When logging into a website you usually start by
submitting your username and password. The
server then checks to see if an account matching
this information exists and if so, replies back
to you with a "cookie" which is used by your
browser for all subsequent requests.
submitting your username and password. The
server then checks to see if an account matching
this information exists and if so, replies back
to you with a "cookie" which is used by your
browser for all subsequent requests.
It's extremely common for websites to
protect your password by encrypting the initial
login, but surprisingly uncommon for
websites to encrypt everything else.
This leaves the cookie (and the user)
vulnerable. HTTP session hijacking
(sometimes called "sidejacking") is when
an attacker gets a hold of a user's cookie,
allowing them to do anything the user
can do on a particular website. On an open
wireless network, cookies are
basically shouted through the air, making
these attacks extremely easy.
protect your password by encrypting the initial
login, but surprisingly uncommon for
websites to encrypt everything else.
This leaves the cookie (and the user)
vulnerable. HTTP session hijacking
(sometimes called "sidejacking") is when
an attacker gets a hold of a user's cookie,
allowing them to do anything the user
can do on a particular website. On an open
wireless network, cookies are
basically shouted through the air, making
these attacks extremely easy.
This is a widely known problem
that has been talked about to death,
yet very popular websites continue
to fail at protecting their users.
The only effective fix for this problem
is full end-to-end encryption, known
on the web as HTTPS or SSL.
Facebook is constantly rolling out
new "privacy" features in an endless
attempt to quell the screams
of unhappy users, but what's the
point when someone can just
take over an account entirely?
Twitter forced all third party
developers to use OAuth then
immediately released (and promoted)
a new version of their insecure
website. When it comes to user privacy,
SSL is the elephant in the room.
that has been talked about to death,
yet very popular websites continue
to fail at protecting their users.
The only effective fix for this problem
is full end-to-end encryption, known
on the web as HTTPS or SSL.
Facebook is constantly rolling out
new "privacy" features in an endless
attempt to quell the screams
of unhappy users, but what's the
point when someone can just
take over an account entirely?
Twitter forced all third party
developers to use OAuth then
immediately released (and promoted)
a new version of their insecure
website. When it comes to user privacy,
SSL is the elephant in the room.
After installing the extension you'll
see a new sidebar. Connect to any
busy open wifi network and click
the big "Start Capturing" button.
Then wait.
see a new sidebar. Connect to any
busy open wifi network and click
the big "Start Capturing" button.
Then wait.
As soon as anyone on the network visits
an insecure website known to Firesheep,
their name and photo will be displayed:
an insecure website known to Firesheep,
their name and photo will be displayed:
Double-click on someone, and you're
instantly logged in as them.
instantly logged in as them.
That's it.
Firesheep is free, open source, and is
available now for Mac OS X and Windows.
Linux support is on the way.
available now for Mac OS X and Windows.
Linux support is on the way.
Websites have a responsibility to protect
the people who depend on their services.
They've been ignoring this responsibility
for too long, and it's time for everyone to
demand a more secure web. My hope is that
Firesheep will help the users win.
the people who depend on their services.
They've been ignoring this responsibility
for too long, and it's time for everyone to
demand a more secure web. My hope is that
Firesheep will help the users win.
By Codebutler..
................................................................
Post a Comment