Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Speaker Deck
PRO
Sign in
Sign up for free
Firesheep: Intentions, Responses, and What's Next
Eric Butler
December 09, 2010
Technology
0
860
Firesheep: Intentions, Responses, and What's Next
Presented at the Seattle iSEC Open Security Forum, December 2010
Eric Butler
December 09, 2010
Tweet
Share
More Decks by Eric Butler
See All by Eric Butler
Fun with Native Code
codebutler
0
360
The Secret Life of SIM Cards
codebutler
9
180k
Other Decks in Technology
See All in Technology
NGINXENG JP#2 - 2-NGINXの動作の詳細
hiropo20
1
140
re:Inventで発表があったIoT事例の紹介と考察
kizawa2020
0
200
OCI DevOps 概要 / OCI DevOps overview
oracle4engineer
PRO
0
510
SPA・SSGでSSRのようなOGP対応!
simo123
2
160
岐路に立つ若手がAmazonianの仕事術を学んできました / learning amazonian productivity hacks as a junior engineer
yayoi_dd
0
160
SignalR を使ったアプリケーション開発をより快適に!
nenonaninu
0
690
「一通りできるようになった」その先の話
hitomi___kt
0
140
もし本番ネットワークをまるごと仮想環境に”コピー”できたらうれしいですか? / janog51
corestate55
0
390
CUEとKubernetesカスタムオペレータを用いた新しいネットワークコントローラをつくってみた
hrk091
1
290
Exploring MapStore Release 2022.02: improved 3DTiles support and more
simboss
PRO
0
390
OpenShiftクラスターのアップグレード自動化への挑戦! / OpenShift Cluster Upgrade Automation
skitamura7446
0
210
ECテックカンファレンス2023 EC事業部のモバイル開発2023
tatsumi0000
0
340
Featured
See All Featured
CoffeeScript is Beautiful & I Never Want to Write Plain JavaScript Again
sstephenson
152
13k
Scaling GitHub
holman
453
140k
Build The Right Thing And Hit Your Dates
maggiecrowley
22
1.4k
Building Flexible Design Systems
yeseniaperezcruz
314
35k
The MySQL Ecosystem @ GitHub 2015
samlambert
240
11k
Six Lessons from altMBA
skipperchong
15
2.3k
Building Applications with DynamoDB
mza
85
5k
Documentation Writing (for coders)
carmenintech
51
2.9k
Learning to Love Humans: Emotional Interface Design
aarron
263
38k
Writing Fast Ruby
sferik
613
58k
Design by the Numbers
sachag
271
18k
For a Future-Friendly Web
brad_frost
166
7.8k
Transcript
Firesheep: Intentions, Responses, and What's Next Eric Butler Ian Gallagher
December 2010 iSEC Open Security Forum
What is Firesheep?
None
HTTP Session Hijacking Tool
(put video here)
Why write Firesheep?
Problem known and ignored by companies for years
HTTPS (ok, SSL) invented in 1994 for this reason.
Firesheep: Released in October at ToorCon San Diego
Posted to HackerNews, picked up by TechCrunch
None
(hours later)
None
None
"Firesheep Highlights Web Privacy Problem" - Wall Street Journal "Digits"
Blog "The Message of Firesheep: "Baaaad Websites, Implement Sitewide HTTPS Now!"" - EFF Deeplinks BLog "Firesheep Exposes Need For Encryption" - InformationWeek
For a moment, hundreds of thousands of people were thinking
about security!
but... there's been plenty of misinformation too.
"Using Wi-Fi? Firesheep may endanger your security" - CNN.com "Firesheep:
Why You May Never Want to Use an Open Wi-Fi Network Again" - forbes.com
Insecure WiFi: Not the problem
Not only facebook!
None
None
"New Firefox Add-On Detects Firesheep, Protects You on Open Networks"
- Mashable
"New Firefox Add-On Detects Firesheep, Protects You on Open Networks"
- Mashable
Anti-virus starts targeting Firesheep
Fallout
amazon • bitly • enom • flickr • gowalla live
• toorcon • cisco • evernote foursquare • hackernews • nytimes tumblr • yahoo • basecamp • cnet facebook • google • harvest • pivotal twitter • yelp • dropbox • github slicehost
amazon • bitly • enom • flickr • gowalla live
• toorcon • cisco • evernote foursquare • hackernews • nytimes tumblr • yahoo • basecamp • cnet facebook • google • harvest • pivotal twitter • yelp • dropbox • github slicehost
Access campaign
How to correctly fix problem?
None
Best: Site-wide HTTPS Secure cookies HSTS (Strict-Transport-Security) No mixed-content SSL
Session resumption Design with security from the start EFF and OWASP have great guides on how to properly deploy HTTPS
Good: HTTPS for sensitive pages Secure cookies required for those
pages No mixed content on secure pages ..still susceptible to determined active attackers (MiTM, SSLStrip)
919,997 downloads to date
What's next?
Linux support, 802.11 monitor mode
Still a huge problem...
Keep demanding SSL!