Firesheep: Easy HTTP session hijacking from within Firefox • Hacker News Board

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#241

Post by jdunck » Mon, Oct 25, 2010, 3:00 PM UTC

pmjordan wrote: post #181

ramanujan wrote: post #154

There are probably going to be a lot of people negatively affected by this for quite some time to come. One thing to point out is that there are grades of things. There is "public", and then there is "top hit on Google". Similarly, there is "insecure" and then there is "simple doubleclick tool to facilitate identity theft". How many millions of dollars and man hours is it going to take to lock down every access point…

How many new servers are going to be needed now that https is used for everything and requests can't be cached? The main thing holding us back there are browsers that go apeshit if you load images via HTTP on an HTTPS page. Requiring JavaScript or other active content to be loaded from the same HTTPS server would be a good thing in many cases. I think currently ANY https server is allowed, which doesn't actually defe…

FWIW, non-JS is still a vector. For example, img tags can stomp on cookies. Yes, serving static media over SSL is diminishing returns, and it would suck for mid-stream proxies (and every ISP will hurt from it). But don't argue that it doesn't matter from a security perspective.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#242

Post by jdunck » Mon, Oct 25, 2010, 3:02 PM UTC

Title is a bit misleading. This is a front-end to libpcap, and can be used for hijacking any token-based-auth, not just HTTP.

It just happens that they released w/ support for social networks as a demonstration.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#243

Post by nikhilgk » Mon, Oct 25, 2010, 3:03 PM UTC

pygy_ wrote: post #174

gaoshan wrote: post #121

For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…

I'd like to buy such a server at low purchase and maintenance cost. The Pandaboard[1] looks like a good fit, but the instructions to install a Linux distro are a bit scary [2]. I guess I could do it, from my Mac, but I'm a bit afraid to mess things up with the low-level disk utilities. Does someones sells SD cards with a distro pre-installed? Or an equivalent device with an easier setup? If not, there's probably a ma…

Instead of a dedicated server, use a router that can run DD-WRT or Tomato. I use a cheap(35$) refurbished wireless router from Linksys[1] and I am sure there are other models. These will be more energy efficient and easier to maintain than running a dedicated server. Additionally, of course, you can use these as routers for your home network.

[1] http://www.amazon.com/Cisco-Linksys-WRT160N-RM-Refurbished-W...

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#244

Post by gbog » Mon, Oct 25, 2010, 3:04 PM UTC

ramanujan wrote: post #154

There are probably going to be a lot of people negatively affected by this for quite some time to come. One thing to point out is that there are grades of things. There is "public", and then there is "top hit on Google". Similarly, there is "insecure" and then there is "simple doubleclick tool to facilitate identity theft". How many millions of dollars and man hours is it going to take to lock down every access point…

It is nice to see a common security issue taken seriously, but for me the even worse gigantic hole is that most people use only one password for their email account and all other accounts. (writing on phone, sorry if unclear)

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#245

Post by eapen » Mon, Oct 25, 2010, 3:11 PM UTC

Sites that are tracked:

amazon basecamp bitly cisco cnet dropbox enom evernote facebook flickr foursquare github google gowalla hackernews harvest live nytimes pivotal sandiego_toorcon slicemanager tumblr twitter wordpress yahoo yelp

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#246

Post by amalcon » Mon, Oct 25, 2010, 3:19 PM UTC

rubinelli wrote: post #179

s3graham wrote: post #150

SSL requires a unique IP per hostname, correct? Maybe this will be what actually ends up getting IPv6 going... :)

It used to be so, but newer servers can now serve more than one HTTPS domain using the same IP. For more details, check out http://serverfault.com/questions/109800/multiple-ssl-domains...

Newer servers can serve more than one HTTPS domain using the same IP... to users who are not using IE/Chrome/Safari under Windows XP. If you depend on SNI, you're leaving out something like a third of your user base.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#247

Post by patio11 » Mon, Oct 25, 2010, 3:22 PM UTC

euroclydon wrote: post #240

patio11 wrote: post #223

Earlier quoted context omitted.

I had a SSL certificate for a while, but actually using it throughout the site without showing users Big Scary Error Messages is not quite trivial. The activation energy for digging through several hours of edge cases was lacking... until today. ("Whoops, while you don't know you're doing it, you pull an unnecessary CSS file into the cached CSS for the registration page which references a background image on an absol…

I've seen some sites which figure out a way to force the user in and out of SSL for certain URLs. You might be able to implement a fix which forces SSL for the admin section and non-SSL for everything else.

That doesn't help, because my all-powerful admin session is as secure as the least secure page I access (or can be made to access) while on a compromised network.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#248

Post by xorglorb » Mon, Oct 25, 2010, 3:26 PM UTC

cheungpat wrote: post #118

zemaj wrote: post #24

Earlier quoted context omitted.

Same setup. Sidebar shows for me after selecting it from the View -> Sidebar menu, however it pops up with a message that says "Run --fix-permissions first." Not sure where I'm supposed to run this flag.

There is so many hoops I have to jump to make this work in OS X. $ mv firesheep-backend firesheep-backend.binary $ cat > firesheep-backend #!/bin/sh sudo /path/to/firesheep-backend.binary $@ ^D $ sudo chmod +x firesheep-backend Then restart Firefox and start capture. You need to run sudo once every certain period.

I keep getting a "Failed to fix permissions" error. Any insight into that?

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#249

Post by 16s » Mon, Oct 25, 2010, 3:32 PM UTC

ianhawes wrote: post #4

This looks really cool. I can't wait to try this out. Very nice work, Eric.

I got it working by running firefox as root, I tried the --fix-permissions thing until I just gave-up.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#250

Post by euroclydon » Mon, Oct 25, 2010, 3:45 PM UTC

patio11 wrote: post #247

euroclydon wrote: post #240

Earlier quoted context omitted.

I've seen some sites which figure out a way to force the user in and out of SSL for certain URLs. You might be able to implement a fix which forces SSL for the admin section and non-SSL for everything else.

That doesn't help, because my all-powerful admin session is as secure as the least secure page I access (or can be made to access ) while on a compromised network.

Doh. Of course. It's all on the same domain. Do you think, that if designing a new application, it would make sense to make a separate admin sub-domain (assuming no wildcard cookies)?

Does the solution entail purchasing legit ssl certs for your static content domains?