Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firesheep: Easy HTTP session hijacking from within Firefox

codebutler.com

Post reply on HN
Print view View original

211–220 of 356 posts

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#211

Post by jfager »

ramanujan wrote: post #208
jfager wrote: post #207

Earlier quoted context omitted.

Butler has not raised the threat level on anything. This has been a widely known issue since forever . A friend of mine wrote a sniffer that could do this back in college, and he was one of the last to the party. Want something else to kvetch about? His tool could impersonate the router and act as a proxy, including serving up ssl-encrypted pages to users who didn't realize they shouldn't accept certs from unknown si…

> Butler has not raised the threat level on anything. Flat out false. Ever heard the term "crime of opportunity"? What's your over/under on the number of identity thefts facilitated by Eric Butler's little gift? Let's make this empirical.

Anyone who wanted to hijack http sessions was five minutes of Googling and installing away from being able to do so before "Eric Butler's little gift" anyways. Are you claiming that the marginal impact of packaging it up into a firefox extension is so great as to make it a threat of a wholly different kind?

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#212

Post by ramanujan »

jfager wrote: post #211
ramanujan wrote: post #208

Earlier quoted context omitted.

> Butler has not raised the threat level on anything. Flat out false. Ever heard the term "crime of opportunity"? What's your over/under on the number of identity thefts facilitated by Eric Butler's little gift? Let's make this empirical.

Anyone who wanted to hijack http sessions was five minutes of Googling and installing away from being able to do so before "Eric Butler's little gift" anyways. Are you claiming that the marginal impact of packaging it up into a firefox extension is so great as to make it a threat of a wholly different kind?

That is exactly what I'm claiming. That's also why this article has 200+ comments and was on the top of Hacker News all day!

You vastly underestimate the barrier that "five minutes of Googling" presents. I assure you, the overwhelming majority of aspiring script kiddies would never be able to figure it out. It took an expert to package an exploit in a nice GUI (and write cookie parsing code for every major social site under the sun).

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#213

Post by gaoshan »

hdeshev wrote: post #193
gaoshan wrote: post #121

For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…

You, sir, made my day! I just set this up with my home Linksys router which is reachable from the internet and it works like a charm. I am using the Tomato firmware ( http://www.polarcloud.com/tomato ) which has an SSH daemon.

Awesome! Happy to help.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#214

Post by jfager »

ramanujan wrote: post #212
jfager wrote: post #211

Earlier quoted context omitted.

Anyone who wanted to hijack http sessions was five minutes of Googling and installing away from being able to do so before "Eric Butler's little gift" anyways. Are you claiming that the marginal impact of packaging it up into a firefox extension is so great as to make it a threat of a wholly different kind?

That is exactly what I'm claiming. That's also why this article has 200+ comments and was on the top of Hacker News all day! You vastly underestimate the barrier that "five minutes of Googling" presents. I assure you, the overwhelming majority of aspiring script kiddies would never be able to figure it out. It took an expert to package an exploit in a nice GUI (and write cookie parsing code for every major social sit…

As long as only the minimally motivated can exploit it, it's not really a problem, gotcha.

How about instead of shooting the messenger, you take some of that righteous anger and point it at the companies with millions/billions to spend who have simply ignored a longstanding known issue?

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#215

Post by euroclydon »

patio11 wrote: post #190

Thanks for posting this. It convinced me to upgrade SSL support from "something that would be nice to implement if I was bored someday" (BCC is not exactly security critical -- except, on reflection, the admin pages) to "drop everything and get it done."

You're saying that the BCC server doesn't have even a self-signed SSL cert installed? Or something else?

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#216

Post by gaoshan »

conanite wrote: post #168
gaoshan wrote: post #121

For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…

ssh -ND 8887 -p 22 rufus@12.120.186.8 just hangs and doesn't look like it's doing anything ... if you want to see stuff happening, so you know it's working, use verbose mode: ssh -vND 8887 -p 22 rufus@12.120.186.8 and you'll see delightful ssl debug information scroll by every time you hit a page in your browser.

I wouldn't say it "hangs" as everything is actually working fine and "hang" means that the process is stuck. It's just there is no output to provide feedback that it is working as expected.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#217

Post by gaoshan »

alanstorm wrote: post #136
gaoshan wrote: post #121

For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…

Also, remember that some programs don't respect the system's proxy settings and instead use their own. Firefox is one of those, you can find its proxy settings in "Advanced -> Network -> Settings"

alanstorm of stackoverflow answers that deal with Magento fame (well, fame being a relative term but famous to me, anyway)?

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#218

Post by ramanujan »

chaitanya wrote: post #184
ramanujan wrote: post #154

There are probably going to be a lot of people negatively affected by this for quite some time to come. One thing to point out is that there are grades of things. There is "public", and then there is "top hit on Google". Similarly, there is "insecure" and then there is "simple doubleclick tool to facilitate identity theft". How many millions of dollars and man hours is it going to take to lock down every access point…

> How many new servers are going to be needed now that https is used for everything and requests can't be cached? Wrong. You don't need to use https for everything -- you can specify a domain and a path in the cookie. For things like images, videos and css, you still don't need SSL.

Many browsers give warnings when mixing secure and insecure content. Know of a good cross-browser example that mixes http and https requests?

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#219

Post by ramanujan »

jfager wrote: post #214
ramanujan wrote: post #212

Earlier quoted context omitted.

That is exactly what I'm claiming. That's also why this article has 200+ comments and was on the top of Hacker News all day! You vastly underestimate the barrier that "five minutes of Googling" presents. I assure you, the overwhelming majority of aspiring script kiddies would never be able to figure it out. It took an expert to package an exploit in a nice GUI (and write cookie parsing code for every major social sit…

As long as only the minimally motivated can exploit it, it's not really a problem, gotcha. How about instead of shooting the messenger, you take some of that righteous anger and point it at the companies with millions/billions to spend who have simply ignored a longstanding known issue?

How about you recognize that there are a lot of innocent people who will be hurt by this stunt? There are hundreds of thousands of companies and millions of people who are targets for this, and most don't have a spare million lying around.

Hospitals, nonprofit groups, anyone running a website has to drop everything to lock it all down now. The effect is a lot like loosing a new virus (and might ultimately be treated that way).

> As long as only the highly motivated can exploit it, it's not really a problem, gotcha.

^ This modified statement is correct. All I'm saying that making something easy to use and publicizing it widely is going to result in a lot more people using it.

[Edits - hey jfager, I don't know you from adam and don't particularly enjoy flamewars. I agree that in the long run this should be fixed, ideally in such a way that 99.99% of people can blissfully go about their day. I just wish that the energy to secure stuff had taken the form of (say) a post on "here's how Google converted Gmail to https" rather than Firesheep. Hope we can find some common ground and you can see my POV.]

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#220

Post by muloka »

muloka wrote: post #30

Thanks to the EFF and the Tor Project we need not worry as much thanks to their HTTPS Everywhere project, a plugin for Firefox: http://www.eff.org/https-everywhere/ Any questions: http://www.eff.org/https-everywhere/faq

I realize I should of put more emphasis on "as much" as yes this only works on only a few popular websites as defined by the plugin.

Thanks to reading Techcrunch this morning, I read about this plugin which allows you to manually define which sites you want to force an HTTPS connection on:

Force-TLS https://addons.mozilla.org/en-US/firefox/addon/12714/

Mind you for any of these extensions to work the website you're visiting needs to be already accessible via ssl. If the site does not have encryption, these plugins can't force the sites to automagically start using the encryption it never had.

Post reply on HN