An alternative is to bind the user's session to their IP address, but that isn't fool proof either because of NAT, DHCP and certain big ISPs that tend to change IPs on the fly.

What cost-effective solution would you suggest?

Banks used to do some weird useragent + IP + cookie thing but that doesn't really matter either if you can send the requests out on the same IP. The UA can be spoofed just as easily.

Is there any other possible way for the attacker to steal my information other than this? I would like to know how to prevent this from happening, because everyday I always browse sensitive sites such as e-banking. Thank you.

As for whether you can sniff on someone via your wifi network, its not always possible. BUT don't assume that is enough. If someone can get access to the router (someone who set it up or anyone who can guess the password) it will be very easy to sniff your traffic.

Also if you are concerned at all about big brother they are probably already doing this.

Theres a cool tool which lets you see all this already called Cain and Abel:
http://www.oxid.it/cain.html
Using ARP poisioning you can actually man in the middle anyone on a LAN unless they use https or anti ARP poisoning tools.

The real security threat will probably come down to sniffing mobile phone 3G data. And I wonder whats possible in that realm.
If you can send it you can receive it, and I doubt its encrypted well enough to prevent reading, especially when the Police want the ability to pick messages out of the air ALA The Wire. :)

BTW I work for a web design brisbane company Kintek.

Wep *should* be vulnerable to this, if you have multiple clients on the same WEP network.

As I am not the network admin of this place, I am really worried about people going to steal my session. So I would like to know is there any way to secure my browsing sessions (as well as other data such as client messenger, etc).

As far as protecting yourself, this is what we're trying to make clear, it's very hard to do so, it's a problem the site operator has to address. Check out our slides from ToorCon 12 for more info: http://codebutler.github.com/firesheep/tc12/

Facebook, Google, etc sure have no problem spending $300 on a SSL certificate, but for smaller websites, this might be the biggest upfront cost.

Summary quote: "In order to [enable HTTPS for all Gmail users] we had to deploy no additional machines and no special hardware. On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead. Many people believe that SSL takes a lot of CPU time and we hope the above numbers (public for the first time) will help to dispel that."

But on an insecured Wi-Fi network, I cannot steal any sessions from the other machine. My attacker is a Win 7 machine, the target is Win XP. And I get nothing when I log in on the Win XP box. I even used Cain to do ARP poisoning, but still got nothing from the XP box.

I tried using BackTrack 4, but got the message saying "Firesheep" is not compatible with Firefox build type Linux_x86-gcc3.

Perhaps it depends on the Wi-Fi card. My attacker is an Eee netbook 1005HA.

My security newbie question is this: is it sufficient for us to redirect JUST LOGINS to https (i.e. leave the rest of the site as just http?) or does everything during an entire website visit need to go over SSL for logged-in users, in order for them to be safe from this?

Thanks for any insight!

"all of our users use HTTPS to secure their email between their browsers and Google, all the time. In order to do this we had to deploy no additional machines and no special hardware. On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead. Many people believe that SSL takes a lot of CPU time and we hope the above numbers (public for the first time) will help to dispel that."

For those of you who think your banking websites are properly secured by SSL, a lot of them aren't properly secured. The login form must be displayed on an HTTPS page to prevent SSL stripping attacks. hsbc.co.uk is an example of a website that doesn't do this.

https://twitter.com/mickeyc

Rather than

http://twitter.com/mickeyc

Wouldn't you ;)

Then those cheapskate idiots can have their users details compromised, their reputations destroyed, and disappear from the face of the web. I’d love to know where people get the idea that they have a God-given right to start an internet business for free.

If you’re building something that asks people for their details, you need to stop whining, open your f—ing wallet, and get serious.

You need 2 things to use the SSL cert: 1. An SSL certificate (they cost lest than < $20 now people!), 2. A static IP website.

Both are easy to do, even if they add a little bit to the cost of web hosting. If you run ANY type of consumer oriented website, you *need* to have SSL login.

Also, fast response by Google (encrypted.google.com)!

You shouldn't have to be raking in a million dollars a year just to run a god damn non-static website.

spacepink: encrypted.google.com has been around for a while. It is not a response to the release of this particular application.

There's also https://www.cacert.org/ but they don't have their root cert in any major browsers atm.

Once DNSSEC becomes common, I expect it to become possible to generate a self signed cert and then plonk a fingerprint in the DNS bypassing CAs. That's several years down the line though.

Also I have a small favour to ask for:
Please make a Firefox 4 compatible version.

2/ The sniffing also works on cabled networks and depending on your ISP also on the same subnet you're on.

2/ The sniffing also works on cabled networks and depending on your ISP also on the same subnet you're on.

Ric

> The sniffing also works on cabled networks...

Not true. Haven't you heard of monitor mode?

Is the answer to this problem not just good application design?

Cookie spoofing is possible, so start designing you application assuming it definitely will.

Non sensitive actions could be executed without SSL but others go over a secured connection which would require a small authentication check.

I know this is not best from a usability point of view but this should be a good tradeof between usability, security and hardware overhead.

@ajx352 in my experience, XSRF tokens are generally tied to specific forms, not to whole web pages. as this is a privacy issue as well, that just isn't sufficient.

also, i don't agree with all the people who are saying that this is a good extension. it's one thing to publicize the problem. it's a major problem, and that's great. but to give the average user a one-click ability to taken advantage of it, is irresponsible and unrealistic.
even if every major hosting company decided today that all sites they host distributing login cookies must use https, that would take months to implement. in the meantime, you've given average joe user access to other peoples' accounts. good job.

http://missnglnk.com/seatac-free-wifi.png

Thanks for creating the plugin and bringing attention to this issue.

p.s. im on my laptop running windows 7 HP

please help

paul

Am I missing something?
Great idea though.

When you sniff packets, that's all you will see unless you do additional ARP poisoning or some kind of a man in the middle attack. Those who know how to do it also know that it's not an easy task and won't need this extension to do the rest and those who need to use this extension, most likely wouldn't know how to do a man in the middle attack if their lives depended on it.

This tool may have created some awareness albeit some false awarness to go with it, but nothing significant can be done with it.

You must enable the sidebar in View/Sidebar/Firesheep

What? You're confusing individual components. When a device is a router, with a built in switch and wireless access point, that doesn't give the access point any magic switch features. RF is shared medium, so someone can always listen; the question is if they can decode the data or not. Because wireless cards are prolific, there is easy access to the protocols using monitor or promiscuous modes of the cards. If you're not seeing other traffic, you're doing it wrong. How, is an exercise for the reader.

If there are problems with my solution, let me know. (Note that it won't stop people hijacking sessions, but it will stop them stealing your credentials.)

Am I wrong at either conclusion? (I hope I am)

Can someone tell me if he managed to work this out with Dell 1397 wifi card? Or if they know of a way to turn monitor mode on in windows7?

I sent an email to Eric this morning about a related problem that is equally dangerous but I expect he was inundated today by many people.

Nicely done sir, thanks for putting it up on GitHub.

If you want to raise awareness, find an important person, steal their IDs and make it very public. A million nobodies will not have nearly the same effect.

Once you connect to the network, all the router / switch rules apply and you won't be able to capture anything but your own communication. The only way to do that is to do a man in the middle attack which is outside the capabilities of this Firefox extension and beyond the capabilities of the majority of the people who are reading this. Even if they can do it, it won't be because of this extension.

Just read all the comments that have been posted here and show me one person who's been able to capture anything but their own cookies from the same computer they have the extension installed on.

And here's a challenge to you and everyone else. Please prove me wrong by doing it and showing us the results using Firesheep alone. Just go find a Starbucks and knock yourselves out.

Can I run pcap under the XP environment with a right click->properties->compatible mode feature? you think that will help?

I think it's safe to say this is a bluff.

"Just because you're not paranoid, doesn't mean they're not after you".

matt@matt-laptop:~/Downloads/firesheep$ ./configure --with-xulrunner-sdk=/home/matt/Downloads/xulrunner-sdk
checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /bin/mkdir -p
checking for gawk... no
checking for mawk... mawk
checking whether make sets $(MAKE)... yes
checking for g++... g++
checking whether the C++ compiler works... yes
checking for C++ compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C++ compiler... yes
checking whether g++ accepts -g... yes
checking for style of include used by make... GNU
checking dependency style of g++... none
checking build system type... x86_64-unknown-linux-gnu
checking host system type... x86_64-unknown-linux-gnu
checking for xpidl... /home/matt/Downloads/xulrunner-sdk/bin/xpidl
configure: creating ./config.status
config.status: creating Makefile
config.status: creating backend/Makefile
config.status: creating mozpopen/Makefile
config.status: executing depfiles commands

matt@matt-laptop:~/Downloads/firesheep$ make
Making all in mozpopen
make[1]: Entering directory `/home/matt/Downloads/firesheep/mozpopen'
make[1]: Nothing to be done for `all'.
make[1]: Leaving directory `/home/matt/Downloads/firesheep/mozpopen'
Making all in backend
make[1]: Entering directory `/home/matt/Downloads/firesheep/backend'
make[1]: *** No rule to make target `deps/http-parser/http_parser.c', needed by `/firesheep-backend'. Stop.
make[1]: Leaving directory `/home/matt/Downloads/firesheep/backend'
make: *** [all-recursive] Error 1

http://www.faqs.org/rfcs/rfc1078.html

With the right OS (not vista or 7) & correct wireless card you can do all sorts of things while connected to a wireless network.

Wireless is a broadcast medium by it's very nature.

Additionally when connected to a wired network do not assume that you are in a switched environment a of home & soho kit are really hubs.

Even on a switched network you quite often don't have to resort to arp poisoning due to the way most companies set up clustered firewalls

I suggest you quit the forums and get out into the real world.

The only way is to get the user to install your own CA root certificate. Unfortunately, there's no way to detect via Javascript or any other browser-based method whether a particular CA certificate is installed on the local machine, so you can't automatically switch over to HTTPS if the browser would trust it (I'm not advocating an API for easy installation of CA certificates, because that would null and void the point of trusting them; rather, just a simple API for detecting whether they are installed).

Granted, it's not the most user-friendly approach in the world, but anyone reading this post probably has the tech savvy for it.

attacker: win7 32-bit netbook
victim: win xp 32-bit laptop

I can capture on my own win7 netbook while in firefox, when I login to facebook, google, twitter in chrome, but can't see my xp laptop.

Based on at least 5 earlier clients it seems very clear that with win7 as the attacker(32 or 64bit) firesheep cannot capture.

Dumb question though, does firesheep need to see the https login packets? I'm guessing no, that any non-secure packet with a cookie for one of the sites is fine.

I looked through as many comments on here as I could, but it doesn't seem like threaded comments are enabled, so I got lost and decided to put up a fresh one.

Win XP, Firefox 3.6.11

It initially collects data and works fine, but then it stops capturing. When I press "Stop capturing", it displays the message.

You have to set your cookies to be "secure" and only transmit over https. If you use a session and it's for non-ssl traffic also, then you can't do that so you'll need to use a secondary secure cookie with a token in it. I chose to md5 the user agent string along with a salt, which I figure adds the extra security that if anyone does steal the cookie somehow then they'd have to be using the exact same os and browser for it to work. And since the token is obfuscated along with a secret salt, it can't be hacked.

Somebody tell me if that's flawed, I'm eager to hear ;)

I am on a small corporate wireless network and I can easily log into my colleagues Facebook accounts etc etc. Wow, this really is an issue!

What if someone else got hold of this blog post in the company and could access my accounts ? What is the solution here from protecting my network from internal users using this on each other ?

Also, I'm no hardcore developer but when I used to create a few PHP apps I always stored the session ID, credentials etc in the DB and not use cookies at all. Am I talking crap or is using cookies a terrible idea in the first place and application developers should be using server-side authentication for their apps.

Trying to use it at my job and failing. It doesn't even scan my own pc traffic. I hope its due to network configurations & at home/at-the-street I'll have more luck.

What I really would like is to take this extension to my Nexus1 :)

And how do you propose an open wireless network transmits a signal to only one interface? Magic? Radio does not work that way. Without encryption, it's all or nothing. You cannot just send something to one client.

The thing is, you need to run another program to do a "man-in-the-middle-attack". This allows running the data packages of the victim over your wi-fi-connection to the hotspot. This is only possible, if your distance is nearer to the victim than the hotspot and your overall signal qualitiy is higher than the one the victim gets from the hotspot.

With that in mind, it works like a charm...

Ignoring duplicate header: connection, old: keep-alive, New: close

how can i prevent this i aint getting any results except for facebook but only on my own computer i dont get any result for anyone else in the lan network

PLEASE HELP ME! ty

The program is called: "Cain & Abel"
found here: http://www.oxid.it/cain.html

With its help (read the helpfile, very useful to set up the bypass with wi-fi), you can re-route and do a "man-in-the-middle-attack".

Now using proXPN - the VPN-software. Works well! This is the only solution to get rid of vulnerabilities like the cookie hashing or man-in-the-middle attacks.

Use a VPN (Virtual Private Network), and your data IS SAFE in EVERY network. Even if it is an unsecured open wi-fi hotspot!

Thumbs up!

There are two options:
1. Your network device is not able to run in "promiscuous" mode, no chance to get the packages (and cookies) without an extra-program
2. You definitely need to re-route the data packages of the victim. This is only possible with another program: So if you are sure, what you are doing, this is it:

The program is called: "Cain & Abel"
found here: http://www.oxid.it/cain.html
(Windows only) - use the in-built help, very useful

Works here very well with firesheep and FF3.6.11 on Win7-64bit and an Intel 4965AG network-device.

I will give no more hints than that. If you are not able to get firesheep running: Let go!

The method: man-in-the-middle and firesheep works damn good!

Needed only 1 minute, to have access to nearly 10 facebook accounts in our company network...

This problem is getting bigger and bigger...

Hopefully for you, that you are using a vpn-connection!

Now getting back, need to read through some account-mails.^^

It's an extension to TCP that adds encryption to all TCP connections, transparently to userspace software, when it detects that the other endpoint also run TCPCrypt.

Authentication can be done by the userspace software by asking for the "connection ID", a hash of the (freshly generated) public keys and algorithms in use for this particular connection. This is the same for both parties, and can thus be cryptographically signed as authentication method.

Seriously cool Eric.

Couldn't get netmask for device en1: en1: no ipv4 address assigned.

I'm running Mac 10.5.8 / FF 3.6.11.

Ideas?

Thanks!

Have the same problem. Any ideas?

I'm not the only one. Try Googling it.

Hope you are able to fix it some time! :)

sudo ~/Library/Application\ Support/Firefox/Profiles/*/extensions/firesheep\@codebutler.com/platform/Darwin_x86-gcc3/firesheep-backend --fix-permissions

[that should all be on one line, no matter how it appears on this webpage]

3) It will ask you for your password, type it in.
4) Restart firefox and the error should go away. If you still get the "--fix-permissions" error, you probably have FireVault installed and need to do the following:

If you have FileVault enabled, it will mount your home directory as "nosuid", so the packet-capturing backend won't be able to run until you Copy-and-Paste these additional commands into the Terminal to move the firesheep-backend to a place it can run SUID root:

sudo mv ~/Library/Application\ Support/Firefox/Profiles/*/extensions/firesheep\@codebutler.com/platform/Darwin_x86-gcc3/firesheep-backend /usr/bin/firesheep-backend

sudo ln -s /usr/bin/firesheep-backend ~/Library/Application\ Support/Firefox/Profiles/*/extensions/firesheep\@codebutler.com/platform/Darwin_x86-gcc3/firesheep-backend

[again, each command should all be on one line, no matter how it appears on this webpage]

ian.charnas@gmail.com

One problem of this apr-method is: In big companies, when alot of machines run over your machine-networking-device, the whole network can drop down. Everyone has a delay and mainly no response. Very clear, that something is not right, especially the admin-tools who analyze the data-packets will alert and find the mac-address (APR-method for wi-fi works only with the real mac-address, no shadowing possible...).

I have tested it in our company environment today (nearly 300 pcs connected over lan and wi-fi in that building), letting apr-method running for no longer than 30 sec., everyone noticed the lag and the whole lan went down a second.

Non the less, i got about 10 facebook-accounts in this short period of time, lets me analyze the ips and connect them to the facebook profiles...

These dangerous tools should not leave in wrong hands. Very dangerous, especially, if you don't know, what you do (like you said in your video, Brandon).

In my case, we discussed this situation with our admin and we will do countermeasures in the near future to prevent this vulnerability. In the meantime, we will block especially facebook and let the https-everywhere addon for firework go to work.

I think, this can become a big problem. Bigger problems in big companies or universities.

We should prevent how-to-do-videos! Don't make it that easy!

@tobytoby292
The program is not a virus, it has a mechanism (possibilities of tools), that are shown as dangerous by anti-virus tools. For sure, this program is mighty and can knock down software-barriers, having a direct input on the hardware (lan, wi-fi-card). A lot of possibilities. I will not give any hints, on how to do this, because it is illegal and can get you in real troubles when using in open environment.

Let's hope, the login-sites are all changed to https as soon as possible.

It is by no means free to implement, of course, but it's cheaper overall (esp. if you have some memcached lying around).

Maybe this tool is interesting for the taskmaster to overwatch the employees are working! hehe

What other program did you use for wep-cracking? Aircrack and cain&abel?
This would be another point, i would test out in open environment...

You said, you switched to linux. What linux distribution are you using?
I tested ubuntu, but it seems, it is (too) familiar with windows gui. So no need to switch over for me (until now). When you say, in linux are more powerful tools to use, i could give it a try...

@andeers0204
USE YOUR EYES and read the posts.
EPIC FAIL

Screenshot is http://img7.imageshack.us/img7/7559/fscrop.jpg

Doesn't matter for how long I leave it to capture.. FF is 3.6.11

What am I missing here?

Isn't it the same as to say "passwords are bad for the environment because people type them over and over and we end up manufacturing more keyboards"? This is how web security works so far. Nothing is free for the environment.

Help?
WinVista Firefox 3.6.10 Sony Vaio
Thank you!

Also, check out this awesome logo someone made for Firesheep :D
http://wompworld.com/2010/10/27/end-the-firesheep-aggro/

cheers

Just an FYI, it does not appear that the Twitter for iPad/iPhone apps are vulnerable, presumably because they are using other backchannels for communication.

I'm assuming it won't run on Macs using the PPC architecture...

tobyboy,

Firesheep doesn't add a button, sidebar or menu by default (at least, on my machine it doesn't) You have to go to the right-click "customize" menu and manually add in the button.

Also, the button for firesheep is broken. I checked the xpi and there is supposed to be a PNG image, but something is wrong in the extension and firesheep ends up trying to use ALL the default icons (back, forward, stop, etc.) in one GIANT button instead of it's built-in png button icon. In order to use it I have to switch all buttons to text-only so that I just get a button that says "Firesheep" on it. THEN I can access the sidebar.

Perhaps your machine is different, but don't lambast andeers0204 for a problem that clearly resides in the extension.

Yep. A VPN or other point to point encryption makes you secure against firesheep and other tools like it (ARP poison/hijack).

All websites should just switch to SSL exclusively. SSL does NOT REQUIRE ADDITIONAL HARDWARE. The additional server CPU load is very minimal. The CPU usage was an issue in 1990's, but today our severs are more than capable to handle this.

SSL Strip can be used against sites that use an initial non SSL login page that switch to SSL during authentication. If only SSL pages are used universally these "exploits" will not be an issue.

The REAL mistake is believing that you're secure when the connection you have DOES NOT SAY "HTTPS".

IMO, if at any time the connection to a site is over "HTTP://" then I assume everything I see and submit is not secured.

Unlike unencrypted or WEP, WPA gives each client their own unique encryption key.

For instance: "Tim's Coffee Shop" could have a sign on the door: "WIFI Password: FreshRoasted", and Firesheep would be defeated.

None of the WIFI users of Tim's Coffee Shop's network will be able to snoop on eachother's data. The network's WPA key doesn't have to be secret, it just has to be USED.

Firesheep is less of an "Exploit" and more of a "Wake Up!" call.

The Lesson: "If your data is not encrypted: IT CAN NOT BE SECURE."

what about unsecured wired connections with a shared switch, hub, or router?

Considering that the latest version of Firefox is 3.6.12, I think your demands are a little out of line. Keep your free software up-to-date and maybe you won't have problems. I was taken back a little by the tone of your post. Shameful.

You are correct about sniffing WIFI hanshakes still being a problem when UNENCRYPTED communications are used.

I am correct as to my statement that "Firesheep will be defeated" since it does not perform the attack you mention.

In fact: Firesheep does not work on WPA networks...

Also note my original reply. Hanshake sniffing is useless against VPNs and connections that use SSL exclusively (end to end encryption).

Note also: Unencrypted HTTP is not secure!! Even over WPA! Https IS SECURE even over unencrypted mediums (like WIFI).

Wired Ethernet networks are equivalent to unencrypted wifi when it comes to connected devices. If you run an APR spoofing attack on a poorly configured ethernet network you may compromise the entire network, this is why Firesheep works on your standard single router ethernet network.

Private Ethernet networks can coexist with Public hotspots and still be secured via double routing (Y routing).

|
A --- C
|
B

A B & C are routers / switches. A connects to the Internet gateway. B provides access for your private systems. C is a publicly accessible. Clients on B are not susceptible to ARP spoofing attacks executed via C.

Public WIFI hosts note: If you do not have a Y setup or dedicated & isolated connection for public use, you risk compromising your private network.

Note: HUBS are not SWITCHES. HUBS simply rebroadcast the electronic signal to all connected devices, they do not switch. Treat a hub like a manual wire splice (You can splice ethernet wires into a T or X or Octopus, and it will work like exactly like an unpowered Hub). If you and I are connected to a hub, we might as well be directly connected to eachother (in which case Firesheep works beautifully)!

In short: Wifi access providers should use WPA/WPA2 if they care about their users' security. Users should demand SSL for all website connections period. Anything less is retarded (literally -- it slows progress), and should be avoided like the plague.

Advocates of unsecured connections consider this: Colon Cancer.

You might think that my wikipedia search about Colon Cancer doesn't need to be encrypted. However, I don't really want my insurance company to know I'm researching health defects online, and raising my rates!

My Solution: If it's data, Encrypt It! There is no reason not to!

Of course, point-to-point encryption is a good thing for personal data, but a) not every site offers HTTPS and b) SSL does not provide a very high level of security. There are many certification authorities that can forge any SSL certificate without your browser popping up any warnings, among those Godaddy, the German Telekom and even chinese companies.

Very good last post! Makes it clear, how network-architectures work!
Thanks for sharing these good points (Switch & Hub difference)!

Well, if you have read VortexCortex (and my last posts), you should have found out, that using firesheep alone is not the point.

I live also in Germany, you are absolutely right that almost every hotspot here has wpa or better encryption.
It does not matter, if you are using wep, wpa, wpa2 or even no encryption!
In combination with an APR-method (man-in-the-middle), everyone who is in the same network as the attacker, you can get spoofed.

So it is NOT safe, if you are in an wpa/wpa2 environment. As we said a thousand times before, the only REAL high-security mode to surf is via VPN.

I want to state out, that it is not safe to only use https-logins. I have checked out in our company network. The user logged into facebook via https. No cookie for me. But when this person switched to facebook-games or modules in facebook, that were not https-secure, i got the cookie! Then, the party could get started!

I think, this security problem will grow in the near future. Beware to protect yourself!

As a result, like VortexCortex said before:

"My Solution: If it's data, Encrypt It! There is no reason not to!"

And don't forget most wired networks are indeed switched and there is software to thwart ARP spoofing attacks, i.e. ARP inspection.

In real life scenarios you are pretty safe using WPA2. No hacker can be bothered to bruteforce WPA keys, he would instead set up an unencrypted access point himself and wait for ignorant users to connect.

> So it is NOT safe, if you are in an wpa/wpa2 environment.

Show me a single successful attack on a WPA2 connection with decent key length. There is none.

And VPN: Yeah that's all nice, but where does your VPN tunnel end? I do not believe in the facebook server farm, so how secure is your data inbetween?

In general, if you share a local network with an attacker, they can see everything you send over the network. There are very few exceptions to this rule.

The only tenable solution is a wholesale switch to encrypted transport.

In the eyes of the law, Butler's rationale is misplaced, said Joe DeMarco, a former Assistant U.S. Attorney and now a partner with the New York City-based law firm DeVore & DeMarco LLP. "Motive, as distinct from intent, generally is not an element of federal crimes, including federal computer crimes," said DeMarco.

"You can't rob a bank, give [the money] to the starving, and then claim you are not guilty of robbery," he said. "By the same token, you can't help others commit cybercrimes and escape liability. If you make software which enables unauthorized access to other people's accounts with the intention of facilitating that crime, you may very well be liable for violating the Computer Fraud and Abuse Act under established principles of aiding and abetting and conspiratorial liability."

http://www.computerworld.com/s/article/9194463/Firesheep_not_evil_says_snoopi...

...is flawed. It is analogous to saying that Firearms manufacturers (e.g. Colt, Remington, Winchester, etc.) are accessories because they make guns and someone committed a murder, or that General Dynamics, Boeing or any other weapons system manufacturer are accessories to war crimes.

This is a simple case of the Establishment trolling for a soundbyte because they are scared and embarrassed that small fish upset their apple cart.

I wonder if you could sue the individual for defamation of character since he implied that you folks were guilty of criminal activity?

http://groups.google.com/group/firesheep

What does this code do?

: Cookie:
: __utma=xxxxxxxxx.yyyyyyyyyy.zzzzzzzzzz.aaaaaaaaaa.bbbbbbbbbb.c;
: __utmb=xxxxxxxxx.y.zz.aaaaaaaaaa; __utmc=bbbbbbbbbb;
: __utmz=xxxxxxxxx.yyyyyyyyyy.z.a.utmcsr=google|utmccn=(organic)|
: utmcmd=organic|utmctr=Firesheep; PHPSESSID=0ezzzzzzz

It's all on the one and same line. It's copy-pasted here from a Usenet posting.

I'm trying to make a script so as to capture the session when I login to http://www.version2.dk. A Danish site. However, modifying the default script in Firesheep fails to produce a link in the Sidebar (Firefox 3.6.12, Mac OS X 10.5.8).

I captured this cookie-setting packet with Ethereal.

The packet seems to be using something from Google and Firesheep appears in the code.

Any ideas?

Cheers.

ok. i have a
mac ox 10.6.4 i downloaded the newest version of firefox and firesheep, and when i am using it, i can only see the stuff that i am doing in safari.

help us please.

thx

"Trend Micro has flagged this hacking tool as noteworthy due to the increased potential for damage, information theft, or both, that it possesses. Specifically, it is a form of a proof-of-concept hack with sidejacking capabilities, which can potentially be used for malicious purposes.

To get a one-glance comprehensive view of the behavior of this Hacking Tool, refer to the Threat Diagram shown below."

=> waiting for a version usable on disk-less Linux ;-)

BTW @codebutler Erik you rule, thanks for having the time to create a little curiosity to everyone interested on internet security. But come on if everyone had been protected what would happen with our jobs lol.

I agree with you that Eric Butler, while showing off his considerable skill and knowlege by publishing this extension, behaved recklessly and irresponsibly. IMHO, this is tatamount to dumping a truckload of loaded, automatic pistols in the town square and then waiting for the inevitable body count in order further to prove the point that guns are dangerous.

In a perfect world, only sane, responsible, law abiding people would have access to guns... or to the Internet. We have a ways to go before we get there. In the meanwhile, people like Mr. Butler should find more caring and appropriate ways to garner fame, fortune and, taking him at his word, to protest their "concerns".

Not being as skilled as many of the posters here, I am relieved to have found this on Wikipedia:
http://en.wikipedia.org/wiki/Firesheep . Now, I have some means of protecting myself from the carnage Mr. Butler's extension will probably loose.

Publishing this tool online is only going to make thing worst.

you may want to update your blog is this is no more true.

for those who are looking for the linux part, try here
http://randommusingsofarealgeek.blogspot.com/2010/11/firesheep-on-linux.html

Cheers

SSL will fails on LAN networks. Don't forget about sslstrip which is used together with ARP poisoning.

Firesheep is a great tool, but I was surprised it doesn't work when the wifi adapter is in monitor mode.

To be clear, I don't agree or disagree...I am just pointing out the similarities in the justification used for releasing a tool like Firesheep in an effort to "fix" something that someone believes is wrong with society.

Striking resemblence...

BTW, I work for a Brisbane Web Development company called BlueBay Solutions.

Buy Guaranteed Signups

Unlimited Web Hosting

Cheers!

"Firefox could not install the file at

file:///C:/Users/user/Desktop/Downloads/firesheep-0.1-1.xpi

because: Unexpected installation error
Review the Error Console log for more details.
-203"

PLEASE HELP ME!!!!!

Are there any plans to develop this further?

PC Repair Tips and Tricks