Hacking.BaBa

HACKING GMAIL AND FACEBOOK ACCOUNTS USING GMAIL SECURITY QUESTION

<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj2YWdEmf1AMD3bM5bR-zBQZ7GnuYAs6XXHFF9bpc203kWF2gGTdTCVr0tGplbrEr2vPs3twH3mB3knLsxigCGaDza2dNUNf6-VXwgc139ZtNyDIy2SguWPTY4XgwTZnkxG_Y2Ece8Ygts/s1600/Untitled.png" imageanchor="1" style="clear: right; float: right; margin-bottom: 1em; margin-left: 1em;"><img border="0" height="150" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj2YWdEmf1AMD3bM5bR-zBQZ7GnuYAs6XXHFF9bpc203kWF2gGTdTCVr0tGplbrEr2vPs3twH3mB3knLsxigCGaDza2dNUNf6-VXwgc139ZtNyDIy2SguWPTY4XgwTZnkxG_Y2Ece8Ygts/s200/Untitled.png" width="200" /></a><style type="text/css">   </style> <br /><div style="margin-bottom: 0in;">I like to check the password retrieval option of different sites and when i was checking out Gmail's option i found and interesting thing. Its not something ingenious or new thing but thought of sharing the observation with everybody so please forgive me if it seemed to you a time waste.</div><div style="margin-bottom: 0in;">So first lets take a look at the Gmail's password retrieval option.</div><div style="margin-bottom: 0in;">So when you click on the 'forgot password' option and provide the email id, in Gmail it gives you three password reseting options.  <br /><a name='more'></a></div><ol><li><div style="margin-bottom: 0in;">it sends the password reseting  link to your alternate email id, which you had provided  during the  account creation.</div></li><li><div style="margin-bottom: 0in;">It sends a random password  reseting code to your mobile through sms which you have provided  during account creation.</div></li><li><div style="margin-bottom: 0in;">It asks the security question  whose answer you have provided during the account creation   </div><div style="margin-bottom: 0in;">(it asks the security question only if  the account has been not logged on for the last 24 hours.)</div></li></ol><div align="LEFT" style="margin-bottom: 0in;"><br /></div><div align="LEFT" style="margin-bottom: 0in;">now the first two option are of no help unless you have hacked the alternate email id or somehow you have in you possession the the users mobile. Mostly all major sites asks two security questions but Gmail asks only one (only if the account has not been logged into for the last 24 hours) now random questions are sometime hard to guess but here again Gmail makes the mistake, to see it we will have to go back in time when the account is actually being created. While creating a Gmail ID it asks you to choose a security question , it gives you the option to select a question from the default set of questions which Gmail provides for the users convenience or you can create your own question. But mostly the users selects one of the default question, (there can be many reasons for this foolishness, like impatience to start a account , laziness or the person may have not understood its importance. Now if we take a look at the default questions they are mostly odd and so mostly the person selects one of the following familiar default questions.</div><ol><li><div align="LEFT" style="margin-bottom: 0in;">What was your first  ever mobile number .</div></li><li><div align="LEFT" style="margin-bottom: 0in;">What was the name of  your first ever teacher.</div></li></ol><div align="LEFT" style="margin-bottom: 0in;">For the first question the person doesn't understand the importance of giving a unique answer which only he knows and he casually gives his current mobile number as the answer. (in india mostly all the young account user are using their first mobile number and they give it as answer).</div><div align="LEFT" style="margin-bottom: 0in;">Now this are very easy questions to guess and Facebook makes it more easier than you can imagine as mostly all Facebook users provide their current mobile in their personal information section.now all you have to do is answer the securtiy question and reset the account. once you reset the gmail account you can easily reset the Facebook account linked to it by using the Facebook's password retrieval option. But Facebook has one more line of defense when you reset the Facebook's password. When you log into it the first time it won't stop you but it will notice that the account has been logged in from the computer with a different IP address and when you try to log in the next time it will all ask you some easy confirmation questions to make sure you are the real account holder.</div><div align="LEFT" style="margin-bottom: 0in;"><br /></div><div align="LEFT" style="margin-bottom: 0in;">Now many of you would think that the probability of success of this method will be very low. So i conducted a small survey of my friend's Facebook accounts (with their prier permission) lets have a look at what i found out.</div><div align="LEFT" style="margin-bottom: 0in;">I selected 20 of my close friends who use their Gmail account to log in Facebook.  </div><div align="LEFT" style="margin-bottom: 0in;">14 of them had not logged into their Gmail account for the last 24 hrs.</div><div align="LEFT" style="margin-bottom: 0in;">5 of them had the security question about first mobile number and 2 had the question about first ever teacher.</div><div align="LEFT" style="margin-bottom: 0in;">3 out of the 5 had given their current mobile no. as the answer which i easily got from their Facebook account information and  1 out of the 2 with the question first ever teacher was my classmate and after  some tries i got the right answer.</div><div align="LEFT" style="margin-bottom: 0in;">So in under an hour i could have  reseted  4 out of the 20 Facebook account.</div><div align="LEFT" style="margin-bottom: 0in;">So by seeing the above result you can guess how careless sometimes the user is towards his online privacy.</div><div align="LEFT" style="margin-bottom: 0in;"><br /></div><div align="LEFT" style="margin-bottom: 0in;">( I wrote this post to make the readers aware of how even small carelessness can put their online security at risk. This should not be tried as the account password is reseted and the victim will soon find it out and i myself consider reseting others password the most sadistic online act. )</div>

HACKING GMAIL AND FACEBOOK ACCOUNTS USING GMAIL SECURITY QUESTION

I like to check the password retrieval option of different sites and when i was checking out Gmail's option i found and interesting thing. Its not something ingenious or new thing but thought of s…

15 Nov 2010