Free Wi-Fi Hotspots Make All Your Website Accounts Vulnerable to Attack

Aaron Pava Profile Photo
Aaron Pava

on

October 28, 2010

Free Wi-Fi Hotspots Make All Your Website Accounts Vulnerable to Attack

If you ever use the free, non-encrypted wi-fi at your Internet cafe, now is the time to stop!

A new Firefox extension called Firesheep now makes it ridiculously easy for a no-gooder to hijack anybody's session who is currently logged-on to Facebook, Twitter, Amazon, Ebay, Craigslist, GoDaddy and more - simply by finding a user on the same network and double-clicking their connection.

Firesheep is what is known as a "packet sniffer" that scans all the data moving between computers and the router on the open Wi-Fi connection and scans for personally identifying information. Once armed with a user name and session ID, the hacker can gain unrestricted access to your account, even without knowing your password.

According to Computerworld, there are two ways to project yourself. First, never login to public Wi-Fi networks that aren't encrypted and available only with a password. Second, use a VPN (virtual private network) as a line of defense when connecting to public Wi-Fi at airports and coffee shops. 

How do you plan to stay safe? Do you have a VPN solution you recommend?

At the end of the day, security-breaking tools like Firesheep underscore the importance for all web developers to deploy SSL-encrypted websites to keep their users safe.

Share it!

Zscaler Security has just released a countermeasure called BlackSheep, a Firefox extension, which actually detects when Firesheep is hijacking your session. See http://www.zscaler.com/blacksheep.html 
First, it's important to realize that even if you're on an open public wi-fi network, your website data, logins, and accounts are protected if you are accessing sites which use SSL encryption (sites that start with https:// and show a lock icon in your browser). Most every financial website does this by default, and now most Google sites you log into (like Gmail) do this by default. However, some sites use SSL only for the login process, then drop back to unencrypted connections after login; such sites are still vulnerable to someone stealing your account info via the Firesheep method.Bottom line - if you are logged-into your account on any site, and the site address shows http:// at the beginning, your account is vulnerable to being attacked on a publlic network.There are add-ins you can install in your web browser (such as Force-TLS for Firefox) that will attempt to use secure SSL (https://) connections for all sites which support it, even if those sites normally don't use SSL by default. However, currently not every site supports SSL.Also, if you use a native email client (like Outlook, Thunderbird, or OS X Mail) you need to make sure that it's configured to connect to your incoming and outgoing mail servers using a secure encrypted connections, which are safe even on a public network. Many mail servers offer insecure as well as secure connections, so be sure you're using the secure ones. This can be a little tricky depending on your email provider and client you're using – you may need to check with your provider for instructions. See Securing email on Thunderbird, OS X Mail, and Gmail for a starting point.The most comprehensive solution is to use some form of VPN, as Aaron mentions. I don't have much experience with VPNs, but here's a VPN article from Mashable to get you started. Some of these are paid solutions, but the upside is easy setup for non-geeks.Since a lot of geeks probably read this blog, you can make your own VPN-on-the-cheap if you have ssh (secure shell) access to a remote server. You'll create what's called a 'secure tunnel' over ssh. Basically this creates a secure connection between your computer and your remote server, then funnels whatever traffic you want (web, email, IM, etc) though the tunnel. Paul Stamatiou shows how to do this to secure your web browsing on Mac OS X. Engadget explains tunnels and shows how to protect your email. These articles are Mac-centric, but you can make an SSH tunnel on any platform (even Windows, using PuTTY) – teh Google is your friend here.Finally, if you're using your iPhone, iPad, Android, netbook, PSP or whatever on an open public wi-fi network, you're just as exposed to these threats as you would be on a laptop, although the solutions may not be as straightforward.I knew about these threats years ago, and knew I should make sure I was secure when on public networks. I just got lazy and never did it. Now that Firesheep is out there, any bozo with Firefox at a coffeeshop can easily hijack your Facebook account or worse. It's time to get serious about security, and Eric Butler did us all a favor by making Firesheep available – it forces the issue.
The intention of the Firesheep creators is to put pressure on web sites to protect their users by implementing SSL for the entire session.  Google has already done this (for gmail, docs, etc)  and claims the increased load is trivial.  
Since i got here from the planet. I wonder if drupal.org and websites developed using drupal are also affected by this session hijacking?Regards,wuf31
I've found http://www.witopia.net to be a good solution for a personal VPN.
Herp derp, been this way for years
This simply underscores the need to have your own secure connection either via a mobile broadband card, or tethering through your phone which is now available with AT&T and the iPhone, along with many other brands and plans.Sadly most people will not know how to protect themselves, or will choose not to spend money on mobile broadband access and will see their accounts hijacked.
ahh happens ... anyway here's two links that might help drupal site builders help protect their users that are still accessing sites over insecure networks.http://crackingdrupal.com/blog/greggles/drupal-and-ssl-multiple-recipes-...http://github.com/blog/737-sidejack-prevention
I mistakenly tagged the post with Drupal Planet and it's now been removed. 
Personally I don't see the problem with putting this on Drupal Planet - it's a topic that should be of interest / concern to the community and can easily have a drupal twist to it.I guess some people are a bit more sensitive to the planet's coverage than me ;)I appreciate the head's up anyway...JamieT
I'm sorry, but why is this on Drupal planet?