HACKERS - Confess... What is possible?

[shibumi]

So this week my wife found herself in, at worse case, an identify theft situation - best case, just a few stolen cc numbers.

We started getting fraud alert notifications from two separate banks (one was a cc, the other a debit card). First charge was on Tues and was only .99 cents - the second card (debit) came in yesterday and was a $52 charge. Luckily the banks contacted her quickly and she was able to close the accounts. So far that is all, but we're waiting to see what's next.

Now we're left trying to figure out HOW someone got access to two (at least) separate credit cards - especially when one of them stays locked up in a drawer and hasn't been used for months.

The only thing that she could come up with is that both are tied to her shiny new EVO. I *think* they both may be in her Mint application (mint.com). That or one is in Mint and the other was used for Google Voice (int'l calling).

So the hacker question: What is possible for a hacker to access on your phone if you're in a place that has wifi hotspots? Are they able to access your phone - and applications on your phone - just by virtue of you having wifi enabled on your EVO? I'm guessing it would have to be some really low-level hacking, but is it even possible?? I'm thinking along the lines of how you setup home networking on a windows machine - ya know File and Print sharing - and how someone could jump on your home router and potentially look at shared folders.

But is that possible on an Android phone?

I could understand if she was using Mint on her phone - on a public hotspot - because then she's sending and receiving unencrypted data. (Which she has not done.)

But if you're not using anything on the phone - you just walk in, the phone's in your pocket or purse, and it sees a wifi connection available - does it just automatically connect - and if it does, could some "Zero Cool" wanna be then get into your phone and steal data??

Trying to figure out the mystery...

 

[storino03]

were the wifi hotspot features encryped with a password?

 

[akarol]

That sounds highly unlikely. It would be easier for the hacker to simply hack mint.com rather than going through her phone while connected publicly and then hacking the mint app there.

I still think some other method was used though, as mint.com and the like are pretty much impossible to get through. If it was possible, they wouldn't exist.

 

[JoshK]

Seems a little high tech for a .99 cent and $52 dollar charge. Are you sure you trust everyone that has access to the phone and/or card(housekeeper, teenager, worthless sibling, ect)? Sorry to sound negative but sometimes these are the realities of life. Good luck.

 

[badbradd2]

Is she using a Rom? From what I understand, if you are using a ROM and your phone is rooted, it's possible the developer of the rom may have included some sort of keylogger or hacking program in their rom to receive anything you type?

 

[KSmithInNY]

Trying to figure out the mystery...

The simple answer to what you're asking is no. It seems to me as if you are insinuating that, by having the WiFi radio enabled on the phone, could someone access information on the phone, then no. But theres heres what you may be missing ...

First and foremost NEVER USE OR PUT PII ON A CELL PHONE!!!!! Period.

With that out of the way, if your wife was sitting in a starbucks or something and using their WiFi, then yes, information transmitted to or from the phone over the air could be capture and decrypted. I emphasize the words "to and from" because any info sitting on the phone idol cannot be captured but information coming to and from the phone can absolutely be captured. Hence why i say you should never use or put PII on a cell phone.

It's no secret that encryption methods are little more than a slight nuisance to someone with the proper skill set. One of my best friends is a certified ethical hacker who spends his days as a contractor for many companies and he actively tries to hack them, including air raid attacks (Penetration of organizational and personal wireless airspace by attackers with malicious intent).

Do I think that someone stole the info from your wifes cell phone? I'd say thats EXTREMELY unlikely unless your wife purchased things on her phone, over a WiFi network, and happened to use both cards and someone with malicious intent was sitting close by.

Of course i cannot tell you how this happened to you but what i can say is i think you're barking up the wrong tree by looking at the cell phone. But if she were using a GSM phone ... it would be a lot easier to capture anything you want

 

[shibumi]

Thanks for the feedback! We knew it sounded a bit far fetched, but at the same time with the OS just being a modified Linux kernel and Java apps, we weren't quite sure what might be possible.

The EVO route was just wishful thinking... because now it's a bit more ominous - in that the two cards are never together (one is stashed away in a drawer, the other is always in her wallet) so someone has gotten access to another source (we can't figure out what) that has all of this info (name, address, card info including ccv from multiple banks - and who knows what else).

It certainly appears to be someone stealing and then selling the data - rather than for their own personal use - because the charges came from outside of the US (hence triggering the fraud alerts).

The small charges (we're told) are so they can 'test' the cards. If the smaller charges go through, then they usually try bigger purchases later. Plus with such a small charge the banks aren't likely to invest any time following up on it.

*I* feel better now though - she was trying to point the finger in my direction cuz I told her that she should just leave her wifi on all the time...

What is PII?? Never heard of it...

 

[shibumi]

Forgot to mention - no, the phone is not rooted - all stock w/ several apps from the Marketplace added on of course.

And we considered "inside jobs" - like the cleaning lady etc, but w/ the cards kept separate and no one having access to the house w/o us (alarm, cameras, dog) it seemed unlikely - plus again, that would be access to only one card.

Sucks.

 

[AndroidOne]

Talking about Mint.com, as I understand the service (please correct me if I am wrong), the bank/cc/account credentials do not reside on the mobile application that you have on the phone but rather on the Mint.com servers. As I understand, that information is not transmitted to-from the mobile client at any time, just summarized balances or transaction info as requested by the client app, but not the account credentials.

Am I wrong?

 

[shibumi]

Talking about Mint.com, as I understand the service (please correct me if I am wrong), the bank/cc/account credentials do not reside on the mobile application that you have on the phone but rather on the Mint.com servers. As I understand, that information is not transmitted to-from the mobile client at any time, just summarized balances or transaction info as requested by the client app, but not the account credentials.

Am I wrong?

I'm not sure. My wife is the one that uses it, not me... I didn't even realize that she was using it - I guess I'll have to watch my spending more closely now!!

She is the one that suggested it as a possible link, but I've never seen it in action. Looks fairly certain that the EVO (or the Mint app on the EVO) won't be the culprit in this case from the responses I'm seeing.

 

[Jerry Hildenbrand]

Forgot to mention - no, the phone is not rooted - all stock w/ several apps from the Marketplace added on of course.

And we considered "inside jobs" - like the cleaning lady etc, but w/ the cards kept separate and no one having access to the house w/o us (alarm, cameras, dog) it seemed unlikely - plus again, that would be access to only one card.

Sucks.

Which apps are installed?
It's possible of course, but pretty unlikely. Are the cards used on a home computer? One that possibly might have clicked one of the million and one Facebook pop up ads? That's where I'd look first.

Next would be iTunes

 

[gspam1]

What is PII?? Never heard of it...

Apparently, it's something you never put on a cell phone. Should I ever run into a PII, I will cross the street. I'm glad I read his valuable warning.

 

[deetman]

PII = Personally identifiable information

Personally identifiable information - Wikipedia, the free encyclopedia

 

[KSmithInNY]

Which apps are installed?
It's possible of course, but pretty unlikely. Are the cards used on a home computer? One that possibly might have clicked one of the million and one Facebook pop up ads? That's where I'd look first.

Next would be iTunes

Don't worry about this jerry, this subject is really up my alley

The likely culprit has nothing to do with cell phones.

The OP is just going to have to take my word that a hacker wouldn't give a flying F about a single girl...

 

[chaosrecords]

If you are being frauded, and you have two separate cards you arent using being compromised. Theres a good chance someone is going through your trash and mail.

The only other way is if you kept all your account info open on a computer and someone gained backdoor access and knew where to look.

If it was just ONE card then i wouldnt think anything of it.. Prob someone using a card generator and getting lucky. Another option is if you called some sham credit care counseling company and gave your CC info out.

You piss anyone off lately?

 

[shibumi]

One that possibly might have clicked one of the million and one Facebook pop up ads? That's where I'd look first.

Next would be iTunes

She is computer savvy and knows not to ever click on pop ups or the FB crap, but the recent iTunes fiasco - forgot about that! lol

She did just recently have her sister drop their computer off over here so she could work on cleaning off a root kit and a bunch of other crap on that one... but I'm not sure if she ever plugged it into our network while doing so.

PII = Personally identifiable information

Personally identifiable information - Wikipedia, the free encyclopedia

Thanks for the link. I did a quick google earlier and couldn't find anything on it. I had never seen that acronym and just thought "PII" was just some *nix tool for hacking wifi or something. lol What's the pronunciation? "pie" or "p2"?

The likely culprit has nothing to do with cell phones.

The OP is just going to have to take my word that a hacker wouldn't give a flying F about a single girl...

Right, we don't believe that *she* was singled out and targeted. The theory was asking about was: could someone set up camp at a hotspot (book store, coffee shop, hell anywhere these days) and then just start scraping data from everyone's personal devices (phones, laptops, ipads etc) when they entered the place - just by virtue of those devices being powered on and set to connect to any available wireless networks. (Which apparently is not the case).

Obviously they can scrape data from folks that are actively doing stuff on a wireless network, but wasn't sure about the extent (if any) that could have been done by just simply having your device connect to the hotspot. And it looks like they can't.

If you are being frauded, and you have two separate cards you arent using being compromised. Theres a good chance someone is going through your trash and mail.

The only other way is if you kept all your account info open on a computer and someone gained backdoor access and knew where to look.

You piss anyone off lately?

LOL not that I know of... BUT - I did tell her to check around at work, because ironically, she does work for an arm of a large back in their division that develops (of all things) the software used in those credit card processing machines - and they are an electronic payments processor. SO - if anyone else starts reporting stuff then it would look more like an inside job there.

I'm doubting that our house was targeted specifically because none of my stuff has been compromised (yet). I'm sure her data was just part of a much larger batch - just frustrating not knowing WHERE.

Oh well - two days w/ no new charges... knock on wood! lol

 

[KSmithInNY]

This is starting to sound like a Russian spy movie ... wait ... maybe I've been reading too much CNN lol