Firesheep: Easy HTTP session hijacking from within Firefox • Hacker News Board

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#171

Post by mike-cardwell » Mon, Oct 25, 2010, 9:28 AM UTC

mike-cardwell wrote: post #170

ramanujan wrote: post #154

There are probably going to be a lot of people negatively affected by this for quite some time to come. One thing to point out is that there are grades of things. There is "public", and then there is "top hit on Google". Similarly, there is "insecure" and then there is "simple doubleclick tool to facilitate identity theft". How many millions of dollars and man hours is it going to take to lock down every access point…

People have been doing this for years already with tools like Wireshark. The only thing the app he has released does it to draw a massive amount of attention to the already existing problem. I say superb. Brilliant effort. Well done. Hopefully more people will stop stupidly sending session cookies over unsecured channels now.

Also. If you want to use Facebook completely over https. Install the "HTTPS Everywhere" Firefox addon. It forces a number of sites to make all of their requests over an SSL secured channel.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#172

Post by itsnotvalid » Mon, Oct 25, 2010, 9:30 AM UTC

cdine wrote: post #113

chrisbroadfoot wrote: post #98

Earlier quoted context omitted.

Good thing GMail has SSL enabled by default ;)

Yup, they're one of our examples of a "good" setup. However, Google leaks iGoogle and some other things (Latitude, address book, reader, ...)

However they don't share the same session cookie for different service as far as I know (which they negotiate that through TLS protected link) Likewise they have also made several other services TLS only (e.g. calendar, docs)

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#173

Post by pieter » Mon, Oct 25, 2010, 9:37 AM UTC

InclinedPlane wrote: post #135

pmorici wrote: post #129

Earlier quoted context omitted.

Yes, assuming you know the password to connect to the network. Otherwise no.

This is incorrect. Traffic on an access point using WPA2 + AES is not sniffable without significant cryptanalysis or use of exploits.

It's fairly easy to do if you are logged in on the network already. For example, for the iPhone you can use something like pirni to spoof the mac address of the router. That way you'll receive all data on the network, and can send it on the router yourself. In the meantime, you can dump all cookies that are passed on. I think the tool even allows you to list all twitter and google cookies, and set them in Safari.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#174

Post by pygy_ » Mon, Oct 25, 2010, 9:38 AM UTC

gaoshan wrote: post #121

For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…

I'd like to buy such a server at low purchase and maintenance cost.

The Pandaboard[1] looks like a good fit, but the instructions to install a Linux distro are a bit scary [2]. I guess I could do it, from my Mac, but I'm a bit afraid to mess things up with the low-level disk utilities.

Does someones sells SD cards with a distro pre-installed? Or an equivalent device with an easier setup?

If not, there's probably a market for that...

[1] http://pandaboard.org/

[2] http://omappedia.org/wiki/OMAP_Pandroid_Main#Getting_Started

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#175

Post by mike_esspe » Mon, Oct 25, 2010, 9:43 AM UTC

Always use encryption, while using open wifi. I use openvpn ( http://openvpn.net/ ) for this.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#176

Post by loewenskind » Mon, Oct 25, 2010, 9:43 AM UTC

limmeau wrote: post #144

Groxx wrote: post #13

Nice . A solid demonstration to show next time your webmaster doesn't want to set up SSL everywhere. That said, the current cartel-like setup of certificate authorities (protection money and everything!) makes SSL annoying and expensive if you want the browser to not have a fit. Especially for small-scale projects. But there's really no excuse for larger sites.

HTTPS also needs distinct IP addresses for distinct hostnames, so that the HTTP handshake, in which the Host: header appears, is already protected by an encrypted channel. No more having multiple websites on one IP address.

That's an incredibly drastic change and I seriously doubt it can even be done with IP4.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#177

Post by mike-cardwell » Mon, Oct 25, 2010, 9:47 AM UTC

GVRV wrote: post #88

chaosmachine wrote: post #2

"Double-click on someone, and you're instantly logged in as them." Ouch. I think it's time to set up that VPN I've been putting off...

Am I the only one who thinks this is spoon feeding the script kiddies to cause mayhem?

Even the dumbest script kiddies have been doing this for years anyway. There are plenty of existing tools. This one just lowers the bar so your mum can perform the attack too.

It almost makes me angry that websites like Facebook and Twitter don't force all traffic over https. They've got the money and the expertise. They just don't care if your account gets sniffed and taken over at a web cafe.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#178

Post by pmjordan » Mon, Oct 25, 2010, 9:48 AM UTC

sswam wrote: post #156

gasull wrote: post #142

Earlier quoted context omitted.

http://silenceisdefeat.com/ Silence Is Defeat provides SSH accounts for a small donation. (I am not affiliated with them)

I provide ssh accounts on 2 VPSs (and growing), free of charge. http://nipl.net/ http://ai.ki/

In case this isn't clear: if you ssh to someone else's machine and use it as a proxy or VPN, the owner of said machine can of course still steal your HTTP cookies. (not trying to say anything about the trustworthiness of the above 2 posters, just a general statement)

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#179

Post by rubinelli » Mon, Oct 25, 2010, 9:49 AM UTC

s3graham wrote: post #150

SSL requires a unique IP per hostname, correct? Maybe this will be what actually ends up getting IPv6 going... :)

It used to be so, but newer servers can now serve more than one HTTPS domain using the same IP. For more details, check out http://serverfault.com/questions/109800/multiple-ssl-domains...

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#180

Post by mike-cardwell » Mon, Oct 25, 2010, 9:51 AM UTC

GVRV wrote: post #106

cdine wrote: post #104

Earlier quoted context omitted.

This vulnerability (it hurts to even call it such at this point) has been around for years, and the attack has always been easy for a determined attacker to carry out. How else are we going to convince people to secure their sites and protect their users? People have been presenting on this issue for years (Ferret & Hamster, Blackhat 2007) and companies haven't responded/cared. It's possible to solve this problem (Gm…

Definitely, I guess as a uni student, I'm worried about the majority of non-technical students who are going to have their sessions hacked and have no clue what hit them and cannot setup proxies/tunnels. I'm not saying this isn't the site's fault. They definitely need a wake-up call.

This was already happening on a massive scale before this new app was released... I honestly don't think it will increase the number of attacks by all that much. It's brilliant as a tool for spreading the word though.