Exploiting "Facebook Trusted Friend" Security Feature

Last week Facebook announced that in one day 600,000 accounts possibly get hacked. Another possible solution for Facebook to combat security issues is to find 3 to 5 "Trusted friends". Facebook will be adding two new security features that will allow users to regain control of their account if it gets hijacked.

In Facebook's case, the keys are codes, and the user can choose from three to five "Trusted friends" who are then provided with a code. If you ever get locked out of your account (and you can't access your email to follow the link after resetting your Facebook password), you gather all the codes and use them to gain access to it again.  This method is used by hackers to hack most of the Facebook account using little bit of Social Engineering.


How to hack using this feature ? 


For this technique you need to create 3 fake Facebook account and you need to surely add these as friends into your victims account whose account you are going to hack.
After success full addition of your fake accounts into victims account as friends follow the below steps .:


1. Go to Facebook and click Forgot your Password ?


2. Than you will get something like below just enter the details you know about him enter his Username, email address and full name.

3. After entering everything check it again and click on submit.

4. After succeful search for the user Facebook will show some information about how many emails are linked to the account and there is simple option saying 
No Longer Access to These click that one.

5. Now it will promote you to enter a new email address on which you will get the password resetting option so enter your email address I suggest you creating a Fake or Temporary email address for safety purpose.

6. Than it will promote you to enter the Security well if you have some security guess about that one than that’s ok but if you don’t know it than simply enter 3 wrong answers and it will take you to the 3 trusted friends recovery page like below.

7. Now just click continue and facebook will ask you to choose 3 trusted friends choose the 3 fake profiles of your which you created and added into the victims account. 
8. After selecting 3 accounts facebook will send security codes to these accounts just enter these codes and you will get Password Resetting email from Facebook on the account you created in Step 5

That’s it now you are successful in Hacking Facebook Password with the 3 Trusted Friends Method.

||source||

Continue Reading

Security firm: Facebook is biggest mobile malware threat

The biggest mobile infection threat isn't malware that specifically targets mobile devices, according to new research from security firm BitDefender. Malware that targets Facebook is a far bigger problem for mobile security, the firm claims.


Spam links on social networks are infecting mobile devices via bad links on Facebook because the worms and other malware are often platform-independent and are widely spread as malware that targets PCs. 

BitDefender officials point to Google statistics, which reveal almost one quarter of Facebook users who fell for a recent scam on the social network did so from their mobile device. The URL that was studied was one that claimed to show users a girl's Facebook status which got her expelled from school. It generated 28,672 clicks -- 24 percent of which originated from mobile platforms. Users who clicked on the link -- whether on their PC or mobile device -- downloaded a Facebook worm and fell victim to an adword-based money grabbing scheme


"When data security researchers focus on finding malware specifically designed for mobile platforms, they lose sight of an important mobile platform threat source -- the social network," said George Petre, BitDefender Threat Intelligence Team Leader.

Continue Reading

WireShark 1.4.3

WireShark is probably one of the most famous and most frequently used network sniffer. People like to call it the Network Protocol Analyzer too. Call it whatever, but, your security tool aresenal is incomplete without WireShark. It was previously called as Ethereal.


Also, it is open source. It is cross platform and it has been in development for more than 10 years now! It also appears in the TOP 100 tools on SecTools. This application is very similar to TCPDump in its working, but it has better sorting & grouping actions. It also has a GUI, which TCPDump lacks. It allows the user to see all traffic being passed over the network. It uses pcap & WinPcap where applicable to capture packets.


Here is the starting introduction video for newbies







Features

* Deep inspection of hundreds of protocols, with more being added all the time
* Live capture and offline analysis
* Standard three-pane packet browser
* Multi-platform: Runs on Windows, Linux, OS X, Solaris, FreeBSD, NetBSD, and many others
* Captured network data can be browsed via a GUI, or via the TTY-mode TShark utility
* The most powerful display filters in the industry
* Rich VoIP analysis
* Read/write many different capture file formats: tcpdump (libpcap), Pcap NG, Catapult DCT2000, Cisco Secure IDS iplog, Microsoft Network Monitor, Network General Sniffer® (compressed and uncompressed), Sniffer® Pro, and NetXray®, Network Instruments Observer, NetScreen snoop, Novell LANalyzer, RADCOM WAN/LAN Analyzer, Shomiti/Finisar Surveyor, Tektronix K12xx, Visual Networks Visual UpTime, WildPackets EtherPeek/TokenPeek/AiroPeek, and many others
* Capture files compressed with gzip can be decompressed on the fly
* Live data can be read from Ethernet, IEEE 802.11, PPP/HDLC, ATM, Bluetooth, USB, Token Ring, Frame Relay, FDDI, and others (depending on your platfrom)
* Decryption support for many protocols, including IPsec, ISAKMP, Kerberos, SNMPv3, SSL/TLS, WEP, and WPA/WPA2
* Coloring rules can be applied to the packet list for quick, intuitive analysis
* Output can be exported to XML, PostScript®, CSV, or plain text

Download Wireshark v1.4.3 & Wireshark v1.2.14 (wireshark-win32-1.4.3.exe/wireshark-1.4.3.tar.bz2) here.

Continue Reading

Google enhances e-mail security in Apps

Google has taken a step to stop legitimate e-mail messages sent by its Apps customers from getting caught in spam filters.

Administrators for Google Apps can now enable digital signing of those messages, which helps recipients verify that the messages came from a known, vetted sender, wrote Adam Dawes, a Google Enterprise product manager on a company blog. 

The system uses DKIM, or DomainKeys Identified Mail, which verifies the domain name through which a message was sent by analyzing the message's cryptographic signature. If the message comes from a domain that is considered reputable, it won't be filtered out.
Some users of Google Apps have complained their e-mail from their custom domain has been blocked even if they have set up a proper Sender Policy Framework (SPF) record. The SPF record allows a domain owner to specify which hosts are allowed to send mail for their domain. 

A SPF record makes it more difficult for spammers to simply forge the "from" address in an e-mail message since the recipient will check the SPF record and filter inconsistent ones out.
Google has used DKIM and DomainKeys, another e-mail authentication method, for its Gmail customers for outbound e-mail since 2004.
In 2008, Google worked with eBay and PayPal to ensure messages from those organizations were always properly signed, due to the high prevalence of phishing e-mails. All unsigned messages purporting to be from those organizations are blocked.
DKIM is free for Google Apps users. Administrators can turn it on by going to the control panel and then to the "advanced tools" tab, Dawes wrote.

Continue Reading