Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.






Lost Password?
No account yet? Register
Who's Online
We have 41 guests and 1 member online
 
Advertisement

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Network Pen Testingarrow HOW TO HACK GMAIL
EH-Net
May 24, 2013, 12:09:21 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: 1 [2]   Go Down
  Print  
Author Topic: HOW TO HACK GMAIL  (Read 16773 times)
0 Members and 1 Guest are viewing this topic.
divine
Newbie
*
Offline Offline

Posts: 12


View Profile
« Reply #15 on: June 19, 2008, 09:44:20 AM »

Keylog the suspected user's terminal.  This will eliminate any legal issues (I am assuming the terminal and IT equipment is owned by the company)... Keylogging will also eliminate encryption as an obstacle.

Plus, if you AREN'T who you say you are, it will be a little more difficult to install a keylogger and have logs sent to you remotely. Problem Solved.

~Efferri

Mmmmm, that is not completely correct, and no offense intended Efferri but just hear me out a sec. I have been dealing with legal issues like this for a major Fortune 100 Financial institution for years now and have a lot of experience in this area (preventing data leakage and prosecuting those who would sell your trade secrets).

 I have seen employees successfully sue their employers for tactics like that EVEN when their is a signed agreement acknowledging no expectation of privacy on company owned equipment. This type of tactic CAN fall into the realm of violating your employees rights even if you own the equipment and is very tricky to handle in court, because you have selected THAT employee for a level of monitoring beyond the rest of your employees it can also fall into the realm of discrimination.

Personally I would avoid this type of situation altogether and deploy a tool like Vontu as Don suggested. It is forensically sound, generally accepted as a standard in legal communities for IP (Intellectual Property) loss cases and keeps your company protected from discrimination responses from your employees.

-Jordan
Logged

-Jordan
CEPT, CREA, C|EH, MCSE:Security (too many others that I don't care about to list)
oneeyedcarmen
Full Member
***
Offline Offline

Posts: 233


Klaatu, Borada,Necktie?


View Profile
« Reply #16 on: June 19, 2008, 10:40:53 AM »

Quote from: divine
...is very tricky to handle in court, because you have selected THAT employee for a level of monitoring beyond the rest of your employees it can also fall into the realm of discrimination.

It's been my impression, though I am a bit newer to this field than many of you, that for an organization to employ the use of keyloggers, it must be done across the entire operation.  Otherwise, not only will the evidence be inadmissible in court, but the company opens itself up to litigation.

I could be wrong, but that's the way I've always understood it.
Logged

Reluctant CISSP, Certified ASS
Efferri
Newbie
*
Offline Offline

Posts: 3



View Profile
« Reply #17 on: June 19, 2008, 11:00:59 AM »

No offense taken what-so-ever.  That's what these forums are for.  I don't claim to be an expert on the laws of the land (or even savvy).  I merely speak from personal experience.  I have had to resort to this two times in the past 11 years, and it has served me well.  Granted, we had a blanket disclaimer on all login screens notifying the user of monitoring, and also have them all sign a pretty lengthy Appropriate Use Agreement (which includes a CYA page of monitoring jargon.)

So, when I offered the KL suggestion, I was assuming the individual would be bright enough to check with his/her superiors before implementing anything.

 Wink
Logged
g00d_4sh
Sr. Member
****
Offline Offline

Posts: 394



View Profile
« Reply #18 on: June 19, 2008, 12:28:57 PM »

That is very true, any action like a keylogger or privacy violation to an employee needs to be first OKed by HR and/or Legal council really.  I actually had an issue earlier this year where I had to go through so much friggin paperwork it made my head hurt... because a user was going places with their federal laptop they should not have been.  I had to prove that I had not singled out this employee for investigation, but rather they had come to me... when their laptop stopped working.  (Anyone say... Viruses?)  I quickly discovered their computer full of... well lets not go there.  None the less, it was a friggin headache, and the user had brought the infected/filled computer to me.  Setting up an appliance that blanket covers the office is probably the best.  Blanket keylogging for a smaller organization is semi-doable I suppose though.
Logged

"Bad.. Good?  I'm the guy with the gun"
divine
Newbie
*
Offline Offline

Posts: 12


View Profile
« Reply #19 on: June 19, 2008, 01:54:06 PM »

Quote from: divine
...is very tricky to handle in court, because you have selected THAT employee for a level of monitoring beyond the rest of your employees it can also fall into the realm of discrimination.

It's been my impression, though I am a bit newer to this field than many of you, that for an organization to employ the use of keyloggers, it must be done across the entire operation.  Otherwise, not only will the evidence be inadmissible in court, but the company opens itself up to litigation.

I could be wrong, but that's the way I've always understood it.

yes, that is exactly my point, you have to be able to prove that you had not singled out the employee, hence blanket coverage is the best way to go IMO.
Logged

-Jordan
CEPT, CREA, C|EH, MCSE:Security (too many others that I don't care about to list)
Pages: 1 [2]   Go Up
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com
Valid XHTML 1.0! Valid CSS!
Page created in 0.076 seconds with 23 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Advertisement

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.