Hacking and Cracking

Hacking and Cracking

Facebook Account Hacked! What To Do Now?

Posted: 17 Jan 2016 09:12 PM PST

Every single day i get emails in my inbox and on my facebook page from users querying about how to recover hacked facebook account and a common problem i see in all of them is that they are proactive. Everyone searches for Facebook account recovery softwares, Facebook hacking softwares and recovery mechanisms after their facebook or any other email account has been hacked. In this article, Gary suggests methods to identify if your computer or email account has been hacked and methods suggesting what you can do after your facebook account has been hacked.

In today's digital world, it is unfortunately not uncommon for an account or machine to become compromised by an attacker for nefarious purposes. During your searches for a step-by-step solution, your frustration may hit the breaking point, as you scroll through page after page, listing preventative measures that it may already be too late for. No problem. In today's article I will outline simple strategies that should get you back in control of your online accounts and devices after a breach is suspected or confirmed. These instructions will be laid out in a manner that should be quite easy for an average user to comprehend and execute. But first, let's take a minute to understand exactly how this probably happened in the first place.

NOTE: If you are potentially dealing with this situation right now, please skip ahead to the " What do I do?" section of this article, first. Then be sure to read the rest.

Did I Get Hacked?

You're browsing around online and suddenly your friends on social media are asking you what these links you keep sending them are, or perhaps your password to an online account has been changed, emails are being sent from your email account, or there is just something strange in your activity log. Do any of these mean that your account has been compromised?

First of all, always assume your account and system have been compromised and take the appropriate measures to secure them, when in doubt. Do not let an attacker maintain a foothold and continue masquerading as you and/or stealing your sensitive data and files, while you come up with excuses to justify unfamiliar activity. Also, while many online services and accounts have a 'connected devices', 'location information', or 'login activity' viewer in their settings, this should never be advised as a sure-fire way to rule out being hacked. There are many ways that these features can be rendered useless - malware can be installed on the user's machine which sets up an HTTP or SOCKS proxy on the machine of the user, session cookies can be stolen, and even the online account settings themselves can be manipulated or even flawed to cover malicious activity. Secure your accounts and system, anyway, just to be safe. It may be time consuming, but it is far better than waiting around for something bad to happen.

How Does This Happen (Methods To Hack Facebook Account)?

There are many methods which attackers deploy to breach online accounts of their victims. This is not meant to be an instruction manual or even a comprehensive list of every way an attacker can possibly compromise your system, accounts, and/or online services. This is just an overview of the most common real-world techniques that are actually being deployed. If you've been hacked, chances are good that it was done by a combination of the techniques listed below.

There are Man-In-The-Middle Attacks which capture data packets from the victim machine and store them, before sending them along to the proper destination. There's Phishing, where an attacker convinces you to sign in to your account via a fake login page, then steals your credentials. Sometimes websites themselves are hacked via sql injection methods that dump the entire database of usernames and password hashes… these same username/password combinations are then attempted on many various sites, since a lot of users use the same login credentials across many websites and services. Then there is potentially the most dangerous… malware can be installed on the victim machine which can do anything from logging keystrokes, to remotely browsing the filesystem, to opening a remote shell, or even spying on the users via their webcams and microphones.

The malicious hacker's toolbox of techniques is always evolving and changing to meet changes in security practice and while there are other ways accounts can be compromised, most real-world hacks are a combination of some of the techniques listed above.

"What Do I Do?"

I would like to divide this into three sections, as each are important. Secure Your Accounts and Services, Secure Your Machines and Devices, and Damage Control. You don't know for sure how much of a foot-hold an attacker has or how long they have had it, before you realized or became suspicious. So assume everything has been compromised and secure each of them, as they may be used by an attacker to later re-compromise what you have secured.

Secure Your Facebook Accounts and Online Services

You must change the passwords to all your online accounts and services that you use. Even the ones that you don't recall using sensitive data on. This practice should obviously be prioritized, beginning with the account that you notice suspicious activity on.

Then quickly change your associated email accounts, as these can usually be used to reset the passwords to your other accounts. Be sure to 'logout active sessions' or connected devices, if your service has this feature. If so, you will probably be asked or prompted with it, during the password reset process.

Do not use the same passwords across different sites or services. Go to the security settings of each site or service and activate every notification you possibly can for login attempts and activity Enable two-factor authentication. Make it a pain in the ass to login if you must. Remember that ease of use and convenience are simply open doors for many others.

Then, after you have secured your devices, go through and do a final sweep of password changes. This final step is due to the fact that, if malware is installed on your device, an attacker could potentially be watching you change all your passwords the first time.

Also, follow your website, social media, or other online service's specific guidelines for reporting unusual behavior and securing your accounts. They most likely have a staff that deals with these situations on a daily basis, are usually very polite and helpful and there should never be any negative consequences if you are in error in your reporting of a hacked account.

Secure Your Devices

We must next purge your devices of any malicious processes. There are usually many free antivirus solutions that do a great job at eliminating these threats in a simple scan, but don't be scammed by a fake. Do your research for the latest, well known and best free or paid (depending on your budget) anti-malware solution. Read third party reviews.

Now, I know that anti-virus protection is not always a 100% solution, as there are many obfuscation and crypting methods that can be used to hide malware signatures from antivirus scans, but the big antivirus companies are very competitive and new definition updates roll out on a regular basis. At the time of writing this, the average private crypts are only FUD (fully undetectable) for approximately one month and the average public crypts which actually are FUD (most are never FUD, from the beginning) are only so for about one or two weeks.

While an anti-virus scan will most likely eliminate the threats on your PC, it is still advised that you backup your important files and data, format your hard drive and reinstall your operating system. For devices other than PC, follow your manufacturer's guidelines for resetting your device to default factory settings.

Damage Control

An often overlooked aspect of securing your accounts and services, is what to do afterward. It is a bit important, because you may not know what messages have been sent to others or what was done in your name.

Financial services should be your first concern. Check your account activity for any purchases you do not recognize. Be sure to call your bank or credit card companies and have new card numbers issued.

As for social media, don't be embarrassed or ashamed to post a public announcement, for everyone to see. Most everyone has seen social media accounts having been taken over by an attacker or bot and posting malicious links all over the internet, already. These things happen all of the time. This is nothing new and people will not think of you as being stupid or view you in a different light. They will instead judge you based on your quick and calm ability to assess and take control of the situation, most likely awarding you with support and respect.

For formal or social media accounts, a statement like this should be sufficient:

"Hello Everyone. I have an important and unfortunate announcement to make. It appears that some of my accounts were compromised (hacked). I noticed suspicious activity on (date XX/XX/XX ) and while I am actively securing everything and the damage seems minimal, there's no way for me to know the full extent or length of time of the breach. If you noticed any suspicious activity from my account or strange messages, please inform me immediately. Also if you have gotten any links from "me" recently, do not follow them. Instead ask me about them after I have finished securing all of my accounts, devices and services. I appreciate your support. Have a great day, everyone and apologies if there has been any inconvenience."

A shorter version:

"One of my accounts was recently hacked. Things seem fine so far. I'm now securing it. Be sure to let me know of anything suspicious from my account. Thanks."

And last, but not least: prevention. This could've saved you a lot of effort and grief to begin with. Keep up to date with the latest security practices for all of your online services, all your accounts, and all of your devices, because often a foothold into one of these can allow access into others.

About the Author

My name is Gary Lewis. While I am not as knowledgeable and skilled as many of your programming and security experts and teachers are, I do have real-world experience. There are a lot of technical skills that I'm not an expert at, but I was involved in a lot of things I will not list here and I do know how hacks are being done in the real world, rather than textbook knowledge. I retired from that scene some time ago and decided to pursue philosophy, art, and poetry. Currently, I am working on 3 series of dark themed art and poetry books entitled Paradoxium, Inevitum, and Relativium about Chaos, Order, and Time. I still stay up to date on data security and am happy to write an article for my good friend Rafay, when he wishes, but my days of hacking are over. So if you have any questions or inquiries, please refer to him and his team. They are very knowledgeable in their field of study.

Hacking and Cracking

Hacking and Cracking

7 Qualities of Highly Effective Hackers

Posted: 12 Jan 2016 09:16 AM PST

Note: How To Become A Hacker Book Now at lowest price ever

When asked to write on this topic, I admit that it made me fringe just a bit. Because I don't consider myself to be a highly effective hacker. I find myself as a noob everywhere that I'm trying to learn new things, or I am frustrated with the most ridiculous "hacker" material on the web, written by school-taught programmers that follow step by step instructions out of a manual that everyone has already read. Then I thought to myself.. "That's it!" That is Number One!

Quality One- Always A N00b

Yea. You heard it, and it sounds crazy, but do you ever wonder why on the forums and comments you always see the trolls calling the weakest link a noob and picking on them.. and then THEY are revealed to be newbies also? Well guess what? I am ALWAYS in over my head, trying to learn things that are too much for me. When I go through phases where I only visit sites and forums where I already am adept at the subject or skill level, at hand, I find that not only have months gone by without me learning anything new.

I have also gotten rusty at things I was beginning to learn. So as crazy as it sounds, I believe that a highly effective hacker is always in places where he is a noob. Always learning things he had no idea of and constantly finding things that overwhelm his mind, until a week later when he is now teaching others how to do it and busy with something else he doesn't yet understand. This is the way of intellectual progress. When you see guys on these forums and blog comments, picking on newbies and boasting the same skills with nothing new, know that they are at their peak. Their time has come and gone because they have settled for what they know and are satisfied with it in an ever evolving and changing world of technology.

Quality Two- Curiosity

Do you think for a moment that the l33t ones out there, finding new exploits and breaking into systems are just following step by step guides or motivated by their job or a pay check? If so, I am sorry to rain on your parade, but an effective hacker has an obsessive curiosity. 

These personal drives will bring a person farther in skill than the need for a promotion or recognition will. "I wonder what would happen if I tried to.." "What do you suppose they keep in here.." "OMG! What if I trick it into running this as a..." These are the basic thought patterns of an effective hacker. Not just when he has a job to do. I mean always. For example when you were a kid (or even now) played a video game and found a weird glitch (not necessarily a 'cheat') that you thought was funny. "Oh wow. If I walk in this corner backward he kinda gets stuck there.. UPSIDE DOWN! LOL", "What would happen if I do that and try to jump at the same time? Oh weird! It drops my character where I'm not even supposed to be yet!". OK This is the curiosity that intrigues an effective hacker. He wants to make things work in ways they were not originally intended to.

Quality Three- Enjoys being places he doesn't belong

Hey sorry all you white-hats out there, but it's true. I won't condone trespassing, but many of the most effective hackers get serious pleasure out of being places they do not belong. I once read that everything that drives a man is a form of penetration, of inserting what he feels is himself into something he feels is not himself. I don't know about all that, but some of these guys get pleasure in the same way that a voyeur enjoys watching what he is not allowed to. They enjoy getting into places they are not supposed to be. Now I am not encouraging this behaviour, just laying out the facts. The reason these people find ways to get into things is because these fundamental, basic drives compel them to. It closes the gap of all the things he must learn in order to achieve what he wants.

Quality Four-An unbalanced lifestyle

I often find myself engorged in a project (not just computer related) and nothing else exists. If you ever see these skinny or fat guys beating at their computer at 3 in the morning with empty coke cans and full ashtrays all around until they finally call it a day.. and then it's time to go back in to work. That's them. LOL Now I am not saying that being an effective hacker means they do not have a life (though some may not). Alot of very successful people get obsessed with what they are working on and do nothing but that.. For a while. Then they go through a phase where they are obsessed with something different.

Quality Five- Likes to break things

Come on guys! We're hackers! We love to smash things apart and see what happens. Because face it, it's much easier to break something than to make it and it rewards a valuable opportunity to put it back together in a different way.

Quality Six- Well Organized

In the beginning, it's ok to have files, folders, projects, and programs littered amongst temporary directories, hard drives and OS's. But eventually that's going to be a huge problem. The most efficient hackers have definitely learned to become very well organized multitaskers. You'll see varions windows and terminals open, seperate directories for everything, that are well categorized, a task manager changing process priorities as he's bouncing from one project to the other, across his screen.

Quality Seven- Everything is Insecure until... Never.

The most efficient hackers know that all software, hardware, and access controls are man made and riddled with flaws, predictabilities, and unpredictabilities, a reflection of the creators. People. Nothing can ever be completely trusted, just as no person can be completely trusted.

About the Author

I'm Gary. Though I have many names in many places, this is my true one. I am honored to have been invited by the RHA InfoSec to create content. I can't really go all the way into my experience, suffice to say my greatest teachers have been hours upon hours of trial, effort, information and second opinions.

My skill-set is wide and varied and I am more a "Jack of all trades", rather than a specialist in any one category. I stay pretty busy with various projects (not all is computer related), but I will do my best to lend my time, effort, and knowledge. If I am busy or unable to answer any of your inquiries or handle your requests, for whatever reason, then I am sure Rafay, or Preston or any of the others can when they are able. Last but not least. I (PERSONALLY) do not want your likes, recognition, attention, traffic, or friends. Please save all of that for Rafay and the RHA Page. These guys have put this together, for you and deserve all recognition for it. Thank you.

Hacking and Cracking

Hacking and Cracking

Secure Application Development And Modern Defenses

Posted: 18 Dec 2015 12:00 PM PST


When it comes to the internet, security has always been an after-thought. A great evidence to support the theory can be seen when we look at the history of the internet. The internet was created by US military back in 1969, branded as "Arpanet" at that time. In 1973, ARPANET created TCP IP protocol suite which later enabled the development of protocols such as "SMTP, POP3, FTP, TELNET " in 1980's and HTTP in 1991. 

All of these protocols could be easily eaves-dropped upon by an attacker as they do not encrypt the traffic. Their secure versions were released only later, such as FTPS, SMTPS, SSH, and HTTPS since at that time connecting people and building features was the priority.  If security would have been present by design, we would not have encountered these problems today. 
The same is the case of when we develop the products today, we consider security to be an after-thought rather than an in-built feature, as a reason of which, security breaches occur.  In this article, we would talk about secure application development and why SDLC (System Development Lifecycle) is an ideal model for building secure products.

The model leads "Security By Design" and "In-depth Defense" approach. The idea behind this model is that security should be an essential part of all phases of SDLC so that the bugs are addressed during the early stages of development. Fixing security issues at earlier stages of the development cycle directly reduces costs, time, effortand resources.

Application Layer Security Attacks

As time passes by, we witness a rise in application security attacks, an upward progression in layer of insecurities of the OSI model. In 80 and 90's most of the attacks were related to Layer 1, Layer 2 and Layer 3 of the OSI model, ​today we are at the point that we have developed a great defense at Network Level, however application layer security remains a big challenge. 

According to a report by Gartner Research, it states that 75% of the attacks today occur at the application layer of the OSI Model. According to a survey by Trustwave, 82% of web applications are vulnerable to XSS attacks. According to another survey, 80% of all the security incidents in the financial sector occur due to Cross-site Scripting. Therefore, building defense at application layer is mandatory.

Application Layer Defenses/Approach

Overtime, there have been multiple defenses and approaches established at application level, most notable being a "Web Application Firewall" and "Runtime Application Self-Protection" so on and so forth.  

A Web Application firewall could be used as an additional layer of security, however all WAF's rely upon Blacklist i.e. Reject Known Bad, as whitelisting mode is not practically applicable in the real world (it's not easy to implement). This can be largely attributed to the fact that the majority of web applications are dynamic, and it is very difficult to predict all the possible inputs in order to write a whitlelist of what is allowed. The blacklist, however is not really effective, and this has been proven in past. As a matter of fact, Bypassing WAF's is my day-to-day job and back in 2013, I had written a cheatsheet "Bypassing Modern WAF's XSS Filters" for bypassing Web Application firewalls in which I had written bypasses for top Web Application firewalls. 

Runtime Application Self Protection is relatively a new approach for preventing application layer attacks, which empowers the application to protect in against attacks in real time. A RASP sits at each junction point of the application such as between the application and database, the file system and the network, it sits there and identifies & blocks any malicious activity, enabling the application an ability to protect itself. The problem, however, with this solution is that it still is based upon a blacklist, it is very costly and requires a lot of time to mature itself. 

"The cost of removing an application security vulnerability during the design phase ranges from 30-60 times less than if removed during production."- NIST, IBM, and Gartner Group

Bottom line is that, You cannot write a vulnerable code and rely upon WAF, RASP and other protection mechanisms to protect your application. 

Secure SDLC 

The defenses we talked about above do help in improving our security model. However, in my opinion, it is the wrong way of solving the problem. The best approach is that the application should itself carry the ability to protect itself and henceforth, be built with security in mind from day one. Experts recommend that security should be embedded into all stages of SDLC i.e. Requirements gathering, Design, Development, Testing, Implementation.
Let's talk about how security could fit into all stages of SDLC:

i) Requirements

The first phase of SDLC is the "Requirement" in which project scope and goals are set.  In this phase, OWASP recommends the establishment of security requirements of the application. The requirements of the customer should be checked in accordance with the security standards such as the password policies, secure network protocols etc. 

ii) Design 
In the design phase, OWASP recommends the building of design with security in mind. This involves what is known as Threat modelling, which is an approach that involves analyzing the security of an application in order to mitigate the threats which yields the security plan. ​ The following is a great presentation on how threat modelling should be performed. 

iii) Development 

In Development phase, OWASP recommends developers to follow "Secure Coding Standards" for which, the organization must conduct an awareness on Secure Coding for developers, because guidelines are often overlooked by developers. Apart from that Source code, reviews must by done by internal team. It is also recommended to have this conducted via third party to mitigate additional findings.

iv) Testing 

In testing phase, OWASP recommends performing a penetration test including infrastructure assessment, in order to counter verify if the findings present inside the design and development phase have been properly fixed. Both Static and Dynamic code analysis should be thoroughly performed. 

Special attention should be paid to Business logic bugs which cannot be otherwise found by automated scanners as the business logic varies for every application. Efforts made in second phase i.e. Design could reduce the number of business logic bugs significantly. 

v) Deployment 

Deployment is a phase where your application goes from development into production environment. In this phase, OWASP recommends securely conducting the migration process from development phase to production phase and to ensure that post production security requirements are met.

In case you would like to learn more about Secure SDLC, I would recommend the following presentation - "Secure Development Lifecycle".

Security is an ongoing process, no specific requirement has to be met for 100% security. 

It should be noted that even after introducing security in every process of SDLC, 100% security cannot be achieved. However, the threat probability could be reduced. As security analysts, we have to close a 100 doors from which an attacker could enter and as an attacker, s/he only needs one door.  The fact that appeals most to me about this approach is that it's proactive, not reactive which is how most of the application development nowadays is done. ​

Exclusive Updates from 'Rafay Hacking Articles'


Recognizing Five Sources of High-Profile Data Security Breaches

Security breaches have rapidly escalated into a major source of reputational damage, business interruption, erosion of customer confidence, and economic loss for organizations across all industries. Click here to download

Latest News Nov 3, 2015

Paypal Mobile Verification And Payment Restrictions Bypass

In this post, i would like to share a very simple logic flaw I found earlier this year I have found a way to circumvent mobile verification by utilizing a different portal for logging into a paypal account. The flaw lies in the fact that paypal does not perform two step verification/authorization checks on all different portals that are used to log into a paypal account. Ideally, there should be a centralized authentication mechanism to authenticate the user or else additional authorization checks have to be applied to all different portals that are used to log into paypal ccount. ...

How to Spy on Text Messages

It seems that in recent years most of society, especially the younger generations, have turned to texting as their preferred mode of conversation. The infinite ability to communicate with other people around the world effortlessly has become a growing concern for parents and employers alike who wish to 'keep an eye on', or monitor, their children or employees. In this post we will discuss the methods and implications of text message spying. ...

Android Browser All Versions - Address Bar Spoofing Vulnerability - CVE-2015-3830


Google security team themselves state that "We recognize that the address bar is the only reliable security indicator in modern browsers" and if the only reliable security indicator could be controlled by an attacker it could carry adverse affects, For instance potentially tricking users into supplying sensitive information to a malicious website due to the fact that it could easily lead the users to believe that they are visiting is legitimate website as the address bar points to the correct website. ...

Sucuri WAF XSS Filter Bypass


Sucuri Cloud Proxy is a very well known WAF capable of preventing DOS, SQL Injection, XSS and malware detection and prevention. It acts as a reverse proxy which means that all the traffic sent to an application behind Sucuri WAF would be first sent to Sucuri's network which (based upon it's signature database) would check if a particular request is legitimate or not, if it's legitimate it would let it reach the application otherwise it would blocked. ...

How To Hack A Mobile Application? - Video Series

In today's world, new mobile innovations have changed the way we bank, shop, play, and communicate. This increased demand for mobile innovation is placing pressure on organizations and developers to get applications to market, quickly. ...

4 Critical Risks Facing Microsoft® Office 365™ Implementation

It seems nearly every technology discussion today somehow involves the cloud -- whether positive or negative, the cloud is a viable option in nearly every aspect of IT. Click here to download

This email was sent to You are receiving this newsletter because you opted-in to receive relevant communications from Rafay Hacking Articles. If you would like to manage your newsletter preferences, please click here.

Rafay Hacking Articles | Karachi, Pakistan 44000