Firesheep usage leads to Idiocy

http://jonty.co.uk/idiocy

by dunk010 • 16 years ago

139 82 16 years ago

jonty.co.uk

I wonder how this jives with security expert Bruce Scheiner's stance: http://www.schneier.com/blog/archives/2008/01/my_open_wirele...

Groxx9• 16 years ago

Doesn't seem to line up much... his stance is about running his own open wireless access point, and how much FUD there is around it, not SSL on websites.

edit: ah, now I see what you were getting at. Though things have changed now that it's easier, and there's nothing inherently dangerous with open wifi - SSH to your server, and you're plenty secure.

erikpukinskis• 16 years ago

jibes.

NathanKP8• 16 years ago

This sounds like an interesting idea, but is it legal to run? Sure it might be a good thing to educate people about the dangers of accessing the internet over open wireless, but what if you accidentally run it on the account of someone who is willing to sue? Do they have a legal basis to sue you?

Just because they are doing something stupid, doesn't give you the right to mess with their accounts.

Groxx9• 16 years ago

Unless they're running a honey-pot machine... how do they tell? You're coming from the same IP, with the same session. At best they can fingerprint your browser, which is far from proof and easy to change. Or nab things from Flash, maybe - but people likely to use this exploit to educate are probably more likely to run Flash blockers.

NathanKP8• 16 years ago

While it may be unlikely for you to get caught in my mind that still doesn't make it a good idea to run Idiocy. In essence I consider it to be a form of cyber terrorism.

Terrorists use illegal or unsavory acts to gain attention and draw media coverage of their cause. Essentially idiocy is just cyber terrorism. It says "Look! I can take over your account. Now that you are scared let me show you what I want you to do."

I'm sure that if this takes off it will get media coverage, and may even cause people and websites to change their habits and protocols, but why should terrorism be used to accomplish a change to secure web protocols?

Then again I have never been a believer in "the end justifies the means" so even assuming that the end result of forcing people to use HTTPS is good, I don't think cyber terrorism is a good way to accomplish it.

citricsquid2• 16 years ago

In the last few days a tool has been released

That seems to imply it's a single tool, and once this is "stopped" you don't need to worry any more. Surely it should mention instead that a recently released tool is widely publicised? Firesheep didn't make this possible, it has been for a long time, it just made it more accessible.

jontywareing5• 16 years ago

I thought the rest of the paragraph covered that, but I'm happy to edit it if you can suggest a rephrasing?

It's just supposed to be a quick introduction stating that the chances of being exploited are significantly higher now that the entry barrier is practically non-existent.

citricsquid2• 16 years ago

I... how did I miss that. I just went back and it's right there in the next sentence, my apologies. wtf.

rarestblog• 16 years ago

Actually a good idea, but a MUCH better idea would be to automatically post a direct message to that person (from your own account or from central Idiocy account) about the problem, rather than hijacking the session and basically hacking the account, running into problems with law.

Encosia• 16 years ago

To DM them, you'd have to make them follow you first, which would still require using the hijacked session. Roaming around busy public WiFi doing that would be an easy way to get a bunch of Twitter followers though!

jontywareing5• 16 years ago

I've been bouncing this back and forth with people all day!

Posting to your own account is an easily understandable visible demonstration of what's possible and why they should care - a DM from another account, or an @ just won't have the same effect on the user.

I might see if it's possible to send a DM to yourself, as that would achieve the same result without the public exposure.

abraham• 16 years ago

You could also send them a DM from their own account.

msmith• 16 years ago

126 lines of python. This is a great demonstration of how simple it is to exploit the vulnerability. Be aware, people.

Groxx9• 16 years ago

A question:

What does it tweet? So far I'm only seeing people tweeting about Idiocy, nothing that appears to be coming from Idiocy. Different tones / content of the message could have extremely differing responses, and as it's intentionally high profile, should be extremely careful.

borski• 16 years ago

From the code:

  status = 'I browsed twitter insecurely on a public network and all I got was this lousy tweet. http://jonty.co.uk/idiocy-what'

mildweed• 16 years ago

Barely in use so far:

https://twitter.com/search?q=I+browsed+twitter+insecurely+on...

Groxx9• 16 years ago

Unfortunately, the link it includes doesn't contain the part mentioning this capability is nothing new, merely that there's a new tool for it: http://jonty.co.uk/idiocy-what

If the creator is browsing through these: include that part, or people will associate the danger with the new tool, and nothing else.

tibbon3• 16 years ago

Anyone have ideas on getting it running on OS X?

One downside to some (often interpreted) languages is that there isn't always an easy way to package them up into a single binary for user consumption.

kijinbear• 16 years ago

Install Python, go to terminal, and type `python idiocy.py`

tibbon3• 16 years ago

$ python idiocy.py Traceback (most recent call last): File "idiocy.py", line 2, in <module> import getopt, sys, pcap, dpkt, re, httplib, urllib ImportError: No module named pcap

I'm not a python programmer. I don't see anything the equivalent of 'gem' to install modules. Googling isn't helping. Here's what I thought to try so far.

$ easy_install libpcap python-pcap python-dpkt

Searching for libpcap Reading http://pypi.python.org/simple/libpcap/ Couldn't find index page for 'libpcap' (maybe misspelled?) Scanning index of all packages (this may take a while) Reading http://pypi.python.org/simple/ No local packages or download links found for libpcap error: Could not find suitable distribution for Requirement.parse('libpcap')

deathbob2• 16 years ago

master>python idiocy.py Traceback (most recent call last): File "idiocy.py", line 2, in <module> import getopt, sys, pcap, dpkt, re, httplib, urllib ImportError: No module named pcap

Is there a python equivalent to RubyGems ?

ovi256• 16 years ago

I'm pretty sure you can install all the dependencies with macports, but you can't put the wireless card in monitor mode using the 'iw' command, because there's no iwtools on the mac AFAIK. And monitor (or promiscuous) mode is necessary.

seltzered2• 16 years ago

Speaking of this, when will HN allow for HTTPS connections? :P

alanh• 16 years ago

Post a feature request: http://news.ycombinator.com/item?id=363

seltzered2• 16 years ago

thanks, I noticed user culix already suggested it, so I upvoted his suggestion: http://news.ycombinator.com/item?id=499851

drivingmenuts• 16 years ago

"Given that most websites will not be making SSL the default any time soon, the only option is to educate people."

And this educates them how, exactly? Education thru vandalism is just vandalism.

jontywareing5• 16 years ago

It educates by providing information about the attack used and how to prevent it happening in the future. You can find the link provided to users here: http://jonty.co.uk/idiocy-what

The tweet can be instantly removed by the user. It's hardly vandalism as nothing is being damaged or destroyed.

As I've said in a message elsewhere in this thread, posting to your own account is an easily understandable visible demonstration of what's possible and why they should care - a DM from another account, or an @ just won't have the same effect on the user.

I've been informed that it's possible to send a DM to yourself, so I'm going to add that as an option shortly.

dandelany2• 16 years ago

Idiocy indeed. While you may run this for altruistic reasons, and I think it's good to teach people about the dangers of unprotected browsing, running a script to automatically hijack and post to the Twitter accounts of everyone around officially makes you an asshole, IMHO.

The fact that someone isn't wearing a belt doesn't mean they deserve a pantsing.

rosser• 16 years ago

The fact that someone isn't wearing a belt doesn't mean they deserve a pantsing.

Perhaps not, but, to stretch your metaphor a bit, if someone's fly is open, they might appreciate having it pointed out to them.

hugh3• 16 years ago

And how do you point it out to them? As discreetly as possible, or by shouting it to all their friends?

codexon4• 16 years ago

I don't like it that Firesheep is driving everyone to use HTTPS.

You cannot have multiple SSL certs on a single IP and you have to pay a significant amount to get a cert that won't pop up an annoying page which turns away most non-technical users.

There needs to be an alternative which just does key exchange and symmetric encryption without the identification.

jgrahamc2• 16 years ago

Your alternative to SSL would allow MITM attacks. Thus it would be useless.

codexon4• 16 years ago

I don't see another compromise that wouldn't require the signature infrastructure.

MITM attacks are much less common than sniffing attacks as we can see here.

bensummers• 16 years ago

There's a 'new' TLS (SSL) feature called Server Name Indication, which allows more than one cert per IP address.

http://en.wikipedia.org/wiki/Server_Name_Indication

It has surprisingly high client support, but obviously isn't universal enough for you to rely on it working.

With a protocol which doesn't require a certificate, you're still subject to MITM attacks. These are particularly viable on public wifi networks -- just set up a rogue access point.

there• 16 years ago

so now firesheep will lead to massive ipv6 deployment...

sedachv• 16 years ago

It's possible to mitigate HTTP session hijacking without resorting to SSL: http://carcaddar.blogspot.com/2010/10/protect-flock-or-how-t...

It's not really viable to serve most things over HTTPS because there's no hope of caching anywhere but at the end-point (and that's usually disabled by default, too).

itsnotvalid• 16 years ago

It's like if Microsoft starts disturbing virus and worms to alert you of new bulletin updates, which is what some security experts condemn to do (sorry I couldn't find the article about Conficker with experts saying this as an approach to fight conficker)

jeffiel• 16 years ago

How does this educate users, who don't have the option of using SSL to begin with? It's the website operators that need the education. This just embarrasses users due to no fault of their own.

_bfhp• 16 years ago

Has anyone gotten this thing to even work? Seems to rely on http://code.google.com/p/pypcap/ and when I attempt install from source the install.py turns out to be horribly useless.

Without installing that pypcap thing and just using libpcap, I get this error:

  Traceback (most recent call last):
  File "idiocy.py", line 128, in <module>
    main()
  File "idiocy.py", line 20, in main
    cap = pcap.pcap(device)
  AttributeError: 'module' object has no attribute 'pcap'

AgentConundrum• 16 years ago

Ok, dumb question time: Outside of things like banks, does anyone actually run a 100% SSL web server?

I thought the point of Firesheep was more "don't use unsecured networks" than "don't use websites that aren't 10% SSL." If it's the former, then this only does any good if the "victims" are the people providing the service. How many people do you think are going to notice this tweet immediately, realize where they were when it happened, and complain to the wifi provider (whose response, of course, will be "use at your own risk").

It might do some good for people running insecure networks at home, but the people that understand what happened and how to fix it would already be running secure networks at home.

Firesheep usage leads to Idiocy

Related Stories