FarSec - Firesheep, what it is and how to protect yourself

Firesheep, what it is and how to protect yourself

Fri, Jul 15 2011 10:41:11 PDT filed under social

Firesheep is a name that gathered a lot of media attention a few months ago, as a new tool that allows people to hijack your Facebook, Twitter, Gmail or other accounts. It caused many services to change the way they operate, but now that this name isn't in people's mind anymore doesn't mean the threat is gone. Here's what Firesheep actually does, and how to protect yourself from it.

What it is

Firesheep is a Firefox extension. What it does is not so much technical as it's a way to expose tools that have existed for a long time. The ability to sniff traffic on a connection, to see what others are doing, and what passwords they use for their services, has always existed. But to do this, one would have to use specialized hackers tools. It's not hard, but it's not something the average user would do.

Firesheep brought those capabilities to a click of a button. By running the extension, suddenly your computer starts listening to all the computers around you, and gather their packets. Then, should anyone use one of the supported services, such as Facebook or Twitter, it shows the information to you and allows you to use their accounts.

How it works

By default, a local network is set so that every computer on the network can see the packets of everyone else. That's the basis behind Ethernet, the protocol under most networks. This also applies to wi-fi, so as long as there is no router between you and the other computer, you can see their traffic, which is usually the case at a coffee shop's free wi-fi service.

Then, it's simply a matter of intercepting the other user's cookies. Cookies are simple lines of text which allows you to stay logged into a site. Without them, every page you'd go to on Facebook wouldn't know who you are and would require you to login again. By sending a cookie, you are telling the site who you are. Firesheep simply gathers those cookies, and allows someone to impersonate you.

How to protect yourself

As long as you use public networks, such as wi-fi hotspots or a network at work, others are able to see your traffic, there is no way around that. So the only sure way to defeat these methods is to encrypt your communication, so they cannot know what your browser is saying to the server.

After Firesheep came out, Facebook and Twitter have introduced options to turn on Secure Connection. These options are available in the settings on both sites, and I would highly encourage you to turn them on. With those on, there is no risk of being impersonated thanks to Firesheep.

There is however one small caveat for Facebook. If you play Flash games on the site, they don't support secure connections, so your communication will fall back down to normal, unencrypted mode.