The title of this post might be a little misleading, as getting a Hotmail password using bruteforce is not really possible. The security engineers at Hotmail have implemented a system that blocks an account when more than some incorrect passwords have been entered, so this will not be really applicable to Hotmail, but might work in other e-mail providers.

But, first of all, we must know what bruteforce is. This is a technique that simply tries all possible passwords from a list until it finds the correct one. The list may consist of some selected words (for example, words extracted from a dictionary) or we can try all possible combinations of letters and numbers with different lengths. Chrootstrap has a good explanation about this.

Fortunately for us, this is a very noisy technique, leaving a lot of logs in the server and easily detectable so not many people are going to try this. Furthermore, most e-mail providers won’t allow use the use of this technique, blocking the account for some time after a few tries, although this can also be a double-edged sword, as if the attacker repeats this for a long time we wouldn’t be able to use our account.

One of the most known method used by hackers is breaking into someone’s computer using an exploit, a program designed to benefit from a vulnerability in remote software. In one of the Matrix sequences (The Matrix Reloaded), Trinity uses an exploit to get access to the server.

Having access to another computer can be really useful to apply some of the other techniques explained, like installing a keylogger or sniffing the network data. To hack into a computer, you need some information about it, like the operating system used, the services it is running,… and if some of these services is vulnerable you’ll need to find an exploit for it. Not an easy task.

There is not a single way to protect from these kind of attacks but a firewall is a first step to do it.

Most web-based mail accounts have an option to recover a forgotten password. They usually work in two different ways: sending the password to a different e-mail acccount or asking a question about something only the owner can know.

In the first case, if we know which account will receive the e-mail with the password we can try to recover it from there if it’s easier than the one we want. Maybe it’s another account which we already have to password or we can get access easily to it.

In the second case, we can try to guess or get to know the answer to the question. Usually, these questions are really easy to answer, for example “mother’s maiden name” or “name of your pet”, and with a bit of investigation we can recover these passwords.

If we want to protect from these attacks, we must choose a hard to answer question. Depending on the email provider we are using they will let us choose the question or we will have to select from a predefined list. If we can choose it it will be easy to enter a really difficult question. If we have to select one from a list we can enter a totally unrelated answer, taking care of remembering it just in case we need it later.

Keyboard logging is the name of the technique used to record all keys pressed by the user of a computer so we can know what he has been doing and all the text he has entered. Of course, if he has used that computer to log into his email account he will have entered the password so it will be recorded with the rest of the data.

There are two different types of keyloggers, software-based and hardware-based ones. The hardware based ones have to be connected between the keyboard and the computer, so you need to have physical access to it to install and to recover the data. On the other hand, these can not be detected with software so they can be hidden quite easily if the keyboard connector is not at plain sight.

Hardware keyboard loggers are not always a malign tool, they can also be used to keep a backup of text written in your computer. For example, Keyghost sells loggers with up to 1 megabyte of memory, where you can save lots of keypresses. If you are a writer or are writing something really important for you, as your thesis, it might be handy to have one of this in case something happens to your harddisk. Any way, this should be no substitute of correct and timely backups, but can be of great help.

The software based ones are simple programs which remain resident in the memory of the computer, monitoring all pressed keys and recording them to a file which can be later retrieved by the attacker. The most sophisticated ones are really stealthy and can even send the collected data by email, so the process is automated.

To protect against keyloggers the most important measure we can take is not to use critical passwords in computers not owned by us. So, don’t login into your bank or your email account in an Internet café, at university or from work, only do so from your home machine. If you must do it, then you better check the connection from the keyboard to the computer to see if there’s some strange gadget attached to it.

To protect against software keyloggers, we can use classical antivirus or antispyware but some keyloggers (mainly custom made ones) are not detected by these utilities, so we can use KL-Detector, a software that checks if any program is recording the keys to a file.