Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firesheep: Easy HTTP session hijacking from within Firefox

codebutler.com

Post reply on HN
Print view View original

151–160 of 356 posts

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#151

Post by _b8r0 »

petercooper wrote: post #117
azim wrote: post #73

Earlier quoted context omitted.

Virtually no modern wired networks use hubs anymore, they're for the most part switched. Unlike wireless networks where packets are broadcast freely in to the air, the switch checks the destination address and sends the packets only to the endpoint. There are some attacks like arp-spoofing and flooding which can defeat this, but they don't work well against modern enterprise-grade switches like you would find in a da…

Have a bazillion karma points. I didn't realize that switching resolved that whole problem. This is why I continue to bring up stupid hypothetical situations on HN from time to time ;-)

Switching doesn't resolve the problem completely. There are a range of complicated attacks that could be done, but can be detected in various ways in a well run NOC.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#152

Post by mfukar »

GVRV wrote: post #99
cdine wrote: post #96

Earlier quoted context omitted.

Well, hopefully it will then convince companies to properly secure their websites and actually protect users.

Agreed, but I still think giving someone else full control is a bit too much. It's not the user's fault (most don't even know this is happening) and they're likely to be the victims here.

This is essentially the same argument that comes up with full disclosure. Yes, it's not pretty. Yes, it causes a lot of collateral damage. But it also makes the big players patch things up faster, while letting the knowledge out to the public, which of course consists of not only the script kiddies, but also the unsuspecting legitimate users.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#153

Post by amanuel »

cdine wrote: post #115
amanuel wrote: post #59

Earlier quoted context omitted.

logging out will cause the captured sessions to be useless. So remember to logout. VPN is really the best overall option.

Most sites don't properly invalidate sessions when you log out, you can't protect yourself as well as you think. See our slide on this topic: http://codebutler.github.com/firesheep/tc12/#18

Excellent points on the slideshow. The general lack of care on this topic among web companies is worrisome.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#154

Post by ramanujan »

There are probably going to be a lot of people negatively affected by this for quite some time to come. One thing to point out is that there are grades of things. There is "public", and then there is "top hit on Google". Similarly, there is "insecure" and then there is "simple doubleclick tool to facilitate identity theft".

How many millions of dollars and man hours is it going to take to lock down every access point? How many new servers are going to be needed now that https is used for everything and requests can't be cached?

America was a better place when people could keep their doors unlocked, and when someone's first response to a break-in was to blame the criminal. By contrast it's fashionable among a certain set (no doubt including the author of this mess, Mr. Butler himself) to hold that the real culprits are the door manufacturers. What said facile analysis excludes, of course is that there is always a greater level of security possible. The level we currently employ reflects our tradeoffs between the available threats and the cost/convenience loss of bolting our doors and putting finials on our gates.

Butler has simply raised the threat level for everyone. He did not invent a new lock or close a hole. He's now forcing lots of people to live up to his level of security. Congratulations to the new Jason Fortuny.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#155

Post by mfukar »

GVRV wrote: post #106
cdine wrote: post #104

Earlier quoted context omitted.

This vulnerability (it hurts to even call it such at this point) has been around for years, and the attack has always been easy for a determined attacker to carry out. How else are we going to convince people to secure their sites and protect their users? People have been presenting on this issue for years (Ferret & Hamster, Blackhat 2007) and companies haven't responded/cared. It's possible to solve this problem (Gm…

Definitely, I guess as a uni student, I'm worried about the majority of non-technical students who are going to have their sessions hacked and have no clue what hit them and cannot setup proxies/tunnels. I'm not saying this isn't the site's fault. They definitely need a wake-up call.

The problem goes beyond client-website interaction. Improper wifi configuration also plays a big part in what Firesheep can achieve. ;)

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#156

Post by sswam »

gasull wrote: post #142
gaoshan wrote: post #121

For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…

http://silenceisdefeat.com/ Silence Is Defeat provides SSH accounts for a small donation. (I am not affiliated with them)

I provide ssh accounts on 2 VPSs (and growing), free of charge. http://nipl.net/ http://ai.ki/

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#157

Post by petercooper »

_b8r0 wrote: post #151
petercooper wrote: post #117

Earlier quoted context omitted.

Have a bazillion karma points. I didn't realize that switching resolved that whole problem. This is why I continue to bring up stupid hypothetical situations on HN from time to time ;-)

Switching doesn't resolve the problem completely. There are a range of complicated attacks that could be done, but can be detected in various ways in a well run NOC.

But we're talking a lot more complicated and deliberate than running tcpdump or this Firefox plugin, right?

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#158

Post by _b8r0 »

petercooper wrote: post #157
_b8r0 wrote: post #151

Earlier quoted context omitted.

Switching doesn't resolve the problem completely. There are a range of complicated attacks that could be done, but can be detected in various ways in a well run NOC.

But we're talking a lot more complicated and deliberate than running tcpdump or this Firefox plugin, right?

I guess if you really wanted to you could run a GUI tool like Cain (http://oxid.it/), but most people doing this type of thing would use something like Scapy or at worst, Yersinia.

So I'd agree, more complex definitely, significantly not as much perhaps (it depends on the type of attack as tool), as for deliberation I'd say about the same as the firefox plugin.

If you do run tcpdump you do pick up broadcasts and such, one of our VPS instances actually sees a load of DNS traffic for our subnet, which we think is the other VPS instances.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#159

Post by mrgordon »

cheungpat wrote: post #118
zemaj wrote: post #24

Earlier quoted context omitted.

Same setup. Sidebar shows for me after selecting it from the View -> Sidebar menu, however it pops up with a message that says "Run --fix-permissions first." Not sure where I'm supposed to run this flag.

There is so many hoops I have to jump to make this work in OS X. $ mv firesheep-backend firesheep-backend.binary $ cat > firesheep-backend #!/bin/sh sudo /path/to/firesheep-backend.binary $@ ^D $ sudo chmod +x firesheep-backend Then restart Firefox and start capture. You need to run sudo once every certain period.

It worked instantly for me on OS X. I installed, restarted the browser, and it opened the side panel.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#160

Post by mrgordon »

charlesshonston wrote: post #138

So wait... this works regardless of wireless card? I've tried to use BackTrack on my mac before and it failed due to the card not being able to run in passive mode.

Yes, I believe it should work on any wireless card because you're not doing packet injection.
Post reply on HN