Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Firesheep: Intentions, Responses, and What's Next
Search
Eric Butler
December 09, 2010
Technology
0
1k
Firesheep: Intentions, Responses, and What's Next
Presented at the Seattle iSEC Open Security Forum, December 2010
Eric Butler
December 09, 2010
Tweet
Share
More Decks by Eric Butler
See All by Eric Butler
Fun with Native Code
codebutler
0
480
The Secret Life of SIM Cards
codebutler
9
190k
Other Decks in Technology
See All in Technology
Data Hubグループ 紹介資料
sansan33
PRO
0
1.7k
CloudBruteによる外部からのS3バケットの探索・公開の発見について / 20250605 Kumiko Hennmi
shift_evolve
3
190
2025advance01
minamizaki
0
130
libsyncrpcってなに?
uhyo
0
160
AIのための オンボーディングドキュメントを整備する - hirotea
hirotea
9
2.3k
Introduction to Bill One Development Engineer
sansan33
PRO
0
240
Eight Engineering Unit 紹介資料
sansan33
PRO
0
3.2k
Swiftは最高だよの話
yuukiw00w
2
290
カンファレンスのつくりかた / The Conference Code: What Makes It All Work
tomzoh
8
930
Java で学ぶ 代数的データ型
ysknsid25
1
530
技術書典18結果報告
mutsumix
2
180
Houtou.pm #1
papix
0
670
Featured
See All Featured
The Art of Programming - Codeland 2020
erikaheidi
54
13k
Dealing with People You Can't Stand - Big Design 2015
cassininazir
367
26k
JavaScript: Past, Present, and Future - NDC Porto 2020
reverentgeek
48
5.4k
Scaling GitHub
holman
459
140k
How GitHub (no longer) Works
holman
314
140k
The Psychology of Web Performance [Beyond Tellerrand 2023]
tammyeverts
47
2.8k
Six Lessons from altMBA
skipperchong
28
3.8k
A designer walks into a library…
pauljervisheath
205
24k
Why Our Code Smells
bkeepers
PRO
336
57k
How STYLIGHT went responsive
nonsquared
100
5.6k
Thoughts on Productivity
jonyablonski
69
4.7k
[Rails World 2023 - Day 1 Closing Keynote] - The Magic of Rails
eileencodes
34
2.3k
Transcript
Firesheep: Intentions, Responses, and What's Next Eric Butler Ian Gallagher
December 2010 iSEC Open Security Forum
What is Firesheep?
None
HTTP Session Hijacking Tool
(put video here)
Why write Firesheep?
Problem known and ignored by companies for years
HTTPS (ok, SSL) invented in 1994 for this reason.
Firesheep: Released in October at ToorCon San Diego
Posted to HackerNews, picked up by TechCrunch
None
(hours later)
None
None
"Firesheep Highlights Web Privacy Problem" - Wall Street Journal "Digits"
Blog "The Message of Firesheep: "Baaaad Websites, Implement Sitewide HTTPS Now!"" - EFF Deeplinks BLog "Firesheep Exposes Need For Encryption" - InformationWeek
For a moment, hundreds of thousands of people were thinking
about security!
but... there's been plenty of misinformation too.
"Using Wi-Fi? Firesheep may endanger your security" - CNN.com "Firesheep:
Why You May Never Want to Use an Open Wi-Fi Network Again" - forbes.com
Insecure WiFi: Not the problem
Not only facebook!
None
None
"New Firefox Add-On Detects Firesheep, Protects You on Open Networks"
- Mashable
"New Firefox Add-On Detects Firesheep, Protects You on Open Networks"
- Mashable
Anti-virus starts targeting Firesheep
Fallout
amazon • bitly • enom • flickr • gowalla live
• toorcon • cisco • evernote foursquare • hackernews • nytimes tumblr • yahoo • basecamp • cnet facebook • google • harvest • pivotal twitter • yelp • dropbox • github slicehost
amazon • bitly • enom • flickr • gowalla live
• toorcon • cisco • evernote foursquare • hackernews • nytimes tumblr • yahoo • basecamp • cnet facebook • google • harvest • pivotal twitter • yelp • dropbox • github slicehost
Access campaign
How to correctly fix problem?
None
Best: Site-wide HTTPS Secure cookies HSTS (Strict-Transport-Security) No mixed-content SSL
Session resumption Design with security from the start EFF and OWASP have great guides on how to properly deploy HTTPS
Good: HTTPS for sensitive pages Secure cookies required for those
pages No mixed content on secure pages ..still susceptible to determined active attackers (MiTM, SSLStrip)
919,997 downloads to date
What's next?
Linux support, 802.11 monitor mode
Still a huge problem...
Keep demanding SSL!