Ethical Hacking: February 2011

Phishing/Case Study

“A heist!!!”

“I can’t do it man, nope, I wont get myself involved in this”

“Oh c’mon pal, it’s just a simple task, nothing will happen, trust us”

“Trust you!!! How could I if MY life is involved in this”

Breezy evening, terrace of a block in the huge campus of this university in southern part of India, Andie, Carrie, AJ and Joe are feeling the heat building in amongst these five shady silhouettes in the twilight as they pit themselves to bulldoze Viv. Their conversation under the dark blue sky was getting heavier and louder as none of these five boys seemed to be on their toes. They seemed like stomping each other verbally over something that may sound as astounding to a passerby as to themselves.

“No way, I would involve myself in this”

The conversation wasn’t coming to any point and all of them just seemed to overcome each others’ dilemma with more confusion over something that they all were feeling restless about but consciously were trying to convince Viv to join their bandwagon in their ‘modus operandi’.

Youth, as they say, is intrigued by the unknown and that’s what exactly happening here was for these engineering sophomores. They were just like any other easy going undergrads but they were just different in one aspect. As individuals they were just a part of a torrid system of uncanny monotony but when they teamed up, their individual abilities cracked open knew vistas of their creativity to venture into the unknown and rip open the doors of the unexpected.

Viv was an individual with a very thoughtful mind and his penchant to learn and learn whatever he does to the core made him different from rest of the pack, the other members being outrageously creative and introvertly submissive to the idea of the other side of the thin line. All these individuals hailed from very different demographies but their common thought process kept them driving as a team to build up new systems on new edges of virtuosity.

As a team, they fitted like a jigsaw to complete the puzzles that came in there way. There penchant for going behind the systems motivated them to explore new vistas. They gradually assimilated themselves to combine into a unassuming unit of disruptive strategies over virtual world.

Andie was known in his entire campus as the guy with the never ending resources for whatever he wanted. His ability to network with people and talk them out to reveal whatever they could was widely synonymous. He could work out with anyone anything he wanted and once in high school, Andie started working out new ways to exploit the loopholes of the existing system from airlines networks to corporate hierarchy. His eye for understanding the psychology on human interaction made him stand out of the crowd and this incident few years back he materialized embedded his name in the minds of his close associates as the ultimate craftsman of Social Engineering.

“To follow the path:

look to the master,

follow the master,

walk with the master,

see through the master,

become the master”.

“Turn … turn… turn” nice voice of a lady comes, “Welcome to Creative Offshore Services. Please dial the required extension… for technical services please press 10, for inquires press 20, for sales support press 600… for further assistant press 0 for operator”. Andie grinned it seems good service corporation. Andie presses 600. Again a lady speaks out. “Welcome to Creative Offshore Services, How I can help you sir?” Andie with some anxiety but with smooth and confidant sound, “I am the Head of Technical Support at IT Set Corporation. Last day one of your support person came to fix my computer. He worked his job very well. Only your corporation is supposed to be having such excellent engineers”. Miss Jacky at the other end of line feels some relief, as it is at last a pressure- releasing call since morning. It was end of the month and number of calls was high as usually and she was also worried about the dues to be paid at the week end. She speaks out, “Thank you Sir. How I can help you Sir?” Andie, “Actually I have a little problem here with my computer that Engineer gave me some tips to over come this, but unfortunately I forget the name of that gentleman” Andie is smiling but feeling a little bit sweating. Miss Jacky “Oh, Sir. This is not a good situation, as we don’t know his name. This is somewhat unlucky Sir. Can I assign you another Service Engineer? Pleas give’s… Andie abruptly jumps in, “Thanks nice lady, but I feel he can help me better. He told me that he has just joined head office a few weeks ago. Do you know him?”. Miss Jacky is feeling some moral pressure to help out such a nice person and not to lose a company customer. Suddenly some thing flashes in her mind, “Well Sir, we have quit a large number of Support Engineers but here I know few persons who joined the office few weeks ago” then she utters three names (Robert, Michel, John). Andie wrote down his required names and requested her for extensions, after writing down these extensions he thanked her for her nice work and told her that he will check these Engineers one by one.

“Turn… turn… turn” Recorded tape starts playing back but Andie was looking in hurry, he didn’t bother to hear, he just dialed 20. “Good Morning, this is inquiries section”. Andie stared, “I am the Head of Technical Support section, today I have some problems in my main office computer lab, I want to contact with your IT Manager for some assistant. What is his office number?”. Inquires section checked a few lists of names and spoke out a number and name. Andie thanked him again. Andie felt great comfort to build such nice relations with the help desk people as it is always helping in future business.

It was midnight, no one was in building, as company to works since morning 9:00 to evening 5:00. “Turn… turn… turn”, a phone rang up in one of IT manager’s room. There is no one to receive the call. A person in a dark room is patiently holding a handset and listening the bells on the other side. Then a person speaks out, its Copperhead IT manager’s office, and I am not available at this time. Please record your message” then recording system starts. He cuts off the line without uttering even a single word. He then dials out through the same sequence for some more time and listen the voice very carefully each time. At last he smiles a little with a twitch of his head.

“Turn… turn… turn” he is waiting anxiously until some one picks and speaks out. “This is support section, Michel with you Sir” A firm voice which is seemed to be always ordering uttered, “Mr. Michel, I am IT Admin Copperhead, and here we have some serious problem. Our servers are getting some data corruption and your files are also included in that corrupted data”. Mr. Michel finds it a good time to impress his new senior, “Sir, how can I help you….?”. “It’s not a big matter to fix, thanks. Anyhow give me your login name and password to fix it. You can log in and log out after a few minutes to check normal work”. Mr. Michel felt a little bit depressed and gave out his login details without any hesitation. The above conversations just appear normal telephony talks but it was not as simple as it was appearing. That was a dooms day for that company. Eventually that company get hacked and lost some money but a lot of reputation. Admins were still in fuss how the attacker came in initially. The company was using best software and hardware techniques to avoid such misfortune. Problem was not technical configurations in their case.

They were the victims of so under estimated or simply over looked art of cracking know as “Social Engineering”. Social Engineering is a combination of art and science that is used to get some kind of information by the means of human resources with out breaking the systems itself. Mostly corporations are spending big bucks on technical and physical security like Firewalls, Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), biometrics and many other things. But mostly the administrators and management ignore the weakest point in security “Human beings”. And the crackers are the persons how mostly pay their due attention to this aspect. By the way, how can we define voodoo art know as “Social Engineering”?

Because of different ways and natures of attacks involved in Social Engineering there are slightly different definitions but the definition that suits most criteria to our problem is as, “The art and Science of the psychological tricks to get the desired results from human beings and to make them comply accordingly for unauthorized operations is known as Social Engineering (in contrast with computer security)”. The goals of the Social Engineering are same as traditional hacking. But by Social Engineering hackers got these goals by implementing social skills and exploiting human tendencies. By Social Engineering crackers are not the mind controllers of the victim. Victim will not do the things out of his normal behavior. He will perform the usual acts but unconsciously he becomes the asset for cracker. Crackers are exploiting the nature of human beings. Most brilliant crackers of the day study the human psychology with same effort and attention as they learn new bugs in most secure operating systems. They will consider/study all the possibilities according to the nature of attack being performed. And they pay more attention in preparations for social engineering than to perform it like normal technical hacking. And every body knows that time taken in a hack is just a small fraction of the time to gather the proper information regarding the victim for real attack.

Andie is the master artiste of this aspect of Information Security paradigm and gels well with other teammates with similar capabilities to catapult the information they require out of the system. Carrie just knows where the best modes to monitor the resources of the system are. He knows the entire mechanics that goes into securing and cracking the system over personnel security. He is the best man to understand and spoof everything that involves technology for physical security or in other words he is the man of biometrics. Though biometrics often are touted as a way to restrict criminality, privacy advocates fear biometrics may be used to diminish personal liberties of law abiding citizens as well. Developments in a huge range of new technologies besides biometrics – digital video, infrared, x-ray, wireless, global positioning satellite systems, image scanning, voice recognition, DNA, and brain wave fingerprinting – provide government with new ways to “search” individuals and collect vast databases of information on law-abiding members of the public.

The best part comes when they always knew they had something in them, although being radically distinct from each other, which combined them to fit together to complete the jigsaw for something big. They always knew they would require each other at some or the other phase of time to wherever they go, whatever they do. And thus comes the commanding quality of Viv which truly distinguished him from the rest of the pack. He always had that knack of steering the ship to the shore and ‘just in time’ as their lingo goes. Viv was the man with ideas as well as resources; in short, he knew something about every thing and was the jack of all trades in true sense. And it was his original idea which actually took the shape of something he never predicted.

On this humid Sunday, the pack as they called themselves when 5 combined gathered at Viv’s home just for regular chit chat when they started talking about their difficulty at school and the remedial measures. None of them were an above average student at school but were never looked down due to that distinct nature of theirs with their own niche to bank upon.

“It’s getting really hard to sustain at school pals, I am clueless”

“Our grades are going down and down as usual, wish I could do something with these examination guys”

“Wish you could do something with these guys? What you gonna do, bribe them”

“I don’t have that kinda money, none of us have, but we have something more precious”

“Oh c’mon man, don’t say you will break open the exam network to alter the results”

“I am not saying that”

“Then?”

“I am doing that!!”

All of them were hinted by Andie over the turn of events due to this conversation started by Viv what they might be in if not now maybe some time later. And that’s what exactly was happening although now with a different motive.

Over the years after the high school, Andie, Viv, AJ, Carrie and Joe developed unique skills to subconsciously complement each other in some or the other way. Andie reknwoned for his soft skills and hard hitting thoughts came to be known as the Social Engineer whence he kept on rolling his expertise to break open whatsoever he could come across till he could not be caught and nabbed and that has yet not happened. Viv was the artiste of planning and execution, the person who steered the team to the goal secreting what was needed from which person and in which magnitude. In short, he was the person of resource utilization and team management, without him being the focal point of the team; they loose sheen and subsequently fall apart like a bunch of loosely tied drumsticks. AJ is a mechanically technical guy, the kind of people who build the system from the inputs of others. Similar to an assembly line workforce, AJ could code anything under the sun in all the major languages and the warehouse of all the network security resources which subsequently will be needed as ammo to sustain and liven their dream. Carrie as they say is the authoritarian Cancer (his sunsign). He could plague any system with the world’s best authentication plugins to plug out the information he required. Joe belonged to that rare breed of craftsmen who just could use simply any tool to work out something productive out of it. He could execute any network security task with aplomb combined with AJ’s expertise to work out the details of the IP Cameras at the Stuggart Airport in Canada to the information security setup at a world class Bangalore Corporate’s Campus.

And thus this day when they all stand together trying to save the falling apart due to the SMS all of them received that read

“URGNT M3TNG REQD, CME 2 APJ BLCK 8 5 SHRP”

From Andie which he rarely uses his cell phone for, they couldn’t resist their reunion to form a brutal force on a tricky heist.

“Whatsup man, what’s the matter”

“You won’t believe your ears when I speak out what I have got for you people”

“You buying us Mercs”

“I am getting you resources for it”

At this juncture, Viv sensed something fishy as Andie doesn’t talk anything he can’t do and this sounded strange.

“Ok what we get here for is a plan, we will materialse and when we are done, we are driving away with our dreams”

“Speak clearly man, our patience is running away”

“Look, I came across these people who are rich and desperate to do anything to set their things rite at school”

‘So???”

“So we will help them, we will use our expertise to access their school resources and set their things rite in lieu of which we would be making our dreams true”

“Hey hey hey, what all is this, what you talking about man”

‘We will hack open the Central board of Education Server and will set their grades rite, what we required the most but couldn’t do it that time”

Carrie added

“Hmmm it seemed like it will be a benevolent job too, we desperately needed to do that but couldn’t so we realize how much they require it”

“Yeah pal, we just need to plan this heist well and everything will be a cakewalk for us”

And this was the flashpoint, when Viv couldn’t stand this conversation any longer and retaliated with full denial. When finally the 5 of them thought of goin for the majority voting. However hard they tried but keeping them apart as individuals was the hardest thing they could do to themselves and finally Viv couldn’t find any supporters for his cause. And half heartedly he gave into the honey trap.

Next day Andie explained to Vivek what all was the rough idea of what they would be doing for him to polish it. They would start with the apprentice of Andie, a victim of Social Engineering in the data warehouse of the computing facility of CBE. Raghu is a high profile techie with the computing facility and Andie came across him through the community gatherings of their native state. What now Viv’s task with Raghu was to access the information of the Data Servers and at an appropriate time when no one else could know about the activities except Raghu going inside the facility. The Pack would be using the remote administration to monitor the time of hibernation for the servers and at the exact time span between the servers updation and hibernation, they would carry out the data transfer through physical as well as network tools.

Day 1 Saturday 2150 Hours

Carrie carries out the first test of the final plan when he uses a public GUI in the form of a search engine to spoof the IP cameras of the facility. He goes to the URL of the search engine and types the INURL command with the given IP Cameras address and bingo! He gets access to the cameras and can monitor any movements inside the facility even spoofing the screens at the reception allowing any intrusion activities at any hour. The perfect plan started with a bang and their motivation seemed at a real high.

Day 2 Sunday 0500 Hours

As Raghu had the late night shift, he stayed with his colleagues inside the facility itself when at the wee hours the shift was to be interchanged. All the colleagues left the facility at 0500 hours sharp when Raghu stayed back to wrap up the residual ‘work’. The next shift was about to be taking place within 15 minutes but who knew these minutes are the years of solitude for these geeks to command the entire facility in their hands. As the IP cameras were already in the command of Carrie, the reception and the personnel security couldn’t gauge what was going inside the facility within these 15 minutes. Raghu moves inside the computing facility and sends the dynamic IP of the systems with the required data to Viv when he monitors both AJ and Joe and telnets the two servers between the two cities miles away within seconds. The pack’s installed setup of Pentium machines were tolerant to T1 data transfers and could sustain work of hours and hours without much performance deterioration. As soon as the servers gets connected, AJ uses the network scanner to find the open ports and to gain the administration password he uses his password cracker with the dictionary attack to compute the 5 digits password as informed by Raghu which the system kept updating every second hour. The password cracker starts computing the password when within minutes he couldn’t still see any progress in the cracking. He uses an alternative to compute the password now with the Brute force attacks and AJ chooses 0 -9, ~ – & and A-Z, a-z as his options and 3 minutes…4 minutes their patience running away, 5 minutes…and they are done. So he logs on in the system as Admin and alters the XLS file with the given exam codes of those candidates. Joe backup the data and copies the file in order to maintain immediate assurity of the work. And thus they are done by the end of 12 minutes. Raghu moves out of the facility with aplomb and the perfect plan has been executed without any hassles.

Day 3 Monday

The working day starts at the facility and Raghu comes at the morning shift when Akash stood there in the room of the systems with their colleagues. Akash looks at Raghu with indifference when he asks

“How is life goin?”

“As in?”

Raghu gets startled. Akash points at the anonymous IP logged in the system on Sunday Morning. Raghu gets a gripping chill running down his spine and stays calm. After constant grilling through the colleagues, Raghu still didn’t spill any beans when Akash runs the traceroute program over the anonymous IP and it ends at the city and place known to Akash as well as Raghu. So Akash still asks Raghu if he knew anything as the IP was logged in the system exactly at the time when he took a time off during the Sunday morning. But he couldn’t say anything. So Akash informs the local authorities to keep Raghu under vigil while he conducts the nabbing trail of the culprits and what they did with the systems.

Akash wanted to call the computer the IP Address was logged in but he knew it would extend the chase. So he preferred to land at the place with his teammates from 24 hours Information Security Response Team and books the itenary for the same.

Day 4 Tuesday

Andie is at an all time high as he couldn’t believe what he executed with his mates actually came out this good. But the perfect plan was still inkling Viv of the lull before the storm. And he kept a low profile while Andie, Joe and AJ carried on with the parties and planning of the money they got after altering the results of the Candidates in the Educational Board Server.

Suddenly, Andie gets a call in the middle of the Party from his college. Andie couldn’t get a hint of what exactly was going to happen within such a short time and to all the involved.

“May I come in”

Andie gets inside the principal’s room with the other 3 with cold feet and stands in front of him. While the gentlemen seated in front of the principal they still couldn’t have clue about.

“How are your studies going?”

“Pretty good Sir”

“What have you people been doing lately part from your good studies?”

“Studying only Sir”

“May I confirm your home address please, all of yours”

And they confirmed the home address of each of the person including Viv and that was it. Akash stood up from the chair in front of the principal and matched the addresses of the IP with the place with what they confirmed. And handed them a dossier as well as notice slapping on them a Fine of Rs 2 Lac to be submitted within 20 days subject to which they would banned from using their PCs, Laptops etc for next 10 years and if they don’t, an RI of 2 years for each of them.

Ethical Hacking

Thursday, February 24, 2011

How to Hack Facebook Fans Page

Tuesday, February 22, 2011

Wednesday, February 16, 2011

Sending A Fake Mail Using Telnet....

Monday, February 14, 2011

How to Control a Remote Computer using Lost Door

Thursday, February 3, 2011

Quote of the Day

Tuesday, February 1, 2011

Phising Case Study

Phishing/Case Study