12 ms·
Firesheep usage leads to Idiocy
- petervandijck 16y agoI wonder how this jives with security expert Bruce Scheiner's stance: http://www.schneier.com/blog/archives/2008/01/my_open_wireles.html http://www.schneier.com/blog/archives/2008/01/my_open_wirele...
- Groxx 16y agoDoesn't seem to line up much... his stance is about running his own open wireless access point, and how much FUD there is around it, not SSL on websites. edit: ah, now I see what you were getting at. Though things have changed now that it's easier, and there's nothing inherently dangerous with open wifi - SSH to your server, and you're plenty secure.
- erikpukinskis 16y agojibes.
- NathanKP 16y agoThis sounds like an interesting idea, but is it legal to run? Sure it might be a good thing to educate people about the dangers of accessing the internet over open wireless, but what if you accidentally run it on the account of someone who is willing to sue? Do they have a legal basis to sue you? Just because they are doing something stupid, doesn't give you the right to mess with their accounts.
- Groxx 16y agoUnless they're running a honey-pot machine... how do they tell? You're coming from the same IP, with the same session. At best they can fingerprint your browser, which is far from proof and easy to change. Or nab things from Flash, maybe - but people likely to use this exploit to educate are probably more likely to run Flash blockers.
- NathanKP 16y agoWhile it may be unlikely for you to get caught in my mind that still doesn't make it a good idea to run Idiocy. In essence I consider it to be a form of cyber terrorism. Terrorists use illegal or unsavory acts to gain attention and draw media coverage of their cause. Essentially idiocy is just cyber terrorism. It says "Look! I can take over your account. Now that you are scared let me show you what I want you to do." I'm sure that if this takes off it will get media coverage, and may even cause people and websites to change their habits and protocols, but why should terrorism be used to accomplish a change to secure web protocols? Then again I have never been a believer in "the end justifies the means" so even assuming that the end result of forcing people to use HTTPS is good, I don't think cyber terrorism is a good way to accomplish it.
- Groxx 16y agoDidn't mean to imply I disagreed with your stance, just pointing out the relative security (unless someone else knows something) of running it. It probably is illegal, yes, and I won't personally run it, nor recommend anyone else does (as much as I've toyed with the idea of doing just such a thing by hand, at times). One could consider this civil disobedience, however, as it's not inherently harmful nor capable of spreading like a virus, and is for a good cause. At worst it annoys and makes people more paranoid online (as they should be), at best it causes change.
- NathanKP 16y agoI understand. Mainly I'm just worried that people aren't thinking things through completely when they make a tool like this freely available. Personally I expect that Firesheep will be used mostly by 4chan, script kiddies, and others who just want lulz. Idiocy is clearly an attempt to use the same concepts for good, but it is still mildly worrying from the point of view of the methods being used to accomplish the goal. Like I said, it feels like a terrorist-style attention grabber to me.
- Natsu 16y ago
- citricsquid 16y agoIn the last few days a tool has been released That seems to imply it's a single tool, and once this is "stopped" you don't need to worry any more. Surely it should mention instead that a recently released tool is widely publicised? Firesheep didn't make this possible, it has been for a long time, it just made it more accessible.
- jontywareing 16y agoI thought the rest of the paragraph covered that, but I'm happy to edit it if you can suggest a rephrasing? It's just supposed to be a quick introduction stating that the chances of being exploited are significantly higher now that the entry barrier is practically non-existent.
- citricsquid 16y agoI... how did I miss that. I just went back and it's right there in the next sentence, my apologies. wtf.
- Groxx 16y agoI get a slightly hard-to-read vibe from the page, personally. Maybe the contrast, maybe the harsher anti-aliasing in Windows (used to OSX), maybe the largish sans-serif font.
- rarestblog 16y agoActually a good idea, but a MUCH better idea would be to automatically post a direct message to that person (from your own account or from central Idiocy account) about the problem, rather than hijacking the session and basically hacking the account, running into problems with law.
- Encosia 16y agoTo DM them, you'd have to make them follow you first, which would still require using the hijacked session. Roaming around busy public WiFi doing that would be an easy way to get a bunch of Twitter followers though!
- jontywareing 16y agoI've been bouncing this back and forth with people all day! Posting to your own account is an easily understandable visible demonstration of what's possible and why they should care - a DM from another account, or an @ just won't have the same effect on the user. I might see if it's possible to send a DM to yourself, as that would achieve the same result without the public exposure.
- abraham 16y agoYou could also send them a DM from their own account.
- msmith 16y ago126 lines of python. This is a great demonstration of how simple it is to exploit the vulnerability. Be aware, people.
- Groxx 16y agoA question: What does it tweet? So far I'm only seeing people tweeting about Idiocy, nothing that appears to be coming from Idiocy. Different tones / content of the message could have extremely differing responses, and as it's intentionally high profile, should be extremely careful.
- borski 16y agoFrom the code: status = 'I browsed twitter insecurely on a public network and all I got was this lousy tweet. http://jonty.co.uk/idiocy-what'
- mildweed 16y agoBarely in use so far: https://twitter.com/search?q=I+browsed+twitter+insecurely+on+a+public+network https://twitter.com/search?q=I+browsed+twitter+insecurely+on...
- dish 16y agohttp://twecan.com/#!/insecurely%20on%20a%20public%20network http://twecan.com/#!/insecurely%20on%20a%20public%20network
- Groxx 16y agoUnfortunately, the link it includes doesn't contain the part mentioning this capability is nothing new, merely that there's a new tool for it: http://jonty.co.uk/idiocy-what http://jonty.co.uk/idiocy-what If the creator is browsing through these: include that part, or people will associate the danger with the new tool, and nothing else.
- jontywareing 16y agoGood point! If you have any other comments I'd love to hear them. Let me know if you think I should make any other edits: http://jonty.co.uk/idiocy-what http://jonty.co.uk/idiocy-what
- tibbon 16y agoAnyone have ideas on getting it running on OS X? One downside to some (often interpreted) languages is that there isn't always an easy way to package them up into a single binary for user consumption.
- kijinbear 16y agoInstall Python, go to terminal, and type `python idiocy.py`
- tibbon 16y ago$ python idiocy.py Traceback (most recent call last): File "idiocy.py", line 2, in <module> import getopt, sys, pcap, dpkt, re, httplib, urllib ImportError: No module named pcap I'm not a python programmer. I don't see anything the equivalent of 'gem' to install modules. Googling isn't helping. Here's what I thought to try so far. $ easy_install libpcap python-pcap python-dpkt Searching for libpcap Reading http://pypi.python.org/simple/libpcap/ http://pypi.python.org/simple/libpcap/ Couldn't find index page for 'libpcap' (maybe misspelled?) Scanning index of all packages (this may take a while) Reading http://pypi.python.org/simple/ http://pypi.python.org/simple/ No local packages or download links found for libpcap error: Could not find suitable distribution for Requirement.parse('libpcap')
- deathbob 16y agomaster>python idiocy.py Traceback (most recent call last): File "idiocy.py", line 2, in <module> import getopt, sys, pcap, dpkt, re, httplib, urllib ImportError: No module named pcap Is there a python equivalent to RubyGems ?
- seltzered 16y agoSpeaking of this, when will HN allow for HTTPS connections? :P
- drivingmenuts 16y ago"Given that most websites will not be making SSL the default any time soon, the only option is to educate people." And this educates them how, exactly? Education thru vandalism is just vandalism.
- jontywareing 16y agoIt educates by providing information about the attack used and how to prevent it happening in the future. You can find the link provided to users here: http://jonty.co.uk/idiocy-what http://jonty.co.uk/idiocy-what The tweet can be instantly removed by the user. It's hardly vandalism as nothing is being damaged or destroyed. As I've said in a message elsewhere in this thread, posting to your own account is an easily understandable visible demonstration of what's possible and why they should care - a DM from another account, or an @ just won't have the same effect on the user. I've been informed that it's possible to send a DM to yourself, so I'm going to add that as an option shortly.
- dandelany 16y agoIdiocy indeed. While you may run this for altruistic reasons, and I think it's good to teach people about the dangers of unprotected browsing, running a script to automatically hijack and post to the Twitter accounts of everyone around officially makes you an asshole, IMHO. The fact that someone isn't wearing a belt doesn't mean they deserve a pantsing.
- rosser 16y agoThe fact that someone isn't wearing a belt doesn't mean they deserve a pantsing. Perhaps not, but, to stretch your metaphor a bit, if someone's fly is open, they might appreciate having it pointed out to them.
- hugh3 16y agoAnd how do you point it out to them? As discreetly as possible, or by shouting it to all their friends?
- lotharbot 16y agoIf half of their friends also have their fly open, shouting it might be a better option.
- tertius 16y agoYou can see their friends' flies open? That's one ninja technique that I didn't want to know about. Point is, you don't know, so don't assume.
- Groxx 16y agoTo continue the metaphor... They walked into a glass building (unencrypted wifi location), unzipped their flies, sat down, and are totally unaware they did so. Someone would have noticed eventually - would they rather be potentially gawked at behind the one-way mirror that's always been there but they never noticed (WireShark), or told, allowing them to cookie-block the ones who do so? As to the volume of the telling, what if near enough to everyone were doing this? You would probably become the crazy person at the intersection, telling everyone the end of privacy is near, repent and use SSL. But at least this way you can demonstrate that yes, their flies are down, in a way they can see, rather than having to take your word on it.
- codexon 16y agoI don't like it that Firesheep is driving everyone to use HTTPS. You cannot have multiple SSL certs on a single IP and you have to pay a significant amount to get a cert that won't pop up an annoying page which turns away most non-technical users. There needs to be an alternative which just does key exchange and symmetric encryption without the identification.
- jgrahamc 16y agoYour alternative to SSL would allow MITM attacks. Thus it would be useless.
- codexon 16y agoI don't see another compromise that wouldn't require the signature infrastructure. MITM attacks are much less common than sniffing attacks as we can see here.
- jgrahamc 16y agoIf people moved to your scheme MITM would become common and we'd be writing about FirePiggyInTheMiddle or similar. They can be automated. You need some trust infrastructure for encryption to work.
- codexon 16y agoIn order to do FirePiggyInTheMiddle, you need to control the router. You can't just sit in the subnet and start sending commands to random clients to hijack their connection, especially when it is symmetrically encrypted.
- thwarted 16y agoA much more likely and easier setup is to poison DNS with results that direct the victim to your own machine.
- 16y ago
- sedachv 16y agoIt's possible to mitigate HTTP session hijacking without resorting to SSL: http://carcaddar.blogspot.com/2010/10/protect-flock-or-how-to-mitigate.html http://carcaddar.blogspot.com/2010/10/protect-flock-or-how-t... It's not really viable to serve most things over HTTPS because there's no hope of caching anywhere but at the end-point (and that's usually disabled by default, too).
- itsnotvalid 16y agoIt's like if Microsoft starts disturbing virus and worms to alert you of new bulletin updates, which is what some security experts condemn to do (sorry I couldn't find the article about Conficker with experts saying this as an approach to fight conficker)
- jeffiel 16y agoHow does this educate users, who don't have the option of using SSL to begin with? It's the website operators that need the education. This just embarrasses users due to no fault of their own.
- detcader 16y agoHas anyone gotten this thing to even work? Seems to rely on http://code.google.com/p/pypcap/ http://code.google.com/p/pypcap/ and when I attempt install from source the install.py turns out to be horribly useless. Without installing that pypcap thing and just using libpcap, I get this error: Traceback (most recent call last): File "idiocy.py", line 128, in <module> main() File "idiocy.py", line 20, in main cap = pcap.pcap(device) AttributeError: 'module' object has no attribute 'pcap'
- AgentConundrum 16y agoOk, dumb question time: Outside of things like banks, does anyone actually run a 100% SSL web server? I thought the point of Firesheep was more "don't use unsecured networks" than "don't use websites that aren't 10% SSL." If it's the former, then this only does any good if the "victims" are the people providing the service. How many people do you think are going to notice this tweet immediately, realize where they were when it happened, and complain to the wifi provider (whose response, of course, will be "use at your own risk"). It might do some good for people running insecure networks at home, but the people that understand what happened and how to fix it would already be running secure networks at home.