Friday, June 20, 2014

Real Life Phishing Scenario : Zero Day google bug

A reader on my blog tried to hack my account

Now all this time I've been teaching people how to hack Wireless networks, Windows machines, Websites and Social Networking accounts. All this we did in Kali Linux. For once, I'm moving away from the operating system and narrating a real life incidence of how someone almost got my Email account and password, and could have possibly infected me with a RAT (remote administration tool). He didn't really mean to hack my account, but was rather interested in making a point. So this is how it happened.



How it started

Everyday, I check my blogger dashboard to see if there are any new comments on my blog. Today morning, I saw an anonymous comment (most of the comments are anonymous so that didn't alarm me) saying that the person needed my help with something but would only contact me via mail. I couldn't give him my personal mail address so I decided to use my website's mail instead, and sent him a message. This was his reply



Looked fair enough. Out of curiosity I clicked the link and it took me to a google drive login page. Everything looked pretty convincing, and I could have easily entered my credentials into the login form, if it were not for the slightly suspicious URL. Also, it was https and chrome verified the digital certificates to be that of google. Faking this can be assumed to be next to be impossible. However, I still was cautious, considering that I run a hacking blog and it's not unlikely that a person visiting here might be good, maybe million times better than me.

What I did

So, I decided, I cannot just dismiss the page as phishing as such without trying. So I entered the email:abcd@gmail.com and password:lookslikephishing and pressed sign in. Now if it were a real page, it would have said incorrect password, but this page had no mechanism for verifying the form data, it actually just kept logging everything (i.e. it recorded whatever someone entered in the form) and would simply download the PDF no matter what we entered in the form. So, after entering the bogus login data, the PDF download started. It completed successfully and I ran the PDF. The content looked genuine and then I realized, well, what if this was a 2 fold attack, first phishing, followed by infection. He could have used a FUD remote administration tool which my antivirus wouldn't be able to detect. I have Windows Defender on my Windows 8 machine, but with proper crypting , anti-viruses can be evaded. So after this, I went to white hat section of hackforums and asked for help (everyone needs help at some time or the other, and I suck at forensics and related stuff) . An expert analyzed my computer thoroughly via teamviewer, and the file was clean indeed. Meanwhile, the following mails had been sent to me.

Mails Recieved


He sent me some mails
He knew I found out the phishing page thing
He said he wants me to spread public awareness regarding this kind of phishing

I replied to him saying that I'm finding out and cleaning the malware he sent me (if any). He replied and said he didn't send any malware or anything.

Finally

 I contacted him via FB. He turned out to be a fellow Indian and was even younger than me (I'm 17 he is 16). By this time I had finished my investigation, and the White hat expert from Hackforums didn't find anything either. I finally concluded that either there is no malware, or he's just too good. Latter is quite unlikely since he was not able to dig up my personal email address on his own. Believe me that's really easy to do. After having a conversation with him and doing some research on this HTTPS phishing page, I realized that it is done using a bug in Google drive, which has been discussed on The Hacker News. I will see if I can replicate a HTTPS phishing website using this bug, and post a tutorial on how to do it. The sole intent of this post is to make people aware that Phishing is a real threat, and to encourage Google to fix this bug soon. Either ways, they will surely patch this bug after I write the tutorial on creating a Phishing page using Google Drive, as Google won't want it's user's accounts to be compromised by any random kid with  a laptop who ended up on this website. Already they have applied a patch which makes carrying this out difficult and during the earlier days of this vulnerability, the URL was short and not suspicious at all, but now it's very long (see the screenshots). Update : Google is probably not going to do anything about the issue as it is not a bug and I'm not gonna take the risk of writing anything which will usher upon me the wrath of Google (as I use blogger for hosting and blogger is owned by google). Google Drive, just like Dropbox allows hosting simple HTML sites like this phishing one. This can be abused, since some people will not know that this is a malicious document uploaded by someone and not a legit Google Drive login page, but it still is not a bug. 
Hacker's message on FB
After I told the hacker on Facebook about this post even he acknowledged that everything about this attack is perfect but the URL which earlier used to start with google drive now has a long suspicious prefix. The vulnerability has been half patched and google will possibly patch the remaining thing soon.

55 comments:

  1. thank you for your post and awareness

    ReplyDelete
    Replies
    1. You're welcome. Today had been a day full of events.

      Delete
  2. Interesting....

    ReplyDelete
  3. Come on guys....stop acting like assholes......i m still hosting the link just for educational purpose so you could view the link and copy the source code (well actually just copying will not do the work alone)........so stop spamming the link with useless comments on login page....my system is still logging everything......from what the shit you type there to your IP addresses also...so be mature...or just tell me and i will take down the link.......and i think someone who haven't read the post carefully actually entered his real password and now his password is resting in my database....well i will make sure that i contact him to change his password immediately...

    ReplyDelete
    Replies
    1. Where is the link... can you please give me the link.. i want to see what it actually looks like

      Delete
  4. is this still working ? and send me a link where i can learn how to use it please ....thank u :)

    ReplyDelete
  5. Looks like the hacker was hacked ! You need to work on cyber security much more or you will face big troubles !!! However good thing that he was a good guy otherwise you will end up with a rootkit or something installed in your pc :)

    ReplyDelete
  6. 01001001 00100111 01101101 00100000 01100001 01101100 01110011 01101111 00100000 01110011 01101111 00100000 01101101 01110101 01100011 01101000 00100000 01100110 01101111 01101111 01101100 01101001 01110011 01101000 00100000 01110100 01101111 00100000 01110000 01101111 01110011 01110100 00100000 01100001 00100000 01100011 01101111 01101101 01101101 01100101 01101110 01110100 00100000 01101111 01101110 00100000 01101000 01100001 01100011 01101011 01101001 01101110 01100111 00100000 01110011 01101001 01110100 01100101 00100000 01110111 01101001 01110100 01101000 00100000 01101101 01111001 00100000 01110010 01100101 01100001 01101100 00100000 01100101 01101101 01100001 01101001 01101100 00100000 00100001 00100001 00100001

    ReplyDelete
    Replies
    1. 01010000 01100101 01101111 01110000 01101100 01100101 00100000 01100011 01101111 01101101 01100101 00100000 01101000 01100101 01110010 01100101 00100000 01110100 01101111 00100000 01101100 01100101 01100001 01110010 01101110 00101100 00100000 01101110 01101111 01110100 00100000 01110100 01101111 00100000 01100011 01100001 01110101 01110011 01100101 00100000 01110100 01110010 01101111 01110101 01100010 01101100 01100101 00101110 00100000 01001001 00100000 01110111 01101111 01110101 01101100 01100100 01101110 00100111 01110100 00100000 01100010 01100101 00100000 01110100 01101111 01101111 00100000 01110111 01101111 01110010 01110010 01101001 01100101 01100100 00100000 00111010 01110000

      Delete
  7. The component which makes this blog extraordinary is the good faith seen all through.
    https://www.duocircle.com/advanced-threat-defense/

    ReplyDelete
  8. I wanted to thank you for this excellent read!! I definitely loved every little bit of it. I have you bookmarked your site to check out the new stuff you post. Email Database USA

    ReplyDelete
  9. Positive site, where did u come up with the information on this posting? I'm pleased I discovered it though, ill be checking back soon to find out what additional posts you include. Buy Bad Google Reviews

    ReplyDelete
  10. IdealAssignmentHelp is one of the best company in the business and are higher acclaimed when it comes to providing assignment help services. It have specialists in their team to take complete responsibility of your task and deliver to you as per your needs. It will cover exactly the way you have stated and that too without any compromise with the standard of service. visit their website if you need any "reliable My Assignment Help".

    ReplyDelete
  11. That lesson is very meaningful, I will apply it now

    ReplyDelete
  12. wonderful experience reading this article and thanks for creating such content moreover if you want to create 3d models and designs for your blog download now Autocad Crack

    ReplyDelete
  13. Very impressive and really a great phising scenario of assignment help service and other services like assignment help Sydney which should people consider these days

    ReplyDelete
  14. Forza Horizon 4 is a 2018 racing video game developed by Playground Games and published by Microsoft Studios.[2] It was released on 2 October 2018 on Xbox One and Microsoft Windows after being announced at Xbox's E3 2018 conference.[3][4] An enhanced version of the game is set to release on Xbox Series X/S on 10 November 2020. The game is set in a fictionalised representation of areas of Great Britain.[2][3][4] It is the fourth Forza Horizon title and eleventh instalment in the Forza series. The game is noted for its introduction of changing seasons to the series.


    Forza Horizon 4 Download Highly Compressed
    AnyTrans Crack

    ReplyDelete
  15. This is really interesting, You are a very skilled blogger. I have joined your rss feed and look forward to seeking more of your excellent post. Also, I’ve shared your site in my social networks!

    solidworks 2020 crack
    matlab r2020a crack
    babylon pro ng crack

    ReplyDelete
  16. FL Studio Crack is a music studio application. It comes with exceptional machining properties. With the app, you can recognize every tool, every track or every effect on your music.
    ipvanish-lifetime-crack-2021-license-key
    cleanmymac-x-activation-number

    ReplyDelete
  17. FL Studio Crack is a music studio application. It comes with exceptional machining properties. With the app, you can recognize every tool, every track or every effect on your music.
    ipvanish-lifetime-crack-2021-license-key
    cleanmymac-x-activation-number

    ReplyDelete
  18. Data Recovery Crack is recovery solution software for businesses with multiple machines, data recovery service providers, system administrators, IT professionals, consultants, and technicians.
    minecraft-cracked-free-download
    stardew-valley-free-download

    ReplyDelete
  19. Data Recovery Crack is recovery solution software for businesses with multiple machines, data recovery service providers, system administrators, IT professionals, consultants, and technicians.
    Minecraft Software free download
    Stardew Valley Free Download

    ReplyDelete
  20. Autodesk 3ds Max Crack is a very good and well-known option for 3D computer animation software that focuses on providing graphic designers with a robust modeling structure.
    Adobe Premiere Pro Keygen Software Free Download
    Wondershare Filmora Keygen Software Free Download

    ReplyDelete

  21. Easy For Download Item :
    https://bit.ly/2WVjxFAj

    ReplyDelete

  22. New year Gift:
    https://bit.ly/3rKwe4k

    ReplyDelete
  23. CCleaner Professional CrackThe program limits the means by which a malicious party monitors your work habits or attacks your system. Permanent deletion of history (Internet browser history), cookies and temporary files created during the working process, as well as unused space on the disk.

    ReplyDelete
  24. WonderShare Mobiletrans Serial KeyTransfer recordings to any computer or device for a backup from which you can later restore data.
    Wondershare MobileTrans Keygen can also be used to back up your system data to other devices.
    Mac users have the option to completely erase all data sent by the original.

    ReplyDelete
  25. Movavi Slideshow Maker Crack is a reliable and feature-rich application that enables you to create great slideshows from your digital photos. The program has built-in effects that allow you to optimize your slide shows with more than 100 transitions, 150 filters, and more than 40 titles. With Movavi Slideshow Maker, you can also add your favorite music to your slide shows.
    https://protocrack.com/movavi-slideshow-maker-crack/
    4K Video Downloader Crack to download free 4K or 4K videos from YouTube and other 4K video sites. Use our PC app to create a collection of the best 4K video downloaders and watch them on your 4K TV without buffers or ads. With over 40 million downloads, Videoder is one of the most popular YouTube downloaders for Android. Just great. 4K Video Downloader does everything you could want and no problem.
    https://secrack.com/4k-video-downloader-crack/
    Built for the latest pens and touchscreens, Adobe Fresco Crack combines the world's largest collection of vector and raster brushes with revolutionary new dynamic brushes to deliver a completely natural drawing and painting experience. For artists, illustrators, animators, designers and all those who want to discover or rediscover the pleasure of drawing and painting.
    https://thiscrack.com/adobe-fresco-crack/

    ReplyDelete
  26. AutoCAD Civil 3D xforce Keygen is the latest form of offline configuration for Windows parts 32 and 64. Autodesk Civil 3D Serial Key is a niche application for design professionals that allows them to modify various structures and plans before building.

    This amazing application can review and control design information, as well as work on different types of frameworks and activities to impart a higher level of implementation. Provide better and faster responses with an increasingly beneficial work process. Include several items and review them once the price goes up quickly.

    ReplyDelete
  27. Omnisphere Serial Number for Windows offers a wide range of completely new software with enhanced capabilities. Its latest features are worth using. This not only allows you to use the sound from the internal audio source, but you can also import your personal audio content and produce endless sounds.

    It also provides the perfect set of music resources offering all kinds of plugins which are, by the way, easy to use and much better. It really is simply the best tool that allows the user to manage substantial aspects of the synthesizer as well.

    ReplyDelete
  28. Dolby Access Software. This application gives you access to a trial version of Dolby Atmos, Dolby Laboratories’ latest surround sound technology, after installation. Once Dolby access crack Reddit is installed, you will be asked to install Dolby Atmos for PC.

    You only need to change the settings of your headphones to use them as the standard surround sound format in the “Speaker Properties”. Dolby access registration key gives you access to a gallery of online multimedia files created with this new technology, particularly to illustrate the positive changes that come with this new format.

    ReplyDelete
  29. Hotspot Shield Premium License Code is the best and most trusted web security software. Online security is a major concern in today’s conditions. Unlike snoopers and programmers who track your workouts online, the ISP also manages log documents related to all client movements.
    It’s like living in a greenhouse where you usually have weaknesses. You can see the internet as an unknown client with full protection. Programmers do not have the ability to see this on their computer.

    ReplyDelete
  30. Stellar Converter Crack is a comprehensive answer for all your audio and video conversion needs. The video and audio ratio converter converts movies. audio documents in many codecs and also offers utilities for video editing. The creation of GIFs to insert metadata and much more for audio and video patch overlays for videos is well known among YouTube, Instant Chat and Instagram users. Provides a clean and fast way to apply video or GIF to identical video displays in the past.
    https://protocrack.com/stellar-converter-crack/
    Adobe Premiere Pro Crack is the innovative video editing software for movies, television, and the Internet. With creative tools, integration with other applications and services, and the power of Adobe Sensei, you can turn your video into high-quality movies and videos. With Premiere Rush, you can create and edit new projects from any device. Automated tools compatible with Adobe Sensei save time so you can focus on your story.
    https://secrack.com/adobe-premiere-pro-crack/
    Camtasia Studio Crack to solve the problem Most of the people have problems with effective communication. Whether it's commenting on a project, teaching a class, or training others, it's hard to make sure people understand. But the problem is that your communication will fail if your message is not prompt and you do not respond. OS With Camtasia Studio, you can create high-quality images and videos for better communication.
    https://thiscrack.com/camtasia-studio-crack/

    ReplyDelete
  31. This is really good and useful information. I am pleased
    you just shared this useful information.
    Keep us updated. Thanks for sharing.
    hitfilm pro crack
    macbooster crack
    eventide anthology crack
    free studio crack

    ReplyDelete
  32. Videoscribe Serial Key
    VideoScribe Registration Number, hence its heavy reported use. It is video and animation software created developed by a UK software company. It comes in variants for the different computing platforms: desktop and mobile.

    ReplyDelete
  33. JRiver Media Center Registration Code
    JRiver Media Center Torrent plays all your media, rips, records and organizes all your music, pictures and videos. MC encodes and plays all popular multimedia formats.

    ReplyDelete
  34. Gmail Hacker Pro Crack Gmail Hacker Pro License Key:
    Gmail password hacker serial key organization like Google doesn’t recognize these piracy strategies against its multi-billion dollar company?

    Panda Antivirus Pro Crack Panda Antivirus Pro Keygen, you get everything you need to protect your PC, Free Download Panda Antivirus Pro Full Version Panda Antivirus Torrent, you can enjoy a new, Panda Antivirus Pro license key improves the security of your computer with the help of Process Monitor.

    ReplyDelete
  35. IObit StartMenu 8 Pro Crack brings the start menu of the start windows. It is specially designed for Windows 8. The start menu of IObit Download offers a really perfect solution for users whose paintings with start windows start the menu all the time and are not familiar with the new subway start screen in the windows Start eight.
    manycam-pro-crack
    iobit-startmenu-8-pro

    ReplyDelete
  36. Miracle Box Crack is a powerful and unique software that handles mobile problems smoothly. Mobile troubleshooting software takes over all hardware and software activity from Android devices
    miracle-box-crack
    corel-draw-graphics-suite-crack

    ReplyDelete



  37. Is this a paid topic or do you change it yourself?
    However, stopping by with great quality writing, it's hard to see any good blog today.

    Wondershare PDFelement Crack

    ReplyDelete
  38. This is a practical and efficient application that deserves to be used when you need to manage and organize a certain number of associated files in a directory structure.
    fusion 360 crack
    mixcraft 9 crack
    smartsvn crack
    ytd video downloader crack
    tracktion collective crack mac
    spotify premium crack
    zbrush torrent crack

    ReplyDelete
  39. an excellent tool for all kinds of 3D mod design and makes it very beautiful and attractive. I loved it as much as you will receive carried out right here.
    The sketch is attractive, your authored material stylish.
    nonetheless, you command get got a shakiness over that you wish
    be delivering the following.

    tenorshare reiboot Crack
    Adobe Acrobat Pro DC Crack
    morhpvox pro crack Crack
    dolby atmos Crack

    ReplyDelete
  40. App Builder Crack is a new and modern way to develop mobile applications with HTML5. There are dozens of visual and non-visual drivers in this software, which you can add to the software environment. These drivers include timers, HTTP clients, text inputs, buttons, and many other drivers for developing mobile applications. The important point about App Builder Patch is that you don’t have to be a JavaScript master to develop software using HTML5.

    ReplyDelete
  41. Stellar Phoenix Serial Key is a multimedia system video file recovery tool that allows you to use this system to repair and restore movie file format on your multimedia system.
    https://upcracks.com/stellar-data-recovery-crack-10-0-0-5-download-for-windows-2021/

    ReplyDelete
  42. This software is a multimedia system document recovery tool which enables you to use this system to repair and restore movie file format of multimedia system.
    Stellar Data Recovery Crack

    ReplyDelete
  43. you content is amazing and very informative, i am sharing this with my team mates please visit us. There are various movies but we sorted according to people. what they love and rated best among them. Asian films that the academy will not honor or inform you about. There are a lot of movies, here are 25 of the Best Asian Films on Netflix. There we discuss about one of the best and top rated movies browse now Asian Movie On NetFlix

    ReplyDelete

© Kali Tutorials, 2016. Unauthorized use and/or duplication of this material without express and written permission from this site’s author and/or owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to Shashwat Chaudhary and Kali Tutorials with appropriate and specific direction to the original content.
Bitcoin: 1B5aLqJcMW7zznffTxQwta8JTZsxBDPguC