Rxpert83

I hesitate to post these, but it goes to show you to keep tabs on your privacy and what methods are possible to invade it these days. I believe education is the best defense so I post these for educational purposes only. If anyone disagrees with this or posting this is against the rules of the forum please remove it. They are not available on the market an therefore are downloaded at your own risk. I will NOT link them here. I have used these apps only with permission of those on my home network (roommates) for testing purposes. They may even be illegal to use in your area. These apps require a rooted phone.

With that being said...It used to be that you only had to worry about using open wifi networks...

Faceniff
-Think of FireSheep for android (on steriods)
-Able to hijack cookie sessions for facebook, twitter, amazon, tumblr, myspace ect.
-"Improvements" upon firesheep:
-Able to sniff cookies on password secured networks
-Able to hijack HTTPS secured logins (SSL stripping)
-Saves cookie information with ability to login to that account at ANY TIME
-Has the power to reveal HTTPS login passwords, but the developer has left that (mostly) out... Just know it can be done


WifiKill (less potential for malicious behavior, but could def be a pain)
-Able to pick and choose what Wifi devices on your network are able to access the internet.
-Able to kill internet to select devices (or all except yours) on the network without them knowing (will still show full wifi signals, but internet will not work).
-Basically tricks the devices into sending all traffic through your phone, which then doesn't forward killed devices.


Long Story Short......
Be careful with your information, don't login to wifi networks you aren't familiar with.

Last edited by Rxpert83; November 3rd, 2011 at 01:46 AM.

ocnbrze

yeah i get nervous when i'm at starbucks or something like that. i try not use my phone as much while i'm there. and anyways i do not bank on my phone or pay bills on my phone so i think that i'm good to go. but thanxs for the write up.

__________________
“The Guide is definitive. Reality is frequently inaccurate.”.......Hitchhiker's Guide to the Universe
“I seldom end up where I wanted to go, but almost always end up where I need to be.”.......Douglas Adams

argedion

Technology is and always will be a double edged sword. I am poor people so I don't have to worry much about my account. People usually look at the negative sign and give up.

__________________
Asking simple questions can keep us from doing dumb things.
Help BabyBlues save the ta ta's

takirb

I try not to use a public wifi if i can avoid it. It was alot easier when all you had to worry about was whether or not you chose to connect using a laptop. But these days, so many people leave their phone's wireless enabled, and check their email, facebook, banking, etc from any available network, that it's very tempting to "verify" the functionality of these types of tools. I'm not a malicious person, but I've put in my time with tools such as Aircrack-ng for "research purposes". I remember informing some of my staff about Firesheep last year, and explained why NOT to use public wifi like Starbucks, county library, hospitals, etc from their phones. Fortunately, tools like these are also used to improve security so i'm as equally glad they're available.

Rxpert83

Yeah developers reasons for making apps like these are generally that they can help draw attention to the problem and get people to take corrective action.


......at least thats what they say so they dont get a mob after them.

9to5cynic

Awesome! Good to know. In my security class last year with did presentations, and one student showed firesheep. Pretty damn impressive piece of software there.

Rxpert83

It is. Everthing firesheep did was already known about, but it was the ease of use for the average joe that made it a threat. We can thank firesheep for facebook and other sites that payed attention for automatically logging in via HTTPS now.

Faceniff is just as easy to use, much more powerful, but doesnt have the same mass user base because it requires a rooted phone. Nevertheless, i expect we will be hearing more about it.

9to5cynic

I am actually really glad all the security issues are made well aware. I find it fascinating myself, but I think for users as a whole it is very beneficial. I also remember reading about a work in progress suite (as of last year when I checked it out) that was a 'privacy mode' for rooted phones. It included a browser using tor, an app to trick network towers (so they don't grab your location) along with several other useful apps. One even was controlled by the "face up" "face down" of the phone, though I could be wrong on that.

I'll probably have to try out facesniff and wifikill sometime. At least for the knowledge of it.

Also, there are a lot of network analyzers out there (though the names escape me (scandroid may have been one)). And you can get tcpdump apps on rooted phones too. Very fun.

ITSecurity = fun.

takirb

I wish i could find an android browser that allowed for SOCKS v5 configuration, I asked about one earlier this year but didn't get a response. I have one of my PC's at the office setup to SSH to my Linux server at home, so all the network traffic gets sent through SSH when i'm browsing the web. No more blocked sites, restrictions, etc. I have a friend that does this on his iPhone when on public wifi, and i'd like to do the same for my Android. ConnectBot will allow for SSH, but i can't find a browser with enough settings to send through SSH.

ocnbrze

just saw this:
iSpy
you do not even have to be on a wifi network. if they can record you either directly or from a reflection with a camera, they can still see what you are typing on your phone. crazy stuff.

Last edited by ocnbrze; November 5th, 2011 at 04:50 AM.

argedion

Information like this is great to know however the only people that seem to pay it any mind are the enthusiast and the security people. Most people don't have a clue. Some think your crazy even after telling them and showing them articles on the stuff. Stuff like this is why I usually don't take security patches as serious as most. I know for every one hole you plug ten to twenty more are out there. (Note: I do install security patches)

Does anyone know what the ratio difference is between having your phone hacked vs having someone hijack your credit card? Just curious
I know my dad has told me his card has been hijacked a couple of times. (Seems to be a restaurant thing for him)

Rxpert83

Interesting read. They used low quality cameras on purpose and were still able to get it (using high tech computers)

takirb

Got it! I used SSHTunnel and ProxyDroid, both in the market. I'm on 3G at my work place, and I've successfully encrypted my network traffic and DNS through the SSH tunnel to my home PC. Confirmation is being able to browse to my router's GUI from Dolphin HD, while on 3G

I'm not going into the specifics on how to setup/configure an SSH server, there's several free options available for Windows/Mac/Linux, but here's the SSHTunnel and ProxyDroid settings below. Just make sure the local port# of SSHTunnel matches the same port# on ProxyDroid (I had accidentally left the default port in on ProxyDroid and couldn't browse)

SSHTunnel Settings



ProxyDroid Settings




Router Page on 3G

Last edited by takirb; November 9th, 2011 at 09:10 AM.

Rxpert83

I'm glad you got that working, many will find that useful