Protecting Yourself From Firesheep with Strict Transport Security

Strict Transport Security is a great solution to protecting against Firesheep

Now ultimately the vulnerable website is supposed to fix this issue on their side. But, let's not wait around for them. Let's fix it on our side and protect our traffic now.

Step 1: Grab a browser that supports Strict Transport Security (Firefox 4 & Google Chrome both support STS)
Step 2: Install an addon that lets you add specific STS settings - STS-UI
Step 3: Configure STS-UI for the sites you're concerned about
Step 4: Be happy your data is more secure. However, securely transmitting data is only one piece of the security pie. But at least you're good in that department.

Configuring STS-UI
Go to tools->Manager Strict Transport Security

Enter the domain name of each site you wish to protect (e.g. force Strict Transport Security upon the site). For example enter "facebook.com" and select "Force subdomains too"


After adding facebook.com and twitter.com it should look like this

Done. Now you will always be using HTTPS for data exchanged between twitter or facebook.

Remember, this only protects you against sites that are either already using STS or sites that you have manually added. This really isn't a scalable approach since xyz.com could be vulnerable and you wouldn't know unless you inspected the traffic going back and forth.

For those that have access to company VPNs or SSH tunnels for their traffic, I'd recommend you also use those when accessing the network from a wireless hotspot. A VPN doesn't solve the problem, but it does remove access from the likely attackers (e.g. other random users of the wireless hotspot).

This is a guest post by Michael Coates, a senior application security consultant with extensive experience in application security, security code review and penetration assessments. He has conducted numerous security assessments for financial, enterprise and cellular customers world-wide.
The original text is published on ...Application Security...


Talkback and comments are most welcome

Related posts
Stealing Twitter and Facebook Account - a Video Example
Corporate Guest WLAN - The best place for Eavesdropping to Interesting Traffic
5 Rules to Home Wi-Fi Security
Example - Bypassing WiFi MAC Address Restriction
Obtaining a valid MAC address to bypass WiFi MAC Restriction

Stealing Twitter and Facebook Account - a Video Example

WiFi security is looking grimmer then ever :)
Shortinfosec has discussed that guest or free WiFi is very open for collecting of interesting information. But you still needed to capture raw IP traffic, and sift through it in order to gain access to useful information.

From a couple of months ago, things became even easier. Eric Butler created the firesheep extension for Firefox. The extension was created as a demonstration of the security risk to users of web sites that only encrypt the login process and not the cookie created during the login process.

Firesheep filters through the captured traffic and collect unencrypted session cookies that 'fly' over the network. With firesheep, the potential attacker does not need to filter through anything - identities simply appear in the firesheep console.

Shortinfosec has performed a test capture on a free WiFi network - a mall. The capture of useful information takes a long time - we managed to capture 1 facebook and 1 twitter account in more then 4 hours. But for a dedicated attacker, whis period can be much longer.

Here is a brief video of the captured identities and opened in the same browser.





Talkback and comments are most welcome

Related posts

Corporate Guest WLAN - The best place for Eavesdropping to Interesting Traffic
5 Rules to Home Wi-Fi Security
Example - Bypassing WiFi MAC Address Restriction
Obtaining a valid MAC address to bypass WiFi MAC Restriction

Designed by Posicionamiento Web