As we explained in the the second technique, many people use the same password at different places so, if we can find one them it will be easy to try it in other sites.

Passwords stored at the ISP might be more easy to find than in other sites, depending on the ISP used. Some of them don’t care too much for security or have employees who can be tricked with social engineering. It’s a shame that people who should be really conscious about security are sometimes the least informed.

A lot of times a single telephone call can be used to retrieve the password. If this doesn’t work and we know some advanced security we can try to find some bugs at ISP’s site, which sometimes are not as secure as they should be.

For us, as users, it’s quite difficult to defend from this type of attacks, as we must trust the ISP and its security. The only thing we can do is try to get information about past security incidents at the ISP, although this can prove difficult, as they don’t usually publish this kind of information. Luckily, every day ISPs give more importance to security so it’s more difficult to accomplish this attacks.

Keyboard logging is the name of the technique used to record all keys pressed by the user of a computer so we can know what he has been doing and all the text he has entered. Of course, if he has used that computer to log into his email account he will have entered the password so it will be recorded with the rest of the data.

There are two different types of keyloggers, software-based and hardware-based ones. The hardware based ones have to be connected between the keyboard and the computer, so you need to have physical access to it to install and to recover the data. On the other hand, these can not be detected with software so they can be hidden quite easily if the keyboard connector is not at plain sight.

Hardware keyboard loggers are not always a malign tool, they can also be used to keep a backup of text written in your computer. For example, Keyghost sells loggers with up to 1 megabyte of memory, where you can save lots of keypresses. If you are a writer or are writing something really important for you, as your thesis, it might be handy to have one of this in case something happens to your harddisk. Any way, this should be no substitute of correct and timely backups, but can be of great help.

The software based ones are simple programs which remain resident in the memory of the computer, monitoring all pressed keys and recording them to a file which can be later retrieved by the attacker. The most sophisticated ones are really stealthy and can even send the collected data by email, so the process is automated.

To protect against keyloggers the most important measure we can take is not to use critical passwords in computers not owned by us. So, don’t login into your bank or your email account in an Internet café, at university or from work, only do so from your home machine. If you must do it, then you better check the connection from the keyboard to the computer to see if there’s some strange gadget attached to it.

To protect against software keyloggers, we can use classical antivirus or antispyware but some keyloggers (mainly custom made ones) are not detected by these utilities, so we can use KL-Detector, a software that checks if any program is recording the keys to a file.

Following the same reasoning than the last post, we can conclude that if people can’t remember long or complicated passwords thay also aren’t able to remember more than one password at the same time.

What most people do is use the same password again and again, in different sites or even in his personal computer. So, if you want to get a password from a site where it’s quite difficult to do it, why not to try with another site which might be easier?

You can try to get the login password, the ISP password or any other one which is saved in the computer. If you have physical access to the computer there are some good ways to get them.

The first one is using ShowPassword. If you find a textbox where there are hidden passwords, which will be replaced with asterisks, these can be easily revealed with this program, only by executing it and moving the cursor over the textbox.

Another program from the same author is Protected Storage Viewer which extracts information from some hidden places in Windows. This can show saved passwords from Outlook, Internet Explorer and MSN Explorer.

We can see that it’s really important to have a good password policy and change it to something different in every place we need to create an account. One policy which can work is having a general password for some non-critical sites (as online forums) and custom passwords where security is more important (as in your bank).

In most hacking forums, one of the most asked questions is how to get a Hotmail password. I said Hotmail but, in fact, almost all web-based e-mail providers work very similar. Almost always, the answer from more knowledgeable people is: “You can’t do that. Dont’ ask again!!”, sometimes accompanied with some rude words. It’s the natural answer to the fact of having to read the same question again and again.

But well, the real answer is not you can’t do that. It would be more like: “maybe, if you are intelligent and have a bit of luck, you could get the password”. So yes, there are multiple ways to get the Hotmail password of someone but they are not usually easy, you need a bit of luck and knowledge and they are always illegal. Keep in mind that there is no automated program where you write the email and it returns you the password. If you find something like this it’s surely a fake.

Anyway, I’m going to give you all this methods. No, I’m not crazy, I only want you to be conscious about it, so you don’t fall in the kind of tricks used by some people to steal the passwords from you.

I’ll give a list with ten different ways to do it and I’m going to explain each one of them in succesive posts.

• Trying basic passwords
• Trying passwords used in other sites
• Social engineering
• Keyboard logging
• Passwords stored at ISP
• Sniffing
• Recovering it from another account
• Breaking into the user’s computer
• Bruteforce
• Stealing files with NetBIOS

From | NNLNews.