Facebook And Twitter Accounts Exposed By Firefox Extension

The dangers from a lack of encryption has been starkly illustrated by a pair of researchers who developed a new Firefox extension that can hijack accounts on Facebook and other Web 2.0 sites.

Software developer Eric Butler and Ian “craSH” Gallagher created a tool they dubbed ‘Firesheep’ to bring the topic of session hijacking front and centre. The browser extension, which was unveiled Sunday at the ToorCon 12 conference in San Diego, enables users to swipe other people’s credentials with just a few clicks.

“When logging into a website you usually start by submitting your username and password,” Butler explained in a blog post. “The server then checks to see if an account matching this information exists and if so, replies back to you with a “cookie” which is used by your browser for all subsequent requests.”

Cookie Vulnerability

“It’s extremely common for websites to protect your password by encrypting the initial login, but surprisingly uncommon for websites to encrypt everything else,” he wrote. “This leaves the cookie (and the user) vulnerable. HTTP session hijacking (sometimes called “sidejacking”) is when an attacker gets a hold of a user’s cookie, allowing them to do anything the user can do on a particular website. On an open wireless network, cookies are basically shouted through the air, making these attacks extremely easy.”

With Firesheep installed, users can target anyone on the same open wireless network visiting non-encrypted sites such as Twitter and Facebook and take over the person’s account.

End-To-End Encryption

“The only effective fix for this problem is full end-to-end encryption, known on the web as HTTPS or SSL,” Butler wrote. “Facebook is constantly rolling out new “privacy” features in an endless attempt to quell the screams of unhappy users, but what’s the point when someone can just take over an account entirely? Twitter forced all third party developers to use OAuth then immediately released (and promoted) a new version of their insecure website. When it comes to user privacy, SSL is the elephant in the room.”

The extension works for Windows and Macintosh computers, and support for Linux is coming, he added.

“Websites have a responsibility to protect the people who depend on their services,” Butler wrote. “They’ve been ignoring this responsibility for too long, and it’s time for everyone to demand a more secure web. My hope is that Firesheep will help the users win.”