A Wonder Apps FaceNiff Allows the Clueless to Hack Facebook in Seconds Over Wi-Fi

Stealing cookies to potentially steal users' credentials just got so easy and portable that loony stalkers are probably jumping for joy. Picture this mobile-type scenario, as a person with a rooted Android smartphone casually strolls by a Starbucks, he or she taps once on a new app, and whammo, hops on and takes over Facebook profiles.
Like a wicked mobile cousin of Firesheep, FaceNiff could allow even a clueless noob to hack Facebook over Wi-FI networks. The hacking app requires root access on Android phones. FaceNiff allows users to sniff and intercept web sessions for Facebook, Twitter, YouTube, Amazon, and Nasza-Klasa (a Polish site). Unlike Firesheep, the FaceNiff app listens in on wireless networks encrypted with WPA and WPA2 (WEP too) so that with one tap and within seconds, users can hijack the account types supported.
Not that you intend to try out FaceNiff, but you can't hijack more than three profiles. However, FaceNiff app developer Bartosz Ponurkiewicz says more sites for hopping onto user accounts will soon be supported. He noted if you want to hijack more than three profiles with FaceNiff, there will be an option to pay and unlock the code.
FaceNiff has been confirmed to work on rooted mobile phones: HTC Desire CM7, original Droid/Milestone CM7, SE Xperia X10, Samsung Galaxy S, Nexus 1 CM7, HTC HD2, LG Swift 2X, LG Optimus black (original ROM), LG Optimus 3D (original ROM), and Samsung Infuse.


Watch How Can It Be Done::::

 

As a portable sniff and snoop, FaceNiff presents yet another possible assault on privacy and security. Imagine how happy this might make off-their-rocker-stalkers, cause it's not just for public wireless networks. Depending how you manage your wireless network at home, someone could park outside or walk by your house and FaceNiff you.

This one-tap-wonder app again underscores the importance of using HTTPS. If you have not done so, you can tweak your Facebook and Twitter settings to always enable HTTPS. Or use the EFF's Firefox add-on HTTPS Everywhere or another addon of your choosing to force SSL. HTTPS is your friend. It is way past time to start applying major public pressure in order to force sites to use HTTPS. Or perhaps time to get serious about security and use a VPN; stay under 100MB and this one is free, or you might want to search for other free VPN services to protect your privacy.
While we are on the subject of Androids and apps, Lookout Mobile Security reported finding 26 malware-laced applications in the official Android Market. The smartphone security firm said the infected apps are a "stripped down version of DroidDream" and were probably maliciously crafted by the same developers. The new malware is being called “Droid Dream Light” (DDLight). Malware in the tainted apps can be activated by an incoming call, meaning users do not actually have to launch the app to trigger it.
Anyone who downloaded an app on Lookout's list could have their personal information compromised. It is suspected that between 30,000 and 120,000 users were affected by DroidDreamLight.

Read More

::::Keep Your Android Smartphones Secure::::Go Through This Article

There have been a high increase in the reports of trojans and malware in the Android Market and users are feeling concerned about their Android smartphones. They are scared of using new application and games feeling that may contain virus, Trojens etc. And this is all because of the high rate of increase in the use of Android based mobile phones. 

The Android smartphone users need to take some simple steps and be careful during their smartphone usage. Especially, they need to think before tapping on unknown links to ensure their devices remain safe all the time.

Most of the users forget to lock their phone screen which is still the first line of defence for all the smartphones. Users just need to go to Settings - Location and Security to lock their screen either through a pattern or a PIN. The lock screen pattern should be unique only to the users so others may not be able to decode it.
Even choosing a screen timeout option works well for the users as it locks the handset whenever there is no activity on the phone for a long time.
Even if the phone is gone, users don't want their data to be compromised. The passwords should not be stored on a single location through a master password. Those who do set a master password, should make sure the passwords are encrypted. While browsing the web on the phone, it is a good practice to avoid storing username and password locally on the phone.
The Android smartphones have the facility to sync the phone with users' Google account so all the important data can be stored on the cloud as well, which allows the users to access the data later whenever they need it. If the users are not using the sync feature, they may find it difficult to manually enter all the important data all the time.
There are apps available in the Android Market as well, which enable the users to lock individual applications through gestures or passwords. Some of them are free but users should make sure the apps they are using come from a trusted source.
Before installing any app, users should read all the access and permission requests. Most of the users make the mistake of not reading the agreement and grant the access to the app without thinking. For example, if a calculator app is being downloaded, and is asking for access to the Internet, it doesn't make sense. Even the permission levels should be looked into and if any app is asking for root access, it should be promptly deleted because root access can let the app play havoc with the phone.
At the same time, when it is being suggested to avoid those apps which are asking for root access, it is advisable that users should root their devices only when they are absolutely sure. If there is any iota of doubt about anything, it's better not to root (make changes to system files) the device - because rooting always opens up the core resources of the phone to anyone, which is not a healthy digital lifestyle.
Many users tend to use their smartphones on WiFi more to keep the data costs under control and speed up their browsing. The problem is they begin to feel safer on WiFi whereas the same risks faced by personal computers are faced by smartphones too while being used on WiFi networks. Any online banking service or financial tracking should be avoided if the users are not on a secure network.
All the apps being used on the phone and the operating system itself should be up to date, which means the latest versions should run on the phone. Keeping the software up to date is important because many new methods of gaining unauthorised access to the Android smartphones are discovered all the time, so the more up to date the phone software is, the more difficult it is to gain unauthorized access to data in it.
Last but not the least, it's always good to depend on the official Android Market or reputed app stores for the apps. As far as physical security of the phone is concerned, there are no tips for that - and no substitute to being careful either.

 

Read More