Image
 
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 17 guests and 1 member online
EH-Net Donations

Enter Amount:
$

Google Ads
ChicagoCon 2008f
chicagocon2008f_125x200banner.jpg
ChicagoCon 2008f
EH-Net News Feeds
Latest Additions
Book Recommendations





 
Advertisement

You are here: Home arrow Forum arrow Ethical Hacking Discussions and Related Certificationsarrow Network Pen Testingarrow HOW TO HACK GMAIL
Ethical Hacker Community Forums
August 30, 2008, 07:03:53 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Registration Now Open for ChicagoCon 2008f Oct 27 - Nov 2! Visit www.chicagocon.com.
 
   Home   Help Calendar Login Register  
Pages: 1 [2]   Go Down
  Print  
Author Topic: HOW TO HACK GMAIL  (Read 4073 times)
0 Members and 1 Guest are viewing this topic.
divine
Newbie
*
Offline Offline

Posts: 12


View Profile
« Reply #15 on: June 19, 2008, 09:44:20 AM »

Keylog the suspected user's terminal.  This will eliminate any legal issues (I am assuming the terminal and IT equipment is owned by the company)... Keylogging will also eliminate encryption as an obstacle.

Plus, if you AREN'T who you say you are, it will be a little more difficult to install a keylogger and have logs sent to you remotely. Problem Solved.

~Efferri

Mmmmm, that is not completely correct, and no offense intended Efferri but just hear me out a sec. I have been dealing with legal issues like this for a major Fortune 100 Financial institution for years now and have a lot of experience in this area (preventing data leakage and prosecuting those who would sell your trade secrets).

 I have seen employees successfully sue their employers for tactics like that EVEN when their is a signed agreement acknowledging no expectation of privacy on company owned equipment. This type of tactic CAN fall into the realm of violating your employees rights even if you own the equipment and is very tricky to handle in court, because you have selected THAT employee for a level of monitoring beyond the rest of your employees it can also fall into the realm of discrimination.

Personally I would avoid this type of situation altogether and deploy a tool like Vontu as Don suggested. It is forensically sound, generally accepted as a standard in legal communities for IP (Intellectual Property) loss cases and keeps your company protected from discrimination responses from your employees.

-Jordan
Logged

-Jordan
CEPT, CREA, C|EH, MCSE:Security (too many others that I don't care about to list)
oneeyedcarmen
Full Member
***
Offline Offline

Posts: 202

Klaatu, Borada,Necktie?


View Profile
« Reply #16 on: June 19, 2008, 10:40:53 AM »

Quote from: divine
...is very tricky to handle in court, because you have selected THAT employee for a level of monitoring beyond the rest of your employees it can also fall into the realm of discrimination.

It's been my impression, though I am a bit newer to this field than many of you, that for an organization to employ the use of keyloggers, it must be done across the entire operation.  Otherwise, not only will the evidence be inadmissible in court, but the company opens itself up to litigation.

I could be wrong, but that's the way I've always understood it.
Logged

MCP, Security+, Associate (ISC)2
Efferri
Newbie
*
Offline Offline

Posts: 3



View Profile
« Reply #17 on: June 19, 2008, 11:00:59 AM »

No offense taken what-so-ever.  That's what these forums are for.  I don't claim to be an expert on the laws of the land (or even savvy).  I merely speak from personal experience.  I have had to resort to this two times in the past 11 years, and it has served me well.  Granted, we had a blanket disclaimer on all login screens notifying the user of monitoring, and also have them all sign a pretty lengthy Appropriate Use Agreement (which includes a CYA page of monitoring jargon.)

So, when I offered the KL suggestion, I was assuming the individual would be bright enough to check with his/her superiors before implementing anything.

 Wink
Logged
g00d_4sh
Sr. Member
****
Offline Offline

Posts: 279



View Profile
« Reply #18 on: June 19, 2008, 12:28:57 PM »

That is very true, any action like a keylogger or privacy violation to an employee needs to be first OKed by HR and/or Legal council really.  I actually had an issue earlier this year where I had to go through so much friggin paperwork it made my head hurt... because a user was going places with their federal laptop they should not have been.  I had to prove that I had not singled out this employee for investigation, but rather they had come to me... when their laptop stopped working.  (Anyone say... Viruses?)  I quickly discovered their computer full of... well lets not go there.  None the less, it was a friggin headache, and the user had brought the infected/filled computer to me.  Setting up an appliance that blanket covers the office is probably the best.  Blanket keylogging for a smaller organization is semi-doable I suppose though.
Logged

"Bad.. Good?  I'm the guy with the gun"
divine
Newbie
*
Offline Offline

Posts: 12


View Profile
« Reply #19 on: June 19, 2008, 01:54:06 PM »

Quote from: divine
...is very tricky to handle in court, because you have selected THAT employee for a level of monitoring beyond the rest of your employees it can also fall into the realm of discrimination.

It's been my impression, though I am a bit newer to this field than many of you, that for an organization to employ the use of keyloggers, it must be done across the entire operation.  Otherwise, not only will the evidence be inadmissible in court, but the company opens itself up to litigation.

I could be wrong, but that's the way I've always understood it.

yes, that is exactly my point, you have to be able to prove that you had not singled out the employee, hence blanket coverage is the best way to go IMO.
Logged

-Jordan
CEPT, CREA, C|EH, MCSE:Security (too many others that I don't care about to list)
Pages: 1 [2]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.5 | SMF © 2006-2008, Simple Machines LLC
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.036 seconds with 22 queries.
 
Polls
Best for daily desktop use:
 
Support EH-Net
chicagocon2008f_125x200banner.jpg
ChicagoCon 2008f


Support EH-Net by
Buying all of your
Amazon items using
the search bar above.

cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!
Recent Forum Topics
Vote For EH-Net

progenic.com
Click here to Vote!

Sadikhov.com
Top IT Cert Sites

binarica.com
Binarica Logo

Add to Technorati Favorites
technorati fave

chicagocon2008f_125x200banner.jpg
ChicagoCon 2008f
 
         
Advertisement

© 2008 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.