faceniff

Are New Platforms Safe – Reality Check : Android App For Hacking Facebook Accounts – Part 1

For people who have heard of Face niff or Firesheep , they must have a idea, how easy these apps make it possible to access Facebook accounts of people in your wifi network. Now we have another app called DroidSheep based on Firesheep which gives you access to Facebook ,Flickr ,Google account  etc of anyone logged in your wifi network. This apps can even bypass WPA security. Okay let me stop here and elaborate for people who did not understand what i said above.

We do come across wifi networks in  public places such as airports,cafes , restaurants  and offices. Now if you have an android tablet , you need to install Droid Sheep from android market and here you will find yourself accessing Facebook , Google , Flickr , Youtube  accounts just at one click.Difficult to believe but trust me it’s quite easy. Thanks to open wifi networks.  The purpose of the article is not to promote use of such apps but rather such apps should be used to find loopholes in wifi network . Besides this we also wants to create an awareness as how unsafe these public wifi spots can be & how vulnerable these new devices are.

Now the question that people must be having is that how is it that one can access others accounts .The app works even on networks protected by WPA and WPA2 encryption schemes by using a technique known as ARP spoofing to redirect local traffic through the attacker’s device. An attacker would have to know the wifi security password, however.

Read More →

Are New Platforms Safe – Reality Check : Android App For Hacking Facebook Accounts – Part 2

The apps gives you access to others accounts. Now how does it work.

When the victim is using the WiFi, his laptop sends all the data intended to be received by Facebook, over the air to the coffee bars wireless router. “Over the air” means “ the data can be captured by anybody”, attacker can read all the data sent by victim. As some data is encrypted before being sent, attacker cannot read victims Facebook password, but in order not to make victim enter his password after each click, Facebook sends victim a so called “session id” after logging in, which  sends with each interaction, making it possible for Facebook to identify Bob. Usually only victim knows this id, as he receives it encrypted. But when victim uses the coffee bars WiFi, he spreads his session id over the air to everybody. So attackers takes this session id and uses it as his– and Facebook cannot determine who used the id.

Installation:
There are two possible ways to install DroidSheep:

  • One of the Android Markets (Google, AppBrain, …) — Simply search for DroidSheep and install the application
  • Download it from the “GET-IT” section using your phones browser and open the file — your phone should ask for installing the app.

Usage:
Make sure, your phone is connected to a WiFi-Network, start DroidSheep and push the “start” button. Just wait for few seconds and it will show all accounts opened which can be directly opened.

Read More →