11.5 Firesheep and HTTPS Anywhere
Module 11: Session Hijacking, 11.5-Firesheep and HTTPS Anywhere
Firesheep is Firefox extension that uses a packet sniffer to intercept unencrypted session cookies from websites:
– The plugin eavesdrops on Wi-Fi communications, listening for session cookies. Detects a session cookie and capture session id.
– The collected identities are displayed in a side bar in Firefox and by clicking on a victim's name, the victim's session is taken over by the attacker.
Firesheep extension for Firefox was released October 2010 to demonstrate the security risk of session hijacking vulnerabilities.
Websites mostly encrypt the login process and not the cookies.
Firesheep can capture cookie and login details.
Mozilla have stated that it didn’t blacklist to disable use of Firesheep on Firefox.
FaceNiff is an Android app to sniff and intercept web session profiles over the WiFi that your mobile is connected to.
It is possible to hijack sessions only when WiFi is not using EAP,
but it should work over any private networks (Open/WEP/WPA-PSK/WPA2-PSK)
It's kind of like Firesheep for android. Maybe a bit easier to use (and it works on WPA2!).
http://faceniff.ponury.net/
HTTPS Everywhere is a free and open source browser extension for Google Chrome, Mozilla Firefox, Opera and Firefox for Android,
HTTPS Everywhere
encrypts your communications with many major websites, making your browsing more secure.
Protect communications by enabling HTTPS encryption automatically on sites that are known to support it.
Developed collaboratively by The Tor Project and the Electronic Frontier Foundation (EFF).
It automatically makes websites use a more secure HTTPS connection instead of HTTP, if they support it.
HTTPS Everywhere enables the sites' HTTPS protection which can protect you against eavesdropping and tampering with the contents of the site or with the information you send to the site.
Session hijacking counter measures
Prevent sniffing by using a secure connection.
HTTPS offers end-to-end security .
Use ‘HTTPS Everywhere’ browser extension to ensure uniform HTTPS access.
HTTPS Everywhere is based on HTTP Strict Transport Security (HSTS).
End user may employ a corporate VPN or implement a personal VPN.
Wired Equivalent Privacy (WEP) password is not secure
Wi-Fi Protected Access (WPA or WPA2) encryption prevents the attacker from using Firesheep.