How to protect against Firesheep attacks
Experts suggest defensive measures to ward off Firefox add-on's hijacking of Facebook, Twitter sessions via Wi-Fi
Computerworld - Security experts today suggested ways users can protect themselves against Firesheep, the new Firefox browser add-on that lets amateurs hijack users' access to Facebook, Twitter and other popular services.
Firesheep adds a sidebar to Mozilla's Firefox browser that shows when anyone on an open network -- such as a coffee shop's Wi-Fi network -- visits an insecure site.
Since researcher Eric Butler released Firesheep on Sunday, the add-on has been downloaded nearly 220,000 times.
"I was in a Peet's Coffee today, and someone was using Firesheep," said Andrew Storms, director of security operations at San Francisco-based nCircle Security. "There were only 10 people in there, and one was using it!"
But users aren't defenseless, Storms and several other experts maintained.
One way they can protect themselves against rogue Firesheep users, experts said on Tuesday, is to avoid public Wi-Fi networks that aren't encrypted and available only with a password.
However, Ian Gallagher, a senior security engineer with Security Innovation, argued that tosses out the baby with the bathwater. Gallagher is one of the two researchers who debuted Firesheep last weekend at a San Diego conference.
"While open Wi-Fi is the prime proving ground for Firesheep, it's not the problem," Gallagher said in a blog post earlier on Tuesday. "This isn't a vulnerability in Wi-Fi, it's the lack of security from the sites you're using."
Free, open Wi-Fi is not only taken for granted by many, but it's not the problem. There are plenty of low-risk activities one can do on the Internet at a public hotspot, including reading news or looking up the address of a nearby eatery.
So if Wi-Fi stays, what's a user to do?
The best defense, said Chet Wisniewski, a senior security adviser at antivirus vendor Sophos, is to use a VPN (virtual private network) when connecting to public Wi-Fi networks at an airport or coffee shop, for example.
While many business workers use a VPN to connect to their office network while they're on the road, consumers typically lack that secure "tunnel" to the Internet.
"But there are some VPN services that you can subscribe to for $5 to $10 month that will prevent someone running Firesheep from 'sidejacking' your sessions," Wisniewski said.
- City Solved Network Mystery - Saves $30K The City of Jacksonville put their hunch to work and not only solved a mystery, but found a new and innovative use for...
- Using Video to Gain a Competitive Advantage: A Business Strategy for Mid-Market Companies The insights provided in this white paper are based on industry analysts and 30+ years of experience from the Video Collaboration Group at...
- Ebook: Big Data Analytics For Dummies Big Data Analytics for Dummies is a valuable resource that addresses the practical dilemmas surrounding Big Data analytics and provides a step-by-step approach...
- A Guide To Preparing Your Data in Tableau Read "A Guide to Preparing Your Data for Tableau" and see how you can: Blend disparate data sources, then cleanse and enrich the...
- PST Archiving: What is it and How is it Done? Learn more about what PST data is, the risks relating to it, and how the new PST Archiving feature in the Simpana 10...
- HP DevOps KnowledgeVault This interactive resource focuses on the evolution taking place in the world of software development, specifically the Agile development framework, and the gap... All Network Security White Papers | Webcasts
Computerworld has launched its annual search for outstanding IT leaders who align technology with business goals. Nominate a top IT executive for the 2015 Premier 100 IT Leaders awards now through July 18.