(HACKING INTERNET USERS,HACKING TECHNIQUES)

HACKING INTERNET USERS

Due to a rapid increase in the number of Internet users in the recent years, malicious
hackers have now started to target individual users for their attack. Numerous client side
vulnerabilities such as browser flaws and lack of security awareness among the Internet
users has made them an easy target for hackers. In this chapter let us look at some of the
popular ways to hack Internet users and also the countermeasures to prevent them.
Objectives of Hacking Internet Users
Hackers target individual users for a wide variety of reasons as mentioned below:
For gaining access to confidential information such as credit cards details, bank
login, account information etc.
To take control of user’s online accounts such as Email, Facebook and other social
network accounts.
To earn advertising revenue by forcefully driving users to online advertisements such
as banners and pop-ups.
To use individual users for attacking other systems such as causing a DDoS attack.
Sometimes even for fun or to show-off talent among the hacker’s community.

 COMMON HACKING TECHNIQUES

Techniques to hack individual users on the
Internet:

Session Hijacking (Cookie Hijacking)

Since web pages have no memories, they have to use a means to identify and authenticate
individual users accessing web pages. Especially when people are accessing restricted
pages or secure area which require password authentication, the website needs a means to
remember users individually after their successful login. For example, when people log
into their Facebook account (by entering password), they may access several different
pages until they finally sign out. It would be impractical to ask users to re-enter password
each time they access a different page.
Session Cookies
Therefore, in order to remember individual users, websites store a small file called session
cookie on the client side (in the user’s browser) which contains unique authentication
information about the user’s active session. These cookies help identify individual users
throughout the website. When the user hits the log out button or closes the browser, the
session is said to expire.

So, when a hacker manages to steal the cookies of an active session he may inject them to
his browser to gain unauthorized to any online account such as emails, social media
accounts and so on. This technique is known as session hijacking (also referred to as
cookie hijacking or cookie stealing).

Session Hijacking Demo
Here is an example of typical session hijacking performed on a sample facebook hack ...

Click here to see the example 

Session Hijacking Countermeasures

The following are some of the countermeasures to prevent session hijacking on your
computer:
Use encryption standards such as SSL (HTTPS) to prevent cookie hijacks via packet
sniffing.
Use an up-to-date browser program to prevent browser exploits.
Configure browser to stop running unverified scripts and also avoid using browser
plug-ins from untrusted sources.



Other Ways to Hack Internet Users

The following are some of the other hacking methods that are common in practice:

JavaScript: Since most client-side applications are written in JavaScript, it also
makes a wonderful tool for hackers to write malicious programs for exploiting
browser vulnerabilities. Due to lack of security awareness among users, they can
easily be fooled into entering sensitive information or navigating to malicious
websites. It can also be used to carry out other attacks such as cross-site scripting and
phishing.

Malware: Using malware is another popular way of hacking Internet users. Hackers
make use of malware programs like virus and Trojan horses to accomplish their task
by affecting large number of people. A popular example of such attack is the use of
“DNSChanger” Trojan which affected millions of Internet users by hijacking their
DNS servers.

Instant Messaging: Attackers can also target IM users by sending them unsolicited
offers in the form of files and links. This may mislead the users into installing
malware or navigating to malicious websites.