Email hacking is illegal access to
an email account or email correspondence.Email on the internet is now commonly sent by
the Simple Mail Transfer Protocol (SMTP). This does not encrypt the text
of emails and so intercepted mail can be read easily unless the user adds their
own encryption. The identity of
the sender or addressee of an email is not authenticated and this provides opportunities for
abuse such as spoofing.
Email Spoofing
Email spoofing is a
technique used by hackers to fraudulently send email messages in which the
sender address and other parts of the email header are altered to appear as
though the email originated from a source other than its actual source. Hackers
use this method to disguise the actual email address from which phishing and
spam messages are sent and often use email spoofing in conjunction with Web
page spoofing to trick users into providing personal and confidential
information.
Software is usually used
to collect or generate the email addresses that are spoofed. Hackers may create
a virus that examines the contact information on an infected computer. That
information is collected and sent to the hacker who then uses another piece of
software a mass email program to send
out bogus emails using the addresses collected.
Alternatively, hackers
may use software that generates random email addresses to use to disguise the
actual origin of the message being sent.
Types of email hacking
1.Phishing
2.RATS(remote administration
tools)
3.Key logging
4.Social Engineering(technique
used by attacker by answering security question)
5.Side jacking(Session Hijacking)
6.From the mail server
1.Phishing
Phishing is an e-mail fraud method in which the Hacker
sends out legitimate-looking email in an attempt to gather personal and
financial information from recipients. Typically, the messages appear to come
from well known and trustworthy Web sites. Web sites that are frequently
spoofed by phishers include PayPal,
eBay, MSN, Yahoo, Best Buy, and America Online. A phishing expedition, like
the fishing expedition it's named for, is a speculative venture: the phisher
puts the lure hoping to fool at least a few of the prey that encounter the
bait.
Techniques
used within Phishing emails
1.Official
looking and sounding emails
2.Copies
of legitimate corporate emails with minor URL changes
3.HTML
based email used to confuse target URL information
4.Standard
virus/worm attachments to emails
5.A excess
of anti spam-detection inclusions
6.Crafting
of “personalized” or unique email messages
7.Fake
postings to popular message boards and mailing lists
8.Use
of fake “Mail From:” addresses and open mail relays for disguising the source
of the email
An Example of a Fake Gmail Home Page
Things to keep
in mind to avoid Phising attacks
1
Most fake communications convey a sense of urgency by threatening
discontinued service
2.Many fraudulent emails contain misspellings, incorrect grammar,
and poor punctuation.
3
Links within the fake email may appear valid but deliver you to a
fradulent site.
4.Phishing emails often use generic salutations like "Dear
Customer," or "Dear account holder," instead of your nameThe address from which the email was sent is often not one from the
company it claims to be.
An Example Of a Fake Email
2.RATS(remote administration
tools)
A RAT is also a shortcut
called Remote Administrator Tool. It is mostly used for malicious
purposes,
such as controlling PC’s, stealing victims data, deleting or editing some
files. You
can only infect someone by sending him file called Server and they
need to click it.
3.Key logging
Keystroke
logging (more often
called keylogging or "keyloggers") is the
action of tracking (or logging) the keys struck on a keyboard, typically in a secret manner so that the person using the
keyboard is unaware that their actions are being monitored. There are numerous
key logging methods, ranging from hardware and software-based approaches to electromagnetic and acoustic analysis.
Types Of Keyloggers
1.Software-based Keyloggers
2.Hardware-based Keyloggers
1.Software-based Keyloggers
Software based
Keyloggers record each and every keystroke typed with the help of a Software.These
keystrokes are stored in a log file.
An example of Keystroke log file
2.Hardware-based Keyloggers
Hardware based keyloggers record each and every keystroke typed with the help of a
Hardware device.
An Example of a typical Hardware Keylogger
An Example of how Hardware Keyloggers are connected to the system.
Countermeasures
Use of Virtual keyboard or On-Screen Keyborad can be an effective method to avoid
keyloggers.But,it will not work under certain circumstances.
4.Social Engineering(technique
used by attacker by
answering security question)
Social
engineering is the
human side of breaking into a corporate network. Companies like ours with
authentication processes, firewalls, VPNs and network monitoring software are
still wide open to an attack if an employee unwittingly gives away key
information in an email, by answering questions over the phone with someone
they don’t know or failing to ask the right questions.
Forms of Social Engineering
Social
engineering is not
limited to phone calls; many organizations have reported cases involving
visitors impersonating a telephone repair technician requesting access to a
wiring closet or a new member of the IT department needing help accessing a
file.
People, for
the most part, look at social engineering as an attack on their intelligence and
no one wants to be considered “ignorant” enough to have been a victim. It’s
important to remember that no matter who you are, you are susceptible to a social
engineering attack.
If you
suspect social engineering – don’t be afraid to ask questions
and/or notify your IT department. If a caller requests information that is
technical in nature, please refer them to your IT department.
How to prevent social Engineering
Never give out
1.usernames;
Administrators should know it or can find out themselves
2.passwords;
Administrators can ask your to enter it into the computer, but don't tell
anyone
3.ID
numbers
4.PIN
numbers
5.server
names
6.system
information
5.Side jacking(Session Hijacking)
Session Hijacking is an attack by which a hacker exploits a valid
computer session and gains access to a client’s session identifier. Since HTTP
is a stateless protocol, when a user logs into a website, a session is created
on that Web Server for that user, this session contains all this user's
information being used by the
server so the username and password is not needed at every page request. The
server uses a unique identifier(Session Identifier) to authenticate this user
to this session, this session identifier is passed between the web server and
the user's computer at every request. Session Hijacking is an attack by which
the hacker steals this user's session identifier and then sends this session
identifier as their own to the server and tricks the server into thinking they
are that user.
After
gaining access to a client’s session identifier for a website, the hacker then
injects the client’s session identifier into his/her browser. From then on,
when that attacker connects to that website, since his session identifier is
the same as the authentic user, he will be logged in as that userand will have
access to all of that user’s information and privileges on that website. Note -
attackers cannot get a user’s password using session hijacking.
1. Use
Secure Connections (Achieved through Secure Socket Layer(SSL) as much as
possible, since SSL creates an encrypted connection between the client and
server, any data the attacker steals during this transfer would be useless to
them. However, SSL does not fully secure against this attack, and hackers can
still use session hijacking even over HTTPS
2. Regenerate
user's session identifier often, therefore, even though the attacker may manage
to steal a user's session identifier, when it is regenerated, the Session
Identifier he stole would be useless.
3. You
can implement an IP Address Check to match a user's Session Identifier to
his/her IP Address. However this may have its limitations.
6.From the mail server
Databases have been the heart of a commercial
website. An attack
on the database
servers can cause a great
monetary loss for the company. Database
servers are usually hacked to get the credit card information.
And just one hack on a commercial site will bring down its reputation and also
the customers as they also want their credit card info secured.
09:01
Thomas Rajasekar
