This is seriously scary stuff.

A new Firefox plug-in is ruffling security feathers thanks to its ability to snatch Web browser cookies for sites such as Facebook and Twitter and gain access to user’s accounts.

Am I correct in understanding that this plug in listens to ambient WiFi and catches raw cookies out of the air as they pass?

Holy C***!

Well, since Apple is the only Vendor/OEM that I am aware of that vets apps prior to allowing them on its App Store, all the rest, Google, Mozilla, et al, are subject to developers of bad character doing this kind of crap, with their only remedy being taking down the app after the fact.  I hope that the Mac Observer asked Mozilla how long it will take for it to remove the Firesheep from its Add-ons website.

Also, it has been reported that Apple and Google have kill switches in their respective iOS and Android operating systems.  I don’t think that Mozilla has any such ability to delete installed plugins.  Or does it?  The Mac Observer might also ask whether Mozilla has a kill switch for FireFox.  And, if it does, will it use it to remove installed instances of Firesheep from Firefox.

Nemo, you realize the real problem is not with this plug-in but with the websites that don’t use a secure connection to transmit cookies/verify passwords, don’t you?

This plug-in is a tool that shows a serious flaw and hopefully will prompt the companies involved to improve the security of their websites.

All banning the plug-in would do is keep the security problem out of sight and allow hackers to exploit it as they see fit.

So if you want to improve security, having a tool like this available will prompt security improvements.

Banning it only allows you pretend there is no problem.

As a She’sGeeky kinda gal, I’d like a balanced POV from hacker-ville in terms of banning/disallowing apps & plug-ins that create chaos (in my parenting/youth sphere, it’s the teen scene, so I have HUGE issues with cyberbullying opps like txtspoof.com that literally put the Molotov cocktail in kids’ hands and encourage them to ready aim/fire toward flaming frenemies) just because they ‘can.’ (often hackers say it’s about ‘finding the holes and testing the limits’)

While I understand the value in correcting security breaches there’s a wide swath of “uh-oh” that exposes and undermines human beings far beyond privacy and cookie setting, which we all know has led to some REALLY unfortunate digital misfires. (e.g. suicides of teens, etc)

I guess I’m asking…where is the legal line of ethics and limitation? Cookie snatching, financial exposure, privacy & beyond…when we scramble to ‘FIX’ it after the damage has been done? What about some pre-emptive logic here?

I realize cutting off a hacker or whacking a plug-in or mischievous app often only asks for yet another Medusasnake-like tendril to grow back even faster, but the damage done in this digital frontier sans vigilance in ‘find-n-fix’ mode is HUGE.

Preventive tactics? Security thoughts? ANYone?
@ShapingYouth

Question:
If traffic between the WAP and the computer is encrypted would that keep this from being able to grab the cookies?

If traffic between the WAP and the computer is encrypted would that keep this from being able to grab the cookies?

Yup, it looks like just affects open networks (which are dangerous to use regardless of this plugin).

Then that would be the best advice for Help on Hacker ...yadda… yadda… yadda.

Make sure your network is encrypted. WPA2 is what we use.

But it doesn’t have to be wireless. I ran it on my desktop (no wireless) and it saw the cookies my laptop was serving up (windows Live) on my laptop with the wireless turned off, but connected (Cat 5) to the same internet gateway.

This is not a wireless issue, it’s a network issue. The benefit of WPA etc. is that it encrypts the data. But, a wired network doesn’t bother to encrypt.

In the case of a school or business, it may be MORE secure to connect wirelessly using WPA etc. rather than connecting via a wire.

Why did this topic fall off the front page list of news items? It’s also no longer in the RSS feed.

ctopher - most wired traffic is switched, so you only see the packets destined for you. You sound like you are on an unswitched network (e.g. just a dumb hub feeding your machines rather than a router with NAT, etc.), which is why you would be able to see that data. Most wired networks are not set up like that.

You’re right! I have a really old 10-base T Hub that is connected to the router and all the computers connect to it.