Firesheep: Intentions, Responses, and What's Next

Transcript

1. 1.

   Firesheep: Intentions, Responses, and What's Next Eric Butler Ian Gallagher

   December 2010 iSEC Open Security Forum
2. 2.

   What is Firesheep?

3. 3.

   None
4. 4.

   HTTP Session Hijacking Tool

5. 5.

   (put video here)

6. 6.

   Why write Firesheep?

7. 7.

   Problem known and ignored by companies for years

8. 8.

   HTTPS (ok, SSL) invented in 1994 for this reason.

9. 9.

   Firesheep: Released in October at ToorCon San Diego

10. 10.

    Posted to HackerNews, picked up by TechCrunch

11. 11.

    None
12. 12.

    (hours later)

13. 13.

    None
14. 14.

    None
15. 15.

    "Firesheep Highlights Web Privacy Problem" - Wall Street Journal "Digits"

    Blog "The Message of Firesheep: "Baaaad Websites, Implement Sitewide HTTPS Now!"" - EFF Deeplinks BLog "Firesheep Exposes Need For Encryption" - InformationWeek
16. 16.

    For a moment, hundreds of thousands of people were thinking

    about security!
17. 17.

    but... there's been plenty of misinformation too.

18. 18.

    "Using Wi-Fi? Firesheep may endanger your security" - CNN.com "Firesheep:

    Why You May Never Want to Use an Open Wi-Fi Network Again" - forbes.com
19. 19.

    Insecure WiFi: Not the problem

20. 20.

    Not only facebook!

21. 21.

    None
22. 22.

    None
23. 23.

    "New Firefox Add-On Detects Firesheep, Protects You on Open Networks"

    - Mashable
24. 24.

    "New Firefox Add-On Detects Firesheep, Protects You on Open Networks"

    - Mashable
25. 25.

    Anti-virus starts targeting Firesheep

26. 26.

    Fallout

27. 27.

    amazon • bitly • enom • flickr • gowalla live

    • toorcon • cisco • evernote foursquare • hackernews • nytimes tumblr • yahoo • basecamp • cnet facebook • google • harvest • pivotal twitter • yelp • dropbox • github slicehost
28. 28.

    amazon • bitly • enom • flickr • gowalla live

    • toorcon • cisco • evernote foursquare • hackernews • nytimes tumblr • yahoo • basecamp • cnet facebook • google • harvest • pivotal twitter • yelp • dropbox • github slicehost
29. 29.

    Access campaign

30. 30.

    How to correctly fix problem?

31. 31.

    None
32. 32.

    Best: Site-wide HTTPS Secure cookies HSTS (Strict-Transport-Security) No mixed-content SSL

    Session resumption Design with security from the start EFF and OWASP have great guides on how to properly deploy HTTPS
33. 33.

    Good: HTTPS for sensitive pages Secure cookies required for those

    pages No mixed content on secure pages ..still susceptible to determined active attackers (MiTM, SSLStrip)
34. 34.

    919,997 downloads to date

35. 35.

    What's next?

36. 36.

    Linux support, 802.11 monitor mode

37. 37.

    Still a huge problem...

38. 38.

    Keep demanding SSL!