Perimeter
Guest Blog // Selected Security Content Provided By Sophos
What's This?
10/26/2010
02:35 PM
Dark Reading
Dark Reading
Security Insights
50%
50%

Cookies, Social Media And FireSheep

We've been seeing a lot of interest in FireSheep, the FireFox add-on that lets you spy on websites. How bad is it really?

We've been seeing a lot of interest in FireSheep, the FireFox add-on that lets you spy on websites. How bad is it really?To back the train up, let me explain what the add-in actually does for the benefit of the not-so-technical reader. When you go to a coffee shop or anywhere that has public WiFi, you share that connection with every other person using it. So the traffic all goes out over the same IP address. If a patron logs into most websites, then he or she will get a session ID and a cookie. If one can spy on the contents of that cookie, then the "hacker" can use that ID and the additional info to send traffic as that patron. Yes, usernames and passwords are encrypted on login with https and/or SSL, but then most sites switch back to plain, old unencrypted HTTP. This is generally seen as a VERY BAD THING if you are a privacy advocate.

Now none of this is new, different, or original. There have been sniffing techniques as long as there have been cookies. However, a well-meaning researcher by the name of Eric Butler has changed the game by making this technique extremely simple and accessible to the average person. Now I get what his aim was: He tried to show how insecure websites are. We security folks have been banging the drum on this for ages. I'm hoping sites like Facebook and Twitter will take notice. But will they?

Putting aside the security hat for a moment, let's look at these sites. Social networking sites have a business plan. That plan is to connect people and get them to share ideas, content, photos, etc., as freely as possible. Security and privacy simply are not at the top of the business plan. They now have to skate the line of trying to satisfy security experts and privacy advocates, while still holding to their business plan of allowing the sharing of information. Now does that mean personally identifiable info (PII) should be on display? Not really, but you willingly provide that information when you sign up for these sites (unless you give false information). These sites have a responsibility to protect your PII, but you have the choice of whether to provide it in the first place. Now that said (security hat goes back on), social networks most certainly DO have an obligation to ensure the person logged into the account really is that person and not someone masquerading as him or her. And, yes, they do need to start securing the whole session and not just the logging in portion of the session.

On a side note, someone asked us at Sophos if we think Firefox should start vetting add-ins to prevent them from ever being downloaded. Should they? Probably. Can they? That's a question I can't answer. Being an open community means there is such great range of innovation and tools to help, but at the same time that means any bad guy can easily get in and spoil things.

Beth Jones is a Senior Threat Researcher in SophosLabs North America. She manages the day-to-day research and analysis activities of incoming suspicious malware threats and potentially unwanted applications that arrive in the Lab via Sophos customers, partners, and prospects.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2130
Published: 2015-03-05
Cisco Secure Access Control Server (ACS) provides an unintentional administration web interface based on Apache Tomcat, which allows remote authenticated users to modify application files and configuration files, and consequently execute arbitrary code, by leveraging administrative privileges, aka B...

CVE-2014-9688
Published: 2015-03-05
Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.

CVE-2015-0598
Published: 2015-03-05
The RADIUS implementation in Cisco IOS and IOS XE allows remote attackers to cause a denial of service (device reload) via crafted IPv6 Attributes in Access-Accept packets, aka Bug IDs CSCur84322 and CSCur27693.

CVE-2015-0607
Published: 2015-03-05
The Authentication Proxy feature in Cisco IOS does not properly handle invalid AAA return codes from RADIUS and TACACS+ servers, which allows remote attackers to bypass authentication in opportunistic circumstances via a connection attempt that triggers an invalid code, as demonstrated by a connecti...

CVE-2015-0657
Published: 2015-03-05
Cisco IOS XR allows remote attackers to cause a denial of service (RSVP process reload) via a malformed RSVP packet, aka Bug ID CSCur69192.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.