Using Social Media Threats for benefits

Dear Readers,

New article connected with the issue Social Media- "Using Social Media Threats for benefits"

Enjoy reading!

Author: Gokula Krishna

"Using Social Media Threats for benefits"

In this article you will explore various types of social media, threats that persists on Social Media, how to use them effectively for your benefit.

What you will learn
-Available Social Media platforms
-Future of Social Media
-Risk involved while attacking a social media user
-How Social Media can be used against you
-How to protect yourself
-Introduction to unconventional attacks
-Analyzing the best approach for attacking
-Hacking social media for profit

What you should know?
Basic knowledge about hosting

Available Social Media

Social media is one of the largest platforms where people all over the world make their residence. The concept of Social Media is evolving day today and it is very hard to imagine how the Social Media can dominate our lives. So far many people think that Facebook, Twitter, Google+and Linkedin as the Social Media platforms. Finding an effective social media is a greatest hack by itself. Apart from finding new connections, Social Media is used for gathering teams, solving social problems, creating new things; gather people for protest and so on. For all group of people all popular Social Media like Facebook and twitter is not a worthy one. Because of privacy concerns, thirst for knowledge and other expectations by Social Media users, they reside on other platform where they can satisfy their needs. For instance, the World’s largest activist team Anonymous used IRC as their primary medium for communication and made different operations around the World. As predicted by McAffe, their activity has decreased a lot. So as a hacker we should know the platforms that are available and we should choose the best ones in order to improve our personal, professional and passionate life. Since Facebook ranks first on the Social Media we heavily focus our attention towards it. Here is the list of Social Media platforms that you should be familiar with:
-IRC – Internet Relay Chat is one of the powerful tools for hackers to discuss about new threats, technologies and plans.
-4chan – Image based bulletin board network for knowledge sharing.
-ICQ – Contact another hacker anonymously. You can make calls; provide your number freely on the web and no one can trace your place directly or eavesdrop on you.
-Hackerrank – Social Media for Hackers. Here you can solve programming challenges and create new community of hackers.

Free internet more possibility

Few months before Google made an attempt to provide free internet with the help of an air balloon, providing free Wi-Fi Internet for the people. This was a failure model since the balloon had very less time span and cannot provide Wi-Fi everywhere. This problem was solved by Facebook by flying an aircraft. User can call for an aircraft and it will position above them immediately where they can access the Internet. Free Internet forced everyone to access the Internet, especially Facebook. Almost all the population on Earth would be at Facebook by end of this decade. If everyone and every device are connected to the Internet and everyone has their own Social Media account, there is a possibility to register a device (like smart refrigerator) or create a bank account under your Social Network Account, or even your account can become your identity for your citizenship. If this happens protecting every user’s data becomes highly critical and it cannot be managed by the Social Network companies. So they need help from Security professional like you to manage the safety of the users.

Risk involved while attacking a Media

While thinking about attacking Social Media you have to understand the consequences and threats that you will be facing. So you should be aware of current protections that a Social Network companies do in order to protect themselves from the attackers. As a naïve hacker, do you think that you easily search vulnerability on the internet and hack a profile? Yes, there are vulnerabilities that are available online but it takes large amount of money to get them and use it. Recently there was vulnerability about Facebook on 1337day.com, using this vulnerability you can send a private message from another message to a targeted account without even logging into their account. Can you imagine the cost of this vulnerability? Do you think that a hacker who spends lot of his/her time on the Internet and give it just for free? No, for this vulnerability the cost was about 1000$ when it hit the market, but it gradually the price came down and Facebook not yet patched that vulnerability. Similarly there is also a vulnerability where you can delete an admin of a page and it costs 5000$ on 1337day.com. The link for these vulnerabilities is provided on the links section of this article. Many companies conduct bug bounty program to find and report the bugs. So if you find a bug on Facebook and report back to them they will give you thousands of dollars. A hacker hacked into Mark Zuckerberg’s profile and posted that it was hacked, he made a demo on how did he did that hack and released on the Youtube, after a very long time the Facebook confirmed the vulnerability and gave him rewards. Similarly a hacker from India also found vulnerability on Facebook and won lots of money from them. So do you think that you can search on Google and hack a Facebook account? No, we should understand the truth that as an individual with less computational power it is very difficult for us to make a penetration test and find a bug. We have to rely on others to attack and learn from them. You can update yourself with the latest vulnerability by frequently watching some of the websites that are provided on the link section.

The Truth

There was an easy way to access one’s Facebook account easily just b knowing their friends, they call it 3 friend vulnerability. You can access an account easily by going to forgot password section on Facebook and type their Facebook and 3 friends name. This feature was soon removed by Facebook. Don’t spend too much of time finding a vulnerability on online, to reach you to your target’s account. Instead you can learn new language and you find your own vulnerability. As said before high profile Websites like Facebook spends large amount of money to protect their user and there are very less attack to succeed. Let’s analyze the truth behind the scene while searching for attacks on Facebook. As a naïve user with creativity search for the term “Facebook Hacking” or “Facebook Hacking Software” he/she will have a result showing some of the techniques that will be used. It asks for your account ID, your victims account ID and your password at last, saying that it required for security. After when you click next you will have a page filled with the basic information about your targets account. In order to download the password the website prompts you to do some activity like sharing their link on Facebook or mail to friends. After when you complete the action it gives you a file in which you will have passwords that will not work or a message saying that error occurred while retrieving the password. Well done! YOU have been hacked, the information that you saw on the basic information page was the data that is publicly available data, you can view that information on the URL “graph.facebook.com/[user name]”. When you enter into the page you will see the information that the spam site was showing to you, successfully your password was sent to an attacker’s server and you made a wealth for attacker by doing a task to download a file also by using this application you have made the application still popular and made opportunity for an attacker for many targets and profit. These types of Social engineering attacks are not so good but they are beautiful when we see on the other side. Spammers, Social engineers are innovating large number of ways to attack and create large number allocation for Security persons.

Social media attacks

Social Engineering
As a hacker we should find a way that will get our job done even though we have very tough situation for hacking a social media. To attack a social network, social engineering is the best method that you can use against your targets.

Session Hijacking
Among various social engineering attacks, this is one of the common and more likely to succeed. But the risk of getting caught is high; you can try this attack in a low profile account. But it can lead you to a big trouble when you are doing this on a high profile account you are in a great trouble. Sessions are created by Servers to uniquely identify the users. With help of the session you can hack someone’s profile without their username and passwords. The specialty of this attack is that most of the times the user does not know that his Session has been hijacked. Traditionally in session hijacking all you need is a server, script for hijacking, valid domain and user’s click at your URL. The basic concept is that you have to hijack a cookie called “datr” that was set by the Facebook when a user logs into his/her account. We have to find a way to grab this data from the Facebook. This attack is now obsolete and it cannot be used right now due to the change in the policy. Another method for doing this is by capturing the packets using Wireshark. The tutorials on how to do this is provided on the link section.

Figure 1: Screenshot of Edit Cookie plug in for Google Chrome showing Facebook cookies

Creating an free Malicious Server
In Many case we need a server to make an attack, like phishing attack. Many Social Networks can detect the malicious server when you are attempting and attack. So here is the methodology that an attackers use in order to make an attack. You can use your own Computer as a server using WAMP or XAMPP, if you are making a targeted attack or you can get it from hosting service provider like youhost.com for massive targeted attacks. You need a trusted URL and you can get it from the bit.ly and send the link to everyone. You can do this attack but you should modify the parameters to get the job done. While typing your URL on the status or the message box the Facebook checks for valid hosting service in the URL which possess it and if you paste the URL that redirects to a server that is not trusted it will prompt you with a message that you may be malicious. So how can you make this attack successful, the first thing is that you can buy a premium server but that is not going to work either because the hosting service provider has strict agreement and you may have chance of getting caught, but there is another trick that can be used to make this attack successful you can use another simple solution, the search engine forwarding attack, when click a URL on a Google page you may see the URL changes and it redirects you to the page that you have requested, we can use this vulnerability to get the job done, get your server 000webhosting.com for free and customize the following URL to your server’s URL by https://www.google.com/search?btnI&q=allinurl%3A%2F%2Fyourattacksite.com and also use the URL shorter from bit.ly, now when you post the link on Facebook, it thinks that you have provided a link to a Google’s server, but actually the Google is going to forward to your server and you forward it to another server that contains information that is popular and grab the user’s session or other information on your server. Seems a lot of work to make an attack but this technique can also be obsolete in few days or even few hours. But this can be used by a fraud groups to steal credential data from the users in a very short period of time and escape.

Spear Phish

Spear Phishing is one of the current trends among Hackers to target their target credentials. In this attack they send message you with your friend’s E-mail. For example an attacker can send a link to you demanding your information or speak to you harshly, creating a misunderstanding in your relationship. It can be an Email using a duplicate server or the Message using Vulnerability on Facebook as discussed before. It will be very difficult for us to identify this attack, since level of sophistication high. It can succeed on anyone, even on a security professional; since a company receives lot of Emails from the user one can’t check everything. The precaution measure is to know how a normal person and spammer will send a message. Some keywords related to this attack is provided on the link section. The chart below explains a lot about the carelessness of the users.

Figure 2: Fire eye’s Report on Email attacks

Application attacks

Many Social Media is like an online OS where you install new application on your account. This is also a good way to target the users. You can create your own application on Facebook and send it to your users to gather user’s personal data. Create an application with the title name “Love Calculator” and create the application to read the user’s private data, since many users do not care about privacy you can grab their data. You can also find bugs on the Facebook just like an OS and use this bug to gain the credential data. Here is an example of Facebook’s XSSed screenshot on its sub-domain “developers.facebook.com”, unfortunately you cannot use this attack to gain sensitive data.

Figure 3: Screenshot of Facebooks XSS attacks by Anonymous member

Death Paradox

In order to sustain the heavy competition Companies introduce variety of features to engage their users. Facebook now has a feature where a user can report about the death of a user and the Facebook will post an RIP message on your wall and decorating it. This feature was used by pranksters, reports a living user is dead. This attack is so suspicious which made many students to lose their mind. You can do this by going to your settings and report death of a friend.

Fake accounts

Figure 4: Fake user’s account on Twitter

Fake accounts can be very dangerous to you. Even though many social networks identify the fake accounts, yet many people suffer from this attack. Apart from creating a fake account for hiding their identity, some accounts are created for the misuse or reduce your reputation. An attacker may create an account similar to yours and start posting things like you post, but he will behave very differently on the chats. Some users may think that you have fake accounts for 2 different purposes, but the fake of yours will destroy you. This attack was made on many individuals which made them to stress very much and it lead many to suicide. This attack was very common on schools and colleges.

Bot Communication

Terrorists are the one who used the social media groups and pages for malicious purpose. You may be an admin of a particular page or groups, they might be posting like a normal user but in a particular format, instead of commenting “I like this page” they might write “## I like this page” which is a weird thing that will not be noticed but it contains some message to another guy. Similarly an attacker can use your page for communication with bots. You may think that “why an attacker can’t create his own page and send message to his bots?” this can’t be done because the risk of getting caught is very high and easy which is not an expected by an attacker. The attacker may post some commands to the bots and the bots will keep searching for commands on your page because listening directly to an attacker’s server can be easily found by the security products and they can be blocked. Since your page has unique URL so an attacker may use that URL scan the entire page and write a bot that can scan your page check for command and execute according to that. The bot can recieve program for execution or task commands from your Page and execute them.

White Hat’s Hack for money

So far we have seen attacks that are used by an attacker to attack you. There is also a positive of Social Media Hacking; here are some of the attacks that are widely used by hackers to obtain money. Black hats aren’t the only group who satisfy their needs by hacking.

Profitable Hacks

Hacking should have a purpose or target. Social media have been integrated to our TV, home, car and almost all the equipments. Have you seen the scroll on a TV program you using the name “Facebook”? In order to engage many users the TV channels are integrating their account with Facebook. So there are many opportunities in doing some tricks on Social media for your profit. Many marketers are in need of application that can automate posting contents. Marketers say that they are wasting their time on posting their ads on forums, social network groups, and other platforms. As a hacker why don’t we use this for our profit? They are really simple hacks that can yield more money. There are some applications that can post a video on youtube, vimeo and other video servers then it post the URL on the social media websites. You can use python for this type application and the skills that you need to know parsing web content, reading image and breaking the captcha, along with other skills that are specific to the particular application. Meanwhile you can use the API for a simplification of your task. You can learn it at ease and you can do it when you are free. Mining the data from a social network has a good scope. You can learn some kind of patterns by using the social networks. A similar application that hacks large number of sites in order to post contents is available on the website http://www.paysforever.com/MP/megapromoter.htm

Social Media gaming hacks

Social media gaming is also a platform for you to find large hacks easily and you can create your wealth. In game hacking you get lots of money for even tiny hacks. The below screenshot tells you everything that you need to know. There are books available which targets the online game hacks.

Figure 5: Facebook post for hacking Wartunes

Summary
Social media is a wonderful place if we use them in a carefully. Thinking about safety isn’t the only thing that can be done on the Social media as a hacker. There may be thousands of reason for not using the Social Media but there are millions of reasons to use them. It all depends on how we look at the Social Media.

On the Web

http://1337day.com/exploit/description/20296 - Facebook’s Delete admin vulnerability

http://1337day.com/exploit/description/21699 - Facebook’s Message from anyone vulnerability

http://www.arclab.com/products/amlc/how-to-read-and-analyze-the-email-header-fields-spf-dkim.html - Tutorial on analyzing the Email Messages

www.fireeye.com/resources/pdfs/fireeye-top-spear-phishing-words.pdf - Top spear phish attack words

http://securityaffairs.co/wordpress/8390/malware/fireeye-advanced-threat-report-the-inadequacy-of-the-defense.html- Fire eye’s threat report

https://www.owasp.org/index.php/Main_Page - Web application attack collection

http://cve.mitre.org/ - Collection of vulnerabilities, Common Vulnerability Exposure (aka CVE)

http://www.cybernewsalerts.com/2014/02/xss-vulnerability-found-in-facebook.html -Working vulnerability on Facebook’s sub-domain

https://bugcrowd.com/list-of-bug-bounty-programs/- List of Bug Bounty Programs

About the Author

Gokula Krishna: a Computer Science Engineer and Computer Security enthusiast from India.Freelance web/system developer and hacking is my passion.He has presented many International Conferences in India related to Security and finds vulnerabilities on real world applications.