Hacking News : Yahoo hit in worst hack ever, 500 million accounts swiped .

The internet company, being bought by Verizon, says a state-sponsored actor stole email addresses, passwords and birth dates. Change your passwords. Now.

Hackers swiped personal information associated with at least a half billion Yahoo accounts, the internet giant said Thursday, marking the biggest data breach in history.

The hack, which took place in 2014, revealed names, email addresses, phone numbers, birth dates and, in some cases, security questions and answers, Yahoo said in a press release. Encrypted passwords, which are jumbled so only a person with the right passcode can read them, were also taken.

The internet pioneer, which is in the process of selling itself to Verizon, said it's "working closely" with law enforcement. It called the hackers a "state-sponsored actor," though it didn't identify a country behind the breach.

Yahoo urged users to change their passwords if they haven't since 2014. The company has 1 billion monthly active users for all its internet services, which span finance, online shopping and fantasy football. Its mail service alone has about 225 million monthly active users, Yahoo told CNET in June.

The hack serves as a reminder of how widespread hacking is and highlights the vulnerability of passwords. Cybersecurity specialists recommend using a different password for each account you have on the internet. Other experts are working on alternatives to passwords, such as biometrics like your fingerprint or retina.

"Cybercriminals know that consumers use the same passwords across websites and applications, which is why these millions of leaked password credentials are so useful for perpetuating fraud," said Brett McDowell, executive director of the FIDO Alliance, an organization that vets the security of password alternatives. "We need to take that ability away from criminals, and the only way to do that is to stop relying on passwords altogether."

ud072517normal.jpg
The breach has exposed at least 500 million accounts' names, email addresses, phone numbers and dates of birth. In some cases, security questions and answers too.
Justin Sullivan, Getty Images
Verizon, which is paying $4.83 billion for Yahoo, said it was notified of the massive breach within the last two days. The telecommunications giant had "limited information and understanding of the impact," according to a statement.

"We will evaluate, as the investigation continues, through the lens of overall Verizon interests, including consumers, customers, shareholders and related communities," Verizon said.

B. Riley & Co. analyst Sameet Sinha told The Wall Street Journal the breach was unlikely to affect the sale to Verizon.

Virginia Sen. Mark Warner, a member of the newly formed Senate Cybersecurity Caucus, criticized Yahoo for not discovering the breach when it originally happened in 2014.

PASSWORDS, PASSWORDS EVERYWHERE

• How to find out if you're at risk in Yahoo hack
• Welcome to the club, Yahoo: 10 other massive hacks
• World Password Day: Here are 4 tips for staying safe online
• Passwords and emails don't match up in cache of 272 million logins
• Lord of the Paranoids: New Yahoo security exec on protecting a billion-plus accounts
• Hacker trades 272 million passwords for social media likes

Hackers' sale of Comcast log-ins reminds us to change our password habits
"While we have seen more and more data breaches in the private sector in recent years, many of them affecting millions of consumers, the seriousness of this breach at Yahoo is huge," Warner said.

The Privacy Rights Clearinghouse, a nonprofit organization that tracks cybersecurity breaches, said the hack was the largest-ever publicly disclosed breach.

Yahoo has taken steps to protect its users, including invalidating security questions and answers, but the real risk lies in hackers using the passwords on other websites.

"We typically see a 0.1 percent to 2 percent log-in success rate from credential stuffing attacks, meaning that a cybercriminal using 500 million passwords to attempt to take over accounts on another website would be able to take over tens of thousands of accounts on most websites," said Shuman Ghosemajumder, Google's former click-fraud czar and CTO of Shape Security.

Facebook co-founder Mark Zuckerberg's Twitter account was hacked using a similar method after the passwords of more than 100 million LinkedIn members were leaked.

It will take Yahoo at least several months before it starts regaining users' trust, according to research from Alertsec. The encryption provider did a study that found about 97 percent of Americans lose trust in companies like Yahoo after massive data breaches.

"When a company has allowed their customers' data to fall into the hands of criminals, the resulting lack of trust is difficult to repair," CEO Ebba Blitz said in a statement.

On August 1, a hacker named "Peace" claimed to have breached 200 million Yahoo usernames and passwords from a hack in 2012, and offered to sell them on the dark web after trying to do the same with MySpace and LinkedIn accounts.

A person familiar with the situation said Peace's assertion prompted Yahoo to initiate an internal investigation. That investigation found no evidence that substantiated Peace's claim, but the investigating team found indications that a state-sponsored actor had stolen data in 2014.


Former Yahoo information security officer Jeremiah Grossman, now chief of security strategy at SentinelOne, said that internet companies, especially giants like Yahoo, face challenges protecting enormous computer networks because the networks offer so many points of entry to attackers.


"It's unsurprising when breaches, even of this magnitude, take place," Grossman said. "Yahoo certainly isn't the first. And they won't be the last."

News Source - https://www.cnet.com/news/yahoo-500-million-accounts-hacked-data-breach/

Hacking Updates : How Russian hackers could disrupt the U.S. election .

As U.S. authorities investigate whether Russia is attempting to alter the presidential decision, states are thinking about how to secure their frameworks and avoid cyberattacks amongst now and Election Day. 

Arizona and Illinois have effectively experienced endeavored hacks of their voter databases and a week ago, U.S. authorities said they are growing their request since agents trust extra states have likewise seen programmers effectively test their decision frameworks. Authorities have not openly said yet who they accept was behind the Arizona and Illinois breaks, yet just like the case with the Democratic National Committee (DNC) hack, Russia is suspected to be dependable. 

More than about six cybersecurity specialists CBS News addressed said it's reasonable Russia, which has among the best programmers on the planet, is attempting to impact the U.S. decision and that the odds of more cyberattacks amongst now and Election Day are high. 

Voter enlistment or voter move databases may be one bit of decision frameworks that could be helpless to further assaults, specialists told CBS. Authorities in Arizona and Illinois said voters' data was not interfered with, but rather it could be risky on the off chance that they break into the framework and erase documents. 

"The genuine peril is whether they can erase voter enrollments," said Herbert Lin, a senior exploration researcher for digital approach and security at Stanford University's Center for International Security and Cooperation. "Suppose they needed to intercede in favor of [Donald] Trump. At that point what you would do is discover a method for refuting the voter enrollments, erasing the voter enlistments of 10 percent of the Democrats in the state. That would make 10 percent of them ineligible to vote." 

Hypothetically, another sort of cutting edge assault, specialists said, would be to target and alter programming for voting machines with the goal that it could influence what names are shown or how votes are numbered, however specialists trust this would be excessively precarious, making it impossible to execute. 

"You could, in principle, hack into that product and change it so it would count something in an unexpected way. Yet, once more, those sorts of things are truly difficult to do just as far as really doing it, and doing it in an undetected way is much, significantly more troublesome," said Daniel Castro, VP at the Information Technology and Innovation Foundation. 

A few specialists are worried about states that utilization touch-screen voting machines that leave no paper trail. Five states are totally paperless: Delaware, Georgia, Louisiana, New Jersey and South Carolina. Nine different states have a few areas that utilization paperless frameworks: Arkansas, Indiana, Kansas, Kentucky, Mississippi, Pennsylvania, Tennessee, Texas and Virginia. 

States are now watchful for conceivable insecurities. A week ago, Washington state uncovered that its online instrument that permits voters to enroll, overhaul individual data and perspective a voter aide was inadvertently open through the site's improvement code. 

There was never a "security break" or "hack of the voter framework," the secretary of state's office said in an admonitory, and it was immediately altered. Be that as it may, the episode fortifies worries that state decision frameworks could be defenseless against potential cyberattacks. 

Specialists told CBS News that a definitive objective of these programmers is not to essentially change the result of the race; their primary target is to de-legitimize the result by sowing uncertainty, vulnerability and suspicion through a progression of cyberattacks. 

"I would contend this is a standout amongst the most noteworthy digital assaults that, as far as anyone is concerned, has ever been directed against the United States. The assailants are attempting to undermine the trust in the discretionary procedure," said Alexander Klimburg, partner at the Harvard Kennedy School's Belfer Center for Science and International Affairs, and writer of an imminent book called The Dark Web. 

"The test in digital operations is that the main confinement in what you can do is your own inventiveness," Klimburg said. "Whatever you can envision doing is practically conceivable in digital terms." 

In this way, Obama organization authorities have put forth no obvious expression either recognizing the Russian government as being behind the cyberattacks or undermining countering. Be that as it may, Russian President Vladimir Putin, in a meeting a week ago with Bloomberg denied that his legislature had anything straightforwardly to do with the DNC hack. "I don't know anything about it, and on a state level Russia has never done this," he said. 

The Department of Homeland Security has offered states backing and help with ensuring against cyberattacks. Alongside the general security proposals made to make frameworks more secure, such as changing passwords and introducing firewalls, one master said the most vital move states can make is performing full trade off evaluations to figure out whether a system has as of now been encroached and observing all PCs on a system that have anything to do with vote counting or the exchange of voter enrollment data. 

Specialists push that programmers won't not plan to utilize these assaults to influence the decision - to support Trump, for instance - yet they are a piece of Russia's long haul methodology to test Western popular government and to upset and debilitate the U.S. political framework. 

"They've as of now accomplished some of their objective," said James Lewis, senior VP and chief of the vital advancements program at the Center for Strategic and International Studies (CSIS). "When they get nearer to November, they'll need to keep up the weight, keep up the disarray. They'll most likely search for ways, if Trump loses, to plant data or make drives that propose by one means or another the race is fixed." 

Trump has over and over cautioned that the decision may be "fixed" and said in a meeting with Larry King a week ago that it's "really improbable" that Russia would interfere​. 

In any case, Lewis said he trusts Russia is behind the DNC assault and interruptions at the state level and said there are several variables that are likely inspiring these programmers. 

"A portion of the objectives are to check whether you can drive a wedge between the U.S. what's more, Europe and some of it is simply fight," he said. "Despite everything they haven't pardoned us for what happened toward the end of the Cold War." 

Yet, FBI Director James Comey said last Thursday that any cyberattacks won't influence the result of the 2016 race since it would be excessively confounded, making it impossible to assault the country's various voting frameworks on a substantial scale. 

"The genuine vote numbering is cumbersome," Comey said. "As it were, that is a gift since it makes it stronger and more distant far from a performing artist who may hope to creep down a fiber optic link." 

Dmitri Alperovitch is the originator and boss innovation officer of CrowdStrike, which has been examining the hacks at the DNC and DCCC, and that distinguished two gatherings, connected to Russian insight offices G.R.U. also, F.S.B., invaded the DNC free of each other. 

While Alperovitch concurs that Russia is attempting to primarily bring about devastation in the U.S. race framework, he said "we can't markdown the likelihood" that programmers could really change the result of the race. 

"On the off chance that it's nearby, and on the off chance that it's truly going to come down to a couple votes in a couple of regions, kind of like the 2000 Bush versus Blood race, then you don't have to hack into each state and each province," he said. "You may need to do one hack and swing a couple of hundred votes." 

Since states and neighborhood purviews run races and utilize diverse frameworks, a few specialists and authorities say its decentralized nature could in itself secure against a huge scale assault. In any case, the way that there isn't an all inclusive framework to hack into likewise displays a drawback. 

"What that implies from an aggressor's perspective is you can look through each state in the country and search for the ones that have a few shortcomings," said Steve Grobman, boss innovation officer of Intel Security. "There's an amazing preferred standpoint for the enemy here in that dislike there's one kept entryway that is worked out of the field that they need to make sense of how to enter. They essentially have 50 entryways that are produced using a wide range of various merchants and a wide range of various advancements and they can squirm all of them, take a gander at every one of them, and locate the loosest one." 

It would be troublesome, in any case, to control the vote extensively, Grobman said. 

Rather, Grobman said his top concern is the way they could impact the race before Election Day in which programmers would discharge bona fide information and interweave it with information that they would manufacture, giving it the presence of everything being reasonable. 

"One of my worries is this is precisely what might happen in the decision cycle where late in October, we would see an arrival of information that would have some bit of dooming substance that would possibly impact the result of the race and...people would expect it's believable, particularly on the off chance that it's interwoven with bona fide, stolen information," he said. "The issue would be there wouldn't be sufficient time to look into and accept that it would be a creation." 

"The Russians are going to choose the Americans are still conflicted about how to react to us," Lewis said in regards to the most recent remarks from key organization authorities, "And they'll see that as a greenlight." 

Solicited what the odds are from Russia making more move - undetected or identified - before the race, Lewis said, "100 percent."

How to Crack Android Full Disk Encryption on Qualcomm Devices ......

The heated battle between Apple and the FBI provoked a lot of talk about Encryption – the technology that has been used to keep all your bits and bytes as safe as possible.
We can not say a lot about Apple's users, but Android users are at severe risk when it comes to encryption of their personal and sensitive data.
Android's full-disk encryption can be cracked much more easily than expected with brute force attack and some patience, affecting potentially hundreds of millions of mobile devices.

There may not be a full fix available for current Android handsets in the market.


Google started implementing Full Disk Encryption on Android by default with Android 5.0 Lollipop. Full disk encryption (FDE) can prevent both hackers and even powerful law enforcement agencies from gaining unauthorized access to device's data.

Android's disk encryption, in short, is the process of encoding all user's data on an Android device before ever written to disk using user's authentication code. Once encrypted, the data is decrypted only if the user enters his/her password.
However, after thoroughly analyzing Android's full disk encryption implementation, a security researcher came to the conclusion that the feature is not as secure as the company claims it is, and he has a working code to prove it.
Cracking Android Full Disk Encryption: Exploit Available Online
how to hack android
Security researcher Gal Beniamini has discovered  issues (CVE-2015-6639 and CVE-2016-2431) in how Android devices handle its full disk encryption, making it easier for attackers to gain access to the user's sensitive data.
Beniamini also published a detailed step-by-step guide this week on how one can break down the encryption protections on Android smartphones powered by Qualcomm Snapdragon processors.

You can find the full source of the exploit on GitHub.


Basically, Android's disk encryption on devices with Qualcomm chips based only on your password. However, in real, Android uses your password to create a strong 2048-bit RSA key (KeyMaster) derived from it instead.
Qualcomm runs in the Snapdragon TrustZone to protect critical functions like encryption and biometric scanning, but Beniamini discovered that it is possible to exploit an Android security flaw to extract the keys from TrustZone.
Qualcomm runs a small kernel in TrustZone to offer a Trusted Execution Environment known as QSEE (Qualcomm Secure Execution Environment) that allows small apps to run inside of QSEE away from the main Android operating system. KeyMaster is also a QSEE app.
The researcher has detailed how attackers can exploit an Android kernel security flaw to load their own version of QSEE app inside this secure environment, thereby exploiting privilege escalation flaw and hijacking of the complete QSEE space, including the keys generated for full disk encryption.
Once getting hold of this key, an attacker could perform a brute-force attack to grab the user password, PIN or lock, cracking Android's full disk encryption.
Moreover, Qualcomm or OEMs can comply with government or law enforcement agencies to break the FDE.

"Since the key is available to TrustZone, Qualcomm, and OEMs [Original Equipment Manufacturers] could simply create and sign a TrustZone image which extracts the KeyMaster keys and flash it to the target device," Beniamini wrote. "This would allow law enforcement to easily brute force the FDE password off the device using the leaked keys."
Beniamini has provided all the technical bits of the analysis on this blog, so you can go through this blog if you are interested in having highly technical details on the issue with Android's FDE.

Although Beniamini is working with both Qualcomm as well as Google, the core of the issue might not be completely fixable and might even require new hardware changes to fix.

Google News : Good Bye Passwords as Google Plans a Different Verification Option

ANDROID USERS WILL BE ABLE TO LOG IN TO SERVICES USING A COMBINATION OF THEIR FACE, TYPING PATTERNS AND HOW THEY MOVE!

Google has channeled efforts to provide Android apps users a much reliable and easier substitute to the ever-so-complicated logins and passwords with Trust API.

Trust API is a new and novel feature that has been introduced by Google at the company’s I/O conference. The company’s head of Advanced Technology and Projects group Daniel Kaufman identified that this new technology will be firstly tested with various “large” financial institutions. The testing will most likely begin from June. Kaufman was the head of the group which is responsible for creating Trust API on the basis of another project that has been codenamed Project Abacus.

Project Abacus was developed last year to eliminate the use of passwords using a superior and better method that combined various weak indicators into a strong piece of evidence that makes use of your personality. These pieces of evidence might include biometric indicators, which, no prizes for guessing, include our face shape, voice, movements and the way we swipe or type on the screen. The software will run in the background of your phone, which will help it in tracking your movements and matching them with its indicators so as to determine who is using the phone.

Google has, thus, built Trust API much on the lines of this particular project and this year, the company has clarified that the service will be accessible to third parties as well, which will allow organizations to verify someone’s identity using biometrics. As of now, financial institutions like banks will be using it for the purpose of verifying customers that use Android apps to log in but by the end of 2016, this technology will be open for all.

We do know that individually biometric system is not as reliable and cannot offer fool-proof security on web-based services. Such as, facial recognition technology is already a part of a majority of Android devices but in comparison to this, the fingerprint scanner is more secure. However, Google’s Trust API tends to combine them both, which will result in making biometric system 10 times secure, just like a fingerprint.

The software won’t give a binary answer as is the case while we enter passwords the system will provide a score that will inform the user how confident the device is about the authenticity of the owner. Institutions that require higher score will program the API in such a way that it will ask for additional data that may be another biometric verification or an ole-style password.

The API seems to be similar to the program being developed by the London-based Nok Bok Labs. But we can assume that these are steps in the right direction. As customer identity management firm Gigya’s Richard Lack stated:


“Consumers tell us that they are struggling to remember what is now an average of over 100 passwords in Europe. At a time when the number of devices we own is rising sharply, this frustration has relegated the registration process to being the most broken thing about the internet. The future lies in methods of authentication without passwords, which consumers clearly favor, both in terms of convenience and enhanced security.”

Lack further added that:

“Biometric authentication is a powerful enabler, allowing businesses smart enough to deploy it to significantly increase rates of registration, gaining data and insight about their customers, while also increasing customer security. This is a win/win scenario which sounds the death-knell for awkward and insecure passwords sooner than we may imagine.”

Do remember that Google has already embedded similar tech on devices that run on Android 5.0 or higher version. It is called “Smart Lock” and it lets you unlock your device automatically if you enter the safe zone, which would be any location that you list as a trusted one. This will be done when a user connects with a trusted Bluetooth device, the device identifies your facial features or you are personally carrying the device.

How To Hack Wifi Password : Steps Wifi Hacking – Cracking WPA2 Password

Wi-Fi Protected Access (WPA) and Wi-Fi Protected Access II (WPA2) are two security protocols and security certification programs developed by the Wi-Fi Alliance to secure wireless computer networks. The Alliance defined these in response to serious weaknesses researchers had found in the previous system, WEP (Wired Equivalent Privacy)

A flaw in a feature added to Wi-Fi, called Wi-Fi Protected Setup (WPS), allows WPA and WPA2 security to be bypassed and effectively broken in many situations. Many access point they have a Wifi Protected Setup enabled by default (even after we hard reset the access point).

Requirements:

1. Wireless card (support promiscuous mode)

2. Access point with WPA2 and WPS enables

5 Steps Wifi Hacking – Cracking WPA2 Password:

1. Open our terminal (CTRL+ALT+T) and type airmon-ng (view tips and tricks how to create keyboard shortcut on kali linux)

this command will lists our wireless card that attached with our system.



2. The next step we need to stop our wireless monitor mode by running airmon-ng stop wlan0

3. Now we ready to capture the wireless traffic around us. By running airodump-ng wlan0 our wireless interface will start capturing the data.

From the picture above, we can see many available access point with all the information. In the green box is our victim access point which is my own access point 🙂

Information:

BSSID (Basic Service Set Identification): the MAC address of access point

PWR: Signal level reported by the card.

Beacons: Number of announcements packets sent by the AP

#Data: Number of captured data packets (if WEP, unique IV count), including data broadcast packets.

#/s: Number of data packets per second measure over the last 10 seconds.

CH: Channel number (taken from beacon packets).

MB: Maximum speed supported by the AP. If MB = 11, it's 802.11b, if MB = 22 it's 802.11b+ and higher rates are 802.11g.

ENC: Encryption algorithm in use.

CIPHER: The cipher detected. TKIP is typically used with WPA and CCMP is typically used with WPA2.

AUTH: The authentication protocol used.

ESSID: Shows the wireless network name. The so-called “SSID”, which can be empty if SSID hiding is activated.

4. From the step 3 above, we can find access point with encryption algorithm WPA2 and note the AP channel number. Now we will find out whether target AP has WPS enabled or not.


wash -i wlan0 -c 8 -C -s


if the WPS Locked status is No, then we ready to crack and move to step 5.

5. The last step is cracking the WPA2 password using reaver.

reaver -i <your_interface> -b <wi-fi victim MAC address> –fail-wait=360

Because we already get the information from step 3 above, so my command look like this:

reaver -i wlan0 -b E0:05:C5:5A:26:94 –fail-wait=360

it took about 5 hours to crack 19 characters WPA2 password (vishnuvalentino.com) from my Kali virtualBox, but it depend with our hardware and wireless card.

Conclusions:

1. WPA and WPA2 security implemented without using the Wi-Fi Protected Setup (WPS) feature are unaffected by the security vulnerability.

2. To prevent this attack, just turn off our WPS/QSS feature on our access point. See picture below (I only have the Chinese version 😛 )

Computer Hacking Technology : How to Hack WhatsApp Account

How to Hack WhatsApp Account

Need to Hack WhatsApp Account?

Below is a WhatsApp Hack Guide with Complete Instructions!

Learn how to hack WhatsApp in simple steps with the following easy to follow and foolproof tutorial. Since WhatsApp has become one of the popular app to share messages and media instantly, it has also become a favorite place for many to engage in illicit activities. Therefore, in order to investigate the truth people are left with no choice other than to hack WhatsApp account.

Possible Ways to Hack WhatsApp
The following are the only two ways to hack WhatsApp account:

1. WhatsApp Hack using a Spying App: The Easiest Way
Even though there are several ways to hack WhatsApp, using a spy app is by far the most simple and easiest way. This method requires no prior hacking knowledge or technical skills to carry out and hence more suitable for common people. Installing a spy app to hack WhatsApp is as simple as installing any other app on mobile. Out of several apps out there, mSpy is one of my favorite one to hack WhatsApp:

WhatsApp Hack with mSpy


mSpy Features:

Hack phone Calls and Text Messages.
Hack WhatsApp, Skype and other popular messengers.
Track Real-Time Location with GPS Tracker.
Spy on Contact List and Web Browsing activities.
Monitor Emails, Pictures and Videos.
Operates in Hidden Mode and remains Undetected!
No Rooting Required!
How to Hack WhatsApp with this App?

Download and Install the app on to the target phone which takes not more than a minute.
After this is done, the app silently records all WhatsApp activities in hidden mode.
All the recorded WhatsApp chat is sent to your online account.
View all the information from anywhere at anytime with your online account.
You can download mSpy from the link below:

Download mSpy
Compatiblity: Android, Apple iPhone, BlackBerry and Windows Mobile.

2. WhatsApp Hack by Spoofing Mac Address: The Tough Way
There is another method to hack WhatsApp known as Mac address spoofing which involves spoofing the Mac address of the target phone on your own phone. Unlike using spy apps, this one is somewhat time consuming and requires technical skills to implement. To spoof the Mac of the target WhatsApp phone address, follow the below mentioned steps:

Find out the Mac address of the target phone on which you need to hack WhatsApp account:
For Android – Navigate to Settings —> About Device —> Status—> Wi-Fi MAC address
For iPhone – Navigate to Settings—> General —> About —> Wi-Fi address
Once you’ve the Mac address of the target WHatsApp phone, you can spoof the Mac address as mentioned in my post: How to Spoof the MAC address.
Next, install WhatsApp on your phone using the target phone number and verify it.
Now, you’ve an exact replica of the target WhatsApp account and you should receive all the conversation and updates on your phone as well.
This method of WhatsApp hacking is quite time consuming and is known to have less success rate when compared to the method of using the spy apps. Therefore, if you are someone who does not have sufficient time and skills to implement this, I still recommend the use of mSPy to successfully hack WhatsApp account.

Computer Hacking Technology : Wireless Hacking Techniques

In this excerpt, from Chapter 6 of their new book Maximum Wireless Security, authors Dr. Cyrus Peikari and Seth Fogie review techniques used by hackers to compromise wireless networks. The excerpt is published with permission from Sams Publishing.

How Can I Block Sniffers?

 Hacking Techniques
A typical hacker attack is not a simple, one-step procedure. It is rare that a hacker can get online or dial up on a remote computer and use only one method to gain full access. It is more likely that the attacker will need several techniques used in combination to bypass the many layers of protection standing between them and root administrative access. Therefore, as a security consultant or network administrator, you should be well versed in these occult techniques in order to thwart them. This chapter, which will be a review for advanced users, will introduce the main types of hacker attacks. Expert users will want to skip ahead to the next chapter (Chapter 7, "Wireless Attacks") and go straight for the goodies.


The following techniques are not specific to wireless networks. Each of these attacks can take multiple forms, and many can be targeted against both wired and wireless networks. When viewed holistically, your wireless network is just another potential hole for a hacker. Therefore, this chapter will review hacking techniques from a generic perspective.

Diverse Hacker Attack Methods
The stereotyped image conjured up by most people when they hear the term "hacker" is that of a pallid, atrophied recluse cloistered in a dank bedroom, whose spotted complexion is revealed only by the unearthly glare of a Linux box used for port scanning with Perl. This mirage might be set off by other imagined features, such as dusty stacks of Dungeons and Dragons lore from the 1980s, empty Jolt Cola cans, and Japanese techno music streaming from the Net.

However, although computer skill is central to a hacker's profession, there are many additional facets that he must master. In fact, if all you can do is point and click, you are a script kiddie, not a hacker. A real hacker must also rely on physical and interpersonal skills such as social engineering and other "wet work" that involves human interaction. However, because most people have a false stereotype of hackers, they fail to realize that the person they are chatting with or talking to on the phone might in fact be a hacker in disguise. In fact, this common misunderstanding is one of the hackers' greatest assets.

Social Engineering
Social engineering is not unique to hacking. In fact, many people use this type of trickery every day, both criminally and professionally. Whether it be haggling for a lower price on a lawn mower at a garage sale, or convincing your spouse you really need that new toy or outfit, you are manipulating the "target." Although your motives might be benign, you are guilty of socially engineering the other party.

One example of social engineering that information technology managers face on a weekly basis is solicitation from vendors. An inimical form of sales takes the form of thinly disguised telemarketing. Straying far from ethical standards of sales technique, such vendors will attempt to trick you into giving them information so they can put your company's name on a mailing list.

Here is one such attempt that we get regularly:

"Hi, this is the copier repair company. We need to get the model of your copier for our service records. Can you get that for us?"

Now, this sounds innocent enough, and there are probably many that fall for this tactic. However, they are simply trying to trick you into providing sensitive information-information that they really have no business knowing.

Like the scam artist, a hacker often uses similar techniques. A popular method that hackers use is pretending to be a survey company. A hacker can call and ask all kinds of questions about the network operating systems, intrusion detection systems (IDSs), firewalls, and more in the guise of a researcher. If the hacker was really malicious, she could even offer a cash reward for the time it took for the network administrator to answer the questions. Unfortunately, most people fall for the bait and reveal sensitive network information.

Lost Password
One of the most common goals of a hacker is to obtain a valid user account and password. In fact, sometimes this is the only way a hacker can bypass security measures. If a company uses firewalls, intrusion detection systems, and more, a hacker will need to borrow a real account until he can obtain root access and set up a new account for himself. However, how can a hacker get this information? One of the easiest ways is to trick someone into giving it to them.

For example, many organizations use a virtual private network (VPN) that enables remote employees to connect to the network from home and essentially become a part of the local network. This is a very popular method of enabling people to work from home, but is also a potential weak spot in any security perimeter. As VPNs are set up and maintained by the IT department, hackers will often impersonate an actual employee and ask one of the IT staff for the password by pretending to have lost the settings. If the IT employee believes the person, he willingly and often gladly hands over the keys. Voila! The hacker now can connect from anywhere on the Internet and use an authorized account to work his way deeper into the network. Imagine if you were the lowly IT staff person on call and the CEO rang you up at 10:30 p.m. irate about a lost password. Would you want to deny her access, risking the loss of your job? Probably not, which makes this type of fear a hacker's best friend.

Chatty Technicians
If you are a home user and think you have nothing to fear from this type of impersonation, think again-you are actually targeted more often by scammers and hackers alike. This is because many Internet newcomers (newbies) will believe anything someone appearing to be their ISP's tech support personnel tells them. For example, hackers will often send out mass messages to people, or sit in chat rooms and wait for a newbie to come along. They will then set up a fake account or use simple tricks to make it appear as if an AOL employee is chatting with them. What the newbies do not realize is that they are actually talking with a hacker in disguise. So, they willingly hand over everything from credit cards to user names and passwords. See Figure 1 for an example of how a fake request might appear.

As you can see, to a beginner it appears that an AOL Administrator is on the other side of this conversation. However, if you look closely, you will see a blank like after Hckr-name:. To make it appear as though an AOL System Administrator is talking, we added a line of space characters to the beginning of the text to drop the AOL System Administrator: to the next line. Although the original name does appear, it would not be difficult for a hacker to set up an account using a date or company name to disguise the fact the account was simply another username.

Social Spying
Social spying is the process of "using observation to acquire information." Although social engineering can provide a hacker with crucial information, small businesses are better protected against social engineering because many people in very small companies know each other. For example, if one of the IT staff received a call from a hacker pretending to be a distressed CEO, he would probably recognize the voice as not belonging to the real CEO. In this case, social spying becomes more important.

To illustrate one of the nontechnical ways social spying can be used, consider how many people handle ATM cards. For example, do you hide your PIN when you take money out at the ATM? Take note of how people protect their PIN the next time you are in line at the ATM. You will probably note most people do not care. Most will whip out their card and punch the numbers without a care for who could be watching. If the wrong person memorized the PIN, he would have all the information needed to access the funds in the account, provided he could first get his hands on the ATM card. Thus, a purse-snatcher would not only get the money just withdrawn from an ATM, but could easily go back and withdraw the entire day's limit.


Similarly, hackers socially spy on users as they enter passwords. A "flower delivery" at 8:00 a.m. in the morning would give a hacker the necessary excuse to casually stroll through an office building. Although she appears to be looking for the recipient of the flowers, she could be watching for people entering passwords or other sensitive information.

In addition to snooping on people as they actively type their user information, most offices have at least several people who are guilty of posting their password on or near their computer monitor. This type of blatant disregard for security is every network administrator's worst nightmare. Regardless of repeated memos, personal visits, and warnings, some people seem to always find an excuse to post their network password right in plain view. Even if some people are at least security-conscious enough to hide their Post-it notes in a discreet place, it still only takes a few seconds to lift up a keyboard or pull open a desk drawer.

If you do not believe this, take a quick walk around and see just how many potential security violations are in your office area. You might be very surprised to see just what type of information is there for the taking!

Garbage Collecting
Have you ever thrown away a credit card statement without shredding it? If so, you are a potential target. Although you might consider your trash to be sacred territory that no one enters because it is dirty, your trash, and the trash of your company, is often a gold mine. Fishing through garbage to find passwords, also known as dumpster diving, can provide a hacker with the crucial information needed to take over your network.


Let's consider a scenario. If you are a network administrator and you receive an anonymous tip that people are posting passwords all around the office, what would you do? Most administrators would immediately investigate and send out a memo to everyone in the company stating that this activity is not allowed, and that violations will be dealt with harshly. Although this might get everyone to temporarily take down their Post-it passwords, the problem has only been exacerbated, for all those passwords are now headed right to the anonymous caller who is waiting at the dumpster.

In addition to passwords, hackers can find memos, sensitive reports, diskettes, old hard drives, and more in the trash. Imagine the value an old cash register hard drive could have to a hacker looking for a way to gain access to a company's credit card database. In many cases, a hard drive can simply be installed on another computer and searched using inexpensive (or free) forensics tools.

Sniffing
A sniffer is a program and/or device that monitors all information passing through a computer network. It sniffs the data passing through the network off the wire and determines where the data is going, where it's coming from, and what it is. In addition to these basic functions, sniffers might have extra features that enable them to filter a certain type of data, capture passwords, and more. Some sniffers (for example, the FBI's controversial mass-monitoring tool Carnivore) can even rebuild files sent across a network, such as an email or Web page.

A sniffer is one of the most important information gathering tools in a hacker's arsenal. The sniffer gives the hacker a complete picture (network topology, IP addresses) of the data sent and received by the computer or network it is monitoring. This data includes, but is not limited to, all email messages, passwords, user names, and documents. With this information, a hacker can form a complete picture of the data traveling on a network, as well as capture important tidbits of data that can help her gain complete control over a network.

How Does a Sniffer Work?
For a computer to have the capability to sniff a network, it must have a network card running in a special mode. This is called promiscuous mode, which means it can receive all the traffic sent across the network. A network card will normally only accept information that has been sent to its specific network address. This network address is properly known as the Media Access Control (MAC) address. You can find your own MAC address by going to the Windows Taskbar and clicking Start?Run and typing winipcfg (for Windows 95/98/ME) or ipconfig /all (for Windows NT/2000/.NET Server). The MAC address is also called the physical address.