SecurityHunk

Many people open there inbox in-order to check their email or send a email and then sign-out but what we do not know that there are indeed lot of things are carried out when we simply send or receive a email.

There is a detail report/history of all those things  that are carried out and are attached with the email.

Yes, I am talking about email headers.They are kept hidden from normal user but we can certainly view it.

These headers comes very handy when tracing email, filtering spams, recording the Ip address of the sender etc. So, let's see what email header is all about and later in the post we will see how to get email header.


What is Email Header?

It is a record/report/history of  the email which covers the path from the sender to the receiver and also contains the vital information about the email servers that it has encountered in its path.

Few emails also contain digital signature to detect the tampering of the email in the path.

What information we can get from Email headers?

As i mentioned above we can get the history of the email and the information on the path the email has traveled to reach us.Lets see what information we can get from it.....
                               
            1.When the sender has composed the message(Date,Time)
            2.When the email was sent from the sender's PC to the email server.(Date,Time)
            3.When the email was sent from the email server to the intended receiver.(Date,Time)
            4.The type of protocol used in the entire path.
            5.The PC of the sender can be identified from the Header.
            6.The IP address of the sender but not always.
            7.The type and the number of digital signatures on the email I mean the type of algorithm.
            8.What type of email-client the sender has used to send the email
            9.The ISP of the sender. 
           10.If any third party is using any tracking means.

How to view Header of an Email?

Here I have listed out not all but few of the web mail providers and email client using which you can get email header.

1.Gmail: Login in a standard version >Open email of your choice >Click the down arrow next to reply >Then select show original.

2.Yahoo: Login >Select the desired email >Click on action drop down menu >Select view full header.

3.Hotmail: Login >Select Inbox >Right click on the desired email >Select view message source.


1.Outlook Express: In order to view email header in outlook Open it >Select  the desired email from Inbox >Right click on it and select Properties >Details.

2.Mozilla:Open it >Open the desired email > Click view menu >Message source.

How to read an Email Header.

Here I have taken the example of my Gmail account to explain, we will see how to view email header in gmail.

As mentioned above we first need to open up the header of  any desired email as shown below.

(Click on the image to zoom it.)

 This is what you will get in a new window as shown below.

(Click on the image to zoom it.)

As you can see i have divided the whole header into 3 sections.It is worth mentioning that a header is always analyzed in bottom to top approach.This is because most of the vital informations about the sender is there at the bottom.You can say in the above image section1 is for destination mostly and section3 is for source mostly.

Section 3:

(Click on the image to zoom it.)

MIME-Version:1.0:MIME stands for Multipurpose Internet Mail Extension. It tells about the types of attachments in the email.It allows to send sound,graphics etc.Here the Mime-Version field shows that it is currently in 1.0.

Received:by :It show the time and date the email reached the Gmail server.

In-Reply-to: and References : Both are same,as the name shows it means whether the sender has sent an reply to the past message or is a direct new message.If it is a reply message then it contains the reference of the past message.This is an unique number.

Message-ID:This show the system from which the email has originated,I mean the senders's PC.It can be changed or forged easily.This is also a unique number.

To: and From: It gives the sender's and receivers email-id.

Content type:What type of content is there in the email ie. text or image or anything else.
Section 2:

(Click on the image to zoom it.)

What is DKIM-Signature?

DKIM(DomainKeys Identified Mail) is a digital signature put on every email we send or receive through email servers.It is used because the emails cannot be tampered or altered in its path.This mechanism is also used in spam filters as spam do not have any digital signature.

In the above image there are certain values let me explain.
                  v=Version
                  a=The algorithm used by Sender or Originating Web mail provider.
                  c=canonicalization algorithm of header and body.
                  d=Sender or Originating Web mail provider.
                  s=Selector
                  h=Contains the list of all the digital signature done on this email.
                  bh=Body hash
                  b=Digital signature of header and body.

Section 1:

Delivered-To:It contains the email-id of the receiver.

Received:by : You can see there is a  2 second difference in time between the "received by:" in section 3 and section 2.It shows the time and date the email reaches the gmail server.

Return-Path: The sender's email-id.

Received :from :Specifies the Ip address of the sender generally in "[ ]" but in gmail it is masked by the gmail server address.

This video explain in detail the insights into what is Email Header using Mozilla Thunderbird client.



If you find this post worth reading then do drop a comment,it will be appreciated.

Recently Google has reported a XSS vulnerability security issue with its Web Optimizer code.So,it has requested its users to update the code in their site immediately.Though the level of threat is low but it is recommended to update the code.The  attacker may exploit this vulnerability and execute malicious code in the victim's site but the attack can be successful  if the attacker has earlier compromised  the web browser.So, friends do update your code immediately and create a new experiment of web optimizer.

Below I have posted the screen shot of the mail that google has sent to my inbox with this alert.

Email: www.securityhunk.com

Gmail is again hit by a new phishing scam, which is warned by the Security researchers from Sunbelt.This is almost similar to the old phishing scam that is using a spoof page(a.k.a fake page) along with the blend of social engineering inorder to fool the users.Dont know what is phishing visit here.

What is new about this scam?

As i mentioned earlier that it is almost similar to the old one but the only striking difference is that it has got an attachment along with a mail.The attacker has used the skills of social engineering to make the user believe that the mail is from the "GOOGLE" itself.Take a look at the mail below......

(Source:Sunbelt.blogspot.com)

The attach file is in Html format called as Gmail_access.html,which is a fake page of Gmail login page having  all the elements and graphics exactly similar to the original page.Take a look at the image below.

(Source:Sunbelt.blogspot.com)

How it Works?

Check the source code of the attachment(html file),use ctrl + f  to find "action=" use without quotes then u will find something different to that of the original page.

action="http://www.wtwener.com/e107_themes/serviceloginAuth.php"

which means when the user enter any values in the login field of the fake page(attachment) then it sends the values to a "serviceloginAuth.php" on an external domain for the attacker and the website under this domain is registered to someone in Sremska Kamenica, Serbia-said Tom Kelchner of sunbelt.

(Credits:sunbelt.blogspot.com)

A Beginners Guide to Ethical Hacking



Download
Why you should buy this book?

• Are you interested in ethical hacking but donot know where to start then this book by Rafay Baloch is the most reliable source and i too also recommend it. 
• "A Beginners Guide to Ethical Hacking" is really a great book for newbie hackers those who are really curious for ethical hacking and lead them to become a master hacker.
• Amaze your friends with awesome hacking tricks from this book and apply them to real world situation.
• It will help you learn how to make your computer secure and free from future hack attacks.
• This book will certainly make your dream come true.
• This book is a unique of its kind and you can have you copy from the vendor.

Bonus 1:  



1000 Hacking Tutorials 

For a limited time only , with the purchase of “A Beginner’s Guide to Ethical Hacking” you will receive the following bonus package! 1000 Hacking Tutorials contains 1000 of the best hacking tutorials of 2010 leaked on the internet!

Set of Phishers

With the purchase of A beginners Guide to Ethical Hacking you will also get a set of 30+ phishers(Fake login page) already created by Rafay.

Its Decision Time!
Now you have heard it all so what are you waiting for.

• This book does not demand any prior knowledge about Hacking. So if you are a newbie to the concept of hacking and want to master it from the basics, then this book is for you.
• The information given in this underground handbook will put you into a hacker’s mindset and teach you all of the hacker’s secret.So what are you waiting for! Grab "A Beginners Guide to Ethical hacking" and start your Hacking journey.

Note: A Beginners guide to Ethical Hacking is in PDF format to make it easy for you to apply the information in real world.

A Beginner's Guide to Ethical Hacking

Regular Price $67.00  Today's Price $20.00

Download Me

Note: Earlier CompufreakS.blogspot.com is now SECURITYHUNK.

Spying on Remote PC can be done in many ways....but today we are going to see how it can be done using RATS(Remote Administration Tools).This tutorial is a general one which can be followed for installing server of all types of RATS.Only thing that you have to notice are the terms associated and data that are to be filled.

This is a Black Hat Tutorial so I would suggest my readers to go through the DISCLAIMER before reading the tutorial.

For carrying out this attack you will need......

a)A Remote Administration Tool (Here i will be using Spy Net2.7Beta)

b)A FTP service and a host under No-Ip.com (How to?....Read here )

Note:Click on the images to Zoom them.

 So lets start......

1.First download the RAT,here i will use Spy Net 2.7Beta.

Purposefully I have not given the download  link,you can take the help of our best friend.... "Google"

2.Run it and click the "START  BUTTON"select your suitable language as shown in the image below.

3.Then click on "CREATE SERVER " and give a suitable name to it as shown in the image below.

4.After step 3. a user with the desired name has been created,now select that and click on "FORWARD"as shown in the image below.

5.Now you will be guided to the server installation process,so fill in the details as shown in the image below...inorder to know  how to fill  read this.


6.After that hop up to the next tab and fill that excatly as show in the image below,i have chosen "svchost.exe" as these are found in multiple in  MS boxes..... lol.

7.The next tab is the message...which means if  you enable this then that message will pop-up when the server is run on the victim's computer,here I am not using it.

8.Then open up the keylogger tab and fillup as shown below but in step 2. fill as said  described here.

9.Now hop up to "Create server" tab and fill as shown in the image below.

10.Now since the server is ready so make it FUD(Fully UnDetectable) by using crypter and you may bind it to some other file using a binder and scan it with novirusthanks.org(do not click on distribute option.)This part will be covered in detail my later post.

For Countermeasures read from below.....



( RATS:Remote Administration Tools & Spying on Remote PC )


If you find this post worth reading do drop a comment it will be appreciated...... :)

This is black hat tutorial is for Educational purpose,Compufreaks condemns black hat.(Disclaimer).

IF YOU LIKED THE CONTENT OF THIS BLOG THEN DO "VOTE" FOR IT........

In many of my post I have pointed out the concept of  "Phishing" in  Email hacking,where the attacker sends a fake/spoof  login page to the victim having manipulated the url to create some sort of illusion.Few months back "Aza Raskin" the Creative Lead  of Mozilla Firefox describes  a new form of  Phishing attack called "Tabnabbing" which manipulates the Tab browsing  of the users.

 What is Tabnabbing?

I feel  you can guess the work it does from its name,Tab means "the different windows attached to the same browser" and Nabbing means "to seize something forcefully".In the same way  for Tabnabbing ,when the user has opened up multiple tabs in the browser and after sometime comes back to one of the earlier opened tab then he/she finds that the content,title,favicon of that tab has changed to a login page of any email account or bank  login page....lol.Apart from  manipulating the tabs of the browser the attacker manipulates the memory of the victim because if the user does not remember what  website he/she had open in that tab then  he/she would login to that fake page thinking that it was open by him/her.....lol.

Check out the video to see the demo.



A New Type of Phishing Attack from Aza Raskin on Vimeo.

How does it works?

The main concept behind this is that  the attacker puts a Javascript in the pagesource code which waits for a certain period of delay and then  changes its favicon,title and content.It is more evil if it the script is intelligent enough which means it detect which sites the user visits normally and then accordingly switch to that site using tabnabbing.


Why is online banking is more vulnerable to this?

In online banking you must have noticed that  if you have logged in to the official page and left it idle for few minutes then it is automatically logged out.Due to this feature Tabnabbing is very  handy in attacking users of online banking beacause the users feel that  he/she would have logged in to the bank account and the session has expired.

CounterMeasures:
 I would recommend Mozilla Firefox browser for web access because it has many security addons which are very handy and easy to use.

1.WOT:Marks the websites with colour and warns the users.(Download)

2.NoScript:This addon protects from XSS,IFrames,ClickJacking,stops Javascript.(Download)

3.Safe:Makes SSL  and extended SSL moree visible to user.(Download)

4.Secure Login:It has a feature to enable or disable Javascript and manages the password manger of Mozilla.(Download)

5.PhishTankSiteChecker:It warns the user about a phish attack.(Download)

6.Close all the browser tabs and web based applications that uses browser cache when using online banking.

7. You can also use some Linux Live CD to access internet while using online banking.

Source:http://www.azarask.in/

If you find this post worthy  to read  do post a comment , it will be appreciated.

IF YOU FIND THIS BLOG WORTH READING THEN DO "VOTE" FOR IT........

•   Date and Time he/she has opened the mail.
•  Location of the recipient as per ISP.
•  Recipient IP Address along with portno.
•  For how long the email was read.
•  How many times the email was  read.
•  To whom it was forwarded
•  If it was again opened in a different PC.
•  Url clicks  if present in the message.

How to detect an email has ".readnotify.com" extension and is a tracking email?

1.For detecting this one has to open the mail once but before opening one has to use a proxy server so the mail cannot track the IP Address.

2.Open the header of the email and search for "Received:"there one can find .readnotify.com  extension  and an error message saying that the google could not  find the actual email ID of the sender as shown in the image below.

HP (Hewlett-Packard) investigators used the services of  ReadNotify.com to trace an e-mail sent to reporter Dawn Kawamoto in an attempt to uncover her source in a media link, Fred Adler, an HP security employee, said during testimony before a U.S. House of Representatives subcommittee.

Declaration:The author will not be held responsible for any illegal use of this article.This is only to aware the users the threats they are exposed to.

In my last post I told how to protect your email account but few days back one of my friend asked me how to protect a twitter account so i have come up with this post.The twitter account can be hacked in different methods as under Email hacking.Once the twitter account is hacked it can hit badly to a person's online reputation and cause nightmare by twitting spam links on porn,unfriendly language and vulgar images.I will not make this post a stress to read rather i will prefer making it more pictorial.There are few things one need to follow from becoming fool in the hands of the attacker.Lets start.....

NOTE:Click on the images below inorder to view them clearly.

1.Inorder to avoid Phishing attack or fake login page sent by the attacker always login to your account by typing the login url in the browser as it may also contain some malicious script.





2.Make your tweets private ie. only the people whom you approve as your followers can see your updates.By doing this one can decrease the chance of being hacked by 50%, as the spammers will not be interested since your tweets are private but they look out for public display of tweets.Follow the steps in the image shown below.
3.Be careful while clicking any link in the direct message section as most of them are spams and malicious scripts to lure the user to click on them.You can expand the url  by using a firefox addon ie.DeTiny URL Expander or LongURL.org

A new feature has been added to twitter search(search.twitter.com) to expand an url as shown in the image below.

4.It is wise to link your phone number with your twitter account in device tab
by doing this one can retrieve his/her password incase the email and the account is compromised.

5.Always backup your tweets as it may hurt you once your account is hacked and the attacked has manipulated your tweets.There are few services that allow his feature are

-BackupmyTweets.

-TweetBackup.

-TweeTake.

-Twistory.

6.Always check the authenticity of the application that asks for twitter password before login to it.

7.Many times people forget that to how many applications they have provided the access to their account so,keep an eye on it.You can revoke the access of an application by clicking on the revoke link as shown in the image below.
8.Another very common thing is that one should always use an unique and difficult to guess password because it makes  difficult on part of the attacker to guess.

Follow these steps and i can guarantee that your account will be 90% protected.


If you find this post  worthy enough to read....then do drop drop a comment it will be appreciated.