Researchers showcased a new tool that can be used to take over the accounts of people using Facebook, Twitter and other Web 2.0 sites on open wireless networks.
A pair of researchers has developed a new Firefox extension that can hijack accounts on Facebook and other Web 2.0 sites
to demonstrate the threat posed by a lack of encryption.
Software developer Eric Butler and Ian "craSH" Gallagher created a tool they dubbed "Firesheep"
bring the topic of session hijacking front and center. The browser
extension, which was unveiled Oct. 24 at the ToorCon 12 conference in
San Diego, Calif., enables users to swipe other people's
credentials with just a few clicks.
"When logging into a Website you usually start by submitting your
username and password," Butler explained in a blog post. "The server
then checks to see if an account matching this information exists and
if so, replies back to you with a "cookie" which is used by your
browser for all subsequent requests."
"It's extremely common for Websites to protect your password by
encrypting the initial login, but surprisingly uncommon for Websites to
encrypt everything else," he wrote. "This leaves the cookie (and the
user) vulnerable. HTTP session hijacking
called "sidejacking") is when an attacker gets a hold of a user's
cookie, allowing them to do anything the user can do on a particular
Website. On an open wireless network, cookies are basically shouted
through the air, making these attacks extremely easy."
With Firesheep installed, users can target anyone on the same open
wireless network visiting non-encrypted sites such as Twitter and
Facebook and take over the person's account.
"The only effective fix for this problem is full end-to-end
encryption, known on the Web as HTTPS or SSL," Butler wrote. "Facebook
is constantly rolling out new 'privacy' features in an endless attempt
to quell the screams of unhappy users, but what's the point when
someone can just take over an account entirely? Twitter forced all
third-party developers to use OAuth then immediately released (and
promoted) a new version of their insecure Website. When it comes to
user privacy, SSL is the elephant in the room."
The extension works for Windows and Macintosh computers, and support for Linux is coming, he added.
"Websites have a responsibility to protect the people who depend on
their services," Butler wrote. "They've been ignoring this
responsibility for too long, and it's time for everyone to demand a
more secure Web. My hope is that Firesheep will help the users win."