Typically, an attacker installs an android rootkit by exploiting known security loopholes (zero-day exploit, unpatched), to obtain passwords (e.g. phishing, clickjacking), or to perform direct attack on encryption (brute-force attack, hijack attack) or through close-in attack (social engineering).
The purpose of Magic Lantern is to obtain passwords to encrypted e-mail as part of a criminal investigation.
"It's kind of scary that somebody could know that much about us," said a former senior U.S. diplomat, pointing out the ability to use such data to impersonate an American official online, obtain passwords and plunder bank accounts.
One of the two former NIRT employees interviewed by Reuters described being on a team that once worked around the clock for five-straight days to patch software hackers had used to gain access to Fed systems in an attempt to obtain passwords.
The research coordinator could obtain password-protected access to the list of all uploaded prospective data forms, and upon mouse click of the "Follow-up Patient" button, the follow-up form was displayed with the required data to assist in follow-up, including patient name, medical record number, social security number, and telephone number (see top of Figure 2).
First, in order to override alerts, physicians had to contact pharmacists to obtain passwords, which were randomly assigned and changed daily.
Respondents were concerned about the management of passwords to access electronic journals within their institutions, explaining that it was difficult to obtain passwords from administration or librarians, who either do not make them readily available, or who "may not always be available to provide them".
There have even been instances of bullies obtaining passwords to the accounts of their targets, hijacking profiles and posting scurrilous comments.
Alex said he was "not a criminal," but said he had obtained passwords of senior Bloomberg employees, and he proposed Bloomberg pay him for pointing out the security breach.
In January, The Times reported that Chinese hackers had repeatedly attacked NYTimes.com and had obtained passwords for some reporters and other employees before being repelled by computer experts working for the company.
