Firesheep: Intentions, Responses, and What's Next

Transcript

1. Firesheep: Intentions, Responses, and What's Next Eric Butler Ian Gallagher

   December 2010 iSEC Open Security Forum

2. What is Firesheep?

3. None

4. HTTP Session Hijacking Tool

5. (put video here)

6. Why write Firesheep?

7. Problem known and ignored by companies for years

8. HTTPS (ok, SSL) invented in 1994 for this reason.

9. Firesheep: Released in October at ToorCon San Diego

10. Posted to HackerNews, picked up by TechCrunch

11. None

12. (hours later)

13. None
14. None

15. "Firesheep Highlights Web Privacy Problem" - Wall Street Journal "Digits"

    Blog "The Message of Firesheep: "Baaaad Websites, Implement Sitewide HTTPS Now!"" - EFF Deeplinks BLog "Firesheep Exposes Need For Encryption" - InformationWeek

16. For a moment, hundreds of thousands of people were thinking

    about security!

17. but... there's been plenty of misinformation too.

18. "Using Wi-Fi? Firesheep may endanger your security" - CNN.com "Firesheep:

    Why You May Never Want to Use an Open Wi-Fi Network Again" - forbes.com

19. Insecure WiFi: Not the problem

20. Not only facebook!

21. None
22. None

23. "New Firefox Add-On Detects Firesheep, Protects You on Open Networks"

    - Mashable

24. "New Firefox Add-On Detects Firesheep, Protects You on Open Networks"

    - Mashable

25. Anti-virus starts targeting Firesheep

26. Fallout

27. amazon • bitly • enom • flickr • gowalla live

    • toorcon • cisco • evernote foursquare • hackernews • nytimes tumblr • yahoo • basecamp • cnet facebook • google • harvest • pivotal twitter • yelp • dropbox • github slicehost

28. amazon • bitly • enom • flickr • gowalla live

    • toorcon • cisco • evernote foursquare • hackernews • nytimes tumblr • yahoo • basecamp • cnet facebook • google • harvest • pivotal twitter • yelp • dropbox • github slicehost

29. Access campaign

30. How to correctly fix problem?

31. None

32. Best: Site-wide HTTPS Secure cookies HSTS (Strict-Transport-Security) No mixed-content SSL

    Session resumption Design with security from the start EFF and OWASP have great guides on how to properly deploy HTTPS

33. Good: HTTPS for sensitive pages Secure cookies required for those

    pages No mixed content on secure pages ..still susceptible to determined active attackers (MiTM, SSLStrip)

34. 919,997 downloads to date

35. What's next?

36. Linux support, 802.11 monitor mode

37. Still a huge problem...

38. Keep demanding SSL!