When it comes to evolving security measures, some people just get skipped over by technology. You can help them...or have some fun!
The biggest security flaw in any system is much more likely to be human than it is technology. Some of us humans just walk around in a daze from being hit over the head with a silly stick all our lives. Almost all of those same humans seem to get jobs, and chances are, you probably feel like they all got into your office or college on some stupid quota or something. There’s a way you can have fun at their expense and also show them why it’s important to learn something about technology when they use it. If that’s not a win-win for you, then we don’t know what can be.
Just guess it
It’s just scary how many people use silly passwords at office. Because it isn’t a private computer, and none of their personal data is at risk, they are nonchalant enough to put work data at risk. Show them the importance of being secure everywhere and your company will thank you. You should try and guess passwords, and there’s a usual list of passwords that n00bs use. Some even use “password” as their password!
However, even if you’re in an office where the security policy is strict and requires long and secure passwords (one uppercase letter, one lower case, at least one number and one special character and no less than 8 characters long, etc) people who use weak passwords will still find a way to use weak passwords, despite all policies. Many will just associate it with something periodic, such as the current month or year. Even if their password is secure, their security question is often too easy. Mother’s maiden name? Even a kid with Google skills and a Facebook account can find that out these days!
Once you’re in, have some fun, but remember, this is to teach them a lesson. Don’t do anything malicious, and nothing that could jeapordise their job.
Keyloggers
Many people don’t think twice when their system slows down to a crawl. In fact, many will turn on their PCs, log in and then walk away while it finishes starting up. To teach such people a lesson, installing a keylogger on thwir PC might be the way to teach them a lesson in security.
Physical keyloggers are available at stores online, but you could make do with a software one as well. You could just install a good keylogging software – such as Reveal Keylogger Free 2.0 – which will send you reports via the internet or LAN. The paid version will even let you transfer files via email and ftp and also take remote screenshots.
Public Wi-Fi
Nothing comes for free. Especially Wi-Fi. People don’t realise that when they connect to an open Wi-Fi, they’re basically risking their systems or phones. Open wifi networks are literally a hacker’s dream. Because of poor security on a user’s end, hackers can get access to a system, and even snoop on super personal information such as banking or work data.
You can download Wireshark, and connect to an open Wi-Fi network. You can even connect another device to the same network and practice snooping on yourself first, and then use it to snoop on others. Once you have mastered the art, snoop on everyone sitting around a free and open Wi-Fi access point, then laugh in their face as you reveal their personal information to them.
Trust me, it was probably more secure in 1995
Go phishing!
If you go through the spam folder in your email, you will come across many emails that attempt to phish information. Although you will probably die of laughter at the silliness of the scams, you will be shocked how often they work, which explains why people still keep trying to run these scams. Yet, some contextual ones have been really successful recently. Take the Hillary Clinton – ISIS hoax email that actually got a lot of Hillary-haters to click on it.
It is pretty easy to create a phishing email. Just get a custom domain, or an official sounding email ID, such as ‘noreply.logininfo@gmail.com’ (that’s probably already taken), and draft an email that sounds really official and states that the receivers need to share their credentials for security reasons (the irony of it!!). Something like this should get you the password you want:
to: noreply.logininfo@gmail.com
Subject – (/rt -dhx UID_pwd)//Don’t change this subject line
Body –
<your email ID><space><your password>
<target email ID>
<set security key>
*end of email*
You will be surprised at how many credentials you receive. Don’t believe us? See how many people fell for the ‘Facebook privacy declaration’ post.
It’s as easy as go phish
Get those pendrives
Most people don’t think twice before sharing their pen drives or external hard drives around. In fact, if you claim to have a decent copy of a good movie, people will throw their drives at you! The assumption is that their antivirus will just do the job of protecting them. This might be true 99% of the time, but only once can be bad enough. You could always tell them to turn off their antivirus when installing a (*cough*) free game!
Some fun applications you can share with them are Fake Format and Fake Delete, both of which imitate actual Windows dialogs and applications and appear to delete your directories and files. You can even create a friendly looking batch file (“Get a free game” anyone?) that throws scary looking DOS messages in the method mentioned here
Click-happy
Click-happy folks can be an endless source of pleasure. They just download anything you send them, and click when you tell them to click – they’re so trusting and naive! They are easy targets for scams that spread malicious code via document macros, which most people do not disable explicitly. You should find it easy to send such an email to them. Keep a harmless macro that only issues a huge warning to them in a document and email it to them. Sit back and watch as they (hopefully) learn their lesson.
Poke the unpatched
Patches are seriously ignored by a whole lot of people, because hitting the ‘Not now’ or ‘Ignore’ button is much easier and time saving than the responsibility of sitting through the upgrade. Most patches to operating systems and software are actually security and stability changes, that unfortunately gets the most rejections. This is a complex and dangerous exploit that not everyone can pull off, but if you’re able to understand code, it shouldn’t be hard for you to find places where the latest exploits are discussed.
Then of course, there are the full-fledged exploit kits that are available which let you take advantage of such bugs. Be careful though, because if you don’t know what you’re doing you could end up hacking yourself and giving access to some real hacker out there – you don’t want to end up being the n00b yourself!
Install Ransomware
Ransomware is easily available online, and if you look hard enough, you will find several harmless variants. If you don’t want to mess with actual malicious software, you can fool a n00b into believing that you have installed ransomware using PowerPoint!
All yopu have to do is create a ransomware announcement screen. remember to use dramatic language and visuals, because the aim is to scare people into submission. Text such as:
All your files and documents on your computer and connected network have been locked and encrypted. ID: 45GHs78Q
A special self destruct code has been used to encrypt your data with our exclusive software and there is NO WAY to decrypt it without your private key! Do not attempt to press ESC or any other Key, as it will:-
Destroy the private key — distribute your files on the dark net — Software to unlock your computer will cost higher
Send an email with unique ID given above to <use the email ID created earlier here> within 72 hours if you want your data. We will send one file to you for free once we receive the email. Have fun!!
When you have created this slide, go to the Slideshow tab, and under the ‘Set up’ group, click on Set up show. Under ‘Show type’, select ‘Browsed at a kiosk’. Under ‘Advance Slides’ select ‘Manually’.
This ensures that they keyboard and mouse interactions won’t make the slide change. To actually make it go away, just hit the ‘Esc’ button. Name the powerpoint as something friendly or harmless and watch the fun.
Webcam and Mic
Recently there has been an increased awareness about webcam and microphone hacking, partly due to a photo of Mark Zuckerberg doing the rounds which shows his laptop having duct tape over the camera and the microphone. Even then, most people do not know how easy it is for someone around them to hack into their webcam and microphone feed. In fact, there is software available online that does it for you, if you do have physical access to the target machine or can get them install it by social engineering.
Webcam hacking is highly illegal. It directly invades someone’s privacy and we want to make it clear that you should NOT do this, especially on a computer people take home with them. Even if you see nothing, invasion of privacy laws might land you in jail, and if it can be proven that you spied on them in their private moments, you’re done for. If it’s a work computer in a relaxed office environment, and you know the person well enough to know they won’t rat on you to the management, you might be safe, but you still might not, so do this at your own risk! We are not going to point you to one of the many webcam hacking software and websites because of this. The fact that this exists is all we wanted to tell you so that you can also protect yourself against such software in the future.
Alter app codes
This particular hack will need some serious coding skills. To give you an example of what’s possible, we point to the recent fake Pokemon Go app that was discovered. It seemed identical to the original app, but asked for way more permissions. The open source nature of the Android ecosystem means that doing such things is possible. You will need to get an APK of an app you want to do this with to begin.
First download the dex2jar tool from following link
Extract the file and create the dex2jar folder
Now you pick your APK file and change its extension to ZIP. Once that is done you can extract it and find the classes.dex file
Copy the classes.dex file into the dex2jar folder
Open a cmd window and type the path to the dex2jar folder
Now type ‘dex2jar.bat classes.dex’ and press [Enter]
Now Open the dex2jar folder you found classes_dex2jar.jar file
Next you download the java decompiler tool from the following link
Last Step Open the file classes_dex2jar.jar in java decompiler tool now you can see the apk code
You can now alter this code and recompile it back into an APK that asks for additional permissions. If this method doesn’t work for you, you can try a few online decompilers available. Keep in mind that neither method is guaranteed to work due to the huge variety of code and development methods used.
If you do successfully manage to create an altered APK, getting someone to install it should be easy. Just mention that it’s an advanced beta file that has some additional features, and is being circulated for testing.
Lessons learnt
You’re probably going to be busy for the next few months trying your hand at these hacks, but remember that you can get into trouble by doing this maliciously, so please don’t blame us if you go to jail!
This article was first published in September 2016 issue of Digit magazine. To read Digit's articles first, subscribe here or download the Digit e-magazine app for Android and iOS. You could also buy Digit's previous issues here.
Follow Us
