Firesheep Sniffs Out User Credentials at Wi-Fi Hotspots [Downloads]

Firefox: Firesheep sniffs out and steals cookies-and the account and identity of the owner inside the process-of popular websites from the browsing sessions of alternative users on the Wi-Fi hot spot you’re attached to.

Firesheep is an explanation-of-concept Firefox extension created by Eric Butler to point out how leaky the safety many popular sites (like Facebook, Flickr, Amazon.com, Dropbox, Evernote, and more) employ is. The difficulty, as Firesheep shockingly demonstrates, is that many websites only encrypt your login. If you are logged in they use an unsecured connect to an easy cookie check. Anyone from your IP address (that of the Wi-Fi hotspot) with that cookie will be you. When using Firesheep on a public hot spot any session it may well intercept is displayed within the Firesheep pane with the user’s name and photograph (when available). Simply click on their name to intercept the session and start browsing the website as though you might be them.

What can you do to offer protection to yourself against the sort of painfully easy attack against your privacy and security? That you can established an SSH SOCKS proxy to encrypt your traffic , effectively sending your site sessions and accompanying cookies through a sniff-proof tunnel.

Firesheep is free, works wherever Firefox does, and requires a wireless card capable of operating in promiscuous mode.

Source

This post is tagged: eric butler, hot spot, ip address, photograph, sessions