4 methods to get other people's passwords on Facebook

[НСК-СБ]

4 methods to get other people's passwords on Facebook
Author: Nelson aguilar

Despite the fact that for many years there have been several incidents related to security on Facebook, many continue to use this social network. Moreover, the number of new users is constantly growing, which allows Facebook to set new records. As of December 31, 2017 Facebook accounted for 2.13 billion monthly users , the average daily is about 1.4 billion.

Part of our lives goes to Facebook. We share our birth dates and anniversaries, talk about our vacation plans and share your current location. We share the dates of the birthdays of our children and the dates of the death of the parents. We talk about the most pleasant events and heavy thoughts. In general, we disclose many aspects of our lives. There are even whole books written by clinical psychologists detailing how powerful Facebook has in our emotions and relationships.

However, we often forget that we are under surveillance.

We use Facebook as a means of communicating with friends, but there are people who use this social network for malicious purposes. We disclose information that others may use against us. Attackers know when we are not at home, and how long our absence will last. They know the answers to secret questions and, in fact, can steal our personal data using the information that we voluntarily indicate in the public profile.

The most unpleasant thing is that the more technological our lives become, the more vulnerable we become for attackers. Even if we share incomplete information in the public domain, in case of urgent need, knowledgeable people can access our email and Facebook account in order to fill in the information gaps regarding our personal data.
In fact, you don’t even need to be a professional hacker to gain access to someone else’s Facebook account.

The process of gaining access to your account can be no more complicated than installing the extension Firesheep . Moreover, on Facebook you can access someone else’s account even without a password. You only need to choose three friends to send the code. Next, you enter the three received codes and gain access to your account. It doesn't get any easier.

In this article, I will show you several ways that hackers and ordinary people can access their Facebook account. After the description of each method, a method of protecting your account from a specific method will be given.

Method 1: Reset Password

The easiest way to access someone else’s Facebook account is to reset your password. Implementing this method is easier for those people who are on the list of friends of the person whose account you plan to hack.

• The first step is to get the email used during authorization (for example, in the section with contacts in the profile). Hackers use utilities like TheHarvester. More information on this topic can be found in this guide .
• Click on the link Forgotten account? and enter the victim’s email. After the account appears, click on This is my account .
• You will be asked if you want to reset your password via email. As we will be accessing by other methods, click on No longer have access to these?
• A question will appear How can we reach you? Enter the email address you have access to. This address should not be linked to any Facebook account.
• You will be asked to answer a question. If you know the victim well, you can probably answer this question. Otherwise, you can try to find the answer. If the correct answer is found, you can change the password. Next, you need to wait 24 hours to log in to the victim's account.
• If you could not find the answer to the question, click on Recover your account with help from friends (restoration of access through friends). Next, you will need to select from 3 to 5 friends to whom the code will be sent so that you can regain access to your account.

Figure 2: List of friends through whom you can regain access to your account

• Passwords will be sent to the selected friends, which must be entered on the next page. You can either create from 3 to 5 fake accounts and add as friends to the victim, or select those friends who agree to share the password you sent.

Figure 3: Page for entering passwords sent to selected friends
How to protect yourself

• When registering with Facebook, use a separate and undelivered email address.
• The secret question should be such that the answer could not be found on the basis of information from the public profile. No animal names or anniversaries. Even the names of primary school teachers should not be used as this information can be found in the alumni album.
• Choose three reliable friends to whom the password will be sent. Thus, you can protect yourself from sending a password to random acquaintances who intend to access your account.

Method 2: Using Keylogger

Software Keylogger

A software keylogger is an application that reads all keystrokes on the keyboard without the knowledge of the user. This application must first be manually downloaded to the victim’s computer. Then the keylogger starts working in the background and intercepts all keystrokes. You can configure so that all collected information is sent to e-mail.

To get started, you can read keylogger installation guide on target computer . If this method does not suit you, you can search for free keyloggers or try to write your own in c ++ .

Figure 4: Parameters of one of the keyloggers

Hardware Keylogger

Hardware keyloggers work exactly like software spies, with the exception that you need to connect a USB flash drive with software to the victim's computer, where all captured keystrokes will be saved. Subsequently, you only need to insert the USB flash drive into your computer and extract the collected information.

There are several varieties of hardware keyloggers. Models like Keyllama must be connected to the victim’s computer and can work on any operating system. In order to receive the collected information, you must have physical access to the device. Alternative option: Wi-Fi keyboard spy . The collected information can be sent by e-mail or downloaded via Wi-Fi.

Figure 5: Hardware Keyloggers

How to protect yourself

Use a firewall that will monitor network activity and will be able to track suspicious operations, since keyloggers usually send collected information via the Internet.

• Install password manager. Password managers will automatically fill out all important forms without using a keyboard, and keyloggers can only intercept keystrokes.
• Install updates on time. As soon as the development company finds out that vulnerabilities have appeared in the application, work on creating patches begins. Older software versions may cause additional holes in your system.
• Change passwords. If you still don’t feel protected, you can change your passwords every two weeks. At first glance, this approach seems too radical, but on the other hand, passwords stolen by attackers will lose relevance too quickly.

Method 3: Phishing

Although implementing this scenario is much more difficult than the previous two, phishing remains one of the most popular ways to gain access to someone else’s account. The most popular type of phishing involves creating a fake login page. The link to this page is usually sent to the victim’s mail and is no different from this authorization form. One of the difficulties is that you need to create an account on a web hosting and, in fact, the fake page itself.

Figure 6: Fake Login Page

The easiest way to create such a page is to familiarize yourself with website cloning guide . Then you will need modify the form so that the information entered by the victim is stored somewhere. The implementation of this method is complicated by the fact that, on the one hand, users have become very careful, on the other hand, phishing filters in email services are constantly improving. However, nothing is impossible, especially if you clone facebook completely .

How to protect yourself

• Do not click on suspicious links in emails. If the letter suggests authorization via the link, be careful. at first check url . If you still have doubts, log in directly to the Facebook website.
• Phishing is not necessarily done via email. Links can be distributed through websites, chats, text messages and so on. Even pop-up advertisements can be harmful. Never click links that look suspicious, and especially those that ask you to enter any confidential information.
• Use antivirus programs and applications that protect against web threats (Norton, McAfee, etc.).

Method 4: Man in the Middle Attack

If you are close to the target, you can provoke the victim to connect to a fake Wi-Fi network to steal accounts. Utilities like Wi-Fi Pumpkin allow you to create fake Wi-Fi networks based on wireless network adapter and Raspberry pi . After you’ve got close to the target with the configured equipment and the victim is connected to a fake network, you can analyze the traffic or redirect to a fake login page. You can even replace individual pages without touching the rest.

Figure 7: A small computer on the basis of which a wireless network clone was created to intercept traffic (author of the photo SADMIN / Null Byte)

How to protect yourself

Never connect to open (and unencrypted) Wi-Fi networks.

• Be especially wary of networks outside public places. For example, a network called Google Starbucks should be suspicious if there are no Starbucks establishments within a few miles. Since hackers have already collected some data for you, your computer or phone will connect to a fake network, as the name of this network has already been used before.
• If you are having problems connecting to a Wi-Fi network, look at the list of neighboring networks for any copies of your network names.
• If the router asks you to enter a password to enable the Internet to update the firmware or shows you a page with a lot of grammatical errors, it is very likely that you are connected to a fake hotspot and someone is trying to steal your account.

Additional hacks

More advanced users can read two more guides: Same Origin Policy Facebook hack and Facebook Password Extractor (The second method is a bit simpler).

How to protect yourself

• In the Account Settings in the Security-related section, check the box next to the Secure Browsing option. Firesheep will not be able to intercept cookies if you work through a secure protocol (for example, HTTPS).
• Permanently enabled SSL. Use extensions HTTPS-Everywhere and ([DLMURL="https://addons.mozilla.org/en-US/firefox/addon/12714/"] Force-TLS [/ DLMURL] for Firefox v52 and below).
• After completing work with the site, end the authorization session. Firesheep cannot support authorization if you are logged out.
• Use only reliable Wi-Fi networks. A hacker can sit near you at Starbucks Cafe to scan your mail without your knowledge.
• Use a VPN. Since in this case all your traffic will be encrypted, even if an attacker intercepts information using fake Wi-Fi, then he will not be able to extract anything useful.

Conclusion

Social networks allow you to keep in touch with old friends and meet new people. You can create events in a few clicks, send greeting cards, declare love to parents and the second half.

Even taking into account the existing hacking capabilities of your account, which we have considered, it is quite possible to use social networks and remain protected. One has only to take certain measures and think several times before you want to publish something on your profile. The less information you publish, the more difficult it is for hackers to access your account.

If your Facebook account was hacked, this guide describes the steps to restore access to your account.

In addition, partly possible track who is viewing your profile .

More details: https://www.securitylab.ru/analytics/492396.php?R=1

 

[Частный детектив. Москва.]

I don't know if this will be useful to me, but thanks anyway!

 

[Kiril Harchevnikov]

The methods are certainly interesting, but they are all pretty primitive.