Slashdot Mirror

← Back to Stories (view on slashdot.org)

Firefox Extension Makes Social-Network ID Spoofing Trivial

Posted by timothy on from the plausible-deniability-for-farmville dept.

Orome1 writes "A simple-to-use Firefox plugin presented yesterday at Toorcon in San Diego has hit the security world with the realization that squabbles about Facebook's changing privacy settings and various privacy breaches simply miss the point. 'When it comes to user privacy, SSL is the elephant in the room,' said Eric Butler, the developer of the extension in question, dubbed Firesheep. By installing and running it, anyone can 'sniff out' the unencrypted HTTP sessions currently allowing users on that network segment to access social networks, online services and other website requiring a login, and simply hijack them and impersonate the user."

7 of 185 comments (clear)

  1. Re:and this is news ? by Anonymous Coward · · Score: 5, Insightful

    the fact that it's unencrypted is facebooks fault, it's not hard to push everything through HTTPS, there's no excuse these days

  2. Re:and this is news ? by Ephemeriis · · Score: 5, Insightful

    someone in the same network sniffing your unencrypted traffic is facebooks fault ?
    or the fact that someone made a UI to do it for dummies ?

    The fact that it is unencrypted is, yes.

    --
    "Work is the curse of the drinking classes." -Oscar Wilde
  3. Another point is not "missing the point" by Chriscypher · · Score: 5, Insightful

    squabbles about Facebook's changing privacy settings and various privacy breaches simply miss the point.

    Another point does not "miss the point".

    Transport security != corporate marketing of private data

    --
    "You have liberated me from thought."
  4. No HTTPS encryption by DrYak · · Score: 4, Insightful

    Kudos to FaceBook and most other networks for NOT using encryption for anything but the log in, making such hacks possible !
    I know that HTTPS would put some stress on the servers, specially with something as big as Facebook.
    But, come-on. Social networks have become so important for some people, that the risks of vandalism/identiy spoof/deffamation, etc. are significant and would benefit from some more protection.

    --
    "Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
  5. Cookie theft by Securityemo · · Score: 5, Insightful

    It's "just" WiFi cookie theft. You can do that easily with wireshark and copy/paste, this just makes it a bit faster. The problem lies in session cookies, and this is a problem known for what, almost a decade now?

    --
    Emotions! In your brain!
  6. Re:and this is news ? by PopeRatzo · · Score: 4, Insightful

    Their only income stream is selling private information.

    Good point.

    I'm surprised so many people are upset about people stealing their private information, but have no problem with someone buying and selling their private information.

    --
    You are welcome on my lawn.
  7. Re:Use md5 (or something) over the wire by gmurray · · Score: 5, Insightful

    furthermore the entire usefulness of md5 is that you can't un-md5 it ;-)