemendia
Subject: Re: Hacking Courseware
Date: Wed, 26 Jan 2005 21:01:09 -0500
To:
X-Mailer: Apple Mail (2.619.2)
See below:
On Jan 26, 2005, at 2:54 PM, JD Nunes wrote:
> Hi Ralph,
>
> I think I found something that might work but I am going to have to
> re-type
> the whole thing so it will take a while. Where are you with Barry on
> all of
> this? Is he going to go for the Hacking and Advanced Pen Test
> material and
> me making changes?
I have already spoken with Barry and can assure you that I will get you
what you need. It may cost a little more.. but I mean very "little".
%% Hey, dun worry hun! Money ain't a problem! JD is rich!
>
> While we are at it, I checked the web site and see that the Adv Pen
> Test
> class is still on there for DC. I am still planning on being there if
> it is
> cool. All I need is a book and a chair. I can also give you guys a
> hand on
> set up or during the class if you want.
Yep it's ON you are more than welcomed to come by, if I need to order
books I will have to let Barry in on the fact that you will be sitting
in, not that that would be a problem.
%% I don't get it. Is he teaching this courses? I'm curious what they
%% teach you during these courses... It's not about hacking for sure!
>
> Finally, are things better with you and Intense? I kind of want to
> stay on
> top of your situation if I can. I have some opportunities that we
> might be
> able to work together on if you end up jumping ship. I know you said
> March
> but I would just like to have an idea.
Ehh.. ya know OK, it's paying the bills;-)
%% "Heey, I want a joooob!"
Send me what you have and I will move on it and get it DONE!
./ralphe
%% What does your signature means, slash dot ralphe? "Hey hackers,
%% own ralphe?" You think being owned and not realising is cool?!
%% It's *NOT! Just ask JD, see what he thinks.
>
> Talk to you later!
>
> -John
>
> -----Original Message-----
> From: Ralph Echemendia [mailto:ralph.echemendia@gmail.com]
> Sent: Friday, January 21, 2005 8:52 PM
> To: jnunes@defensivethinking.com
> Subject: Re: Hacking Courseware
>
>
> Let me see what I can dig up here. I am sure I have something.
>
> ./ralphe
>
> On Jan 20, 2005, at 1:08 PM, JD Nunes wrote:
>
>> Dude...I am having a horrible time finding a template for a contract.
>> Do
>> you know anyone that might have one? I know that Barry is going to
>> give
>> anything I send to the legal bodies for review. So I guess it needs
>> to look
>> somewhat respectable.
%% Utterly boring. I am bound to shoot myself. Thanks John!
>>
>> John
>>
>> -----Original Message-----
>> From: Ralph Echemendia [mailto:ralph.echemendia@gmail.com]
>> Sent: Monday, January 17, 2005 11:15 PM
>> To: jnunes@defensivethinking.com
>> Subject: Re: Hacking Courseware
>>
>>
>> Hey you got anything, contract-wise that we can get going with?
>>
>> ./ralphe
>>
>> On Jan 7, 2005, at 7:29 AM, JD Nunes wrote:
>>
>>> You can get me on my cell phone 703-593-1579. I have a 1pm flight
>>> out
>>> of Phoenix today and will have an hour in Atlanta at about 7pm.
>>> Won't
>>> be home till about 10pm tonight but will be around all day tomorrow.
>>>
>>> Thanks
>>>
>>> John
>>>
>>> -----Original Message-----
>>> From: Ralph Echemendia (ldablo) [mailto:ldablo@bellsouth.net]
>>> Sent: Thursday, January 06, 2005 3:27 PM
>>> To: jnunes@defensivethinking.com
>>> Cc: rechemendia@intenseschool.com
>>> Subject: Re: Hacking Courseware
>>>
>>>
>>> Yo,
>>>
>>> What's the best number to reach you at today?
>>>
>>> ./ralphe
%% Ralph, you're such a loser! Change this signature, you silly!
%% It surely doesn't make you look "cool" or "geeky".
>>>
>>> On Jan 5, 2005, at 1:27 PM, JD Nunes wrote:
>>>
>>>> Ralph,
>>>>
>>>> Please give me a call whenever you have a chance. I need to discuss
>>>> licensing the hacking courseware. It has suddenly become urgent.
>>>>
>>>> John
>>>>
>>>
>>>
>>
>>
>
From hlgreenblatt@internetworkdefense.com Wed Jan 26 22:26:07 2005
Return-path:
Envelope-to: jnunes@defensivethinking.com
Delivery-date: Wed, 26 Jan 2005 22:26:07 -0500
Received: from [66.118.156.201] (helo=ns1.webmasters.com)
by core1.needhosting.net with smtp (Exim 4.44)
id 1Cu0II-0001wn-OS
for jnunes@defensivethinking.com; Wed, 26 Jan 2005 22:26:07 -0500
Received: (qmail 31202 invoked from network); 27 Jan 2005 03:25:52 -0000
Received: from unknown (HELO 13CFB6DD7F03432) (66.92.236.221)
by ns1.webmasters.com with SMTP; 27 Jan 2005 03:25:52 -0000
Reply-To:
From: "H. L. Greenblatt"
To:
Subject: RE: student introduction
Date: Wed, 26 Jan 2005 22:26:05 -0500
Organization: InterNetwork Defense
MIME-Version: 1.0
Content-Type: text/plain;
charset="US-ASCII"
Content-Transfer-Encoding: 7bit
X-Mailer: Microsoft Office Outlook, Build 11.0.5510
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180
thread-index: AcUD37zL1fHOIvfVRqyh4z0Q0cRtEAAP38Pw
In-Reply-To:
Yo,
Not sure if you got the right Larry. Big goofy CISSP instructor with a
Chinese girlfriend, Charlene Wu. I am still teaching 90% for Intense
School, and Ryan was in an Intense class in Fort Lauderdale last month.
%% Yeah, all CISSP are fat, goth and havin gook gf. Maybe because gook
%% bitches are used to small dicks?!
Dude, I cc: Ryan in the first mail. Between me and you, Ryan is extremely
bright but does have a severe vision handicap. His mother came to class to
help him take notes. Dude, mom is very extremely hot and very sweet. I am
not sure if Ryan's sight allows him to understand just how incredible his
mom's assets.
%% Haha, come on! Stop hittin on that kid's mom! He's just an autist (i hate
%% the word 'retard') trying to learn how to pentest, just like the rest of
%% you. I'm pretty sure Ryan's mom would rather fuck young meat than more-meat
%% like you, pig! Altho Ryan's vision is bad and he's kinda autistic, I hope he
%% sees what you think about his mom!
-----Original Message-----
From: JD Nunes [mailto:jnunes@cox.net]
Sent: Wednesday, January 26, 2005 2:49 PM
To: hlgreenblatt@internetworkdefense.com
Subject: RE: student introduction
Hi Larry,
Hows things going? Haven't heard from you in a while. Whatcha doing now
days? Are you still working for Mile2? I haven't done any job for them
since about May. Just kinda bouncing around on contract work for the most
part.
%% "Man, I hate those fuckers! They fired me and now I can't pay my bills!"
%% You are pathetic, Nunes! PHC will fuck you up for good!
I'll shoot this guy an email from my gmail account. Who were you teaching
for when you had him as a student? Also, was it the EC Council material or
something else?
%% *yawn*
Take care and talk at ya later.
John
-----Original Message-----
From: H. L. Greenblatt [mailto:hlgreenblatt@internetworkdefense.com]
Sent: Tuesday, January 25, 2005 11:26 AM
To: jnunes@cox.net
Subject: student introduction
Yo,
Hey John, I want to introduce you to a student of mine, Ryan Coleman. Ryan
was hoping to correspond with you.
%% Is this the Ryan with the hot mommy?
Ryan is extremely bright, in his early twenties and looking for a break into
the field of security testing. I am certain anyone who hires Ryan will be
glad they did.
%% Yep, I am sure they will. Another autistic kid trying to join the infosec
%% How many of you are left, outhere?!
-----Original Message-----
From: Ryan Coleman [mailto:straticus1@gmail.com]
Sent: Thursday, January 13, 2005 7:52 AM
To: hlgreenblatt@internetworkdefense.com
Subject: Hi Larry
%% Oh God! The autistic-Ryan emails fat-goth-gook-fucker!
Hey Larry,
It's me, Ryan, from class just emailing you to say hi, and ask you if
you could introduce me to John Nunes, I've read alot about this guy
%% "I would let *HIM* to stare at my mummy, not you! Go away!"
%% Ain't it sad, Larry?
online, learned about him from Barry, found out he has an email
address at Defensive Thinking (jnunes@defensivethinking.com), and
heard he does work with EC-Council, so after I read that he is in an
%% WOW, really?!
industry I am desperately trying to break into (pen testing) thought
he might be a beneficial person to get to know, could learn alot, and
you never know, So I was wondering if you could introduce me to this
guy, it might be better than me just emailing him out of the blue --
let me know what you think!
%% OK, let me see if i get this straight: an autistic kid is trying to
%% 'break into the industry'; his mom is like 50 yrs old but hot (Larry,
%% we've got Ryan's mom pics: you are *SICK*. Someone should shoot you!);
%% Larry wants to shag her; Larry wants JD to shag Ryan; Ryan wants to
%% blow JD and so on. Ain't this a dick sucking contest?
%% Security professionals...
Thanks, see you in class!
Ryan
%% Will you bring your mom? If you do, we'll be attending that class just
%% to have our cock's drained out of jizz by a 50yr old mom. Or not.
From primarily@gmail.com Thu Jan 27 14:50:28 2005
Return-path:
Envelope-to: jnunes@defensivethinking.com
Delivery-date: Thu, 27 Jan 2005 14:50:28 -0500
Received: from [64.233.170.192] (helo=rproxy.gmail.com)
by core1.needhosting.net with esmtp (Exim 4.44)
id 1CuFeu-0001wo-IW
for jnunes@defensivethinking.com; Thu, 27 Jan 2005 14:50:28 -0500
Received: by rproxy.gmail.com with SMTP id c16so377753rne
for ; Thu, 27 Jan 2005 11:50:29 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=beta; d=gmail.com;
h=received:message-id:date:from:reply-to:to:subject:mime-version:content-type:content-transfer-encoding;
b=qgpmE5aqxzHzfGT1vTxzAC0ib0bn7ekGZHLKvNHKqfWq8gK1EdDrXTWJC+z5cxjcVX8vTFiQgQDnvhPHzBcep+jO7gnum6DwvLjXPz5
IcQAuc5G0vbr3TkOB7fHDwddNTAR4Qkqz+ZF6xpe+seMat3L0Piy22xRdDGvmNTfqC1A=
Received: by 10.38.162.16 with SMTP id k16mr244774rne;
Thu, 27 Jan 2005 11:50:29 -0800 (PST)
Received: by 10.38.162.52 with HTTP; Thu, 27 Jan 2005 11:50:29 -0800 (PST)
Message-ID: <712ea230050127115031d122f2@mail.gmail.com>
Date: Thu, 27 Jan 2005 14:50:29 -0500
From: Primarily
Reply-To: Primarily
To: jnunes@defensivethinking.com, jnunes@cox.net
Subject: Trying to get through
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
I hope this works
%% No, it didn't. It got to PHC!
From primarily@gmail.com Thu Jan 27 14:52:02 2005
Return-path:
Envelope-to: jnunes@defensivethinking.com
Delivery-date: Thu, 27 Jan 2005 14:52:02 -0500
Received: from [64.233.170.193] (helo=rproxy.gmail.com)
by core1.needhosting.net with esmtp (Exim 4.44)
id 1CuFgQ-00020d-K5
for jnunes@defensivethinking.com; Thu, 27 Jan 2005 14:52:02 -0500
Received: by rproxy.gmail.com with SMTP id a41so560152rng
for ; Thu, 27 Jan 2005 11:52:03 -0800 (PST)
DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws;
s=beta; d=gmail.com;
h=received:message-id:date:from:reply-to:to:subject:mime-version:content-type:content-transfer-encoding;
b=Us4vnY8pF02AurYhjr7Y99P4AjAWGjo3YqWEBn6aHU5HJBqcmBpTEwLhDznONgjrY9sItSQu/IMytmhJC8mdHxBEQxE7O35uY8MnuZ
7uFZVAI9L6Ukr4sJ40hNldB37NNQwJKBM5EyzqCc1ZOpCsrw7yvsp9u1h3JqzWErqZgu0=
Received: by 10.38.12.21 with SMTP id 21mr67584rnl;
Thu, 27 Jan 2005 11:52:03 -0800 (PST)
Received: by 10.38.162.52 with HTTP; Thu, 27 Jan 2005 11:52:03 -0800 (PST)
Message-ID: <712ea23005012711527a93d334@mail.gmail.com>
Date: Thu, 27 Jan 2005 14:52:03 -0500
From: Primarily
Reply-To: Primarily
To: jnunes@defensivethinking.com
Subject: Another try
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Think we have found the problem now!
%% Yeah, yeah, you did. And we did too. And fix it. Now we're stealthrm'ing the hd.
Dear John,
We have some other emails from you but we simply hate whitehat mailing lists. We hate
YOU for being so damn ethical. We have a lot of stuff about you, but we're not sure
wether to release it or not. Oh, and one more thing: tell kevin we're after him! *giggle*
- Phrack High Council, 2005 AD