Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Firesheep: Easy HTTP session hijacking from within Firefox

codebutler.com

Post reply on HN
Print view View original

311–320 of 356 posts

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#311

Post by ItarPeyo »

losvedir wrote: post #304
chrisbroadfoot wrote: post #82

Has anyone checked the source code to check that the passwords aren't sent to the author's website? :)

Not sure why you're being downvoted, seems like a legitimate question to me! I was a little leery of checking it out at first, too, but curiosity got the better of me... Maybe someone who has developed a FF extension can lay my worries to rest -- could this have, say, a built in key logger which sends that data to the author? I downloaded the source code from github and glanced through it, enough to comfort me somewh…

>> Maybe someone who has developed a FF extension can lay my worries to rest -- could this have, say, a built in key logger which sends that data to the author?

If it could sniff packets on network interfaces why couldn't it send data to a website? ;)

This kind of FF plugin requires extensive C++ coding. But even simple plugins that are only JS could easily send your username and password (if entered within them) to any web server.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#312

Post by seanalltogether »

alanstorm wrote: post #136
gaoshan wrote: post #121

For anyone who has SSH access to a server (but not VPN) and is wondering what to do when you need some security in a pinch, here is a quick fix... Open an ssh connection to a server you have access to using something like the following: ssh -ND 8887 -p 22 rufus@12.120.186.8 where 8887 is the port on your laptop that you will tunnel through, -p 22 is the port the ssh server is on (22 is the default but I use a differe…

Also, remember that some programs don't respect the system's proxy settings and instead use their own. Firefox is one of those, you can find its proxy settings in "Advanced -> Network -> Settings"

Also unfortunately I think Flash and Silverlight media streaming don't respect proxies, leaving me unable to stream Hulu and Netflix when I'm in the UK.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#314

Post by robhu »

jonknee wrote: post #200
robhu wrote: post #198

Earlier quoted context omitted.

I tried it on Facebook. I have a WPA2 protected Wifi network. Two laptops (a MB and a MBP) on it. I run it on the MBP, on the MB I refresh a logged in Facebook page, and nothing appears as captured on the MBP. If on the MBP I refresh Facebook in another browser it appears.

Try on an open wireless network.

Why? It should work on a WPA encrypted network as long as I have the network key - from the perspective of my network interface nothing is encrypted.

This indicates that the card has not properly been put in to listening mode, which means the plugin is not operating my card correctly.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#315

Post by Groxx »

pak wrote: post #310
EricButler wrote: post #100

Earlier quoted context omitted.

When Gmail switched on SSL for everyone earlier this year they added "no additional machines" ( http://unblog.pidster.com/imperialviolet-overclocking-ssl ). Regarding IPs, there's a bigger issue here. People are used to being able to shut their laptop at home and open it back up at work without having to re-authenticate all their browser tabs. If you filter by IP this breaks. SSL requires no changes to user behavior.

People bring up the Google stat, but you have to remember they have incredible engineering resources so they probably optimize in many features every day without adding additional machines. That doesn't mean every dude with a LAMP stack out there can turn on SSL and expect the same performance, just that it's possible with mongo manpower and talent to make it work. (Google doesn't even release the details of their we…

How many web servers do you know of which are CPU bound, and not through massive code stupidity, and not I/O (in some manner - waiting on SQL, disk access, bandwidth)? Encryption can run while other threads are waiting for a response.

In general, it's a negligible cost; it adds a very minor delay compared to latency / transfer time, and uses CPU otherwise highly unlikely to be pegged. If you're pushing threading limits / CPU usage limits, you're probably inches from needing new hardware anyway, and SSL should be considered part of the cost of running a web server.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#316

Post by enneff »

bsaunder wrote: post #201
zecg wrote: post #166

Earlier quoted context omitted.

This is IMO a completely wrong approach to security. Butler has not raised the threat level, he has merely illuminated the existing threat level.

Illumination is one thing. Enabling a ten year old to do malicious stuff with a few clicks and poorly considered actions is entirely another.

I know 10-year-olds who do this already.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#317

Post by enneff »

seanalltogether wrote: post #312
alanstorm wrote: post #136

Earlier quoted context omitted.

Also, remember that some programs don't respect the system's proxy settings and instead use their own. Firefox is one of those, you can find its proxy settings in "Advanced -> Network -> Settings"

Also unfortunately I think Flash and Silverlight media streaming don't respect proxies, leaving me unable to stream Hulu and Netflix when I'm in the UK.

They _should_, and do for me typically using Chrome.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#318

Post by Encosia »

mattmillr wrote: post #303
BrandonM wrote: post #296

Earlier quoted context omitted.

> I... haven't locked my front door during the day This isn't what people mean when they say they don't lock their doors. I grew up in the country in northeast Ohio. I knew many people who simply never locked their doors, including overnight or even when they weren't home.

I lived in middle-of-nowhere Texas for several years, and I think the only time I ever locked the door to my home was when I left for two weeks at Christmas. If my car didn't automatically lock itself after you get out, I would have left it unlocked as well, with the key lying in the center console. I live in Brooklyn now. Things are a little different here. My door has a $350 deadbolt lock that -- when it broke and…

Question is, would it have been that hard to defeat if you were someone who cared absolutely nothing for minimizing damage to the door and door frame? Usually, the answer is not at all.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#319

Post by a_m_kelly »

uxp wrote: post #293
mike-cardwell wrote: post #177

Earlier quoted context omitted.

Even the dumbest script kiddies have been doing this for years anyway. There are plenty of existing tools. This one just lowers the bar so your mum can perform the attack too. It almost makes me angry that websites like Facebook and Twitter don't force all traffic over https. They've got the money and the expertise. They just don't care if your account gets sniffed and taken over at a web cafe.

Exactly. I'm not a blackhat and my only "hacking" consists of forcing myself into my own systems which I've stupidly locked myself out of, yet I've managed to do much that this plugin can do. The most un-ethical thing I have done was to take one of the OLPC XO laptops and convert it into a MITM machine, rebroadcasting the SSID it connects to while routing and logging all traffic anyone who connects to it generates. I…

re: the OLPC, what were you running on it? I have one in my closet and I've been meaning to put something that isn't the stock software on there for a long time.

Re: Firesheep: Easy HTTP session hijacking from within Firefox

#320

Post by mmaro »

kogir wrote: post #186

This is one of many reasons Loopt has used SSL for all[1] traffic from the very beginning. At least WiFi has fairly limited range. Cell networks[2] (and satellite internet[3]) can be sniffed miles away. In addition to making session hijacking harder, using SSL keeps crappy proxies from caching private data. Remember when some AT&T users were getting logged in as other users on Facebook's mobile site? The cause was a…

There are antennas[1] that let you sniff wifi from ~4 miles way. Some routers can be configured to drop clients more than N meters away, though.

[1] http://www.radiolabs.com/products/antennas/2.4gig/long-range...

Post reply on HN