Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

In the SU chat yesterday is was raised that the newly released FF plugin Firesheep makes it very easy (obviously it was already possible, just difficult) for an attacker to session sidejack another user.

This is achieved by copying the sessions cookies from any http transmission that the attacker can see, and then using them to connect to the relevant website and impersonate the target user - this works extremely well on unsecured wireless networks where all packets can be read by anyone within range, but will work in other network configurations as well.

So, from the end-user perspective, what practical measures can be used to protect oneself from this kind of attack?

share|improve this question

4 Answers 4

up vote 4 down vote accepted

The best solution would be to use an encrypted connection from point to point. That is not always an option though because some websites do not offer HTTPS on all parts of their website, such as Facebook, they only offer full HTTPS at the login screen but nowhere else. This still allows attackers to capture the victims session and hijack it.

As mentioned in another answer, you can use a SSH tunnel or VPN to a trusted location if you are currently in a hostile environment that you do not trust, this would then allow you to have an encrypted connection inside of that network so then they cannot decypher your traffic, although they can still capture it.

There are some addon's available for Firefox for greasemonkey and other addons that will change all the links on a page from http to https which will force some more encryption, but the real problem lies on the websites end, where they should offer a secure connection without you having to do it manually.

EDIT: A tool has been released to flood running FireSheep users on your network, here.

share|improve this answer

BlackSheep

BlackSheep, also a Firefox plugin is designed to combat Firesheep. BlackSheep does this by dropping ‘fake’ session ID information on the wire and then monitors traffic to see if it has been hijacked. While Firesheep is largely passive, once it identifies session information for a targeted domain, it then makes a subsequent request to that same domain, using the hijacked session information in order to obtain the name of the hijacked user along with an image of the person, if available. It is this request that BlackSheep identifies in order to detect the presence of Firesheep on the network. When identified, the user will be receive the following warning message:

enter image description here

share|improve this answer

Refusing to use open wireless networks is a start. When you HAVE to, encrypting all data using VPN, SSH tunneling, and similar tools is a good idea. Never explicitly trust an unknown network.

share|improve this answer

Use firefox extensions that force SSL mode (like “HTTPS everywhere” or “force tls”).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.