Firesheep by Eric Butler has just been released to the world. This Firefox plugin does a few things that have already been fairly easy to do for a while, but rolled up in one easy to use package:
Sniffs data on unencrypted Wireless Networks
Looks for unencrypted login cookies sent to known popular insecure sites
Allows you to login to that account with ‘One Click’
So what sites are impacted by default? Amazon.com, Basecamp, bit.ly, Cisco, CNET, Dropbox, Enom, Evernote, Facebook, Flickr, Github, Google, HackerNews, Harvest, Windows Live, NY Times, Pivotal Tracker, Slicehost, tumblr, Twitter, WordPress, Yahoo, and Yelp are among the few. A plugin system allows anyone to add their own sites (and cookie styles) to the plugin.
Yikes! It goes without saying that this is a major security problem for anyone who uses unencrypted wireless networks. Includes on this list are many universities and companies such as Starbucks.
Browsing Tag
Security
10 posts
Google Adds Two-Factor Authentication To Google Apps (For Real, This Time)
I’m not trying to say I had anything to do with Google…
Essential FourSquare Anti-Stalking Security Tips
Currently I am in the Computer Science Master’s Program at West Chester University and I am focusing my research on Location Based Updates in Social Media and their societal and security implications. So you can say I think about this topic more than most normal people do.
FourSquare is a growing service that allows you to “Check in” to restaurants, grocery stores, museums and just about any place you can imagine. However, I have seen several of my friends checking in to locations which, I must say as a security research student, set off warning bells. Although I am calling out FourSquare specifically, these also apply to just about any other location based software where you broadcast your location to other folks, whether they are your friends or the general public. GoWalla and BrightKite are in the same boat.
Without further ado… here is my list of top FourSquare Security Faux Pas (after the break…)
Social Media and the Downfall of the Password Reset Question
There have been a number of high profile account compromises due to…
Command Line Packet Sniff Existing Running Process in Linux
Have you ever come across a server that is doing a lot…
Presentation on Hybrid Stealthy Networks – Wireless Ad Hoc Networks
I presented this paper to my class on March 17th, 2009. Hybrid…
Remote Desktop from Windows XP to Windows Server 2008 or Windows Vista
The Remote Desktop connection settings for Windows Server 2008, and I believe…