Carder
Professional
- Messages
- 2,616
- Reaction score
- 1,942
- Points
- 113
We check if they read our correspondence.
As part of this test, you are asked to create a trap and check if someone else is reading your correspondence (suitable for email, instant messengers, social networks, websites and forums, SMS).Here I will show you how you can check if your correspondence is being read in messengers, mail or social networks. We used this method on a popular social network in Russia, creating a provocative personal message that the moderators should read. They read, and we saw that our messages are being read. Perhaps you want to check if your spouse, hacker or boss is reading your correspondence - this method is perfect for you.
The essence of the proposed method is to create a hook link that will be added to the message. The trap will be created using a one-time Privnote.
The essence of the Privnote note is that after reading it is deleted, and it is impossible to read it anymore - this functionality of the service is known to many, but not everyone knows that Privnote has the ability to receive a notice of reading the note by e-mail. The first thing you need to do is create a Privnote. Be sure to select the option "Do not ask for confirmation before showing and destroying the note (as in Privnote Classic)" when creating a note, we do not need any confirmation. Be sure to indicate "E-mail for notification of the destruction of the note." It is necessary to receive a notification as soon as the note is read. After creating a note, you get a link like
We will not send a link to Privnote, we will change it, for example, through the Bitly short link service. The link will look something like this https://bit.ly/2JFYEGV. Then you send the recipient a message containing this link by email, messenger or social network. It is desirable to design the message so that the attacker would be tempted to follow the link.
For example, like this: All documents on the upcoming transaction.
I am waiting for an answer whether something needs to be improved. The recipient must be notified that this message is a decoy, otherwise he will open the link himself and the trap will work. The recipient should not click on the link, the secret reader of your correspondence should click on it.
The correspondence can be read by the "person in the middle", for example, by a moderator of a social network. In this case, you should change the communication method or encrypt the transmitted data. It is much more dangerous if the correspondence is read on the device of the sender or recipient. We recommend placing traps on devices and checking if someone else has access to them.
Panic Button will help you to protect against physical access; download and install the program from the official website.
Panic Button works very simply: when the computer starts, the owner deactivates the program with a special action, for example, a key combination or activating a masked file. The attacker does not know about this and, when gaining access to the device, falls into a trap - Panic Button is activated in the logic bomb mode, informing the owner. In addition to notifying the owner, Panic Button turns off the computer, depending on the settings, it deletes saved passwords, browser history, history of viewed files, pictures, documents. The user can specify files that Panic Button will irrevocably destroy upon activation, preventing an attacker from reaching them. When configuring, you will need to choose to send notifications to your email address if Panic Button is activated.
Protection against unauthorized access is not the main task of Panic Button. It is a tool for emergency data destruction and protection against forensic analysis, but it will help if someone else gets access. It is more difficult when it comes to remotely accessing your device, for example, you have a remote access program (RAT) installed. But here, too, there are ways to "catch live bait", we will talk about them in the chapter devoted to malicious software and methods of protection against it.
We are looking for unauthorized use of your Wi-Fi. It can be a cunning neighbor or an intruder; As part of the test, we will scan your Wi-Fi network and find all connected devices, as well as set up a notification system for unauthorized connections to your router.
Checking the Wi-Fi network for the presence of third-party connections In this test, we will scan our Wi-Fi network and check for the presence of third-party connections in it. For example, in this way you can find out if a neighbor or an intruder is connecting to your Wi-Fi, and indeed you can see all connected users. For this test, we need SoftPerfect WiFi Guard. The SoftPerfect WiFi Guard program scans the network and shows the user a list of currently connected devices, displaying available information about them, such as the MAC address, manufacturer and internal IP address (the latter, however, is interesting only for specialists).SoftPerfect WiFi Guard can also work in passive monitoring mode, scanning the selected network at a specified interval, and if unknown devices are found, notify the user about this using a pop-up window. In simple words: if a neighbor suddenly connects to your Wi-Fi, the program will detect him and notify you. SoftPerfect WiFi Guard is available on Windows, macOS and Linux devices. The free version of the program limits the output of information to five devices: if five or fewer devices must be connected to your Wi-Fi, the free version is enough for you, if more, you will have to pay $ 19 for a license.
Using SoftPerfect WiFi Guard on Windows, Linux and macOS The program works roughly the same on all devices, so we'll show it using macOS as an example. After reading the instructions, you can easily run the program on Windows or Linux. Download and install SoftPerfect WiFi Guard to get started. When you start WiFi Guard, you will be immediately prompted to configure the program. The main thing here is to choose a Wi-Fi network adapter.
Let's move on to scanning the network. Do not be alarmed if the system detects unknown devices on your network during the first scan. For the program, all devices are now unknown, except for your computer from which the scan was launched. The unknown devices found are likely your phones, tablets, or your family members' devices.
How can I check this? By MAC Address: By comparing the MAC addresses of the discovered devices with the MAC addresses of your devices. To find out the MAC address of your device, read this chapter. If all found devices are yours, we recommend adding them to the whitelist so that the program does not mark these devices as unknown in the future and does not raise an alarm when they are detected. " Select the device that you know by double-clicking on its name with the mouse. In the form that opens, select "I know this computer or device." The selected device will be added to the whitelist.
The program will continue to scan the network and if it detects unfamiliar devices, it will immediately notify you about them. We recommend that you run a scan periodically, for example, once a week, but whether to conduct a constant regular scan is already your choice. For security, this is certainly a big plus, since with a regular manual check, there is a possibility that the attacker will not be connected to the network at the time of scanning.
There is another interesting indicator - ping. It will help to find out how long the signal takes from the investigated router to the detected device and, accordingly, how far from the router it is located. First of all, determine the ping to the router from the device from which the scan is carried out, in my case it is 9 ms. The ping from my computer to the unknown device is 19 ms, from here we subtract the ping to the router, and 10 ms remains, which means that the device under investigation is approximately the same distance from the Wi-Fi router as my laptop from which the scan was carried out.
What if you find unknown devices on your network? So, you ran a test and found unknown devices on your Wi-Fi network. This is an alarm bell, and you urgently need to take care of the security of your Wi-Fi router. Here I will write a short list of measures, they will be discussed in detail within the framework of this chapter on configuring the security of a Wi-Fi router. Add attackers' MAC addresses to the blacklist of the router. Conduct a security audit of the router. Change passwords: for both administrator and network connection. If you want to scan the traffic of the uninvited guest and see for what purposes he uses your router. Set SoftPerfect WiFi Guard to scan regularly for at least a week to make sure the problem is resolved.
Does your password contain both upper and lower case letters?
If not, then you should. Modern practice recommends using letters of different registry, numbers and password length should not be less than 8 characters. Alternatively, we can recommend that you use Russian letters in passwords - this way you can save the old password, you just need to change the keyboard layout.We check our personal data for illegal use or sale. The proposed methods will allow you to check whether intruders are using your personal data, such as copies of documents, photographs, for illegal purposes or whether they are being sold on the black market.
How to check if your identity has been stolen Earlier, we have already told you what identity theft is, how and why it is stolen, what measures to take to protect against personal data leakage. In this article I will tell you how to check if your data has already leaked into the hands of cybercriminals. I want to note right away: I do not know of guaranteed verification methods that can give an accurate answer about the presence or absence of your personal data from ill-wishers.Checking accounts for leaks
You can check the availability of your accounts in publicly known databases leaked to the network using this link. Data leakage is not always accompanied by identity theft, for example, access to e-mail may not be enough to steal an identity if no information is there.Even stealing an account on a social network if there is no genuine information there should not be considered identity theft. However, your accounts can be used for illegal purposes, which we discussed in this chapter, and this can lead to the consequences of more terrible identity theft.
Leak monitoring
A lot of personal data ends up in the hands of hackers, special services, or even in the public domain due to leaks from websites. You need to be aware of the news of leaks, and if your personal data was on the compromised site, you will at least be aware that now this data is in the hands of the bad guys. We cover how to monitor for leaks in detail in the chapter on data leaks. Of course, this method does not provide guarantees, since the leak may not be recognized or the news will not appear on the proposed sites.Sometimes it becomes known about leaks too late, as in the case of Yahoo users, who found out only a few years later that all email inboxes were compromised (except for compromise, it became known that the US intelligence services had access to mail and analyzed letters for words- beacons).
Search by pictures
Check your photos that you have posted publicly for use on third-party resources or social media accounts. We tell you in detail how to do this in the chapter "What can be found out from a photograph".Search by first and last name
This advice only works if you have a rare first and last name. Many services allow indexing of user accounts, and you will immediately find out that there is a registration using your data, but again in the case of a rare combination of first and last name.Contacting the vendors of stolen data
In the Russian-speaking part of the Internet, they can be found through a search, for example, by the request "buy photocopies of a passport", "buy a photo of documents", they can also be found on the Darknet. From communication with such sellers, I understood that many of the documents are sorted, and they can make a fairly accurate sample up to the date of birth. This is what we use for verification. You choose a certain amount of information about yourself, for example: "woman, 1987, registration Rostov, birthday in July, traditional unremarkable first and last name." Next, you write to the sellers that you will pay dearly for copies of user documents with similar data. Offer a really good amount to motivate them to look well. If the seller reports a suitable kit or kits are available, ask for proof before paying. For example, copies of documents in poor quality,with shaded data and other other means of protection - you already recognize a copy of your document. These are all methods we know so far. In the next chapter, we will tell you what to do if your identity is stolen.We check our email for resistance to hacking from hackers. In this test, you will order hackers to hack their own mail.
Here we are talking mainly about email, but the proposed verification method can be applied to both social media accounts and messenger accounts. For most users, email is tied to various services, and hacking email allows an attacker to gain access to them. If you are serious about the security of your data and are studying our course, most likely you are using this recommendation, and hacking your mail will not lead to hacking accounts associated with email. However, you must admit that it is not pleasant if someone gets access to the contents of your mail. At one time, hacking personal mail cost Hillary Clinton the post of President of the United States, and the hacker Fly brought him to jail. Let's simulate a situation when your ill-wisher, for example a business competitor, orders a hack of your mail, and we will order it ourselves.This will be an excellent test of account protection, so to speak, a proactive action. The first step is to find a hacker or a service that provides services to hack mail accounts. To do this, you do not have to go to the Deep Web, in the search enter "hacking mail", and you will be offered a lot of services dealing with hacking mail. Most of them work without prepayment, which is exactly what we need. Some of them are scammers who set themselves the sole purpose of getting money from you, they usually do not even try to hack mail. They will ask for an advance payment, you can politely thank them and say goodbye. But there are more cunning scammers. Some time after ordering, such a scammer will report that the victim's mail has been successfully hacked and for confirmation he sent you a letter from the hacked mailbox through his program. But since the sending went through the program,the letter most likely ended up in spam. Of course, after that the "hacker" will ask for money for the work. Remember, there is no program, as well as hacking mail, in this case, a banal substitution of the address is used, and such letters are immediately sent by mail services to spam. Extortionists can also get caught, who, having received an order, will begin to blackmail you. The essence of their proposal usually boils down to the following: either you pay money, or they transfer all information about your order to the victim and / or to law enforcement agencies. As you can imagine, in our case it is not scary. Among the scammers and ransomware are real services that start checking your email inbox for resistance to various hacking methods. I do not want to describe the process in detail, as this will affect the effectiveness of the test. You yourself will have to figure out the techniques used.Select several services for hacking mail and place an order. Services warn about the prohibition of simultaneous ordering for several services, but in our situation this can be ignored. If the services at the end of their work report the futility of attempts to hack your mail, then your ill-wisher, contacting them, will receive a similar result. If you are afraid to give your mail, create a separate email, set up its security similar to your main one and "incite" hackers to it. If a hacker gets the job done, be sure to pay him, it will be a valuable lesson for you and a reason to rethink the security of your email.but in our situation this can be ignored. If the services at the end of their work report the futility of attempts to hack your mail, then your ill-wisher, contacting them, will receive a similar result. If you are afraid to give your mail, create a separate email, set up its security in the same way as your main one and "incite" hackers to it. If the hacker gets the job done, be sure to pay him, it will be a valuable lesson for you and a reason to rethink the security of your email.but in our situation this can be ignored. If the services at the end of their work report the futility of attempts to hack your mail, then your ill-wisher, contacting them, will receive a similar result. If you are afraid to give your mail, create a separate email, set up its security similar to your main one and "incite" hackers to it. If a hacker gets the job done, be sure to pay him, it will be a valuable lesson for you and a reason to rethink the security of your email.be sure to pay him, it will be a valuable lesson for you and a reason to reconsider the security of your email.be sure to pay him, it will be a valuable lesson for you and a reason to reconsider the security of your email.We check if your data was involved in major leaks over the past 7 years. In this test, you need to remember whether you had accounts in popular services at the time of the leak. If so, I have bad news for you ...
If you answered yes to at least one of the following questions, then your safety is at stake:- Did you use the Yahoo mail service before 2015?
- Did you have an account with Ashley Madison dating site in 2015?
- Did you use the BTC-E exchange before 2015?
- Did you use the Dropbox cloud storage service before 2013?
- Did you have mailboxes on mail.ru in 2014?
- Did you have mailboxes on Rambler.ru in 2014?
- Have you used Snapchat messenger in 2014?
- Did you have a page on the VK.com social network in 2012?
- Did you have a Yandex account before 2013?
- Did you have an account with Sprashivay.ru before 2016?
- Were you on LinkedIn in 2012?