WikiLeaks Expose Charges China of Hacking Google

A leaked document passed on to the New York Times by WikiLeaks cites an unidentified Chinese contact warning the US Embassy in Beijing about the Chinese Politburo's involvement in the 2009 Google attack.<br /><br />This news comes as a courtesy of WikiLeaks vault, full of more than a quarter million US Department of State cables, which are confidential documents sourced from US embassies spread all over

WikiLeaks Expose Charges China of Hacking Google

A leaked document passed on to the New York Times by WikiLeaks cites an unidentified Chinese contact warning the US Embassy in Beijing about the Chinese Politburo's involvement in the 2009 Google atta…

Read more »

HTTP SESSION HIJACKING (Cookie Stealing)

<div dir="ltr" style="text-align: left;" trbidi="on">When you log in to your account at a website, your web browser sends your username and password to the website server. The password is first encrypted and then send over the network. Then the server checks the username and password against the database and if they both match then sends to the user's browser a "cookie" (a text which the browser uses for further requests to the web server) but unlike the password the cookies are not encrypted and are sent as it is over the network, this cookies can be easily captured as they travel through the network or a busy WI-FI. The newly released Firefox extension "FIRESHEEP" makes it more easy. Actually so easy that even a total nube can capture this cookies.<br />for more information and to download firesheep visit here <a href="http://codebutler.com/firesheep" target="_blank"><b><span style="color: blue;">FIRESHEEP</span></b></a></div>

HTTP SESSION HIJACKING (Cookie Stealing)

When you log in to your account at a website, your web browser sends your username and password to the website server. The password is first encrypted and then send over the network. Then the server c…

Read more »

HACKING GMAIL AND FACEBOOK ACCOUNTS USING GMAIL SECURITY QUESTION

<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj2YWdEmf1AMD3bM5bR-zBQZ7GnuYAs6XXHFF9bpc203kWF2gGTdTCVr0tGplbrEr2vPs3twH3mB3knLsxigCGaDza2dNUNf6-VXwgc139ZtNyDIy2SguWPTY4XgwTZnkxG_Y2Ece8Ygts/s1600/Untitled.png" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" height="150" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj2YWdEmf1AMD3bM5bR-zBQZ7GnuYAs6XXHFF9bpc203kWF2gGTdTCVr0tGplbrEr2vPs3twH3mB3knLsxigCGaDza2dNUNf6-VXwgc139ZtNyDIy2SguWPTY4XgwTZnkxG_Y2Ece8Ygts/s200/Untitled.png" width="200" /></a><style type="text/css"> <!-- @page { size: 8.5in 11in; margin: 0.79in } P { margin-bottom: 0.08in } --> </style> <br /><div style="margin-bottom: 0in;">I like to check the password retrieval option of different sites and when i was checking out Gmail's option i found and interesting thing. Its not something ingenious or new thing but thought of sharing the observation with everybody so please forgive me if it seemed to you a time waste.</div><div style="margin-bottom: 0in;">So first lets take a look at the Gmail's password retrieval option.</div><div style="margin-bottom: 0in;">So when you click on the 'forgot password' option and provide the email id, in Gmail it gives you three password reseting options. <br /><a name='more'></a></div><ol><li><div style="margin-bottom: 0in;">it sends the password reseting link to your alternate email id, which you had provided during the account creation.</div></li><li><div style="margin-bottom: 0in;">It sends a random password reseting code to your mobile through sms which you have provided during account creation.</div></li><li><div style="margin-bottom: 0in;">It asks the security question whose answer you have provided during the account creation </div><div style="margin-bottom: 0in;">(it asks the security question only if the account has been not logged on for the last 24 hours.)</div></li></ol><div align="LEFT" style="margin-bottom: 0in;"><br /></div><div align="LEFT" style="margin-bottom: 0in;">now the first two option are of no help unless you have hacked the alternate email id or somehow you have in you possession the the users mobile. Mostly all major sites asks two security questions but Gmail asks only one (only if the account has not been logged into for the last 24 hours) now random questions are sometime hard to guess but here again Gmail makes the mistake, to see it we will have to go back in time when the account is actually being created. While creating a Gmail ID it asks you to choose a security question , it gives you the option to select a question from the default set of questions which Gmail provides for the users convenience or you can create your own question. But mostly the users selects one of the default question, (there can be many reasons for this foolishness, like impatience to start a account , laziness or the person may have not understood its importance. Now if we take a look at the default questions they are mostly odd and so mostly the person selects one of the following familiar default questions.</div><ol><li><div align="LEFT" style="margin-bottom: 0in;">What was your first ever mobile number .</div></li><li><div align="LEFT" style="margin-bottom: 0in;">What was the name of your first ever teacher.</div></li></ol><div align="LEFT" style="margin-bottom: 0in;">For the first question the person doesn't understand the importance of giving a unique answer which only he knows and he casually gives his current mobile number as the answer. (in india mostly all the young account user are using their first mobile number and they give it as answer).</div><div align="LEFT" style="margin-bottom: 0in;">Now this are very easy questions to guess and Facebook makes it more easier than you can imagine as mostly all Facebook users provide their current mobile in their personal information section.now all you have to do is answer the securtiy question and reset the account. once you reset the gmail account you can easily reset the Facebook account linked to it by using the Facebook's password retrieval option. But Facebook has one more line of defense when you reset the Facebook's password. When you log into it the first time it won't stop you but it will notice that the account has been logged in from the computer with a different IP address and when you try to log in the next time it will all ask you some easy confirmation questions to make sure you are the real account holder.</div><div align="LEFT" style="margin-bottom: 0in;"><br /></div><div align="LEFT" style="margin-bottom: 0in;">Now many of you would think that the probability of success of this method will be very low. So i conducted a small survey of my friend's Facebook accounts (with their prier permission) lets have a look at what i found out.</div><div align="LEFT" style="margin-bottom: 0in;">I selected 20 of my close friends who use their Gmail account to log in Facebook. </div><div align="LEFT" style="margin-bottom: 0in;">14 of them had not logged into their Gmail account for the last 24 hrs.</div><div align="LEFT" style="margin-bottom: 0in;">5 of them had the security question about first mobile number and 2 had the question about first ever teacher.</div><div align="LEFT" style="margin-bottom: 0in;">3 out of the 5 had given their current mobile no. as the answer which i easily got from their Facebook account information and 1 out of the 2 with the question first ever teacher was my classmate and after some tries i got the right answer.</div><div align="LEFT" style="margin-bottom: 0in;">So in under an hour i could have reseted 4 out of the 20 Facebook account.</div><div align="LEFT" style="margin-bottom: 0in;">So by seeing the above result you can guess how careless sometimes the user is towards his online privacy.</div><div align="LEFT" style="margin-bottom: 0in;"><br /></div><div align="LEFT" style="margin-bottom: 0in;">( I wrote this post to make the readers aware of how even small carelessness can put their online security at risk. This should not be tried as the account password is reseted and the victim will soon find it out and i myself consider reseting others password the most sadistic online act. )</div>

HACKING GMAIL AND FACEBOOK ACCOUNTS USING GMAIL SECURITY QUESTION

I like to check the password retrieval option of different sites and when i was checking out Gmail's option i found and interesting thing. Its not something ingenious or new thing but thought of s…

Read more »