Firesheep: Easy HTTP session hijacking from within Firefox • Hacker News Board

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#121

Post by gaoshan » Mon, Oct 25, 2010, 5:03 AM UTC

For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix...

Open an ssh connection to a server you have access to using something like the following:

ssh -ND 8887 -p 22 rufus@12.120.186.8

where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a different port so I am used to specifying this) and the rest is your username and the address of the server

Set your network to point to the proxy. On a Mac that would be…

... Open Network Preferences…

... Click Advanced…

... Click Proxies…

... Check the SOCKS Proxy box then in the SOCKS Proxy Server field enter localhost and the port you used (8887)

... OK and Apply and you are done!

Now you can surf safely.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#122

Post by [deleted] » Mon, Oct 25, 2010, 5:03 AM UTC

[deleted]

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#123

Post by bluesmoon » Mon, Oct 25, 2010, 5:04 AM UTC

Well, whatever... encrypt all you like, $5 will still crack your session: http://xkcd.com/538/

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#124

Post by n-named » Mon, Oct 25, 2010, 5:05 AM UTC

carbon8 wrote: post #47

This is kind of a big deal. Not a whole lot of people are aware of this vulnerability and among those who are it's likely only a small subset that knew how to exploit it until now. I suspect all of the coffee shops in the college town where I live will have people using this starting tomorrow. I've personally been working from cafes and tunneling everything through SSH for years, but in my experience almost no one el…

Exactly. That's why the net effect of this is going to be exactly what the author wants. All major potential targets will update this really fast.

I can't think of a more effective way for him to convince them all to update now.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#125

Post by AndyKelley » Mon, Oct 25, 2010, 5:06 AM UTC

Linux installation needs work. README is empty, and the INSTALL says use ./configure which doesn't exist. ./autogen.sh complains about needing xulrunner-sdk path, which is isn't something normal for linux.

Edit: Oops! Linux support is "on the way." I guess I assumed since linux is the easiest platform to get your driver to go into monitor mode.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#126

Post by psadauskas » Mon, Oct 25, 2010, 5:31 AM UTC

bluesmoon wrote: post #32

Groxx wrote: post #13

Nice . A solid demonstration to show next time your webmaster doesn't want to set up SSL everywhere. That said, the current cartel-like setup of certificate authorities (protection money and everything!) makes SSL annoying and expensive if you want the browser to not have a fit. Especially for small-scale projects. But there's really no excuse for larger sites.

SSL is bad for the environment because it requires far more server side hardware... Well, I'm only partially serious about the environment thing, the question is, how can internet companies make it commercially viable to use SSL for everything? The added hardware and power costs make each user way more expensive, possibly to the point where they may not actually be worth it. An alternative is to bind the user's sessi…

That may have been true 10 years ago, but the overhead of SSL for CPU is almost nothing, and only a few ms of latency. Web applications are mostly IO and memory bound, anyways. We should be using SSL all the time, by default. There's no reason not to, at this point, aside from certificate authorities.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#127

Post by carey » Mon, Oct 25, 2010, 5:38 AM UTC

StavrosK wrote: post #45

qeorge wrote: post #44

Earlier quoted context omitted.

Check historio.us, the ssl cert there is a free one (which is, sadly, why subdomains don't validate). AFAIK this is common to all certs (free or otherwise). You need a separate one for each subdomain (including www).

No, there are also wildcard certificates that match all subdomains, but are rather more expensive.

Wildcard certificates are available for USD $49.90 from StartSSL (http://www.startssl.com/?app=40), which is rather more expensive than free, but shouldn’t be a hardship.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#128

Post by thought_alarm » Mon, Oct 25, 2010, 5:50 AM UTC

Does this kind of wi-fi sniffing work with WEP or WPA encrypted networks? What about 802.1x?

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#129

Post by pmorici » Mon, Oct 25, 2010, 5:53 AM UTC

thought_alarm wrote: post #128

Does this kind of wi-fi sniffing work with WEP or WPA encrypted networks? What about 802.1x?

Yes, assuming you know the password to connect to the network. Otherwise no.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#130

Post by thought_alarm » Mon, Oct 25, 2010, 5:59 AM UTC

pmorici wrote: post #129

thought_alarm wrote: post #128

Does this kind of wi-fi sniffing work with WEP or WPA encrypted networks? What about 802.1x?

Yes, assuming you know the password to connect to the network. Otherwise no.

Are you sure? It's not working on my WPA2 network.