Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

11/1/2010
01:17 PM
Jim Rapoza
Jim Rapoza
Commentary
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Firesheep Simplifies Stealing Logins

Firefox extension created to shine a light on the problem of unencrypted websites fails, because rather than offering a solution, it only makes it worse.

Most people know that public Wi-Fi hotspots aren't the safest connections in the world and probably aren't the best place to be doing things like online banking. But you probably didn't realize just how easy it is to steal logins for email and services like Facebook from other people on a hotspot.

Well, thanks to a new Firefox extension called Firesheep, anyone can easily view other people on their network and, with a click of a button, assume another person's identity and login credentials from any non-secure site that the unwitting person is logged into.

Firesheep was created by two developers who are hoping to shine a light on the problem of websites that don't use SSL encryption throughout an entire user session. It has always been easy for the bad guys to view and steal login information from users accessing non HTTPS-secured websites and Firesheep is just making that a whole lot easier.

To a certain degree this is a worthwhile cause. Too many sites put users at risk of giving away their login information by their failure to use secure connections. However, I wish the Firesheep developers could have made their point without putting this tool in the hands of bad guys, cranky teens, and disgruntled employees everywhere.

And don't think that because a webmail site or ecommerce site uses SSL for the login page that you're safe. If SSL isn't enabled for the entire session, someone using Firesheep can still take over your account after you've logged in.

Also, this problem isn't limited to Wi-Fi hotspots. Someone using Firesheep can see and steal the login information from anyone on a shared network segment, whether that's a hotspot, a home network, or a company network.

How Firesheep Can Hijack Web Sessions
(click image for larger view)
Slideshow: How Firesheep Can Hijack Web Sessions

So what can you do to avoid the dangers of Firesheep (and the older sniffing tools familiar to real hackers)?

For those traveling or using public networks and hotspots, a VPN is probably your best option, as it will encrypt your entire Internet connection. But not everyone has access to a VPN, especially when it comes to non-business users.

The second best option is to make sure that the site you are using has https enabled throughout the entire session. Some sites, like Google Gmail, now do this by default, but that isn't the case for every site.

Browser extensions such as HTTPS Everywhere and Force-TLS will make sure that your browser uses a secure connection when it is available.

However, not every site has the capability to run under HTTPS for an entire session. Some sites use it only for login (which doesn't protect you against Firesheep) and some don't use it at all.

In these cases, if you don't have a VPN handy, then I would advise not using these sites or services at all when you are on a network that you don't trust 100%.

Of course the best solution would be for all sites that need to protect user information, whether they are webmail, social networks, or ecommerce sites, to use HTTPS all the time.

And with the threat of Firesheep out there, they all might finally do that.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-31476
PUBLISHED: 2021-06-16
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.1.3.37598. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the han...
CVE-2021-31477
PUBLISHED: 2021-06-16
This vulnerability allows remote attackers to execute arbitrary code on affected installations of GE Reason RPV311 14A03. Authentication is not required to exploit this vulnerability. The specific flaw exists within the firmware and filesystem of the device. The firmware and filesystem contain hard-...
CVE-2021-32690
PUBLISHED: 2021-06-16
Helm is a tool for managing Charts (packages of pre-configured Kubernetes resources). In versions of helm prior to 3.6.1, a vulnerability exists where the username and password credentials associated with a Helm repository could be passed on to another domain referenced by that Helm repository. This...
CVE-2021-32691
PUBLISHED: 2021-06-16
Apollos Apps is an open source platform for launching church-related apps. In Apollos Apps versions prior to 2.20.0, new user registrations are able to access anyone's account by only knowing their basic profile information (name, birthday, gender, etc). This includes all app functionality within th...
CVE-2021-32243
PUBLISHED: 2021-06-16
FOGProject v1.5.9 is affected by a File Upload RCE (Authenticated).