NOW I UPDATED THE POST BY THE FACT DAT ALL THE INTERNET SERVICES UPDATES THEIR SECURITY METHODS & REQURED REGULAR LOGIN AFTER A PARTICULAR SPAN SO METHODS LIKE COOKIE CHATCHING,BRUITE FORCE R OF NO USE BUT STILL U CAN READ THIS POST AS D PURPOSE OF STUDY COZ DIS HV D BASIC THINGS WHICH ALL CAN SCIP THINKING AS LENGTHY & BORING…!!
MOST OF THE PEOPLE DON'T WANNA TAKE PAIN N JUS WANT FINAL SCRIP/SOFTWARE WHICH CAN HACK FOR THEM JUST 4 CLICK….. DO STOP DEVLOPING THIS SORT OF THINKING N START'S BRUNING UNLESS U CAN;T GET SWEET RESULTS..!!
DAT'S D WAY'S WHICH R USED TO….
We get numerous calls from people who want to recover AOL®, Yahoo® or
Hotmail® or other online and email passwords. We do not do this type of
work. Many of these people claim that they have lost their passwords because
they have been hacked and now need to get their password back.
As we have reviewed information on the web, we found
very little real information about the actual techniques that could be used
to hack these services. So we decided to pull together a detailed explanation.
What follows is a detailed explanation of the methodologies involved. We
do not condone any illegal activity and we clearly mention in this article
techniques that are illegal. Sometimes these methods are known as "Phishing."
THE HOAX
Let's dispose of one technique that is absolutely a hoax (meaning a fraud:
something intended to deceive; deliberate trickery intended to gain an advantage.)
If you see a newsgroup post or web page with something like the following, it is a
hoax and will not work.
: : : (([[THIS REALLY WORKS ]])) : : :
(1) send an E-mail to passwordrecovery@yourdomainhere.com
(2) In the subject box type the screenname of the person whose password you wish to steal
(3) In the message box type the following:
/cgi-bin/start?v703&login.USER=passmachine&class
=supervisor&f={your aol password}&f=27586&javascript=ACTIVE&rsa
(4) Send the e-mail with priority set to "high" (red ! in some mailprograms)
(5) wait 2-3 minutes and check your mail
(6) Read the message.-Where YOUR password was typed before,
NOW, the password of the screenname in the code string is there!!!
Why does this work? It´s a special decryption-server that
AOL-employees can use to decrypt passwords.The aolbackdoor
account is a bot that reads your authentification from the message
body and identifiying you as a valid AOL Staff-member,
you will get the password mailed back to you. The trick is that this
Bot´s script seems to be a little bit buggy and it automatically recogises
you as an supervisor (AOL-Staff member), even if you use a normal AOL
account. This means, that EVERYONE having a valid AOL account can
hack as many other accounts as he wants.
This is just a scam to steal your password and may explain some of the
calls we get from people saying they were hacked. Never give your
password to anyone. No legitimate web service or customer service
representative will ask for it or need it. There is no magic email address
or series of commands that will reveal the passwords of users.
LOCALLY STORED PASSWORDS
Most browsers, including Internet Explorer® and Netscape®, the AOL®
client, and Windows® Dial-Up Connections allow you the option to store
passwords. These passwords are stored on the local machine and
(depending upon where and how it is stored) there is usually a method
of recovering these passwords. Storing any password locally is insecure
and may allow the password to be recovered by anyone who has access
to the local machine. While we are not currently aware of any program to
recover locally stored AOL® passwords, we do not recommend that these
are secure. Software does exist that can recover most of the other types
of locally stored passwords.
TROJAN
A Trojan is a program that is sent to a user that allows an attacker to control
functions of the target computer, recover information from the target or to delete
or damage files on the target. The name Trojan is given because the program wil
l usually come attached to some other program or file that entices you to run it.
There are a wide variety of Trojans any number of which can be programmed to
capture passwords as they are typed and to email or transmit them to a third party.
To protect yourself against Trojans, you should
never execute or download software or files that are not from a trusted source.
It is critical that anyone working on internet use a virus protection program
(which should catch most Trojans.) Note that since a Trojan requires the password
to be typed or stored in order to be recovered, this is not an effective way to recover
your own password. It could explain, however, how someone could lose their
password to a hacker. Sending someone a Trojan program is certainly illegal and
we do not recommend or condone this activity. A Trojan is unlikely to be effective
in recovering a particular account password since it requires the target to install it.
However, hackers will often bulk mail Trojans to thousands of people in the hope that a
small percentage will get caught. Legitimate account holders who may have been
caught by a Trojan and can authenticate themselves should contact their service provider
to have their account passwords reset.
KEYLOGGER
A keylogger is a program or piece of hardware that records all keyboard keystrokes
to an encrypted file which can then be read later. Based on the order of the keystrokes,
it is usually easy to identify the password(s) from the file later. Like the Trojan, this
also requires that someone actually type the password. Keyloggers come in two types:
hardware and software. A hardware keylogger can be fitted between the keyboard
cable and the computer and can be activated with a few keystrokes. It is then left in
place until after the password that you are looking to hack is typed. Later it is removed
and the file of keystrokes is examined for the password. A software keylogger is
installed on a system and effectively has the same function, however, it is a little bit more
complex to use since it must be installed to run stealthily. A keylogger could be used
to steal a password from someone who is using an office computer or sharing a
computer. It is likely that installing and using such a device or piece of software is
illegal and we do not recommend or condone this activity.
IMPERSONATION
It is possible to impersonate a program on a computer by launching windows that look
like something else. For instance, let's say you login to the MSN® service and visit a
website (in this case a hostile website.) It would be possible for this website to pop-
up some windows that look like something else. They could look almost identical to
windows that an inexperienced user might expect from his local computer. The user
could be fooled into submitting information to the hostile website. For instance, consider the effect of
seeing the following series of windows:
If these could trick you into entering your password, then you could end-up sending your
password to the attacker. Windows such as these could be created to mirror virtually
any program or series of actions. Your browser will likely identify your operating
system and your IP address might identify your ISP. Therefore, a hostile website
could target you with a series of screen shots that look exactly as they should
on your system. The key is that the screen shots are not coming from your system,
but are coming from the hostile website. First, creating such a hostile website is probably
fraudulent and illegal. We do not recommend
or condone this activity. To protect yourself against this type of attack, make sure to
configure your browser for high security and enable warnings for any code that is executed on your system.
SNIFFING
If two people do not share the same computer, but do share the same network,
it may be possible for one to sniff the others' packets as they sign-on.
The traffic between your computer and the internet site you are
accessing may be able to be recorded and decrypted or "played-back."
This is not a simple attack to execute, but is possible if two people are
close to one another and share a hub. Again, this is likely to be illegal and we do not condone this activity.
BRUTE-FORCE ATTACK
Many people want to find software to perform a brute-force attack.
This is really impractical. It would take hundreds of thousands of years
to attempt any kind of reasonable brute-force attack on AOL®, Yahoo®
or Hotmail® and this would expand exponentially if the password is longer
than the minimum length. Using multiple computers or multiple sessions could
reduce this to merely thousands of years. This is highly illegal since these
services own the servers on which an account is hosted. Even if you are
hacking your own account, you don't own the servers and the service
is going to monitor and log this activity. It is extremely unlikely that you
could recover a password in this way, but it is extremely likely that
you'd be arrested and prosecuted for doing this.
SOCIAL ENGINEERING
Social engineering is the name given to the art of attacking the person,
rather than the computer or system. The basic principle is that many
people can be talked into giving someone else their id and password
if they think it is someone that they can trust. For instance, I might call
someone and say I was from AOL and that I was finally getting around
to responding to their technical support question. I would then ask you to
describe the problem that you are having and tell you that we have a solution.
However, I just need to verify the account. Can you give me the username and
password again? A surprising number of people would fall for this obvious scam.
There is no limit as to how elaborate this can be. The more information that is
given by the caller, the more realistic or believable the call is. Again, never give
your password to anyone. No legitimate customer service representative will
ask for this information.
These are the basic methods that we are aware of for hacking an AOL®,
Yahoo®, Hotmail® or any other dial-up or on-line password. Hopefully this
will answer some questions and help you protect yourself against these attacks.
Password Crackers, Inc. does offer an America Online (AOL)® Personal
Filing Cabinet (.pfc) conversion service. We can convert AOL® Personal
Filing Cabinets (.pfc) to either Netscape®, Microsoft Outlook® (.pst) or text
(.txt) formats 
No comments:
Post a Comment