FaceNiff App Makes It Easy To Hack Facebook, Twitter & YouTube Accounts From Android

[evilsatan]

FaceNiff is a new Android App that makes it literally effortless to log into someone else’s Facebook account, if that person is on the same Wi-Fi network. Yes, any Wi-Fi network.

This application works by capturing all the packets that are sent back and forth inside the network. While the application itself won’t break into Facebook, it will wait for a legitimate user to login, then it will intercept the data and display the user’s login ID. By simply clicking on it, an ill-intentioned user would be able to log in and take over the account. In addition to Facebook, this application supports Twitter, YouTube, Amazon and Nasza-Klasa, a Polish micro-blogging platform.

This App is an elaborate form of packet sniffer, a program that intercepts data that’s sent back and forth inside a network. There are many packet sniffers available online for free, such as Wireshark, a full-fledged Windows application, and more recently Firesheep, a Firefox add-on. The main difference between FaceNiff and other packet sniffers is the program’s ease of use: while most packet sniffers capture every single packet that is sent or received inside the network, unless it’s configured otherwise, FaceNiff was designed specifically for collecting login data. That makes this app a lot less idiot-proof, and therefore more widespread.

There are ways you can protect yourself from these attacks. The most obvious way would be to use HTTPS on public networks, as opposed to HTTP. Services like Gmail, and yes, Facebook, have a setting that allows users to log in with HTTPS. You can also get a free VPN, such as Hotspot Shield, which will automatically encrypt all the data that’s sent from your computer. Both of those measures will shield sensitive data from prying eyes and yes, packet sniffers. If you’re a regular user of public Wi-Fi, stay on the lookout and make sure you’re safe.

In order to use this application, the phone needs to be rooted, which should be fairly effortless for most people. Once that’s done, you can get the application from this website. The developer stresses that this app was made "for educational purposes only" and let’s keep it that way. If you don’t know how to be a responsible individual, you most likely shouldn’t be allowed anywhere near a phone to begin with.

YouTube - ‪FaceNiff for Android on LG Swift 2X‬‏

[evilsatan]

Looks interesting, wouldn't mind testing it on my network to see how vulnerable I am.

[{{909}}]

crap, i was hoping for something else, want to have poke around a mates facebook account

[JonEp]

Does this work on the San Francisco ?

I am alway a bit weary of give root to apps outside the market..

[iNSPECTA]

Looking at the download page it seems that it only works with certain rom's and on certain devices.
Seems Desire users need Cyanogen Mod 7 installed. List of confirmed devices and rom's are on the bottom of the page.

[drdude]

Effortless I changed my Gmail and Facebook settings long ago to use HTTPS, but not sure how to do it for Twitter - does an option exist? The Modaco R12 ROM on my San Francisco does not work with VPNs which is quite annoying as I have access to Giganews VPNs which would help protect against this kind of application.

[BFG]

I saw this on Redmond Pie yesterday. :S

[beacytan]

Effortless I changed my Gmail and Facebook settings long ago to use HTTPS, but not sure how to do it for Twitter - does an option exist? The Modaco R12 ROM on my San Francisco does not work with VPNs which is quite annoying as I have access to Giganews VPNs which would help protect against this kind of application.

Can't you just log in to twitter with https anyway?

[Cooleo]

Working on my San fransisco, Oh the fun you can have with WiFi networks

[beacytan]

Could be worth picking up a San fran just to do this! How much can u get these for now???

[liveseytowers]

I like the idea of this but would be worried that if I tested it on the Mrs Facebook that it would upload her password somewhere as well. Will be changing all my accounts to HTTPS tonight!

[maltloaf]

works on my dell streak

[DJ OD]

Do u have to be logged on to the wifi network itself or just be in range of it?


DJ OD

[hungabunga]

There is nothing to stop this app passing on the login details you require on to the developer so use with caution

[Possy_99]

Do u have to be logged on to the wifi network itself or just be in range of it?


DJ OD

interesting.. I'm gonna stick with my original thought though, I'd suggest you have to be connected.. particulary if wep/wpa encryption is used

[JonEp]

Use penetrate or Router Keygen from the market to connect to most Thopmson / BT Home Hub / 02 Wireless locked AP's

[AspectUK]

I have a Desire running Cyanogen 7, just used it and it works a treat
You have to be logged into the Wifi connection your sniffing, no way it could work really unless you were.

Limited to 3 accounts though, anymore and you have to pay $4.99 to unlock the software

Beltin'

[drdude]

Use penetrate or Router Keygen from the market to connect to most Thopmson / BT Home Hub / 02 Wireless locked AP's

Very useful!

[drdude]

Can't you just log in to twitter with https anyway?

True, I'll start doing that from now on. However, I was wondering whether the Twitter app. from the market uses HTTPS by default. There's an explicit option on Facebook to always use HTTPS wherever possible and was hoping that Twitter had a similar one.

[AspectUK]

Use penetrate or Router Keygen from the market to connect to most Thopmson / BT Home Hub / 02 Wireless locked AP's

I don't find them on the market .. the autocomplete is shown for them, but on searching they aren't listed

Any ideas?