When logging into a website you usually start by submitting your
username and password. The server then checks to see if an account
matching this information exists and if so, replies back to you with a
“cookie” which is used by your browser for all subsequent requests.
It’s extremely common for websites to protect your password by
encrypting the initial login, but surprisingly uncommon for websites to
encrypt everything else. This leaves the cookie (and the user)
vulnerable. HTTP session hijacking (sometimes called “sidejacking”) is
when an attacker gets a hold of a user’s cookie, allowing them to do
anything the user can do on a particular website. On an open wireless
network, cookies are basically shouted through the air, making these
attacks extremely easy.
This is a widely known problem that has been talked
about to death, yet very popular websites continue to fail at protecting
their users. The only effective fix for this problem is full end-to-end
encryption, known on the web as HTTPS or SSL. Facebook is constantly
rolling out new “privacy” features in an endless attempt to quell the
screams of unhappy users, but what’s the point when someone can just
take over an account entirely? Twitter forced all third party developers
to use OAuth then immediately released (and promoted) a new version of
their insecure website. When it comes to user privacy, SSL is the
elephant in the room.
Firesheep, a Firefox extension designed to demonstrate just how serious this problem is.
After installing the extension you’ll see a new sidebar. Connect to any
busy open wifi network and click the big “Start Capturing” button. Then
wait.
As soon as anyone on the network visits an insecure website known to Firesheep, their name and photo will be displayed:
Double-click on someone, and you’re instantly logged in as them.
That’s it.
Firesheep is free, open source, and is available now for Mac OS X and Windows. Linux support is on the way.
Websites have a responsibility to protect the people who depend on their
services. They’ve been ignoring this responsibility for too long, and
it’s time for everyone to demand a more secure web.
Download Link
Enjoy…….
No comments:
Post a Comment