Menu
Jan 20, 2016 - Google offers tools for enhancing your security and privacy settings. You've made, such as to your password, or to your recovery phone or email. Other steps in this checklist tell you to check your computer for malware. In iOS 12 How to Spot Fake Product Reviews Was the Big Hack Really Big?
You might have seen a lot of websites that offer to hack Gmail or Hotmail or Yahoo or other webmail account password, some claim to hack them using the 'expertise' they gained in last X years , some claim to hack it using previously existing loopholes...
Goes same for 'Gmail/Yahoo password crackers' or 'Hotmail/Gmail password stealers' or 'Gmail password hacking' ...
Just type 'Gmail/Hotmail password hacker' in Google & see for your self. Countless results of websites who claim to hack Gmail/Yahoo passwords or help you to steal Facebook passwords...
Goes same for 'Gmail/Yahoo password crackers' or 'Hotmail/Gmail password stealers' or 'Gmail password hacking' ...
Just type 'Gmail/Hotmail password hacker' in Google & see for your self. Countless results of websites who claim to hack Gmail/Yahoo passwords or help you to steal Facebook passwords...
There is NO Gmail/Hotmail/Yahoo Hacking Software, no Site that can hack or crack these webmails.
![Piracy Piracy](/uploads/1/2/5/7/125746108/900548923.jpg)
The internet is a dangerous place, replete with shady people looking to steal your personal information. Enabling two-factor authentication (sometimes called two-factor verification) is one of the best way to keep your online accounts secure. However, famed hacker Kevin Mitnick shows how even this security measure can’t completely protect your data if you don’t remain constantly vigilant.
The hack in question was not developed by Mitnick, who works as Chief Hacking Officer for security firm KnowBe4. Credit for that goes to Mitnick’s friend and white hat hacker Kuba Gretzky. The tool is known as evilginx, and it makes phishing feasible even when the target uses two-factor authentication. It’s essentially a man-in-the-middle attack, but it uses proxy_pass and sub_filter to modify and capture HTTP traffic. It requires a Nginx HTTP server and some familiarity with Debian Linux. Many people have the necessary expertise to do it.
You can get a complete technical rundown of evilginx on Gretzky’s site, but Mitnick has a nice, digestible video demo of the tool in action(embedded below). He uses LinkedIn as an example, but it could be used on Google, Facebook, and anything else that uses standard two-factor login. The attack starts in the same way all phishing attacks do — with a cleverly crafted email. You have to convince the target to click on a link that loads your site, which masquerades as the page your target expects. In this case, it’s LinkedIn.
Stealing a username and password like this is simple because they don’t change. A two-factor code changes every few seconds, so taking that from your fake page is pointless. Using evilginx, Mitnick shows how the page captures not the 2FA code but the session cookie. That identifies the user to a site, allowing the attacker to hop onto your account immediately.
Mitnick goes on to show how you can load the session cookie manually via the Chrome developer console, which only takes a few clicks. Then, all you need to do is reload the page, and LinkedIn displays the logged-in session. You don’t need to enter a username, password, or even the 2FA code.
Gretzky has published the code for his 2FA hack on GitHub, so everyone has access to it. That means people could try to use it for phishing purposes, but security researchers and educators can also help protect users. It just goes to show you; even two-factor authentication won’t protect you from your own poor decisions.
Now read: 20 Best Privacy Tips to Stay Anonymous Online