Firesheep: Intentions, Responses, and What's Next

Presented at the Seattle iSEC Open Security Forum, December 2010

Transcript

1. Firesheep: Intentions, Responses, and What's Next Eric Butler Ian Gallagher December 2010 iSEC Open Security Forum
2. What is Firesheep?
4. HTTP Session Hijacking Tool
5. (put video here)
6. Why write Firesheep?
7. Problem known and ignored by companies for years
8. HTTPS (ok, SSL) invented in 1994 for this reason.
9. Firesheep: Released in October at ToorCon San Diego
10. Posted to HackerNews, picked up by TechCrunch
12. (hours later)
15. "Firesheep Highlights Web Privacy Problem" - Wall Street Journal "Digits" Blog "The Message of Firesheep: "Baaaad Websites, Implement Sitewide HTTPS Now!"" - EFF Deeplinks BLog "Firesheep Exposes Need For Encryption" - InformationWeek
16. For a moment, hundreds of thousands of people were thinking about security!
17. but... there's been plenty of misinformation too.
18. "Using Wi-Fi? Firesheep may endanger your security" - CNN.com "Firesheep: Why You May Never Want to Use an Open Wi-Fi Network Again" - forbes.com
19. Insecure WiFi: Not the problem
20. Not only facebook!
23. "New Firefox Add-On Detects Firesheep, Protects You on Open Networks" - Mashable
24. "New Firefox Add-On Detects Firesheep, Protects You on Open Networks" - Mashable
25. Anti-virus starts targeting Firesheep
26. Fallout
27. amazon • bitly • enom • flickr • gowalla live • toorcon • cisco • evernote foursquare • hackernews • nytimes tumblr • yahoo • basecamp • cnet facebook • google • harvest • pivotal twitter • yelp • dropbox • github slicehost
28. amazon • bitly • enom • flickr • gowalla live • toorcon • cisco • evernote foursquare • hackernews • nytimes tumblr • yahoo • basecamp • cnet facebook • google • harvest • pivotal twitter • yelp • dropbox • github slicehost
29. Access campaign
30. How to correctly fix problem?
32. Best: Site-wide HTTPS Secure cookies HSTS (Strict-Transport-Security) No mixed-content SSL Session resumption Design with security from the start EFF and OWASP have great guides on how to properly deploy HTTPS
33. Good: HTTPS for sensitive pages Secure cookies required for those pages No mixed content on secure pages ..still susceptible to determined active attackers (MiTM, SSLStrip)
34. 919,997 downloads to date
35. What's next?
36. Linux support, 802.11 monitor mode
37. Still a huge problem...
38. Keep demanding SSL!