Firesheep: Easy HTTP session hijacking from within Firefox • Hacker News Board

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#251

Post by gaoshan » Mon, Oct 25, 2010, 3:51 PM UTC

someone_here wrote: post #236

gaoshan wrote: post #121

For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…

You proxy through the NSA? How brave!

You win a cookie! I was wondering how long it would take for someone to comment on that. :)

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#252

Post by azim » Mon, Oct 25, 2010, 3:51 PM UTC

thought_alarm wrote: post #128

Does this kind of wi-fi sniffing work with WEP or WPA encrypted networks? What about 802.1x?

This specific attack should work just fine with WEP but will not work against WPA2 (Disclaimer: I haven't tried the combinations personally). With WEP every single client uses the same encryption key, so all the packets are visible to everyone. With WPA2-PSK, each client has it's own key which is derived from the pre-shared key. Because of this, your adapter won't decode someone else's packets, but it's technically feasible to do so with other types of attacks outside of the scope of this firefox plugin. I'm not that familiar with the encryption within WPA-Enterprise, but I don't believe you can derive other people's keys and sniff their data when using it.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#253

Post by hendler » Mon, Oct 25, 2010, 4:01 PM UTC

ramanujan wrote: post #219

jfager wrote: post #214

Earlier quoted context omitted.

As long as only the minimally motivated can exploit it, it's not really a problem, gotcha. How about instead of shooting the messenger, you take some of that righteous anger and point it at the companies with millions/billions to spend who have simply ignored a longstanding known issue?

How about you recognize that there are a lot of innocent people who will be hurt by this stunt? There are hundreds of thousands of companies and millions of people who are targets for this, and most don't have a spare million lying around. Hospitals, nonprofit groups, anyone running a website has to drop everything to lock it all down now. The effect is a lot like loosing a new virus (and might ultimately be treated…

Obvious, easy security exploits should be be as publicly exposed as possible, and repeatedly so.

This kind of exploit is so many years old that it's a matter of basic public education and computer literacy. While this might be a "forcing function" on the web development community - it is not unfair. There is so much new tech every year, it's unfortunate that security isn't more in the consciousness of tech.

There may be more graceful ways to lead "sheep" to more secure use of the internet deserving of praise, but it's fair game to release an exploit, and I'd rather see FireSheep than censorship of it.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#254

Post by Encosia » Mon, Oct 25, 2010, 4:01 PM UTC

jberryman wrote: post #224

ramanujan wrote: post #154

There are probably going to be a lot of people negatively affected by this for quite some time to come. One thing to point out is that there are grades of things. There is "public", and then there is "top hit on Google". Similarly, there is "insecure" and then there is "simple doubleclick tool to facilitate identity theft". How many millions of dollars and man hours is it going to take to lock down every access point…

America was a better place when people could keep their doors unlocked I hate this mythical "good old days" B.S. I know people who live in the country who don't lock their doors because they live in the country. The idea that people who lived in urban areas ever could leave their doors unlocked is absurd.

I live in a suburb of Atlanta and haven't locked my front door during the day in about a decade (since moving from an apartment to a house). The world isn't really as scary as the news makes it seem.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#255

Post by DJN » Mon, Oct 25, 2010, 4:24 PM UTC

The main problem will be with SaaS apps that allow custom domains names (i.e. mywebsite.com instead of mywebsite.mysaasprovider.com).

I made an early decision to enable SSL everywhere in Trafficspaces with the obvious downside being that I need to allocate a dedicated IP address each time someone requests a custom domain name.

I used to get worried that perhaps it would have been better to only provide SSL in specific stages (such as sign-in and payment) and only through a generic domain name. Not any more.

Firesheep clearly vindicates that decision.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#256

Post by xorglorb » Mon, Oct 25, 2010, 4:24 PM UTC

16s wrote: post #249

ianhawes wrote: post #4

This looks really cool. I can't wait to try this out. Very nice work, Eric.

I got it working by running firefox as root, I tried the --fix-permissions thing until I just gave-up.

Just so you know, that is a horrific idea security wise.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#257

Post by 16s » Mon, Oct 25, 2010, 4:29 PM UTC

xorglorb wrote: post #256

16s wrote: post #249

Earlier quoted context omitted.

I got it working by running firefox as root, I tried the --fix-permissions thing until I just gave-up.

Just so you know, that is a horrific idea security wise.

Yes, I know, but it's the only way I could test it... and it does work ;)

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#258

Post by phamilton » Mon, Oct 25, 2010, 4:40 PM UTC

amanuel wrote: post #59

gregwebs wrote: post #31

What can an end user do to minimize this? This exploit is for insecure Wifi networks- so only using encrypted Wi-fi or Ethernet would seem to remove this attack vector. Is there a real risk that someone (besides the government) can see your cookie?

logging out will cause the captured sessions to be useless. So remember to logout. VPN is really the best overall option.

Just tried it with iGoogle

Logging out doesn't kill the session.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#259

Post by phamilton » Mon, Oct 25, 2010, 4:41 PM UTC

robhu wrote: post #192

mrgordon wrote: post #160

Earlier quoted context omitted.

Yes, I believe it should work on any wireless card because you're not doing packet injection.

It doesn't work on my late 2009 MBP (sniffs sessions from other browsers on my laptop but not other laptops on our wifi).

are you sure you aren't on a WPA encrypted network? My understanding is that it doesn't work over WPA. WEP apparently does work though.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#260

Post by Dornkirk » Mon, Oct 25, 2010, 4:45 PM UTC

gaoshan wrote: post #121

For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…

This is a stupid question, but what about a guy like me who has no access to a server?

I'm going traveling for all of next month, the only sites I'll be checking where I'll be logged in is my hotmail account, and I might check my bank account (Chase) - both use https, so I suppose I'm in the clear then? (also when I click "log out" on these sites, it logs me out, but if my session has been hijacked, will it log the hijacker out of the session he's hijacked of mine as well?)