Hacking Online Banking and Credit Card Transactions

<div style="text-align: center;"><h4 style="font-weight: bold; text-align: justify;"> Hacking Online Banking and Credit Card Transactions – And How to Prevent It:</h4>Here is process for hacking online banking and credit cards transactions and also a process to prevent from them .<br /><h4 style="font-weight: normal; text-align: justify;">The Scenario</h4><div> </div><p style="text-align: justify;"> You go to a coffee shop for a cup of coffee and to utilize the shop’s Wi-Fi HotSpot to surf the web. You connect to the hotspot network and decide to perform some online banking or to purchase something online. By the way, this could happen to you at home, as well. As an end-user, you <em>feel</em> quite secure, as you see the lock in the bottom corner of your Internet browser, symbolizing that the online banking or online credit card transaction is safe from prying eyes. Your data, including username, password, credit card info, etc. will be encrypted with 128-bit encryption. <em><strong>So it's secure, right?</strong></em> </p><div style="text-align: justify;"> <a href="http://www.spotplex.com/code/743704" target="_blank"><img border="0" src="http://www.spotplex.com/send/743704/no-image.gif?r=http%3A%2F%2Fwww.ethicalhacker.net%2Fcontent%2Fview%2F25%2F24%2F" /></a> </div><p style="text-align: justify;"> It is not uncommon to perform banking and to purchase products online with your credit card. It is also a common thought that doing so is secure, as this is done via SSL. For the most part, this is true and the sessions are secure. Discover Card, for example, posts the following statement on their website: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <img border="0" height="302" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/1.jpg" width="580" /><br /><strong>Figure 1</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> The problem is that it is not “virtually impossible” for someone else to see your data, such as login information or credit card numbers. It can actually be relatively easy, as you’ll see, if you as an end-user are not knowledgeable about how you can be exploited and know the signs that this is occurring. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="86" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/2.jpg" width="187" /><br />Figure 2 </strong>(Indicates a Secure SSL Session) </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> Continuing with the scenario, what you didn’t realize is that a hacker has intercepted your Online Banking login credentials and credit card information and can now log into your Online Banking Website or purchase items with your credit card. How is this possible, since SSL was used and is hard to break? The answer is that you made a fatal mistake that subjected you to an SSL Man-in-the-Middle (MITM) attack. </p><div style="text-align: justify;"> </div><h4 style="text-align: justify;">The Attack</h4><div style="text-align: justify;"> </div><p style="text-align: justify;"> The fatal flaw that enabled the sensitive information to be stolen is possible when an end-user is not properly educated on an easy to do and well-known SSL exploit – SSL MITM. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong>Here’s how it’s done:</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> The hacker goes to coffee shop and connects to the same Wi-Fi network you are connected to. He runs a series of utilities to redirect other user’s data through his machine. He runs a number of other utilities to sniff the data, act as an SSL Certificate Server and to be the Man-the-Middle. The following diagram shows a very simplified graphic of how your SSL Banking session should work under normal conditions, then how it would work during an attack: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="301" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/3.gif" width="575" /><br />Figure 3</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="318" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/4.gif" width="575" /><br />Figure 4</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> An important concept to grasp here is that a certificate is used to establish the secure SSL connection. This is a good thing, if you have a good certificate and are connecting directly to the website to which you intended to use. Then all your data is encrypted from your browser to the SSL website where the bank’s website will use the information from the certificate it gave you to decrypt your data/credentials. If that is <em>truly</em> the case, then it is pretty darn hard for a hacker to decrypt the data/credentials being transmitted, even if he is able to sniff your data. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> This is a bad thing if you have a “Fake” certificate being sent from the hacker, and you are actually connecting to his machine, not directly to the bank’s website. In this case, your credentials are being transmitted between your browser and the hacker’s machine. The hacker is able to grab that traffic, and, because he gave you the certificate to encrypt the data/credentials, he can use that same certificate to decrypt your data/credentials. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong>Here are the exact steps a hacker could use to perform this attack:</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> The first thing he would do is turn on <strong>Fragrouter</strong>, so that his machine can perform IP forwarding </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/5.jpg" width="607" /><br />Figure 5</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> After that, he’ll want to direct your Wi-Fi network traffic to his machine instead of your data traffic going directly to the Internet. This enables him to be the “Man-in-the-Middle” between your machine and the Internet. Using <strong>Arpspoof</strong>, a real easy way to do this, he determines your IP address is 192.168.1.15 and the Default Gateway of the Wi-Fi network is 192.168.1.1: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/6.jpg" width="607" /><br />Figure 6</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> The next step is to enable DNS Spoofing via <strong>DNSSpoof</strong>: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/7.jpg" width="607" /><br />Figure 7</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> Since he will be replacing the Bank's or Online Store’s valid certificate with his own fake one, he will need to turn on the utility to enable his system to be the Man-in-the-Middle for web sessions and to handle certificates. This is done via <strong>webmitm</strong>: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/8.jpg" width="607" /><br />Figure 8</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> At this point, he is setup and ready to go, he now needs to begin actively sniffing your data passing through his machine including your login information and credit card info. He opts to do this with <strong>Ethereal</strong>, then saves his capture: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="384" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/9.gif" width="464" /><br />Figure 9</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> He now has the data, but it is still encrypted with 128-bit SSL. No problem, since he has the key. What he simply needs to do now is decrypt the data using the certificate that he gave you. He does this with <strong>SSL Dump</strong>: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/10.gif" width="607" /><br />Figure 10</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> The data is now decrypted and he runs a Cat command to view the now decrypted SSL information. Note that the username is “Bankusername” and the password is “BankPassword”. Conveniently, this dump also shows that the Banking site as National City. FYI, the better, more secure banking and online store websites will have you first connect to another, preceeding page via SSL, prior to connecting to the page where you enter the sensitive information such as bank login credentials or credit card numbers. The reason for this is to stop the MITM-type attack. How this helps is that if you were to access this preceeding page first with a "fake" certificate and then proceeded to the next page where you were to enter the sensitve information, that page where you would enter the sensitive information would not display. That is because the page gathering the sensitive information would be expecting a valid certificate, which it would not receive because of the Man-in-the-Middle. While some online banks and stores do implement this extra step/page for security reasons, the real flaw in this attack is the uneducated end-user, as you'll soon see: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="398" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/11.jpg" width="641" /><br />Figure 11</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> With this information, he can now log into your Online Banking Account with the same access and privileges as you. He could transfer money, view account data, etc. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> Below is an example of a sniffed SSL credit card purchase/transaction. You can see that Elvis Presley was attempting to make a purchase with his credit card 5440123412341234 with an expiration date of 5/06 and the billing address of Graceland in Memphis, TN (He is alive!). If this was your information, the hacker could easily make online purchases with your card. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/12.jpg" width="607" /><br />Figure 12</strong> </p><div style="text-align: justify;"> </div><h4 style="text-align: justify;">Also Real Bad News for SSL VPN Admins</h4><div style="text-align: justify;"> </div><p style="text-align: justify;"> This type of attack could be particularly bad for corporations. The reason for this is that Corporate SSL VPN solutions are also vulnerable to this type of attack. Corporate SSL VPN solutions will often authenticate against Active Directory, the NT Domain, LDAP or some other centralized credentials data store. Sniffing the SSL VPN login then gives an attacker valid credentials to the corporate network and other systems. </p><div style="text-align: justify;"> </div><h4 style="text-align: justify;">What an End-User Needs To Know</h4><div style="text-align: justify;"> </div><p style="text-align: justify;"> There’s a big step and end-user can take to prevent this from taking place. When the MITM Hacker uses the “bad” certificate instead of the “good”, valid certificate, the end-user is actually alerted to this. The problem is that most end-users don’t understand what this means and will unknowingly agree to use the fake certificate. Below is an example of the Security Alert an end-user would receive. Most uneducated end-users would simply click “Yes”… and this is the fatal flaw: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="300" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/13.jpg" width="382" /><br />Figure 13</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> By clicking “Yes”, they have set themselves up to be hacked. By clicking the “View Certificate” button, the end-user would easily see that there is a problem. Below are examples of the various certificate views/tabs that show a good certificate compared to the bad certificate: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="332" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/14.jpg" width="576" /><br />Figure 14</strong><br />(Good Certificate) (Bad Certificate) </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="339" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/15.jpg" width="575" /><br />Figure 15</strong><br />(Good Certificate) (Bad Certificate) </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img align="middle" border="0" height="336" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/16.jpg" width="575" /><br />Figure 16</strong><br />(Good Certificate) (Bad Certificate) </p><div style="text-align: justify;"> </div><h4 style="text-align: justify;">How an End-User Can Prevent This</h4><div style="text-align: justify;"> </div><ul style="text-align: justify;"><li> <p> Again, the simple act of viewing the certificate and clicking “No” would have prevented this from happening. </p> </li><li> <p> Education is the key for an end-user. If you see this message, take the time to view the certificate. As you can see from the examples above, you can tell when something doesn’t look right. If you can’t tell, err on the side of caution and call your Online Bank or the Online store. </p> </li><li> <p> Take the time to read and understand all security messages you receive. Don’t just randomly click yes out of convenience. </p> </li></ul><div style="text-align: justify;"> </div><h4 style="text-align: justify;">How a Corporation Can Prevent This</h4><div style="text-align: justify;"> </div><ul style="text-align: justify;"><li> <p> Educate the end-user on the Security Alert and how to react to it. </p> </li><li> <p> Utilize One Time Passwords, such as RSA Tokens, to prevent the reuse of sniffed credentials. </p> </li><li> <p> When using SSL VPN, utilize mature products with advanced features, such as Juniper’s Secure Application Manager or Network Connect functionality. </p> </li></ul><div style="text-align: justify;"> </div><br /></div>

Hacking Online Banking and Credit Card Transactions

Hacking Online Banking and Credit Card Transactions – And How to Prevent It: Here is process for hacking online banking and credit car...

Leer más »

Hacking Online Banking and Credit Card Transactions

<div style="text-align: center;"><h4 style="font-weight: bold; text-align: justify;"> Hacking Online Banking and Credit Card Transactions – And How to Prevent It:</h4>Here is process for hacking online banking and credit cards transactions and also a process to prevent from them .<br /><h4 style="font-weight: normal; text-align: justify;">The Scenario</h4><div> </div><p style="text-align: justify;"> You go to a coffee shop for a cup of coffee and to utilize the shop’s Wi-Fi HotSpot to surf the web. You connect to the hotspot network and decide to perform some online banking or to purchase something online. By the way, this could happen to you at home, as well. As an end-user, you <em>feel</em> quite secure, as you see the lock in the bottom corner of your Internet browser, symbolizing that the online banking or online credit card transaction is safe from prying eyes. Your data, including username, password, credit card info, etc. will be encrypted with 128-bit encryption. <em><strong>So it's secure, right?</strong></em> </p><div style="text-align: justify;"> <a href="http://www.spotplex.com/code/743704" target="_blank"><img border="0" src="http://www.spotplex.com/send/743704/no-image.gif?r=http%3A%2F%2Fwww.ethicalhacker.net%2Fcontent%2Fview%2F25%2F24%2F"></a> </div><p style="text-align: justify;"> It is not uncommon to perform banking and to purchase products online with your credit card. It is also a common thought that doing so is secure, as this is done via SSL. For the most part, this is true and the sessions are secure. Discover Card, for example, posts the following statement on their website: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <img border="0" height="302" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/1.jpg" width="580"><br /><strong>Figure 1</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> The problem is that it is not “virtually impossible” for someone else to see your data, such as login information or credit card numbers. It can actually be relatively easy, as you’ll see, if you as an end-user are not knowledgeable about how you can be exploited and know the signs that this is occurring. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="86" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/2.jpg" width="187"><br />Figure 2 </strong>(Indicates a Secure SSL Session) </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> Continuing with the scenario, what you didn’t realize is that a hacker has intercepted your Online Banking login credentials and credit card information and can now log into your Online Banking Website or purchase items with your credit card. How is this possible, since SSL was used and is hard to break? The answer is that you made a fatal mistake that subjected you to an SSL Man-in-the-Middle (MITM) attack. </p><div style="text-align: justify;"> </div><h4 style="text-align: justify;">The Attack</h4><div style="text-align: justify;"> </div><p style="text-align: justify;"> The fatal flaw that enabled the sensitive information to be stolen is possible when an end-user is not properly educated on an easy to do and well-known SSL exploit – SSL MITM. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong>Here’s how it’s done:</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> The hacker goes to coffee shop and connects to the same Wi-Fi network you are connected to. He runs a series of utilities to redirect other user’s data through his machine. He runs a number of other utilities to sniff the data, act as an SSL Certificate Server and to be the Man-the-Middle. The following diagram shows a very simplified graphic of how your SSL Banking session should work under normal conditions, then how it would work during an attack: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="301" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/3.gif" width="575"><br />Figure 3</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="318" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/4.gif" width="575"><br />Figure 4</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> An important concept to grasp here is that a certificate is used to establish the secure SSL connection. This is a good thing, if you have a good certificate and are connecting directly to the website to which you intended to use. Then all your data is encrypted from your browser to the SSL website where the bank’s website will use the information from the certificate it gave you to decrypt your data/credentials. If that is <em>truly</em> the case, then it is pretty darn hard for a hacker to decrypt the data/credentials being transmitted, even if he is able to sniff your data. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> This is a bad thing if you have a “Fake” certificate being sent from the hacker, and you are actually connecting to his machine, not directly to the bank’s website. In this case, your credentials are being transmitted between your browser and the hacker’s machine. The hacker is able to grab that traffic, and, because he gave you the certificate to encrypt the data/credentials, he can use that same certificate to decrypt your data/credentials. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong>Here are the exact steps a hacker could use to perform this attack:</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> The first thing he would do is turn on <strong>Fragrouter</strong>, so that his machine can perform IP forwarding </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/5.jpg" width="607"><br />Figure 5</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> After that, he’ll want to direct your Wi-Fi network traffic to his machine instead of your data traffic going directly to the Internet. This enables him to be the “Man-in-the-Middle” between your machine and the Internet. Using <strong>Arpspoof</strong>, a real easy way to do this, he determines your IP address is 192.168.1.15 and the Default Gateway of the Wi-Fi network is 192.168.1.1: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/6.jpg" width="607"><br />Figure 6</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> The next step is to enable DNS Spoofing via <strong>DNSSpoof</strong>: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/7.jpg" width="607"><br />Figure 7</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> Since he will be replacing the Bank's or Online Store’s valid certificate with his own fake one, he will need to turn on the utility to enable his system to be the Man-in-the-Middle for web sessions and to handle certificates. This is done via <strong>webmitm</strong>: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/8.jpg" width="607"><br />Figure 8</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> At this point, he is setup and ready to go, he now needs to begin actively sniffing your data passing through his machine including your login information and credit card info. He opts to do this with <strong>Ethereal</strong>, then saves his capture: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="384" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/9.gif" width="464"><br />Figure 9</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> He now has the data, but it is still encrypted with 128-bit SSL. No problem, since he has the key. What he simply needs to do now is decrypt the data using the certificate that he gave you. He does this with <strong>SSL Dump</strong>: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/10.gif" width="607"><br />Figure 10</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> The data is now decrypted and he runs a Cat command to view the now decrypted SSL information. Note that the username is “Bankusername” and the password is “BankPassword”. Conveniently, this dump also shows that the Banking site as National City. FYI, the better, more secure banking and online store websites will have you first connect to another, preceeding page via SSL, prior to connecting to the page where you enter the sensitive information such as bank login credentials or credit card numbers. The reason for this is to stop the MITM-type attack. How this helps is that if you were to access this preceeding page first with a "fake" certificate and then proceeded to the next page where you were to enter the sensitve information, that page where you would enter the sensitive information would not display. That is because the page gathering the sensitive information would be expecting a valid certificate, which it would not receive because of the Man-in-the-Middle. While some online banks and stores do implement this extra step/page for security reasons, the real flaw in this attack is the uneducated end-user, as you'll soon see: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="398" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/11.jpg" width="641"><br />Figure 11</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> With this information, he can now log into your Online Banking Account with the same access and privileges as you. He could transfer money, view account data, etc. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> Below is an example of a sniffed SSL credit card purchase/transaction. You can see that Elvis Presley was attempting to make a purchase with his credit card 5440123412341234 with an expiration date of 5/06 and the billing address of Graceland in Memphis, TN (He is alive!). If this was your information, the hacker could easily make online purchases with your card. </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="377" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/12.jpg" width="607"><br />Figure 12</strong> </p><div style="text-align: justify;"> </div><h4 style="text-align: justify;">Also Real Bad News for SSL VPN Admins</h4><div style="text-align: justify;"> </div><p style="text-align: justify;"> This type of attack could be particularly bad for corporations. The reason for this is that Corporate SSL VPN solutions are also vulnerable to this type of attack. Corporate SSL VPN solutions will often authenticate against Active Directory, the NT Domain, LDAP or some other centralized credentials data store. Sniffing the SSL VPN login then gives an attacker valid credentials to the corporate network and other systems. </p><div style="text-align: justify;"> </div><h4 style="text-align: justify;">What an End-User Needs To Know</h4><div style="text-align: justify;"> </div><p style="text-align: justify;"> There’s a big step and end-user can take to prevent this from taking place. When the MITM Hacker uses the “bad” certificate instead of the “good”, valid certificate, the end-user is actually alerted to this. The problem is that most end-users don’t understand what this means and will unknowingly agree to use the fake certificate. Below is an example of the Security Alert an end-user would receive. Most uneducated end-users would simply click “Yes”… and this is the fatal flaw: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="300" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/13.jpg" width="382"><br />Figure 13</strong> </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> By clicking “Yes”, they have set themselves up to be hacked. By clicking the “View Certificate” button, the end-user would easily see that there is a problem. Below are examples of the various certificate views/tabs that show a good certificate compared to the bad certificate: </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="332" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/14.jpg" width="576"><br />Figure 14</strong><br />(Good Certificate) (Bad Certificate) </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img border="0" height="339" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/15.jpg" width="575"><br />Figure 15</strong><br />(Good Certificate) (Bad Certificate) </p><div style="text-align: justify;"> </div><p style="text-align: justify;"> <strong><img align="middle" border="0" height="336" src="http://www.ethicalhacker.net/images/stories/columns/hoffman/feb06/16.jpg" width="575"><br />Figure 16</strong><br />(Good Certificate) (Bad Certificate) </p><div style="text-align: justify;"> </div><h4 style="text-align: justify;">How an End-User Can Prevent This</h4><div style="text-align: justify;"> </div><ul style="text-align: justify;"><li> <p> Again, the simple act of viewing the certificate and clicking “No” would have prevented this from happening. </p> </li><li> <p> Education is the key for an end-user. If you see this message, take the time to view the certificate. As you can see from the examples above, you can tell when something doesn’t look right. If you can’t tell, err on the side of caution and call your Online Bank or the Online store. </p> </li><li> <p> Take the time to read and understand all security messages you receive. Don’t just randomly click yes out of convenience. </p> </li></ul><div style="text-align: justify;"> </div><h4 style="text-align: justify;">How a Corporation Can Prevent This</h4><div style="text-align: justify;"> </div><ul style="text-align: justify;"><li> <p> Educate the end-user on the Security Alert and how to react to it. </p> </li><li> <p> Utilize One Time Passwords, such as RSA Tokens, to prevent the reuse of sniffed credentials. </p> </li><li> <p> When using SSL VPN, utilize mature products with advanced features, such as Juniper’s Secure Application Manager or Network Connect functionality. </p> </li></ul><div style="text-align: justify;"> </div><br /></div>

Hacking Online Banking and Credit Card Transactions

Hacking Online Banking and Credit Card Transactions – And How to Prevent It: Here is process for hacking online banking and credit car...

Leer más »

cardcheck - Programa Validador de Targetas

<div style="text-align: center;"><div align="center"><img alt="" border="0" src="http://www.fileflash.com/graphics/screens/CardCheck-132.gif" /></div><br /><div align="center">CardCheck comprueba que los números de una <span class="IL_AD" id="IL_AD4">tarjeta</span> de crédito son correctos.<br />Realmente CardCheck no verifica la información de la tarjeta, únicamente lo que hace es comprobar que el <span class="IL_AD" id="IL_AD3">conjunto</span> de números de la tarjeta son correctos.<br />Hace un chequeo de validación para asegurar la validez de la tarjeta que se comprueba. Este sistema es capaz de encontrar en el 90% de los casos una tarjeta erronea de una correcta.<br />CardCheck también te ofrece la posibilidad de darle un listado de números de <span class="IL_AD" id="IL_AD2">tarjetas</span> de crédito, para hacer una comprobación masiva de tarjetas.<br />Además podrás imprimir los resultados.<br />Para utilizar CardCheck necesitas:<br /> * Sistema operativo: Win95/98/98SE/2000/NT<br /></div><div class="hiddencontent"><a href="http://members.fortunecity.com/hbook/cardcheck.zip">http://members.fortunecity.com/hbook/cardcheck.zip</a></div></div>

cardcheck - Programa Validador de Targetas

CardCheck comprueba que los números de una tarjeta de crédito son correctos. Realmente CardCheck no verifica la información de la tarjeta, ...

Leer más »

Genera Códigos Cvv2 (Cvv2 Retriever)

<div align="center"><div align="center"><img alt="" border="0" onload="NcodeImageResizer.createOn(this);" src="http://i40.tinypic.com/1ex6k0.jpg" /></div></div>Esta herramienta nos permite obtener los tan codiciados codigos Cvv2 de las tarjetas de credito, El <b>codigo Cvv2</b> se utiliza como clave de autentificacion de la tarjeta ingresada, tambien sirve para hacer un seguimiento de las actividades que lleva a cabo una determinada tarjeta.<br /><br />Como dice la descripción, con <b>Cvv2 Retriever</b> podremos obtener el código cvv2 de la tarjeta que introduzcamos con un sólo click.<br />Este <b>generador de códigos cvv2</b> tiene una gran probabilidad de acierto a diferencia de los demás y nos sorprende su sencillez y efectividad.<br /><div style="text-align: center;"><a class="link_live" href="http://www.anoni.info/?http://www.megaupload.com/?d=Z3XTNA39" rel="nofollow" target="_blank">http://www.megaupload.com/?d=Z3XTNA39</a><br /></div>

Genera Códigos Cvv2 (Cvv2 Retriever)

Esta herramienta nos permite obtener los tan codiciados codigos Cvv2 de las tarjetas de credito, El codigo Cvv2 se utiliza como clave de au...

Leer más »

Credit Master v4.0 (Generador de tarjetas de crédito)

<div style="text-align: center;"><a class="preview" href="http://www.anoni.info/?http://kimeras.es/imagenes/upload_image/fc2d70db3989c8511b8c01e24ae7f58b.jpg" rel="nofollow" target="_blank"><img alt="" border="0" id="ncode_imageresizer_container_1" onload="NcodeImageResizer.createOn(this);" src="http://kimeras.es/imagenes/upload_image/thumb/fc2d70db3989c8511b8c01e24ae7f58b.jpg" style="width: 506px; height: 355px;" /></a><br /></div>vamos a postear cosas nuevas y novedosas este 2010 en arkangeles aca les dejo el Credit Master v4.0 (Generador de tarjetas de crédito) Credit master es una aplicacion de consola para MS-DOS, que nos permite generar numeros de tarjetas de credito del tipo Visa, MasterCard, American Express y Tarjetas Discover. Credit master dispone de una lista de prefijos bancarios de mas de 200 items.Otro Generador de tarjetas de crédito, pero desde la línea de comandos ms-dos.Obviamente, consume muchos menos recursos que los otros generadores de tarjetas de crédito y es más práctico asi si funciona este pos posteare mas cosas novedosas espero que les guste y sea de su agrado nos vemos amigos <br /><br />descargar:<br /><br /><div style="text-align: center;" class="hiddencontent"><a href="http://www.anoni.info/?http://www.filebox.ro/down.php?key=mnifqhgdu1a6k9u1" rel="nofollow" target="_blank">Descargar aca<br /></a></div><br />pass:<br /><div class="hiddencontent">extremezone.3kshforum</div><br />nos vemos atte kimeras

Credit Master v4.0 (Generador de tarjetas de crédito)

vamos a postear cosas nuevas y novedosas este 2010 en arkangeles aca les dejo el Credit Master v4.0 (Generador de tarjetas de crédito) Credi...

Leer más »