Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Firesheep: Intentions, Responses, and What's Next
Search
Eric Butler
December 09, 2010
Technology
0
1.1k
Firesheep: Intentions, Responses, and What's Next
Presented at the Seattle iSEC Open Security Forum, December 2010
Eric Butler
December 09, 2010
Tweet
Share
More Decks by Eric Butler
See All by Eric Butler
Fun with Native Code
codebutler
0
490
The Secret Life of SIM Cards
codebutler
9
190k
Other Decks in Technology
See All in Technology
Agile PBL at New Grads Trainings
kawaguti
PRO
1
270
Grafana MCPサーバーによるAIエージェント経由でのGrafanaダッシュボード動的生成
hamadakoji
1
1.3k
kubellが考える戦略と実行を繋ぐ活用ファーストのデータ分析基盤
kubell_hr
0
140
ライブサービスゲームQAのパフォーマンス検証による品質改善の取り組み
gree_tech
PRO
0
540
Codeful Serverless / 一人運用でもやり抜く力
_kensh
4
140
スプリントレトロスペクティブはチーム観察の宝庫? 〜チームの衝突レベルに合わせたアプローチ仮説!〜
electricsatie
1
160
【初心者向け】ローカルLLMの色々な動かし方まとめ
aratako
7
3.2k
カミナシ社の『ID管理基盤』製品内製 - その意思決定背景と2年間の進化 #AWSUnicornDay / Kaminashi ID - The Big Whys
kaminashi
3
800
異業種出身エンジニアが気づいた、転向して十数年経っても変わらない自分の武器とは
macnekoayu
0
280
Flutterでキャッチしないエラーはどこに行く
taiju59
0
220
データアナリストからアナリティクスエンジニアになった話
hiyokko_data
2
420
Autonomous Database - Dedicated 技術詳細 / adb-d_technical_detail_jp
oracle4engineer
PRO
4
9.9k
Featured
See All Featured
Why You Should Never Use an ORM
jnunemaker
PRO
59
9.5k
How to Ace a Technical Interview
jacobian
279
23k
The Language of Interfaces
destraynor
161
25k
The Art of Delivering Value - GDevCon NA Keynote
reverentgeek
15
1.6k
Code Review Best Practice
trishagee
70
19k
Making the Leap to Tech Lead
cromwellryan
135
9.5k
For a Future-Friendly Web
brad_frost
180
9.9k
Building Adaptive Systems
keathley
43
2.7k
jQuery: Nuts, Bolts and Bling
dougneiner
64
7.9k
Sharpening the Axe: The Primacy of Toolmaking
bcantrill
44
2.5k
Product Roadmaps are Hard
iamctodd
PRO
54
11k
Testing 201, or: Great Expectations
jmmastey
45
7.6k
Transcript
Firesheep: Intentions, Responses, and What's Next Eric Butler Ian Gallagher
December 2010 iSEC Open Security Forum
What is Firesheep?
None
HTTP Session Hijacking Tool
(put video here)
Why write Firesheep?
Problem known and ignored by companies for years
HTTPS (ok, SSL) invented in 1994 for this reason.
Firesheep: Released in October at ToorCon San Diego
Posted to HackerNews, picked up by TechCrunch
None
(hours later)
None
None
"Firesheep Highlights Web Privacy Problem" - Wall Street Journal "Digits"
Blog "The Message of Firesheep: "Baaaad Websites, Implement Sitewide HTTPS Now!"" - EFF Deeplinks BLog "Firesheep Exposes Need For Encryption" - InformationWeek
For a moment, hundreds of thousands of people were thinking
about security!
but... there's been plenty of misinformation too.
"Using Wi-Fi? Firesheep may endanger your security" - CNN.com "Firesheep:
Why You May Never Want to Use an Open Wi-Fi Network Again" - forbes.com
Insecure WiFi: Not the problem
Not only facebook!
None
None
"New Firefox Add-On Detects Firesheep, Protects You on Open Networks"
- Mashable
"New Firefox Add-On Detects Firesheep, Protects You on Open Networks"
- Mashable
Anti-virus starts targeting Firesheep
Fallout
amazon • bitly • enom • flickr • gowalla live
• toorcon • cisco • evernote foursquare • hackernews • nytimes tumblr • yahoo • basecamp • cnet facebook • google • harvest • pivotal twitter • yelp • dropbox • github slicehost
amazon • bitly • enom • flickr • gowalla live
• toorcon • cisco • evernote foursquare • hackernews • nytimes tumblr • yahoo • basecamp • cnet facebook • google • harvest • pivotal twitter • yelp • dropbox • github slicehost
Access campaign
How to correctly fix problem?
None
Best: Site-wide HTTPS Secure cookies HSTS (Strict-Transport-Security) No mixed-content SSL
Session resumption Design with security from the start EFF and OWASP have great guides on how to properly deploy HTTPS
Good: HTTPS for sensitive pages Secure cookies required for those
pages No mixed content on secure pages ..still susceptible to determined active attackers (MiTM, SSLStrip)
919,997 downloads to date
What's next?
Linux support, 802.11 monitor mode
Still a huge problem...
Keep demanding SSL!