Hey Web 2.0:
HTTP
- Request, Response
- Send username/password once
- Receive cookie
- Use cookie for all future requests
"Logged In"
Cookies need to be kept secret
- But they usually aren't.
WiFi
- Cookies shouted through the air.
- Someone just has to start listening.
$ sudo tcpdump -A -i en1 tcp port 80
Request
POST /login.php?login_attempt=1 HTTP/1.1
Host: login.facebook.com
email=sheep@example.com&pass=supersecure
Response
HTTP/1.1 302 Found Location: http://www.facebook.com/home.php? Set-Cookie: xs=a1cac26e11645bca984ea98f98a6a19c; path=/; domain=.facebook.com; httponly
"Session hijacking"
- "sidejacking"
How to stay safe?
- Lots of things work against you.
Avoiding insecure sites when on wifi?
- Good luck.
Avoiding insecure sites when on wifi?
- Doesn't matter in the end.
- Active attacker can redirect your browser.
(SSLStrip)
Log out
- But don't forget.
- Logging out doesn't guarantee session is invalidated.
Use only secure wifi
- WPA2 designed to protect clients from each other.
- No more coffee shops for you.
- Wifi has long history of problems. (Hole 196)
- Do you trust the network operator?
- What about ISP?
VPN
- Good, but:
- Doesn't come up right away.
- What happens when it drops?
- Pushes problem to the other side.
- Slow, annoying.
Need end-to-end encryption
- Traffic should be private between you and destination.
- Other solutions just move problem, don't fix.
Excuses:
1. Ignorance
2. IP Addresses
- Server Name Indication (RFC 3546)
- Allows virtual hosting with SSL/TLS
- Firefox 2+, Opera 8+, IE 7+, Chrome, Safari, iPhone, Android
(XP users: Firefox only)
3. Scaling
Gmail
- Went full SSL in January 2010.
- "we had to deploy no additional machines and no special hardware."
- http://www.imperialviolet.org/2010/06/25/overclocking-ssl.html
- If you can't scale securely, you're not scaling!
Web 2.0 Privacy Concerns
- Facebook under fire for new features.
- Irrelevant if someone can just take over your account.
Does it all matter?
- Sites like Facebook are many people's primary form of communication.
- Email isn't always better (Hotmail).
- Lots and lots of sites do it wrong (Enom!).
Widely known problem
Enough is enough.
- How to make people understand risk?
Firesheep
Firefox extension
One-click session hijacking
Extensible via javascript
register({
name: 'Hacker News',
domains: [ 'news.ycombinator.com' ],
sessionCookieNames: [ 'user' ],
identifyUser: function () {
var resp = this.httpGet(this.siteUrl);
this.userName = resp.body
.querySelectorAll(".pagetop a")[7]
.textContent;
}
});Firesheep
- Free
- Open Source
- Mac OS X
- Windows (Beta)
- Linux (Soon)
Available Now
- http://codebutler.github.com/firesheep
Known problem.
- For attacker, has always been easy.
Companies have a responsibility to protect you.
- But they don't
DEMAND SSL Everywhere!
Until then...
Enjoy the wifi!
Questions?
- Download Firesheep at
http://codebutler.github.com/firesheep - Ian Gallagher
@cdine
crash@neg9.org
igallagher@securityinnovation.com
crash@neg9.org
igallagher@securityinnovation.com
- Eric Butler
@codebutler
eric@codebutler.com
eric@codebutler.com