Risk
11/1/2010
01:17 PM
Jim Rapoza
Jim Rapoza
Commentary
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Firesheep Simplifies Stealing Logins

Firefox extension created to shine a light on the problem of unencrypted websites fails, because rather than offering a solution, it only makes it worse.

Most people know that public Wi-Fi hotspots aren't the safest connections in the world and probably aren't the best place to be doing things like online banking. But you probably didn't realize just how easy it is to steal logins for email and services like Facebook from other people on a hotspot.

Well, thanks to a new Firefox extension called Firesheep, anyone can easily view other people on their network and, with a click of a button, assume another person's identity and login credentials from any non-secure site that the unwitting person is logged into.

Firesheep was created by two developers who are hoping to shine a light on the problem of websites that don't use SSL encryption throughout an entire user session. It has always been easy for the bad guys to view and steal login information from users accessing non HTTPS-secured websites and Firesheep is just making that a whole lot easier.

To a certain degree this is a worthwhile cause. Too many sites put users at risk of giving away their login information by their failure to use secure connections. However, I wish the Firesheep developers could have made their point without putting this tool in the hands of bad guys, cranky teens, and disgruntled employees everywhere.

And don't think that because a webmail site or ecommerce site uses SSL for the login page that you're safe. If SSL isn't enabled for the entire session, someone using Firesheep can still take over your account after you've logged in.

Also, this problem isn't limited to Wi-Fi hotspots. Someone using Firesheep can see and steal the login information from anyone on a shared network segment, whether that's a hotspot, a home network, or a company network.

How Firesheep Can Hijack Web Sessions
(click image for larger view)
Slideshow: How Firesheep Can Hijack Web Sessions

So what can you do to avoid the dangers of Firesheep (and the older sniffing tools familiar to real hackers)?

For those traveling or using public networks and hotspots, a VPN is probably your best option, as it will encrypt your entire Internet connection. But not everyone has access to a VPN, especially when it comes to non-business users.

The second best option is to make sure that the site you are using has https enabled throughout the entire session. Some sites, like Google Gmail, now do this by default, but that isn't the case for every site.

Browser extensions such as HTTPS Everywhere and Force-TLS will make sure that your browser uses a secure connection when it is available.

However, not every site has the capability to run under HTTPS for an entire session. Some sites use it only for login (which doesn't protect you against Firesheep) and some don't use it at all.

In these cases, if you don't have a VPN handy, then I would advise not using these sites or services at all when you are on a network that you don't trust 100%.

Of course the best solution would be for all sites that need to protect user information, whether they are webmail, social networks, or ecommerce sites, to use HTTPS all the time.

And with the threat of Firesheep out there, they all might finally do that.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3341
Published: 2014-08-19
The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exists, which allows remote attackers to enumerate VLANs via a series of requests, aka Bug ID CSCup85616.

CVE-2014-3464
Published: 2014-08-19
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers ...

CVE-2014-3472
Published: 2014-08-19
The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

CVE-2014-3490
Published: 2014-08-19
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have...

CVE-2014-3504
Published: 2014-08-19
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Dark Reading continuing coverage of the Black Hat 2014 conference brings interviews and commentary to Dark Reading listeners.