Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firesheep: Easy HTTP session hijacking from within Firefox

codebutler.com

Post reply on HN
Print view View original

101–110 of 356 posts

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#101

Post by kijinbear »

tswicegood wrote: post #78
kijinbear wrote: post #60

Earlier quoted context omitted.

> If the first connection is over http then a man in the middle attack can succeed. There are ways to work around this, if the non-https site immediately redirects to the https version and a "secure cookie" (https-only) is exchanged afterwards.

Someone correct me if I'm wrong, but that's the exact vector point for a man-in-the-middle attack. First request over HTTP gets hijacked, redirected to a "secure" server, then you (the user) see the lock and go to town, secure in the knowledge that you're communications with this server are protected because they're encrypted.

Isn't that exactly why HTTPS sites are supposed to have expensive certificates issued by big companies? Otherwise the browser will display a big red warning message. If you ignore that warning, you deserve to be hacked.

If the request gets redirected to a HTTPS proxy site that the attacker has set up, that's a different story. But again, you should be checking what's in your address bar. No security system can rescue you if you can't tell the difference between "mail.google.com" and "mail.google.haxxor.com". But for those of us who actually read what's in the address bar, HTTPS is pretty good security.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#102

Post by Dornkirk »

flexterra wrote: post #89

Here is a simple tutorial on how to set up an SSH Tunnel for Mac OS X http://bit.ly/cffjOY This way all your communication is encrypted

Thanks for the link!

I'm going to be traveling for a while pretty soon and using a lot of internet cafes and other free wi-fi spots so I should probably get this set up - I'm worried someone will be able to grab my password while logging in to check mail.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#103

Post by EricButler »

GVRV wrote: post #99
cdine wrote: post #96

Earlier quoted context omitted.

Well, hopefully it will then convince companies to properly secure their websites and actually protect users.

Agreed, but I still think giving someone else full control is a bit too much. It's not the user's fault (most don't even know this is happening) and they're likely to be the victims here.

The script kiddies already have their scripts and already do this. Firesheep will hopefully allow users to see the problem in a way they can clearly understand.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#104

Post by cdine »

GVRV wrote: post #99
cdine wrote: post #96

Earlier quoted context omitted.

Well, hopefully it will then convince companies to properly secure their websites and actually protect users.

Agreed, but I still think giving someone else full control is a bit too much. It's not the user's fault (most don't even know this is happening) and they're likely to be the victims here.

This vulnerability (it hurts to even call it such at this point) has been around for years, and the attack has always been easy for a determined attacker to carry out.

How else are we going to convince people to secure their sites and protect their users? People have been presenting on this issue for years (Ferret & Hamster, Blackhat 2007) and companies haven't responded/cared. It's possible to solve this problem (Gmail is all HTTPS, and done correctly, Amazon has a tiered authentication system that properly uses SSL for important things, Wordpress does SSL right for accessing their admin interface) - companies need to step up and address the issue.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#105

Post by flexterra »

cdine wrote: post #95
flexterra wrote: post #89

Here is a simple tutorial on how to set up an SSH Tunnel for Mac OS X http://bit.ly/cffjOY This way all your communication is encrypted

I love SSH tunnels, but in regards to this particular problem, it really just pushes the problem off to wherever you ssh tunnel terminates. Do you trust you server operator? ISP? This is addressed in our presentation, here (VPN's are essentially doing the same thing): http://codebutler.github.com/firesheep/tc12/#20

Totally agree!

But right now I'm more worried about a co-worker or stranger in a Starbucks taking over my personal Facebook or Gmail account than my server operator trying to spy on me.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#106

Post by GVRV »

cdine wrote: post #104
GVRV wrote: post #99

Earlier quoted context omitted.

Agreed, but I still think giving someone else full control is a bit too much. It's not the user's fault (most don't even know this is happening) and they're likely to be the victims here.

This vulnerability (it hurts to even call it such at this point) has been around for years, and the attack has always been easy for a determined attacker to carry out. How else are we going to convince people to secure their sites and protect their users? People have been presenting on this issue for years (Ferret & Hamster, Blackhat 2007) and companies haven't responded/cared. It's possible to solve this problem (Gm…

Definitely, I guess as a uni student, I'm worried about the majority of non-technical students who are going to have their sessions hacked and have no clue what hit them and cannot setup proxies/tunnels.

I'm not saying this isn't the site's fault. They definitely need a wake-up call.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#107

Post by qeorge »

EricButler wrote: post #100
bluesmoon wrote: post #32

Earlier quoted context omitted.

SSL is bad for the environment because it requires far more server side hardware... Well, I'm only partially serious about the environment thing, the question is, how can internet companies make it commercially viable to use SSL for everything? The added hardware and power costs make each user way more expensive, possibly to the point where they may not actually be worth it. An alternative is to bind the user's sessi…

When Gmail switched on SSL for everyone earlier this year they added "no additional machines" ( http://unblog.pidster.com/imperialviolet-overclocking-ssl ). Regarding IPs, there's a bigger issue here. People are used to being able to shut their laptop at home and open it back up at work without having to re-authenticate all their browser tabs. If you filter by IP this breaks. SSL requires no changes to user behavior.

What about pairing the auth token with a browser fingerprint? [1]

It would make it harder to troll an open network for random victims, and wouldn't annoy the user.

[1] Perhaps a hash based on something like this https://panopticlick.eff.org/

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#108

Post by jdunck »

cdine wrote: post #95
flexterra wrote: post #89

Here is a simple tutorial on how to set up an SSH Tunnel for Mac OS X http://bit.ly/cffjOY This way all your communication is encrypted

I love SSH tunnels, but in regards to this particular problem, it really just pushes the problem off to wherever you ssh tunnel terminates. Do you trust you server operator? ISP? This is addressed in our presentation, here (VPN's are essentially doing the same thing): http://codebutler.github.com/firesheep/tc12/#20

I trust my server operator much more than anyone squatting on attwifi, yes.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#109

Post by EricButler »

muloka wrote: post #30

Thanks to the EFF and the Tor Project we need not worry as much thanks to their HTTPS Everywhere project, a plugin for Firefox: http://www.eff.org/https-everywhere/ Any questions: http://www.eff.org/https-everywhere/faq

Logging into insecure sites over Tor is probably not a good idea. It's always good to assume that people running exit nodes are not the most trustworthy.

HTTPS Everywhere is good but only works on known sites (and known domains for those sites).

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#110

Post by cdine »

muloka wrote: post #30

Thanks to the EFF and the Tor Project we need not worry as much thanks to their HTTPS Everywhere project, a plugin for Firefox: http://www.eff.org/https-everywhere/ Any questions: http://www.eff.org/https-everywhere/faq

HTTPS Everywhere only works on a select few sites. You're up a creek for anything it doesn't cover.

And Tor, there's lots of cases where operators did bad things. Don't trust it for sensitive information. http://blog.ironkey.com/?p=201

Post reply on HN