View RSS Feed

Enter The Hedgehog

FireSheep Shows How Vulnerable Facebook and Other Sites Really Are

Rate this Entry
by , 10-30-2010 at 02:34 PM (6362 Views)
A few days ago, A friend of mine showed me a FireFox Add-on called FireSheep, we began testing it out. We were both connected to the same WiFi Network, interestingly, using it, we both were able to login as the other onto any website. For example, I could have logged in as him on Facebook (Screenshot here). I then installed NoScript on FireFox and made it force sites like FaceBook and Twitter to use HTTPS instead of HTTP. After that, he couldn't login as me. This points out how insecure all websites really are and it's exactly the reason FireSheep was created. FireSheep doesn't bring reveals anything new. This type of hacking has always existed for a long time. This is what the site of firesheep says;

When logging into a website you usually start by submitting your username and password. The server then checks to see if an account matching this information exists and if so, replies back to you with a "cookie" which is used by your browser for all subsequent requests.
It's extremely common for websites to protect your password by encrypting the initial login, but surprisingly uncommon for websites to encrypt everything else. This leaves the cookie (and the user) vulnerable. HTTP session hijacking (sometimes called "sidejacking") is when an attacker gets a hold of a user's cookie, allowing them to do anything the user can do on a particular website. On an open wireless network, cookies are basically shouted through the air, making these attacks extremely easy.

This is a widely known problem that has been talked about to death, yet very popular websites continue to fail at protecting their users. The only effective fix for this problem is full end-to-end encryption, known on the web as HTTPS or SSL. Facebook is constantly rolling out new "privacy" features in an endless attempt to quell the screams of unhappy users, but what's the point when someone can just take over an account entirely? Twitter forced all third party developers to use OAuth then immediately released (and promoted) a new version of their insecure website. When it comes to user privacy, SSL is the elephant in the room.

Today at Toorcon 12 I announced the release of Firesheep, a Firefox extension designed to demonstrate just how serious this problem is.

After installing the extension you'll see a new sidebar. Connect to any busy open wifi network and click the big "Start Capturing" button. Then wait.
There you have it. If you want to mess around with FireSheep, here's the website, however please don't start going onto people's wifi and logging onto sites as them ;p

Also, if you're interested on making yourself immune to FireSheep, download and install NoScript (FireFox only), which can be found <a href="">here (Click)</a>, then once installed, go into NoScript Preferences (Tools -> Add-Ons -> NoScript -> Preferences). Then go to the Advanced Tab and click HTTPS.

Under 'Force the following sites to use secure (HTTPS) connections' add in the sites you want to make 'immune to firesheep'. Note, if the site you add doesn't support HTTPS and you add it to the list, the site will no longer work. For example, if I were to add to the list, it doesn't have HTTPS so it wouldn't work.

Here's a start-off list of sites that work;

Taken from my Blog @

Submit "FireSheep Shows How Vulnerable Facebook and Other Sites Really Are" to Digg Submit "FireSheep Shows How Vulnerable Facebook and Other Sites Really Are" to Submit "FireSheep Shows How Vulnerable Facebook and Other Sites Really Are" to StumbleUpon Submit "FireSheep Shows How Vulnerable Facebook and Other Sites Really Are" to Google

Updated 02-23-2011 at 05:59 AM by ShadowSonic2



  1. davepm's Avatar
    • |
    • permalink
    FireShepherd is a pretty good windows console app to block it.

    The best thing that anyone running an open WIFI access point could do would be to switch on WPA/WPA2 PSK on the router, then give everyone the password, all traffic would be encrypted then and firesheep wouldnt work.

    What a lot of people didn't realise was that firesheep is nothing new, capturing cookies on open networks is a standard attack for anyone who knows what they are doing, but the fact that it can now be done by anyone, with a simple FF extension is whats new!

    Whatever anyone things about this being right or wrong, it does serve the purpose now of (hopefully) forcing the major sites to moe over to proper HTTPS login's.

  2. Bliepo's Avatar
    • |
    • permalink
    In my opinion, web developpers should be giving security a far higher priority than they do. In fact, it should be priority number 1. I have seen this so often and it really annoys me. One time, I managed to get into the database of the developper of the website of my school using a simple SQL injection (I notified them of this and didn't do anything evil, don't worry ).

    Anyway, I myself am a use fan of noscript. It is really a must have for anyone who wants to be secure on the internet.