Worried and feeling low???????

Hi All,

I have a concern. yesterday in my company while I was accessing my Yahoo! Mail account one of the associate challenged that he can access my this Yahoo! mail account using my computer and I am positivly sure that he did not knew the password.

I logged out before handling him my machine. Now, he blocked my veiw so that i can not see all what was going on. However I am sure he pulled out the data from the computer, one of the file. And Bingo! he was IN!!!!!!!!!!

Now I am sure he was not using this so called any hacking program. What he had was knowledge, that i do not. I just wish to know what he did!!!!!!!!!

I want to repay him. When I do a google search I get all misleading link.

Help guys.
Thanks

Just for now... And I could be wrong and if I am please feel free to correct me...
Didn't msn go through something with cookies a couple months back where your password was dropped into a cookie and could be decoded extreamly eaisly? or even in plain text, I forget the details behind what that was about...but maybe the same thing?

I think it was something like this. He did fetched some unreadable characters and that worked. Do you think he used my cookies and if yes, then may I know how?

It was either him decoding your cookies or he's got a keylogger on your system. I'd suspect the keylogger before the cookies actually...

I am sure he is running key logger on the system, and looked into the log file and got the password from there.

You said that he blocked your site so you couldn't see what he did then how come you know that he access a file with unreadable characters. Anyways as the key loggers log every single key so obviously information in the log file might look unreadable although they all are keystrokes.

I would concur that he probably had a keylogger.

but a few years ago found a few interesting things with yahoo, one of which was the ability to login to your account via the url and your hashed password (which was in the url). Lets just say i had some fun with that locally. Dont know if it was ever fixed, or changed, or what, but ya...

This guy you were talking about was any smart or something, did he had a great grade where he worked for you to say he had "knoledge".

Now on the one hand, he could use a easy programable(there are tutorials everywhere) keyloger that could record your key strikes. Another fact is that he could use a different keylogger this time to steal your Cookies and decode them. Or he simple got to your computer while you weren't there and backed up some Cookies.

There are lot of posibilities, another plausible one is that someone who knew your password told him.

Anyways, good luck choosing an verry plausible scenario :)

Funnily enough, there are no mentions here of how to remove the keylogger (if there is one). How long did he take to do it? If it took him about 20 seconds and you didn't see/hear him insert any disks, then it's probably a keylogger. So, ship yourself over to Lavasoft and download the Ad-Aware SE Personal executable to install it. Then, run it (preferably in safe mode).

I've also become quite attached to a-squared recently, so you may find that of use as well. :)

Cheers,

-jk

[edit] Oh, and change your password as soon as you can...

who needs a key logger?
there are stand alone tools to run from cd or Jump drive to extract passwords from chached files..

as for revenge.. foget it.. treat the demonstration as an example of security weakness... your habits..

as J_K9 said change your password..regularly.. dont cache your passwords (clear your browser cahce)...

Quote:

---

Originally posted here by Und3ertak3r
there are stand alone tools to run from cd or Jump drive to extract passwords from chached files..

---

Hm...yeah, there are, but even using 350MB rainbow tables it will take at least a couple of minutes to crack the system passwords. And he would have heard something being plugged in, or a CD drive open...

Anyway, next time, don't let the guy on your computer - he obviously knows enough to discover your password, so you just want to secure yourself a bit more and change your password every couple of weeks. And deny him physical access to your PC :D

Cheers,

-jk

Sounds like "session hijacking". My understanding's somewhat limited never having tried it, but the idea is to trick the session state mechanism used by Yahoo via cookies. There's a book called "Web Attacks" that has a whole chapter on it. Or you might google it.

What you need to do is to clear out all your cookies, login to Yahoo mail, and then sign in using SSL. See if he's then able to pull the same trick.

If you use webmail, and I do, you should always be logging in via some secure mechanism or option. In Yahoo, you'll see a "Submits over SSL" link right below the sign in button. Log in via that link. In Hotmail, you'll see "Sign in using enhanced security" in their login box. I don't know about Gmail, haven't used their system. Webmail has some glaring security weakness, primarily cookies and also passwords being sent in the clear. It's not unusual to see passwords in packets that sniffers like Ethereal pick up.

Let me know if your associate is able to pull the same stunt when you've logged in securely. I'm curious to know the results. Thnx.

A small clarification:

Paragraph 2: "What you need to do is to clear out all your cookies, login to Yahoo mail, and then sign in using SSL." should read, "What you need to do is to clear out all your cookies, then login to Yahoo mail using SSL."

--sigh--

I'll never make it as an editor...

:confused:

Quote:

---

I'll never make it as an editor...

---

Not if you don't use the "edit" button.

Since we are on the topic of keyloggers...
Just for fun, look at the back of your machine for any hardware based keyloggers.
To see what one looks like, go to google, click on the 'Images' link
and type in Hardware Keylogger. That will show you pictures of one of the more
commonly used types.

errr... while highly doubtful, there is always the possibility that IF a hardware keylogger
was used, it was built into the keyboard itself.... but as I mentioned... doubtful. That
would cost quite a bit more $$$ and is seen more-so in government related environments.... and even then, not that often.
Pics of both: http://greenroom.nochex.com/showthread.php?t=3756

*If you did find one by chance, I'd take it/hide it and see how odd the guy acts when he finds it missing. LOL*

You dont by chance use yahoo messenger do you? I think you can go straight to your inbox from a link in the app if messenger is logged in. Just a thought.

I don't mean to be untechy like, but IMHO it seems to me that it was like a stunt you just pull out of the bag. This to me does imply knowledge of how to get past the system.

If I wanted to pull out a parlour trick it would be something that I knew, I would not go to the trouble of setting up keyloggers and the like to prove a point (unless this guy really had no self esteme what so ever).

I think more or clearer information on what was seen is needed.

Quote:

---

However I am sure he pulled out the data from the computer, one of the file. And Bingo! he was IN!!!!!!!!!!

---

Unfortunately does not really say what happened. Did he physically insert something into the computer, or do you mean that he looked through the files on your computer?

I think BrokenCrow is much more on the right track, though, I don't know too much about hacking computers as I'm sure you guys have figured out, but I know a little about hacking the mind.

:smokes:

Jonny UberFrond

Greeting's

Almost everyone has given their 0.02 $ but the fact remains that no one COULD concluded and if you want a definite answer you need to go beyond the amount of information you have provided. I'm sure everyone who has replied to this thread will come down to an unanimous conclusion if you provide some information.

i think following might help.

1. Are you the owner and the only user of the computer ? (what i mean is do you only use it or does he have access to it. If he does have access what is the user level of access that he has)

2. Do you use any kind of password storing application or do you even use IE AUTOCOMPLETE feature

3. Did you clear your cache file after logging off ?

Now if he's using a old version of some free key logger THAT DOES NOT ENCRYPT THE FILE WHERE IT STORE ALL THE KEY STROKE's then following is a fool proof way of getting the file :

type some long paraphrase like (just an e.g.) :

open notepad type : qscfthnjil.;[1234567890
write it down on a paper
close the file but **DON'T SAVE IT**
Reboot your PC
open search and then write the same phrase in the : A WORD OR PHRASE IN THE FILE.
make sure you search all the drive's and all file's
if there is a key logger you will surely find it and your yahoo password in it.

BUT IF THE KEY LOGGER ENCRYPTS THE FILE THIS METHOD WILL NOT WORK then simply download a good spyware cleaner like SPYBOT OR ADAWARE AND update the def files and let it do the rest


Apart from this there is possibility of cookie editing if he did that with a software then there is a possibility that it might show up in start menu (if you USE XP)

Beyond this why don't you scan your system for any malware, empty your cache (if you use autocomplete delete all form data in that) and then log in (if you use IE check the option of not storing encrypted web page's on the disk, then log-in in front of him. LOG-out and delete all cache files (use a program like ccleaner [www.ccleaner] if you want) then ask him to log-in to your account.

oh yes I'm sure i don't need to say this but before you do the above step change your password (keep it complex and NOTHING RELATED TO YOU and/or your LIFE)

If your last password was something that you liked, someone's birth date or anything that the other person might have known then he simply social eng. you

for the last part where you want to repay him my suggestion is that you find answer to how he cracked into your account first rather then going out to crack into his account. GOOGLE WILL NEVER GIVE YOU A CORRECT LINK OR SOFTWARE TO HACK INTO YaHOO OR MSN. NOBODY KEEPS A FILE WHERE YOU ENTER SOMEONE"S EMAIL ADDRESS AND YOU GET HIS PASSWORD
Also if you have fallen for a hoax of sending an email to some ID with your password and the email of the person who's password you want then you might not want to do that again and change your password again.

any chance he just used the history file?

Hi Guys.
Looks like you are right. in saying that he used my cookies. And yes that took somewhere around 1 minutes to do the needful. Now as for a kelogger I am sure there is none in my system. I have run a complete scan of my system of my system using the Ad ware downloaded from Lavasoft. Still nothing. Now I have cleared my cookies. And will never let him touch my system. But why and how this happen. i really need to get and know what was that he did with my cookies. Any Help!

Thanks

This has seemed real suspicious for the starting to me so I'm going to ask you, why must you know how he did it? You seem to be asking for a step-by-step procedure on how he got your password and logged into your account.

Quote:

---

This has seemed real suspicious for the starting to me so I'm going to ask you, why must you know how he did it? You seem to be asking for a step-by-step procedure on how he got your password and logged into your account.

---

Whilst I agree with you Raion, and I think you are right to voice it, I would argue that he seems come from a place of genuine newbie curiosity.


Jon the fluffer Frond :bigpimp:

If someone broke into something of mine, I would definitely want to know how they did it. Especially if it could assist me in preventing it from happening again. There is no harm in knowing how an attack is carried out, it is what you do with the knowledge that matters.

Quote:

---

Originally posted here by bisht_kamal
...I am positivly sure that he did not knew the password...

---

If this is legit.. I disagree. I am very confident he has done some shoulder surfing, can diving, listening in, etc. and acquired your login, then waited until the right moment so he could "display his skillz". It is one of the easiest (oldest) methods to gain access especially if your are not expecting someone (like a coworker) to do it.

I used to do this and then walk up to the person, let them know that they should change their password. They would ask why? And then I'd tell them their password and how I acquired it. I've done it in grocery stores and told the patron their pin, and then told them to be more secretive about how they enter the numbers on the keypads. Some folks get pissed, but others would say, "No way! That was too easy, I'm getting it changed." Fortunately for them, I'm one of the good guys!

Anyway, here's an easy test. Change the darn password, to one a good solid one, delete all the history, cookies, etc., as mentioned above, and then have him do it again! I will eat my words if he can!

cheers

I still say: you need to clear out all your cookies, login to Yahoo mail, and then sign in using SSL. Then see if he's then able to pull the same trick.

If he can't pull it off this time, it's a session hijack, probably via a cookie. And if he did use some kind of aforementioned hijack, he probably does NOT have your password. He needed a cookie off your machine to pull it off.

If he CAN pull off the same trick after you cleared the cache (use CCleaner!) and logged in via SSL, well, I'd say it was a keylogger. Another thing: if it was a k-logger, he's got your user name and password and can pull off the login to your Yahoo acc't from HIS workstation.

You need to play with this guy a little bit. Don't overreact. Play it cool and glean from him what you can. Let us know.

Maybe you could show him a trick on his machine. Tell him not to look, bring up a command prompt, then type in "format c:".

You can always say you're sorry.

:cool:

I could be wrong. According to MSDN, SSL affords scant protection of your cookies:

http://msdn.microsoft.com/msdnmag/i.../08/WickedCode/

One more thing you might try on your associate, Kamal, is a little social engineering. Just ask the guy about session hijacking using cookies. If he gives you a "Huh?", just ask him, "The cookies thing, how'd you do it EXACTLY?"

Make him think you're on to him (you are, aren't you?) and see how he reacts. Don't be intimidated or afraid of the situation. Just put him on the defensive...

Being suspcious Ok, You have the right to be. I hope you remember your first days in the world of computer and networking. The itch that hits you right into eyes, when you see something out of the box happening. The wonder wand that you wished was yours when your saw the magician used to pull up a out-of-air rabbit. Did'nt you as a kid felt the curosity to know what was done. I think that is how everybody as a learner shold feel.

Practical man and visiulaization !!! A lot of theroy has been given and beleive me it has helped me a lot. but then It is not my resolution. And that is why I am curious.


Remeber it was your curosity that made you understand how to type in to computers >> Catch a fish >> Ride a Bike and if you remember that. Then you might, as well remember the joy of succeding in any one of them.

I understand that what I am talking about is not something like diriving a bike, I can use this information to access somebodies account. May be I am tempted to and may be I am sane enough to value his/her privacy. But that does not means that learning to drive a bike and even after learning the Bike. I gaurantee I am not prone to accidents.

I THANK YOU all for you efficent feedbacks. My Search will however continue.

Also Raion, just think where we would all be if Newton and Bush would not have been curious to know why??????

And think where you would be???

Thanks all
You were a real nice people to talk with.

See you Raion.

Greeting's

Okay i have to post my questions again because you still are looking for the answer :

1. Are you the owner and the only user of the computer ? (what i mean is do you only use it or does he have access to it. If he does have access what is the user level of access that he has)

2. Do you use any kind of password storing application or do you even use IE AUTOCOMPLETE feature

3. Did you clear your cache file after logging off ?

If you just answer them, you will get your answer.

You said you logged off. I've seen plenty of instances where hitting the back key (after logging off) retrieves the last page you were on (including e-mail). It may not allow you to do anything without logging in (if you try anything, it'll usually give a timeout message), but I've seen it happen on a lot of pages. Yahoo may not be a page where this happens, but you never know.

A.J.

Hello there,

Quote:

---

I am sure he pulled out the data from ... one of the file.

---

Quote:

---

he blocked my veiw

---

How can you specify what he did & be so sure about it, when you couldn't see anything!.

Plus if I was the one with such a knowledge, then I wouldn't want any
of my other associates knowing my secret capabilities, unless you are a
very close friend, but then in this case I wouldn't hide anything from you.

So I think that the best think for you to do is to persuade your friend to
show you how he did it, then you can come and tell us.

Quote:

---

The wonder wand that you wished was yours when your saw the magician used to pull up a out-of-air rabbit

---

I have never been able to pull a rabbit out of a hat, but I can pull a hair out of my ar*e.



Sorry guys..... I know.... but I couldn't help myself...... I mean what do you do when you see such a blatant comedy moment?



The Fromedy Store :jester:

Quote:

---

I have run a complete scan of my system of my system using the Ad ware downloaded from Lavasoft.

---

Well that will gaurentee a Spyware/Keylogger free system..

there are a lot of other questions to be answered... here is my final comments:
A-Squared
The Cleaner
Ewido

this is wher you will start to assure clean.. all other methods of how it was done have been explained.. If you dont understand what has been said, then you have a long way to go before you have a chance off pulling off a similar stunt.

I wont repeat my other earlier comments..

There are NO guarantees...only vigilance.

He might have been running Cain & Abel to crack IE's MRU hashes, He may have been running a plugin on the browser that remembers passwords (without prompting the user), possibly the keylogger or else he may have been running Spike proxy and had the browser set to pass through the local host proxy, capturing any and all data in the process.