Sign up for a new account or log in here:
also @ TechSpot: Oculus Rift secures $16 million in Series A round of funding
Firesheep currently targets a few dozen popular sites, including Amazon, Facebook, Foursquare, Google, The New York Times, Twitter, Windows Live, Wordpress and Yahoo. But it is also customizable to target other websites not listed by the developer. Basically what the extension does is eavesdrop on any open Wi-Fi network and list captured cookies on a panel to the left. Typically, this cookie will not contain your password, but even without your password someone using Firesheep can simply load your session cookie with a click and gain access to your account.
In other words someone with access to your Yahoo Mail cookie could send an email on your behalf, with your Facebook he could access friend’s profiles and post messages, and so on. This problem doesn't really register when you're on a secure Wi-Fi network -- when WPA is enabled, for example. But of course there are ways to get around that as well.
Butler says moderately knowledgeable hackers were already exploiting this vulnerability, but by making it dead simple to use he hopes to raise awareness and compel sites to raise the bar on security. He also promised to release a new blog post in the next few hours that will help users protect themselves.
User Comments: 32
Got something to say? Post a comment-
therickster90 said:
I just tried it. I'm sitting here at school on an unsecured connection with 20 people on laptops around me and the only thing it is picking up is my gmail login, which is https. hmmm...at least I don't have facebook anymore.
Same here. Except I am trying it on my home network (WPA-PSK). I use my roommates computer (with her permission) to log into her Facebook and click random links. Nothing shows up.
It does, however, pick up my own credentials.
Thanks Firesheep!
-
This is why I use Safari.
-
Old news to anyone that uses tcpdump/Wireshark or any other network sniffer if you know how to find the "session keys". Any unencrypted(or poorly encrypted) data can be intercepted for "bad" purposes. IE iPhones will send/receive all of their local bookmarks in plain text when they sync with the server. This doesn't even take into consideration "man in the middle" attacks.
For the comments along the lines of "don't put anything important and it isn't a problem." You are quite simply wrong if anyone on your friends list trusts that you are you. I could steal your FB account(and even better if I got access to your FB email account at the same time) and then pretend I was stranded somewhere you had mentioned traveling to recently, or as was the case in a recent FB chat exploit scam claim I was in London. And along with the notice, ask for money since I need to pay off some fee or another.
-
AppleFanboy said:
This is why I use Safari.
Which does you no good. This isn't a FF problem. It's a combination of using a public WiFi service and websites not encrypting your sessions. His FireFox extension would show all your Safari sessions too.
-
Its always better and safer to visit such private sites from your most secured location called HOME. I never try to access my emails and other pvt accounts outside of home network.
-
I knew there was a catch with them fancy open Wi-Fi networks :P
-
limpangel said:
@p51d007: Deleting your cookie at FF exit doesn't help. The cookie is still transmitted when you use FF an that's when it is captured. FF deletes the cookie after you exit, but unless you log-out of the website (thus invalidating the session) the session cookie still remains on the sidejacker's computer and it can be used to acces your account.
@Fragrant Coit: Even if the password is changed every day doesn't help because the sidejacker is probably in the same cafe as you and probably has the pass already. The only thing is, he would need another tool to decrypt the data he captures.
@xanthic42: Of course you can use Wireshark, but it is not for everyone. This extension can be installed by not so technical people with just a few clicks and the access is instant.
@AppleFanboy, Ranger12: doesn't mater which web browser you use. You are still vulnerable to sidejacking. Have you even read the article???
Most Popular
| Trending | Featured |
-
PlayStation 4 is destroying the Xbox One in Amazon customer poll
-
In Win D-Frame Case Review
-
Noise cancellation technique harnesses magnets to silence CPU fans [video]
-
Intel Haswell-E enthusiast chip to carry eight cores and support DDR4
-
Cookie-blocking browser plugin Ghostery feeds data to the ad industry
Subscribe to TechSpot
Get free exclusive content, learn about new features and breaking tech news.