SSL, The Elephant In The Room

[thetan]

http://codebutler.com/firesheep

http://github.com/codebutler/firesheep

I've been nagging about the importance of end to end encryption for seemingly ages now. Thank god for people like this highlighting the importance.

Install this firefox addon, connect to an unencrypted WAP, and let the session hijacking begin

[Goatboy]

Doesn't really work well, but it's a very early release so I can understand. My results:

Attacker comp: Desktop running Windows Vista, using a fairly generic Buffalo USB wireless card (no promisc)
Victim comp: Laptop running Ubuntu 10.04, using built-in wireless card (no promisc)

Test 1: Start capture on Attacker, visit Facebook on Victim. Both machines contained cookie data from my personal FB.
Result: N/A (Unable to tell if it worked, derp)

Test 2: Start capture on Attacker, visit dummy Facebook on Victim. Attacker has my personal FB cookies, Victim should now have dummy FB cookies.
Result: Fail. Unable to gain access on Attacker comp.

Test 3: All FB cookies on both computers have been erased. Start capture on Attacker, log in to Facebook as Victim on dummy account.
Result: Fail. Unable to gain access on Attacker comp.

Test 4: All cookies erased on both machines. Both have been restarted, and individually connected to the network. Attacker has Firefox open on blank tab, Victim opens Firefox and logs into dummy FB account.
Result: Fail. Unable to gain access on Attacker comp.

---

Although these tests are far from scientific, I think they are somewhat revealing. I'd like to see other people post their results as well, perhaps with a bit more scrutiny as to the scientific method. I also tried Tests 1 and 2 with a higher-end Alfa wireless card (promisc, packet injection, etc) and it still did not work. I made sure to select the correct driver to use before each test, and even tried a few that shouldn't work, just for the hell of it.

[thetan]

Worked fine for me at work on my laptop :-/

[Goatboy]

That's because you are God encased in a mortal shell.

[thetan]

And in the wake of firesheep comes yet another similar system

This time it's called "idiocy"

http://jonty.co.uk/idiocy
http://github.com/jonty/idiocy

[tgoe]

zomg, idiocy should be renamed juicy.

[Goatboy]

zomg, idiocy should be renamed juicy.

wat

[sanddbox]

wat

[tgoe]

lol I officially resign from my post.

[thetan]

lol I officially resign from my post.

I believe this only furthers the confusion.