Should Mozilla block Firesheep?

Summary:Firesheep is a new, free Firefox add-on that makes it a snap for anyone to scan a WiFi network and hijack other people's Facebook, Twitter and other online accounts.

Firesheep is a new, free Firefox add-on that makes it a snap for anyone to scan a WiFi network and hijack other people's Facebook, Twitter and other online accounts.

Firesheep was developed by Seattle web app developer Eric Butler and released over the weekend at the ToorCoon security conference. Butler claims that the purpose of Firesheep is to get websites to tighten up security:

It's extremely common for websites to protect your password by encrypting the initial login, but surprisingly uncommon for websites to encrypt everything else. This leaves the cookie (and the user) vulnerable. HTTP session hijacking (sometimes called "sidejacking") is when an attacker gets a hold of a user's cookie, allowing them to do anything the user can do on a particular website. On an open wireless network, cookies are basically shouted through the air, making these attacks extremely easy.

This is a widely known problem that has been talked about to death, yet very popular websites continue to fail at protecting their users. The only effective fix for this problem is full end-to-end encryption, known on the web as HTTPS or SSL. Facebook is constantly rolling out new "privacy" features in an endless attempt to quell the screams of unhappy users, but what's the point when someone can just take over an account entirely? Twitter forced all third party developers to use OAuth then immediately released (and promoted) a new version of their insecure website. When it comes to user privacy, SSL is the elephant in the room.

The add-on is incredibly easy to use. Download the add-on. Log in to an open WiFi network and click a single button. The add-on starts capturing login data, displaying user names and photos in the sidebar. To log into the site as a particular user, just double-click on their name and you're in as them.

It's very, very easy. And very, very scary.

Firesheep can capture login data for many big sites such as Facebook, Twitter, Flickr, bit.ly, Google and Amazon.

Firesheep is free and open source and works on Mac OS X and Windows (Linus support is on the way).

Now, Firesheep is an add-on for the Firefox browser, and Mozilla have a blocklist mechanism that can be used to cripple an add-on. But in this case Mozilla's director of Firefox, Mike Beltzner, has said that Mozilla will not activate the kill-switch in this case because Firesheep doesn't exploit a vulnerability in the browser itself.

[poll id="567"]

Topics: Browser, Mobility, Security, Software Development, Wi-Fi

About

Adrian Kingsley-Hughes is an internationally published technology author who has devoted over a decade to helping users get the most from technology -- whether that be by learning to program, building a PC from a pile of parts, or helping them get the most from their new MP3 player or digital camera.Adrian has authored/co-authored technic... Full Bio

zdnet_core.socialButton.googleLabel Contact Disclosure

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Related Stories

The best of ZDNet, delivered

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
Subscription failed.