Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firesheep: Easy HTTP session hijacking from within Firefox

codebutler.com

Post reply on HN
Print view View original

271–280 of 356 posts

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#271

Post by [deleted] »

pieter wrote: post #173
InclinedPlane wrote: post #135

Earlier quoted context omitted.

This is incorrect. Traffic on an access point using WPA2 + AES is not sniffable without significant cryptanalysis or use of exploits.

It's fairly easy to do if you are logged in on the network already. For example, for the iPhone you can use something like pirni to spoof the mac address of the router. That way you'll receive all data on the network, and can send it on the router yourself. In the meantime, you can dump all cookies that are passed on. I think the tool even allows you to list all twitter and google cookies, and set them in Safari.

[deleted]

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#272

Post by StavrosK »

conanite wrote: post #168
gaoshan wrote: post #121

For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…

ssh -ND 8887 -p 22 rufus@12.120.186.8 just hangs and doesn't look like it's doing anything ... if you want to see stuff happening, so you know it's working, use verbose mode: ssh -vND 8887 -p 22 rufus@12.120.186.8 and you'll see delightful ssl debug information scroll by every time you hit a page in your browser.

You can remove the N option and you'll get a shell.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#273

Post by chaitanya »

ramanujan wrote: post #218
chaitanya wrote: post #184

Earlier quoted context omitted.

> How many new servers are going to be needed now that https is used for everything and requests can't be cached? Wrong. You don't need to use https for everything -- you can specify a domain and a path in the cookie. For things like images, videos and css, you still don't need SSL.

Many browsers give warnings when mixing secure and insecure content. Know of a good cross-browser example that mixes http and https requests?

That's a good point -- I hadn't thought about this.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#274

Post by [deleted] »

ramanujan wrote: post #154

There are probably going to be a lot of people negatively affected by this for quite some time to come. One thing to point out is that there are grades of things. There is "public", and then there is "top hit on Google". Similarly, there is "insecure" and then there is "simple doubleclick tool to facilitate identity theft". How many millions of dollars and man hours is it going to take to lock down every access point…

[deleted]

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#275

Post by cazlab »

ramanujan wrote: post #154

There are probably going to be a lot of people negatively affected by this for quite some time to come. One thing to point out is that there are grades of things. There is "public", and then there is "top hit on Google". Similarly, there is "insecure" and then there is "simple doubleclick tool to facilitate identity theft". How many millions of dollars and man hours is it going to take to lock down every access point…

LOL at the "Everything was better in a magical time that never existed, but my faulty memory has synthesized from biscuit commercials i saw as a child."

ramanujan: no one blames door manufacturers for break ins and there has never been a time when it was wise to leave your door unlocked.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#276

Post by alanh »

patio11 wrote: post #247
euroclydon wrote: post #240

Earlier quoted context omitted.

I've seen some sites which figure out a way to force the user in and out of SSL for certain URLs. You might be able to implement a fix which forces SSL for the admin section and non-SSL for everything else.

That doesn't help, because my all-powerful admin session is as secure as the least secure page I access (or can be made to access ) while on a compromised network.

Er, can’t you just specify that the session cookie is only sent over HTTPS?

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#277

Post by marbletiles »

jfager wrote: post #225
ramanujan wrote: post #219

Earlier quoted context omitted.

How about you recognize that there are a lot of innocent people who will be hurt by this stunt? There are hundreds of thousands of companies and millions of people who are targets for this, and most don't have a spare million lying around. Hospitals, nonprofit groups, anyone running a website has to drop everything to lock it all down now. The effect is a lot like loosing a new virus (and might ultimately be treated…

The intersection of 'evil enough to do something truly malicious', 'read a tech blog in the right 24-hour period', 'didn't already know the problem existed', and 'in enough cafes to pair with enough potential victims' is too low to cause "millions" more to be impacted by this, I promise. Your implicit definition of 'highly motivated' (someone willing to put in 5 minutes of Googling) makes me sad. I'm agitated because…

It might make you sad, but it's spot on. People were sharing MP3 files on usenet pretty easily, back in the day. It would have taken 5 minutes or less to work out how -- even easier than grabbing cookies.

It wasn't until Napster made that 0 minutes of googling that MP3 filesharing really took off.

For something like this to end up on millions of desktops, you have to be able to explain it to a half-stoned frat at a party. "Five minutes of googling and then some nerdery"? No chance. "Install this, go to the quad and you can sign into the facebook of any other person there?" Yup, that's going to spread like wildfire.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#278

Post by InclinedPlane »

pieter wrote: post #173
InclinedPlane wrote: post #135

Earlier quoted context omitted.

This is incorrect. Traffic on an access point using WPA2 + AES is not sniffable without significant cryptanalysis or use of exploits.

It's fairly easy to do if you are logged in on the network already. For example, for the iPhone you can use something like pirni to spoof the mac address of the router. That way you'll receive all data on the network, and can send it on the router yourself. In the meantime, you can dump all cookies that are passed on. I think the tool even allows you to list all twitter and google cookies, and set them in Safari.

Pirni uses a vulnerability of a common WPA2 configuration to execute a MITM attack using ARP spoofing. There are ways to prevent this exploit as well.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#279

Post by JshWright »

It's an interesting assortment of sites that are "supported" out of the box. Some of them are pretty harmless (bit.ly, Flickr), some could cause some pretty serious hassles (Google, Amazon), and some could be absolutely devastating (Deleting someone's Slicehost account? Ouch...).

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#280

Post by InclinedPlane »

oasisbob wrote: post #164
InclinedPlane wrote: post #135

Earlier quoted context omitted.

This is incorrect. Traffic on an access point using WPA2 + AES is not sniffable without significant cryptanalysis or use of exploits.

Mind providing more information on this? eg, what about WPA2+TKIP? I'm trying to wrap my head around how WPA2 could still provide protection with a shared key... I'm sure I'm not the only geek who feels like their knowledge of WiFi protocols goes stale every six months or so.

TKIP is much more vulnerable. In theory it requires "work" to crack WPA2+TKIP but it's comparatively trivial with modern hardware. With WPA2+AES you basically open a public/private key encrypted connection to the router (similar to SSL) and exchange the PSK in order to authorize the client. This traffic isn't any more sniffable, in principle, than https traffic. However, depending on configuration it can be vulnerable to man in the middle attacks and such-like.
Post reply on HN