Firesheep

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by Gadfium (talk | contribs) at 21:55, 12 October 2012 (Reverted edits by 193.62.3.251 (talk) to last version by Mitja). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

Firesheep
Developer(s)Eric Butler
Stable release
0.1-1[1]
Repository
Operating systemMicrosoft Windows and Mac OS X (highly unstable on Linux)
Available inEnglish
TypeAdd-on (Mozilla)
Websitecodebutler.com/firesheep

Firesheep is an extension for the Firefox web browser that uses a packet sniffer to intercept unencrypted cookies from websites such as Facebook and Twitter. As cookies are transmitted over networks, packet sniffing is used to discover identities on a sidebar displayed in the browser, and allows the user to instantly take on the log-in credentials of the user by double-clicking on the victim's name.[2]

The extension was created as a demonstration of the security risk of session hijacking vulnerabilities to users of web sites that only encrypt the login process and not the cookie(s) created during the login process.[3] It has been warned that the use of the extension to capture login details without permission would violate wiretapping laws and/or computer security laws in some countries. Despite the security threat surrounding Firesheep, representatives for Mozilla Add-ons have stated that it would not use the browser's internal add-on blacklist to disable use of Firesheep, as the blacklist has only been used to disable spyware or add-ons which inadvertently create security vulnerabilities, as opposed to attack tools (which may legitimately be used to test the security of one's own systems).[4]

Later a similar tool called Faceniff was released for Android mobile phones.[5]

History

Developed by Eric Butler, released in 2010.

Countermeasures

Multiple methods exist to counter Firesheep's local network sniffing, such as preventing sniffing by using a secure connection. This can be realized in several ways: for example by using HTTPS,[6] or a virtual private network (VPN) connection, or using wireless security. These approaches may be employed individually or in any combination, and their availability in any given situation will vary, in part due to web site and local network characteristics and configuration.

HTTPS

HTTPS offers end-to-end security between the user agent and the web server. This works well with web sites that are offered uniformly over HTTPS. However, many web sites employ HTTPS only for accomplishing what is sometimes called "web login" (also often inaccurately referred to as "form-based authentication"), then revert the user's session back to insecure HTTP.

This can be addressed in two intersecting fashions:

  • First, the site can offer itself uniformly over HTTPS.[6][7]
  • Second, the user can employ a browser extension, such as HTTPS-Everywhere which can help ensure uniform HTTPS access to certain websites (the list is extensive), whether or not the site offers itself uniformly over HTTPS or employs HSTS. Also, in Mozilla Firefox 4 (or later) as well as Google Chrome (version 4 and later) the user may natively hand-configure the browser to treat the site as HTTPS-only.[8]

Virtual private network

The end-user may also employ a corporate virtual private network or implement a personal VPN (for example via OpenVPN) to a home PC acting as a VPN server to encrypt absolutely all the data during transmission over the public Wi-Fi link.

However, one must then trust the VPN's operators not to capture the session cookies themselves. That is particularly a concern with the Tor network, for which anyone can set up an exit node and monitor traffic going to non-HTTPS websites.

Wireless network security

Local Wi-Fi networks may be configured with varying levels of security enabled. Using a Wired Equivalent Privacy (WEP) password, the attacker running Firesheep must have the password, but once this has been achieved (a likely scenario if a coffee shop is asking all users for the same basic password) they are able to decrypt the cookies and continue their attack. However, using Wi-Fi Protected Access (WPA) encryption offers individual user isolation, preventing the attacker from decrypting any cookies sent over the network even if they have logged into the network using the same password.[9] An attacker would be able to manually retrieve and decrypt another user's data on a WPA-PSK connection, if the key is known and the attacker was present at the time of the handshake.

See also

References

  1. ^ Butler, Eric. "Firesheep – codebutler". Retrieved December 20, 2010.
  2. ^ Steve Gibson, Gibson Research Corporation. "Security Now! Transcript of Episode No. 272". Grc.com. Retrieved November 2, 2010.
  3. ^ "Firesheep Sniffs Out Facebook and Other User Credentials on Wi-Fi Hotspots". Lifehacker. Retrieved October 28, 2010.
  4. ^ Keizer, Gregg. "Mozilla: No 'kill switch' for Firesheep add-on". Computer World. Retrieved October 29, 2010.
  5. ^ "Sniff and intercept web session profiles on Android". Help Net Security. Retrieved June 2, 2011.
  6. ^ a b Seth Schoen (October 29, 2010). "The Message of Firesheep: "Baaaad Websites, Implement Sitewide HTTPS Now!"". Retrieved March 8, 2011.
  7. ^ Chris Palmer (November 15, 2010). "How to Deploy HTTPS Correctly". Retrieved March 8, 2011.
  8. ^ a b Jeff Hodges (October 31, 2010). "Firesheep and HSTS (HTTP Strict Transport Security)". Retrieved March 8, 2011.
  9. ^ See episode 272 "Firesheep"[1]

External links