Saturday, October 14, 2017

Successful application in UKVI's strict system

I've been recently (~ 2 weeks ago)  given a tier-4 visa study in the United Kingdom:

A post shared by George Chalhoub (@georgechalhoub) on

However, I'd be a liar if I say that the process has been easy or straightforward. In fact, obtaining that visa was a long and tedious process which has cost a lot of money, time, paperwork (and an acceptance at St Andrews).

GO.UK has a clear guide to applying for a tier-4 visa application but it doesn't have all the details and more detailed PDF documents ( > 100 pages) have to be read to make sure you are compliant with all of their guidelines.

What are the most recent UK Visa incidents?

Starting the application 

That wasn't hard because of a new beta system called Visa4UK where you sign up, sign in and apply for a visa application online. There is no need anymore to fill any papers. It is intended to be used by applicants from abroad.

Making the payments

All visa applications require you to pay an amount of 456$, plus an immigration health surcharge of 300$ which totals 800$. The amount is only refundable if you don't attend your visa interview and withdraw your application online prior to your interview time. If your visa application has been unsuccessful, the amount remains nonrefundable. 

Setting up an interview 

Luckily, that was easy as well. After making the payment, you will be able to set up an interview date using the UKVI's web application Visa4UK. I don't have a screenshot anymore of the page but it looks like this (My interview was not in May 2017, illustration picture only):

Degree award delayed

Despite finishing all my courses and requirements at university in July 2017, the university was unable to provide me with a degree telling me to actually wait until September 2017 because of the vote of the Senate. This is clearly an issue as St Andrews University (where I have an acceptance) starts on the 8th of September 2017. I would not be able to catch my university on time. 

Emailing UKVI

At that point, I've had to email UKVI and ask if I can apply for a Tier-4 visa before my degree was officially awarded and the answer was no.

Emailing UKVI again

At this point, I was really desperate; I told them about my issue and that I would be late for St Andrews but the answer was still no:

Postponing the interview 

At that point, I have no choice but to postpone my visa interview until my degree was awarded.

No degree awarded yet 

On September the 2nd, LAU still didn't award me my degree. 

Withdrawing my visa application

At this point, I've decided to withdraw my visa application and I realized it is unrealistic to attend St Andrews anymore which starts on the 8th of September. Even if the visa is awarded (which would take time), I would be very late to register for and attend St Andrews.

Informing St Andrews I'm not attending 

That was done in writing as you see below:

Official Degree Awarded

Finally, the good people of LAU have given my degree on the 7th of September.

Checking another university

At this stage, I've confirmed to the University of Southampton that I'm attending (already had an acceptance) and I've asked them to issue a CAS. The university was set to start on 28 September.

Starting new visa application

That was done quickly and urgently. New payments were set.

Parents joint bank account issue

One of the UKVI's major Tier-4 visa requirements is proving that you can finance yourself. I've had decided to use parent's joint bank account. But it turns out, it wasn't accepted. UKCISA has reported:

It’s important to be aware that according to page 52 of the Tier 4 policy guidance and paragraph 1A(k) of Appendix C of the Immigration Rules you are only allowed to use money held in a joint bank account if you are one of the named account holders.  If you use a joint account that is not in your name then there is a risk that your Tier 4 application will be refused.

Requesting copy of urgent sponsorship letter

So I've had now to urgently request from my partial sponsor Fondation Sesam to send me a letter of partial sponsorship support to provide with my application. And they did quickly:

A post shared by George Chalhoub (@georgechalhoub) on

Registering with TLSContact Beirut

This is UKVI's commercial partner that handles all visa applications and interviews in person. I've had to register there and link application and confirm interview times:

Paying for priority visa

Attending the interview

September 13: I've attended the video interview and submitted my passport and all the documentation required.

Application transferred to UKVI

September 13: The application was transferred for decision.

Application received by UKVI 

September 17: The application was received for decision by the UKVI.

Decision Made by UKVI

September 24: The application was accessed for decision by the UKVI.

Passport ready for collection

September 25: The password was ready for collection by TLSContact.

Visa acceptance letter

I've picked up my password and the letter informing me the visa application has been successful.

What next?

I've left Lebanon in few days to catch up with the University of Southampton.

Tuesday, September 5, 2017

iCloud Trauma: 13,625 images and videos disappear and how I recovered them

Imagine that you wake up one day to find out that 13,625 images and videos have disappeared from your iPhone, iPad, and

This is exactly what happened to my iCloud and specifically iCloud Photo Library. I woke up one day to find out that all of my old images from March 2014 till March 2017 now have disappeared.

I kept refreshing, changing browsers, and researching. The "Deleted Photos" folder was empty. I was screwed.

I even waited a day to check back and still images didn't show up.

Exact thoughts 

"Fuck you Apple, literally fuck you". I couldn't process it. I trusted iCloud and I thought my data was safe there but apparently, it wasn't. Those images were important to me and only some images from 2014 were backed up. The rest weren't.

First attempt to contact Apple Support 

The first attempt to contact their support was an utter failure. I was barely hearing the support personnel (who was located in Egypt and speaking Arabic). The call disconnected before I articulated my problem and they didn't bother to call me back, they instead sent me this: 

An empty email with a header message saying contact us. Not even a body message. 

Using forensic tools

At that point, I completely gave up on Apple and I started looking for online help to fix my issue. I found a great forensic tool called Elcomsoft phone breaker for Mac:

 What this tool claimed to do was:

"Elcomsoft Phone Breaker can extract photos and videos stored in the user’s iCloud Photo Library. In addition to existing files, Elcomsoft Phone Breaker can extract media files that have been deleted from the Library during the past 30 days. Selective downloads are possible by specifying which user-created albums to download."

Exploring Elcomsoft PhoneBreaker

I was really skeptical about this software so  I decided to give it a try, I have turned off two step authentication temporarily and logged in via their program to see this interface:

I was really happy that now my missing images are appearing in "Deleted". On, the deleted folder was empty. However, they were being displayed in this software.

Purchasing Elcomsoft PhoneBreaker

At that point, Elcomsoft has proven to be working (by allowing me to recover only up to 10 pictures). I had to purchase the software for USD200.  

After a few minutes, I received my registration code:

Starting the Download:

This was the most chaotic part. The download took almost a day despite having an internet speed of 1.5 MB/s. The download has interrupted at least 20 times (due to poor internet connectivity or iCloud issues/restrictions).

However, I realized later that the download is resumable because the pictures are downloaded in chunks inside a hidden folder called .chunks. The contents of the folder look similar to this:

So every time the download interrupted, I re-downloaded it using the same directory that had .chunks, so the download resumed instead of restarting. At the end of the day, I had my images downloaded. 

Images had no timestamp

Images were mixed without a date, so they lost they lost their chronological order. I realized that at that point, I have to contact Apple again.

Another attempt to contact Apple 

This time I couldn't even submit a request:

Final attempt to contact Apple 

The next day, I kept trying to contact support until they managed to call me. This time, finally, I was able to talk to a support technician from Apple. Apple performed their security checks and when they have done that, they have informed me that they will be able to recover them.

Their support was really great. 

Images reappear in Recently Deleted

After the call ended, support was able to restore images to "Recently Deleted" but not to "All Photos".

Support attempts to call me again 

Only to inform me this time that images have been recovered but they are in the "Recently Deleted" folder and I had no move them back to other folders to prevent the permanent deletion of them in 30 days. 

Case Closed

Images have been recovered. I moved on. 

So, what caused this?

It is not really known what caused the images to be removed. But I believe, when I have switched from my old to my new mac, I used Apple's Migrate Assistant, which moved the old Macbook data to the new Macbook. Later on, I activated iCloud Photos. So the contents of the Photos app were synced (Which had few images only).

I think that iCloud Photo Library thought that I have removed the images and thus removed them from iCloud Photo Library and consequently all of my devices.

What is the lesson?

Never trust the cloud and specifically iCloud. Your data isn't safe and might be removed forever. Physical encrypted backups for everything are a must.

Final thoughts

It was important to deal with this situation calmly, I will not stop using iCloud Photo Library even though it fucked up; but I will increase my backups with those photos. I have already downloaded Google Photos and I will be allowing the app to store all of those images. I will be also having physical and encrypted backups of those images.

Sunday, July 16, 2017

Challenge: No Internet & Cell Phone For 7 days

I've known this blogger since I was very young. Inspired by Leo Babauta's post "A Month With Limited Internet, & Now No Cell Phone", I have decided to go offline for 7 days. It believe it is an important challenge. Similarly to Leo Babauta, I:
  • Make my living on the Internet.
  • Watch movies on the Internet.
  • I receive my mail on the Internet.
  • I manage my academic duties on the Internet.
  • Study on the Internet.
  • Listen to music on the Internet.
  • Practice programming on the Internet. 
  • Socialize on the Internet.
  • I pay my bills on the Internet.
  • I make my purchases on the Internet. 
  • Backup my data on the Internet.
  • And so on...
I don't consider myself as a person struggling with internet addiction, but as a person who spends a lot of time online and sees the Internet as something that has of extreme value and importance in my life.

So, from Monday, 17th July till Sunday, 23rd July, I will not be connected to the Internet and my phone will be turned off. They will be out of reach and if possible out of the house to avoid the temptation. I will be writing down what happens every day, and in addition to not being connected to the internet, the challenge includes:
  • No SMS or chatting of any kind.
  • No movies or series of any kind.
  • No listening to music of any kind.
  • No use of laptop of any kind.
  • No use of cell-phone of any kind.
  • No use of television of any kind.
As mentioned above, the challenge will go for 7 days and in addition to that, it is a "cold turkey" challenge. Cheating is not allowed nor tolerated and would mean the challenge has failed.

Monday, July 3, 2017

Recovering a hijacked Facebook account

I can without a doubt confirm that the most hijacked and hacked accounts worldwide belong to Facebook. I have been asked myself to recover more than 15 accounts belonging to my friends or mutual friends. I don't succeed most of the time.

For example, my best friend's girlfriend had her account hijacked 1 month ago. The girl noticed the change one month later. I was asked to remedy the situation, I was having trouble even locating her account, but when I did nothing could recover her account back. The hijackers set up trusted friends, new email, new phone, new photos and even a new name.

Recently, my friend's account was hijacked and I was asked to recover it. It was an immensely important account used to conduct business and had chats were supposed confidential, so I wasn't taking it lightly.

The password's been obviously changed and the email address (Hotmail) hijacked and two-step authentication set up (Confirmed from Hotmail's account recovery process). So, recovering the account was pretty much a dead-end confirmed with Facebook's horrid message:

So, I was really stuck. At this point, there is was no direct way to contact Facebook regarding hacked accounts. You can directly contact them for impersonation or copyright issues but not for hacked accounts. 

Then, after that, I have asked the victim to find any web browser where he's logged in on Facebook in the past (with the old password), screenshot he's sent:

After he has pressed on "click here", he has indicated that the Facebook account has been compromised, next photo:

After the victim clicked on "Secure My Account", he was taken to this page, the victim's Hotmail account was compromised so he clicked on "No longer have access to these?":

And surprisingly, and taken to this annoying and useless page, the victim has clicked on "I cannot access my email account":

Then, Facebook asked for a new email address:

At this stage, an email address that I operate was provided, this page below was shown; however, this page is not accessible for everyone. The URL for this page is the following but apparently will not be enabled for anyone unless they went through the recovery process (from a browser that they have logged in on in the past):

After the ID has been provided, Facebook Support directly sent me an email since the victim set up an email of mine as the contact email for the resolution of the issue:

Since the victim has uploaded his ID, I have briefly described the issue to Facebook:

One day later, the account was recoverable. Win:

But we were not done yet, I've had to reverse the damage. First, I've had to invalidate the old email and add another email for the victim. At this point, I've set up an email for him from my domain name and added it to his Facebook. The email had two-step authentication configured on it as well as a complex password, and no matter what I can recover it:

The email was confirmed:

Then, the account was logged out of all the devices: 
Added phone numbers, emails and apps were all removed:

Recent activity was checked as well for malicious posts added:

That's it, the account was recovered and two-step authentication was activated now; a step the victim didn't know existed in the first place. 

Friday, June 30, 2017

How to get the url of the currently playing video of a playlist in JWPlayer 7?

In case you are a JWPlayer fan (like me), you will most probably reach a point where you'd have to use their API. I am talking mostly about the "JW Player JavaScript API Reference".

I have recently been trying to get all of the sources (.mp4 files of the same video, each with different quality) of the currently playing video item from a playlist with multiple videos (2 or more video items). I have searched a lot online no how to do that but no real help was provided as you see in the link below:

How do I get the filename of the currently playing item from a playlist containing more than one?

But nothing was helpful, so I had to dig through JWPlayer's API and find out myself how to do it in the Playlist section here. It is definitely very easy and the trick is to simply under their API and use it properly. The code uses JQuery so make sure you import it.

Here is the full code (playlistVideoLinks.js):

Here is the minified code (playlistVideoLinks-min.js):


Thursday, June 29, 2017

Can you really hack a Chromebook and get 100K from Google?

It has been almost a year since the search and artificial intelligence giant just announced on its Blogger blog that it is are willing to pay USD100,000 to whoever can hack its Chromebook. In a blog post called, Get Rich or Hack Tryin', Google said:
Increasing our top reward from $50,000 to $100,000. Last year we introduced a $50,000 reward for the persistent compromise of a Chromebook in guest mode. Since we introduced the $50,000 reward, we haven’t had a successful submission. That said, great research deserves great awards, so we’re putting up a standing six-figure sum, available all year round with no quotas and no maximum reward pool.

In other technical words, 100,000USD is to be given to whoever can hack its operating system Chromium OS that is updated almost daily from the finest and most talented software engineers.

Sounds like a good deal, yeah? Actually, not.  It is worth noting that Google set extremely hard rules and the chance of winning the amount is close to 0. Yes, it is possible to hack a Chromebook but your chances are close to 0. Here is more information about the reward:
We have a standing $100,000 reward for participants that can compromise a Chromebook or Chromebox with device persistence in guest mode (i.e. guest to guest persistence with interim reboot, delivered via a web page).

What does it mean?
  • You need to find a bug in Chromium OS's sandboxing secure mechanism that has been evolving for four years. Sandboxing ensures that each Chrome Extension (they call them apps) is run in a restricted environment and is sandboxed (quarantined, imprisoned). In other words, you need to create a Google Extension and from that extension, you need to locate a bug in Chromium OS, if it does exist I assume.
  • Once you find this invisible bug, you create an extension that would take advantage of the bug so that it would escalade access and escape the sandbox. All that, you need to in Guest mode.
  • Once you escape the sandbox, you need to find a second bug that would allow you to tamper with the system and corrupt its files. That is, first, you need to find a third bug that would allow you to access the developer's mode from the guest mode.
  • One you gain access to the developer's mode from the guest mode, you need a way to break the administrator account inside of the "Linux-based" operating system from a non-privileged account.
  • Hold on, we're not done yet. It needs to be persistent. That means, once you edit the operating system files, you need to tamper secure boot scripts as well, which double checks the operating system files on boot to see if they were tampered with.
The hack, if found, is probably worth more than USD10,000,000 in the black market, the odds of getting a Chromebook hacked from the "guest" mode is about the same odds of winning the lottery. If you're looking for some quick cash, you might as well go buy a lottery ticket rather than go get a Chromebook and attempt the hacking.

The USD100,000 is just a tiny small amount from Google's pocket, but most importantly, it is a guarantee from Google that their Chromebook is safe, as long as no one wins the bounty, Google would smile and double the amount whenever they want.

Wednesday, June 28, 2017

A Hacker's Manifesto [Full Essay]

In few months, A Hacker's Manifesto will turn 31 years old. In honor of this essay, I will repost it on my blog. The Hacker's Manifesto is known as The Conscience of a Hacker. Date released is in January 8, 1986 and the author is The Mentor.

Another one got caught today, it's all over the papers. "Teenager Arrested in Computer Crime Scandal", "Hacker Arrested after Bank Tampering"...

Damn kids. They're all alike.

But did you, in your three-piece psychology and 1950's technobrain, ever take a look behind the eyes of the hacker? Did you ever wonder what made him tick, what forces shaped him, what may have molded him? I am a hacker, enter my world...

Mine is a world that begins with school... I'm smarter than most of the other kids, this crap they teach us bores me...

Damn underachiever. They're all alike.

I'm in junior high or high school. I've listened to teachers explain for the fifteenth time how to reduce a fraction. I understand it. "No, Ms. Smith, I didn't show my work. I did it in my head..."

Damn kid. Probably copied it. They're all alike.

I made a discovery today. I found a computer. Wait a second, this is cool. It does what I want it to. If it makes a mistake, it's because I screwed it up. Not because it doesn't like me...

Or feels threatened by me...

Or thinks I'm a smart ass...

Or doesn't like teaching and shouldn't be here...

Damn kid. All he does is play games. They're all alike.

And then it happened... a door opened to a world... rushing through the phone line like heroin through an addict's veins, an electronic pulse is sent out, a refuge from the day-to-day incompetencies is sought... a board is found.

"This is it... this is where I belong..."

I know everyone here... even if I've never met them, never talked to them, may never hear from them again... I know you all...

Damn kid. Tying up the phone line again. They're all alike...

You bet your ass we're all alike... we've been spoon-fed baby food at school when we hungered for steak... the bits of meat that you did let slip through were pre-chewed and tasteless. We've been dominated by sadists, or ignored by the apathetic. The few that had something to teach found us willing pupils, but those few are like drops of water in the desert.

This is our world now... the world of the electron and the switch, the beauty of the baud. We make use of a service already existing without paying for what could be dirt-cheap if it wasn't run by profiteering gluttons, and you call us criminals. We explore... and you call us criminals. We seek after knowledge... and you call us criminals. We exist without skin color, without nationality, without religious bias... and you call us criminals. You build atomic bombs, you wage wars, you murder, cheat, and lie to us and try to make us believe it's for our own good, yet we're the criminals.

Yes, I am a criminal. My crime is that of curiosity. My crime is that of judging people by what they say and think, not what they look like. My crime is that of outsmarting you, something that you will never forgive me for.

I am a hacker, and this is my manifesto. You may stop this individual, but you can't stop us all... after all, we're all alike.

Sunday, April 30, 2017

I just recieved one of the most sophisticated phishing attacks ever

I am not a fan of hijackers and phishing criminals. But social engineering has become the most common to crack, target and steal any online account. Those hijackers either lack the sufficient skills to penetrate a system or the system is too tedious to penetrate or hack; thus they resort to sending phishing attacks. When you send a phishing attack, you can creative as much as you want and the limit would be just the sky. In this case, they started by creating extremely identical pages which is an easy step:

    Real Apple Login Page:

    Fake Apple Login Page:

But moving on, surprisingly, the phishing link was Yes, I was extremely surprised but it turns out that their phishing attack had used unicode characters.

    Real Apple Phishing Link:

    Fake Apple Phishing Link:

Ironically, the phishing website was linking non-https images but it was detectable by chrome and not only that, they could not fake the EV Certificate which says "Apple Inc.". Looking at both source codes and comparing them confirmed the phishing attack.

After adding dummy data, a two-step authentication page was opened where the attackers have assumed I have set it up. They did not have my mobile number or my devices so they asked me to add a mobile number (which doesn't happen on a real apple login page). If I had inserted correct login information, their system would have sent me the verification code and I would have given it to them and bingo they would have accessed my Apple ID.

This is one of the best phishing attacks I have ever received, I was really impressed by it. Even the spoof email ( had bypassed Outlook's spam filters and went into my inbox. But the formatting of the email really looked suspicious. They succeeded in gaining my attention by saying that a purchase has been made from my account.


Tuesday, April 11, 2017

How I built an .exe program that secretly copies source code in the clipboard

My friend recently asked me to create for him a .exe program that downloads the source code from the internet and copies it to the clipboard. Source code can be anything such as Java, PHP or Python. Without doubt, the program would only work on Windows machine. My friend also wanted:

1. The program to retrieve the code from an URL which links to a text file.
2. The program should work silently, doesn't print anything on success.
3. The program should handle and catch exceptions.
4. The program should select one out of three.txt files based on users keystroke.
5. The program should be compatible with Windows 10.
6. The program should look like a calculator.

I have found the request very fun and decided to do it. C# would be a great and excellent tool for this, so I have download Microsoft Visual Studio C# 2008 for this task. I was taught C# and C++ on Visual Studio 2005 and 2008, so I really do not know the recent versions of Visual studio.

First, I have downloaded from the internet three sources codes for my friend in Java: BucketSort, RadixSort, and MergeSort. And I have uploaded them into my Google Cloud bucket.

So, I have three public URLs.

Then, I have started by downloading and installing a Visual Studio C# 2008 from this link and created a new project. On my machine, it was installed in French for some reason, but I was too lazy to fix it.

A default form is created by Visual Studio, so I had to rename it to form to Calculator and changed its icons. I also made sure the form doesn't resize by twisting the settings. So, it looked like the image you see on the left.

Now the fun part, our program. In the source of your form, I imported the necessary libraries.

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.Net;
using System.Windows;

Then, inside the constructor of the Calculator, I have created a key event listener. What this means is that if you press any key while the .exe is running, the event listener will be called. So the constructor looked like this:

public Calculator()
    this.KeyDown += new KeyEventHandler(tb_KeyDown);

What's left now,  doing creating the function tb_KeyDown and making it accept some arguments. Function looked like: tb_KeyDown(object sender, KeyEventArgs e).

Now, that code is inside the function, I have captured the keystroke, then decide to which links it belongs. So, if user presses on B, the would be copied; similarly for M (MergeSort) and R (RadixSort).

string dumb_key = e.KeyCode + "";
string link = "";
if (dumb_key == "B")
     link = "";

if (dumb_key == "M")
    link = "";

if (dumb_key == "R")
    link = "";

Now, I had to download to URL and put it in the clipboard. For that, you need to create an object of the WebClient class:

WebClient client = new WebClient();

Then download the link:
Byte[] pageData = client.DownloadData(link);

And put in a string (With the formatting and breaks):
string pageHtml = Encoding.ASCII.GetString(pageData);

Then, put it in the clipboard:

Then, the annoying part for me was handling exceptions, so I encapsulated the code in a try/catch clause. Inside the catch clause I handled errors:
//Couldn't connect to the internet.
if (webEx.Status == WebExceptionStatus.ConnectFailure) {
    Clipboard.SetText("Couldn't connect to a network.");

//Catching errors such as: 404, 403 and 400.
if (webEx.Status == WebExceptionStatus.ProtocolError) {
    var response = webEx.Response as HttpWebResponse;
    if (response != null) 
         Clipboard.SetText(response.StatusCode + "");
    else {
         Clipboard.SetText(webEx + "");

    //An unknown error has occurred, just print to the clipboard.
    Clipboard.SetText(webEx + "");

Then, I compiled and ran the program, and everything was working correctly. On keystrokes, the code was copied to the clipboard. I have included the .exe in case you wish to test it. Download it at your own risk.

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.Net;
using System.Windows;
namespace WindowsFormsApplication1 {
 public partial class Calculator: Form {
  public Calculator() {
   this.KeyDown += new KeyEventHandler(tb_KeyDown);
private void Calculator_Load(object sender, EventArgs e) {
  static void tb_KeyDown(object sender, KeyEventArgs e) {
   string dumb_key = e.KeyCode + "";
   string link = "";
   if (dumb_key == "B")
    link = "";
   if (dumb_key == "M")
    link = "";
   if (dumb_key == "R")
    link = "";
   WebClient client = new WebClient();
   try {
    Byte[] pageData = client.DownloadData(link);
    string pageHtml = Encoding.ASCII.GetString(pageData);
   } catch (WebException webEx) {
    //Couldn't connect to the internet.
    if (webEx.Status == WebExceptionStatus.ConnectFailure) {
     Clipboard.SetText("Couldn't connect to a network.");
    //Catching erros such as: 404, 403 and 400.
    if (webEx.Status == WebExceptionStatus.ProtocolError) {
     var response = webEx.Response as HttpWebResponse;
     if (response != null) {
      Clipboard.SetText(response.StatusCode + "");
     } else {
      Clipboard.SetText(webEx + "");
    } else {
     //Unknown error just print to clipboard.
     Clipboard.SetText(webEx + "");
  private void Form1_Load(object sender, EventArgs e) {