Double-click on someone, instantly log in as them
p2pnet view Advertising | Security:- “As I write this, the extension has been downloaded some 8,000 times, and the number is rising by the second”, says Zljka Zorz today on Help Net Security.
Under discussion is Firesheep, a “simple-to-use Firefox plugin” presented at Toorcon in San Diego.
As soon as anyone on the network visits an insecure website known to Firesheep, their name and photo will be displayed, says its creator, Eric Butler, in the story.
Just “Double-click on someone, and you’re instantly logged in as them.”
“It’s extremely common for websites to protect your password by encrypting the initial login, but surprisingly uncommon for websites to encrypt everything else”, says Butler on his {Codebutler} site, continuing >>>
This leaves the cookie (and the user) vulnerable. HTTP session hijacking (sometimes called “sidejacking”) is when an attacker gets a hold of a user’s cookie, allowing them to do anything the user can do on a particular website. On an open wireless network, cookies are basically shouted through the air, making these attacks extremely easy.
This is a widely known problem that has been talked about to death, yet very popular websites continue to fail at protecting their users.
The only effective fix for this problem is full end-to-end encryption, known on the web as HTTPS or SSL. Facebook is constantly rolling out new “privacy” features in an endless attempt to quell the screams of unhappy users, but what’s the point when someone can just take over an account entirely?
Twitter forced all third party developers to use OAuth then immediately released (and promoted) a new version of their insecure website. When it comes to user privacy, SSL is the elephant in the room.
Experts have been able to take advantage of the possibilities before the advent of Firesheep, says Butler in Help Net Security
However, Firesheep make it easy for anyone, he says.
“Among the websites whose cookies Firesheep can identify are Facebook, Flickr, Amazon.com, bit.ly, Google, Twitter, Yahoo, WordPress, and many others”, the story reveals.
Says Butler on his {Codebutler} site.
“Firesheep is free, open source, and is available now for Mac OS X and Windows. Linux support is on the way.
“Websites have a responsibility to protect the people who depend on their services. They’ve been ignoring this responsibility for too long, and it’s time for everyone to demand a more secure web. My hope is that Firesheep will help the users win.”
Stay tuned.
Help Net Security – Firefox extension makes social network ID spoofing trivial, October 25, 2010
First they ignore you, then they laugh at you, then they fight you, then you win ~ Mahatma Gandhi
Use free p2pnet newsfeeds for your site. It`s really easy!
Use free p2pnet newsfeeds for your site. Subscribe to p2pnet.net | rss feed: http://p2pnet.net/feed
Net access blocked by government restrictions? Use Psiphon from the Citizen Lab at the University of Toronto. Go here for details.
October 25th, 2010 at 12:20 pm
I wonder why web sites are so hesitant to use HTTPS? Getting a cert is easy and relatively cheap. Maybe they think it consumes too much server-side CPU to have everyone using HTTPS connections? I’ve done this for a few forums and it was always OK, although CPU was up a bit.