Firesheep will permanently scare you from hotspots
UPDATE 10/28/2010 – Even Forced SSL is broken for Facebook Google Twitter
Update 11/2/2010 – See report card for various online services
Do you know what the above screenshot is? It’s the picture of your Google accounts, Facebook accounts, Twitter accounts, Flickr accounts being hijacked by anyone running a simple point-n-click Firefox plug-in called “Firesheep“. A complete novice in computer hacking would be able to go into your Facebook page as you and do anything they want as you. I wouldn’t be surprised if a bunch of juveniles started posting nasty comments on other people’s accounts.
Why would anyone write such a destructive plugin in such a high grade weaponized form? Because very little media coverage and very few people listened years ago when this technology first became readily available 3 years ago. So because it didn’t get much media coverage, most people didn’t care and most of the popular websites (besides Gmail and Google search but not other Google properties) have failed to enable start-to-finish SSL which would have prevented this type of attack. Making this type of attack more visible puts pressure on the application providers to fix their websites.
The typical tired excuse from application providers is that SSL from start to finish is too computationally expensive for the server infrastructure which hasn’t been true for a decade with the speed of modern computers. Furthermore, the most compute intensive part of SSL is getting the session started and keeping it going requires minimal effort. To be more precise, it costs thousands of times more compute power to start an SSL session than to maintain it. The most silly use of SSL is WordPress.com which hosts millions of blogs. They turn on SSL every time you go to the administration page but turn it off when you leave it thinking they’re saving server resources. But then starts a new session when you return to the admin page and WordPress servers get hit with even more work than if they had just left SSL running.
Protecting yourself
Unfortunately, it’s not easy for the typical consumer to protect themselves because action must be taken by infrastructure providers and application providers. Consumers can use secure tunneling services like VPN but those generally cost money, add complexity, and reduce performance. The easiest thing consumers can do is to send loud complaints to their application and hotspot providers to fix it on their end. Consumers should certainly enable permanent SSL on their Gmail accounts if they haven’t already done so, but sites like Facebook and Twitter don’t have this option and they won’t have it until enough people complain.
What should application providers do?
Facebook, Twitter, and Google really need to get their act together and make all of their sites SSL by default from start to finish. Enough with the excuses, it’s time they fixed their sites. And before someone asks: where’s your SSL Mr. Digital Society smarty pants? Well we had that covered since inception with https://www.digitalsociety.org, but that’s not really important since our readers aren’t logging in to our site and we don’t know or store your identity here like Facebook or Twitter or Google sites.
What should hotspot providers do?
Some like Tris Hussey suggested that they should just turn on WEP/WPA. Well that’s really not good enough since WEP is absolutely worthless, and “WPA” has two modes one of which wouldn’t protect you in the context of a hotspot. If WPA is used in Pre-Shared Key (PSK) mode for a hotspot, it’s effectively a party line since everyone knows the PSK which allows session keys to be derived which means you’re not protected.
WPA has to be operated in “enterprise” mode which is something that Google tries to do with their free hotspot service in parts of their home town in Mountain View but fails miserably at. For one thing, they don’t even let you use your existing Google account credentials and you’re forced to set up a new account with them just for the hotspot service. Then they assign you an account password which doesn’t even work. If a network geek like me can’t make it work, I can’t imagine how it would be for normal people.
But the reality is that people don’t want to deal with usernames and passwords at all, and I’ve proposed a really simple solution 3 years ago with anonymous secure hotspots. The user could just use a blank username and blank password and then be given a secure WPA Enterprise connection. It still amazes me that whenever I go to RSA security conferences, they still go to the trouble of setting up a help desk to hand out unique usernames and passwords just to accomplish the same thing. Security people have got to figure out that if security is too hard to implement and use, then the security scheme is essentially broken since no one will use it.
You just can’t get any easier than a blank username and blank password with point-n-click secure connectivity. Once a hotspot provider enables secure encryption, this will essentially offer wire equivalent security for hotspot users and it will give a level of protection to all the websites and all the applications people use. Note that I didn’t say that this was full proof, just that it’s equivalent to wired security which is a huge step up. The wireless network infrastructure still has to block malicious behavior such as ARP spoofing.
[...] [Cross-posted at Digital Society] [...]
[...] [...]
[...] been a lot of constructive attention on Firesheep this week, which is a simple tool that lets anyone hijack other people’s web accounts with absolutely no skill required. A lot of people are offering the suggestion that running [...]
[...] http://www.digitalsociety.org/2010/10/firesheep-will-permanently-scare-you-from-hotspots/ [...]
[...] [...]
[...] over the last week since the release of a simple-to-use website user account hijacking tool called FireSheep. The tool gives attackers temporary full access to your web accounts like Facebook, Twitter, [...]
[...] [...]
[...] will note that cookie stealing exploits (sidejacking) like Firesheep work independently of full time SSL browsing. Sites like Facebook that allow you to manually [...]
[...] over the last week since the release of a simple-to-use website user account hijacking tool called FireSheep. The tool gives attackers temporary full access to your web accounts like Facebook, Twitter, [...]
[...] [...]
[...] 11/9/2010 – The researchers at Zscaler have come up with a clever tool for detecting usage of FireSheep. More precisely, they’ve come up with a honey pot for baiting and then collecting the [...]
As someone who has designed and implemented several major VPN and transactional website infrastructures since 2003, the providers defense “SSL from start to finish is too computationally expensive for the server infrastructure” makes me smile!
Why?
Because apart from the very small VPN solution (less than 200 concurrent users) I’ve never used the servers for SSL connection termination, there being much more efficient and effective solutions available (conversation goes along the lines, “yes you could do this with a raft of Microsoft/Linux servers using the free licenses under your existing agreements, however, it will take at least 3~6 months to design, build and harden; with the appliance-based solution I’m proposing it can be up and running in 2 weeks with similar reductions in build and on costs…”).
So this set me thinking, why are they (the providers) saying this? Then the light bulb went on: my clients understood that if they wanted a robust website capable of securely handling thousands of concurrent users then they needed to services of an Enterprise ICT Solution Architect, namely, someone who understands that a website is more than just the servers hosting the website.
[...] Digital Society: 1 2 [...]
[...] [...]
[...] [...]
[...] [...]
Leave your response!
Twitter Feed
About Us
Digital Society is a digital think tank that believes culture and commerce are inseparable, that the digital economy flourishes when people are free and rights are secure, and that free markets free people.
Digital Society is an independent 501(c)3 non-profit organization, funded by donations from Jon Henke and from Arts+Labs. We advocate for a pro-culture, pro-commerce digital society through research, analysis and debate on emerging technology issues.
Reply Comments
Transparency and interactivity are trademarks of the Internet era, and we aim to foster them here at Digital Society. It is inevitable that some people will disagree with the technology policy positions we take. We want to have that constructive debate.
The Reply Comments feature gives our critics a chance to respond to our viewpoints and the Digital Society audience convenient access to competing arguments. Any time we directly challenge the views of an individual or a group on this site, the party in question may substantively respond in a guest post.
Please contact executive director Jon Henke by e-mail.
Subscribe
Recent Posts
Recent Posts
Most Commented
Most Viewed