Firesheep (Wireless Security)

Dulloldfart

Squirrel Extraordinaire
Interesting article if you happen to use unencrypted wireless networks, like at a local Starbucks.

Excerpted from http://www.katu.com/news/local/110646519.html

SEATTLE -- On a recent afternoon, I surprised a lot of people at a coffee shop in Seattle's Capitol Hill neighborhood. I walked in, sat down, got onto the café's free Wi-Fi network and fired up a free application called Firesheep.

Within a minute, the names of a dozen people on the same wireless network started to appear in the Firesheep program. The users were listed along with the names of multi-billion dollar websites like Facebook, Twitter, Amazon, YouTube and The New York Times.

In some cases, the person's Facebook profile picture would also appear, making it easy for me to identify them in the café.

With a simple click on the user's icon in Firesheep, I could log into their account on Facebook or Twitter or a variety of other websites that do not use encryption to fully protect the browsing session with their users. I could easily assume someone else's online identity and do nearly anything I wanted with their account.​
Paul
 

Dulloldfart

Squirrel Extraordinaire
Warning. It is also illegal to do that.

I was thinking more in terms of protecting oneself from others than in going on the offensive. According to the article just looking (while in a coffee shop) probably isn't illegal, but as soon as you actually post something from another's account you have definitely crossed the line.

If someone on ESMB is feeling paranoid about OSA, and keeps looking for vans parked outside their home, and their home wireless network is unencrypted, well. . . .

Paul
 

OTBT

Patron Meritorious
http://notendur.hi.is/~gas15/FireShepherd/

FireShepherd, a small console program that floods the nearby wireless network with packets designed to turn off FireSheep, effectively shutting down nearby FireSheep programs every 0.5 sec or so, making you and the people around you secure from most people using FireSheep.

The program kills the current version of FireSheep running nearby, but the user is still in danger of all other session hijacking mechanisms. Do not do anything over a untrusted network that you cannot share with everyone.

-Know that this is only a temporary solution to the FireSheep problem, created to give people the chance to secure themselves and the others around them from the current threat, while the security vulnerabilities revealed by FireSheep are being fixed.

Optional command line switches:
-i *IP* Ip Destination for packets, local router is recommended. (A trivial facebook server is default)
The local router can be found with the tracert command. (For example the first hit from "tracert www.google.com")
-t *timeout* Timeout in ms for packet sending. About 200 is ok for a local router. (400 is default)
-h Shows this message

Note that a dot represents a packet being sent.

Download FireShepherd.exe (Win32)
Download Source code
Download Licence.txt

Note that by downloading/using you accept the terms found in licence.txt

Gunnar Atli Sigurdsson, University of Iceland, 2010
e: gas15 at_hi.is
 

FinallyMe

Silver Meritorious Patron
JEEEEZ! Thanks Paul. I guess I have been VERY ignorant, or naive! Because of firewalls, there are MANY places I can't go on the Internet here at work, so I will occasionally take my iPod Touch downstairs to the Starbucks space and check my personal e-mails. I reasoned that it would take a talented hacker to invade my connection, and I wasn't on the 'Net for that long. I had no idea it would be that easy! I will hereafter wait until I get home to check my e-mails. YIKES!
 

Dulloldfart

Squirrel Extraordinaire
JEEEEZ! Thanks Paul. I guess I have been VERY ignorant, or naive! Because of firewalls, there are MANY places I can't go on the Internet here at work, so I will occasionally take my iPod Touch downstairs to the Starbucks space and check my personal e-mails. I reasoned that it would take a talented hacker to invade my connection, and I wasn't on the 'Net for that long. I had no idea it would be that easy! I will hereafter wait until I get home to check my e-mails. YIKES!

Take a look at the article. It is not *everything* that is available. Still, if in doubt, better safe than sorry.

Paul
 

MrNobody

Who needs merits?
Two things:

1. Using a technology that isn't fully understood (by it's user), is risky.

2. Using a technology that can't be fully controlled by it's user. is also risky.

That's why I prefer cable-based networking. There are enough risks involved with that, but this one risk, that can be exploited by every idiot-and-his-dog, even from miles away, without the legal user even having a chance to realize it, is effectively removed.
 

Dulloldfart

Squirrel Extraordinaire
Two things:

1. Using a technology that isn't fully understood (by it's user), is risky.

2. Using a technology that can't be fully controlled by it's user. is also risky.

That's why I prefer cable-based networking. There are enough risks involved with that, but this one risk, that can be exploited by every idiot-and-his-dog, even from miles away, without the legal user even having a chance to realize it, is effectively removed.

Yes. TEMPEST is interesting stuff, but not really available to every Tom, Dick and Harry.

Paul
 
I'm already scared of technology...but I really should learn all about all this stuff, for self-protection.

Thanks Paul and OTBT, Mr. Nobody and all you other posters as well.

Can't people do the same thing with a cell phone signal? :unsure:
 
Top