4 ms·
What about Firesheep users? Surely there are many people who find it a lot easier to just capture some WiFi traffic via libpcap, WireShark or the like than to
by julian37 16y ago
What about Firesheep users? Surely there are many people who find it a lot easier to just capture some WiFi traffic via libpcap, WireShark or the like than to set up a fake WiFi access point, poison a DNS cache or mount other such attacks that would allow them to actually modify traffic.
- tptacek 16y agoWhy are we talking about defenses that are defeated by just a couple lines of code? Firesheep could use pcap_write in addition to pcap_loop and redirect connections. What's the point of a defense that breaks Firesheep 1.0 only to fall to Firesheep 2.0?
- julian37 16y agoIsn't that a bit like saying that it's pointless for policemen to wear bulletproof vests because there could always be a sniper aiming at their head? Generally speaking, and regardless of today's protocols, surely passive eavesdropping is and will always remain easier to accomplish than actively mounting a MITM attack.
- tptacek 16y agoNo. The opposite is true. It's actually easier to MITM in 2011 than it is to sniff passively; the MITM only needs to play packet games long enough to get the victim to connect to her.
- julian37 16y agoInteresting, I didn't realize that. Since you're tptacek I'll take your word for it :-)
- caf 16y agoThe only reason Firesheep doesn't modify traffic is because it doesn't have to. Faking DNS replies or similar would be trivial to add, were it needed. The vulnerability here isn't "someone running Firesheep" - that's the exploit. The vulnerability here is "an open WiFi network is a completely trusted medium".