please don't tell 4chan
Firesheep: Easy HTTP session hijacking from within Firefox
281–290 of 356 posts
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#282Earlier quoted context omitted.
"Firesheep 0.1 could not be installed because it is not compatible with Firefox 3.6.9." And yes, WinPcap is installed. I don't think it should matter, but I'm running Windows XP on a VirtualBox.
Oh, you just need to update to the latest version of Firefox (3.6.11). Your version is out of date and not secure. http://www.mozilla.org/security/known-vulnerabilities/firefo...
What should happen if you use iPhone tethering? Could it top into the vast people on that network? (I have absolutely no idea). If this is the case, the internet will have a panic attack in 2 days max.
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#283Earlier quoted context omitted.
A cheap linux VPS is a couple bucks a month. Mine is three. If you aren't looking for a deal, there are many many options at the 5 dollar price point. If five bucks is worth peace of mind for the next month, then that's your answer. This will also have the benefit of getting around filters that are operating on WiFi network you are on.
Wow, three? I thought prgmr.com's $5 system was the best deal I'd be able to find.
BuyVM.net has some good-for-my-purpose VPSes for cheap, so long as you can get them "in stock" (whatever that means...). Lowest one is a 15 bucks a year(!)
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#284There are probably going to be a lot of people negatively affected by this for quite some time to come. One thing to point out is that there are grades of things. There is "public", and then there is "top hit on Google". Similarly, there is "insecure" and then there is "simple doubleclick tool to facilitate identity theft". How many millions of dollars and man hours is it going to take to lock down every access point…
Security through obscurity. Information is dangerous. Two sentiments that you're espousing that I consider bogus.
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#285There are probably going to be a lot of people negatively affected by this for quite some time to come. One thing to point out is that there are grades of things. There is "public", and then there is "top hit on Google". Similarly, there is "insecure" and then there is "simple doubleclick tool to facilitate identity theft". How many millions of dollars and man hours is it going to take to lock down every access point…
Bull crap. Hamster and Ferret was only slightly harder to use than Firesheep. You had to run it, then adjust your proxy to localhost:1234. Aside from that, it does exactly the same thing. And before it was around, we were using cookie editing plugins in FireFox to import stuff we grabbed from Wireshark. And before that, we were manually editing our browser's cookie stores to bring in cookies we caught with tcpdump. And before that...
This isn't a new threat. Just a new shiny piece of ware that lowers the bar a little further.
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#286Earlier quoted context omitted.
Someone correct me if I'm wrong, but that's the exact vector point for a man-in-the-middle attack. First request over HTTP gets hijacked, redirected to a "secure" server, then you (the user) see the lock and go to town, secure in the knowledge that you're communications with this server are protected because they're encrypted.
Isn't that exactly why HTTPS sites are supposed to have expensive certificates issued by big companies? Otherwise the browser will display a big red warning message. If you ignore that warning, you deserve to be hacked. If the request gets redirected to a HTTPS proxy site that the attacker has set up, that's a different story. But again, you should be checking what's in your address bar. No security system can rescue…
Isn't that exactly why HTTPS sites are supposed to have expensive certificates issued by big companies?
There is virtually no cost associated with issuing a certificate. The fact that they are nevertheless prohibitively expensive for most private domains is partly responsible for the failure to adopt SSL on a broad scale.
Otherwise the browser will display a big red warning message.
While it is true that this warning is intended to protect users again man-in-the-middle attacks and other methods that redirect traffic away from the original source, it also prevents people with absolutely valid (but free) certificates from offering perfectly good encryption on their sites. This warning is misguided and does more to prevent the secure use of the web than anything else.
The remedies would be simple, but I guess commercial reasons prevent them from being adopted at the expense of everyday users.
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#287Earlier quoted context omitted.
If it can be that easily scripted, 10 year olds were already doing it. Suppressing knowledge, especially knowledge of a flawed system, doesn't make the system safer. In terms of severity, computing has overcome worse exploits; this is a problem awaiting an answer, which sounds like opportunity to me.
> Suppressing knowledge Again, degrees matter. Abstract knowledge is one thing. A simple tool to facilitate griefing people is quite another. Mobile web browsing existed before the Iphone. Search existed before Google. Telecommunication preceded the internet. You could share mp3s before Napster and mp4s before Youtube. And you used to have to delve into Wireshark to pull this off, but now you can snag grandma's crede…
And without raising awareness of the issue, everybody might always be somewhat vulnerable forever, whereas now that "we know", after being highly vulnerable for a short time everybody's vulnerability to this should drop to zero very quickly.
If you assume a limited number of evildoers and a limited ability to exploit this at will (e.g. you have to catch your victim in close proximity on public wi-fi that you're sharing with him), releasing a tool like Firesheep may produce significantly less total damage.
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#288For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…
Client -> SSH_Server == Encrypted SSH_Server -> FaceBook == Unencrypted SSH proxies are not end to end encryption. They only protect part of the path. Not sure why this is being down voted. It's true. The tunnel is only between the client and the SSH server. The HTTP websites that you visit beyond the SSH server see your clear text packets.
So? The problem is insecure WiFi and local networks.
The network from the SSH_Server to Facebook and much larger and more secure.
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#289Well, whatever... encrypt all you like, $5 will still crack your session: http://xkcd.com/538/
wow, -1. HN readers sure left their senses of humour at home today.
I shall call this experiment a success.
Re: Firesheep: Easy HTTP session hijacking from within Firefox
#290Earlier quoted context omitted.
The intersection of 'evil enough to do something truly malicious', 'read a tech blog in the right 24-hour period', 'didn't already know the problem existed', and 'in enough cafes to pair with enough potential victims' is too low to cause "millions" more to be impacted by this, I promise. Your implicit definition of 'highly motivated' (someone willing to put in 5 minutes of Googling) makes me sad. I'm agitated because…
It might make you sad, but it's spot on. People were sharing MP3 files on usenet pretty easily, back in the day. It would have taken 5 minutes or less to work out how -- even easier than grabbing cookies. It wasn't until Napster made that 0 minutes of googling that MP3 filesharing really took off. For something like this to end up on millions of desktops, you have to be able to explain it to a half-stoned frat at a p…
The responsibility is with every admin that setup an insecure access point, not with every security researcher to stay quiet about widely known and widely exploited vulnerabilities.
This isn't new. Point and click tools for doing this existed 10 years ago. Making a firefox plugin just pushed it back to the top of the headlines. This is actually a good thing because if word spreads more people will be aware of the already existing risk and will be more security conscious.
Does this mean everyone should stop logging into their personal accounts over unsecure wifi at school or starbucks? ABSOLUTELY.
Hopefully this new attention on an old hole will motivate more admins to fix their networks and more users to realize how vulnerable they are.