Threat of the month: Firesheep

Share this article:
Randy Abrams
Randy Abrams

Firesheep

What is it?

Firesheep is a Firefox add-on that automates the hijacking of accounts that are not secured by SSL (https).

How does it work?
When a user logs onto Facebook, Amazon, Twitter or any number of other accounts, the user name and password are encrypted, but the cookie that the site sets to remember the user is not encrypted as it is sent to that person's computer. This means that if the user is at their local coffee shop using their open Wi-Fi system and logs onto a website, the cookie can be intercepted by anyone else using the same Wi-Fi network. By intercepting the cookie, the attacker can use that user's account.

How can I prevent it?
There are ways to protect your accounts. You can use a VPN, but do not expect your corporate VPN to do the job. Typically, only traffic between your computer and the company are tunneled, leaving your webmail and other accounts unprotected. The safest approach is not to surf anywhere that requires a password when you are on a public network.

– Randy Abrams, director of technical education, ESET

Share this article:
You must be a registered member of SC Magazine to post a comment.
close

Next Article in Opinions

Sign up to our newsletters

More in Opinions

Me and my job: Chris Sullivan, vice president of advanced solutions, Courion

Me and my job: Chris Sullivan, vice president ...

This month we get to know Chris Sullivan, vice president of advanced solutions at Courion.

Threat of the month: SVPENG

Threat of the month: SVPENG

We take a closer look at SVPENG, malware that's capable of launching two different types of attacks.

Security assessment stability

Security assessment stability

We should be asking if it is worth the cost of constantly switching security assessment companies, says Ken Stasiak CEO, SecureState.