How To: Avoid Getting Fleeced By Firesheep

Over the last 24 hours the world has been abuzz with talk about a small Firefox extension. Usually Firefox extensions don’t make headlines, but in this case one did. Why? This extension is called Firesheep, and it’s scary.

The Firesheep plugin can hijack your Facebook, Twitter, and Flikr sessions while you are connected to unsecured wifi. What do we mean hijack? We mean that it can steal your sessions, pretend to be you, and you won’t even know it.

Yeah, wow.

There is a lot of discussion about the ramifications of releasing something that is simple enough to let anyone become a hacker, and TUAW has some good suggestions for how to guard against Firesheep, but I want to give you my take on it and what practical steps you can take.

First off I want to tell you about my day yesterday (it relates, trust me). Sitting at home working on articles for this joint, I get a call from one of my friends at the CBC. “Have you heard about Firesheep?” I said I saw some headlines, but I hadn’t really looked at it. “Could you look at it and talk about it on camera?”, umm…sure….when? “How about an hour?” Eek. Sure…why not.

I dash to one of my favourite coffee places close by (which I also knew had open wifi) after getting Firesheep all loaded up (it took less than a minute). I order a latte, settle in and …

Holy crap.

Just like everyone said, running Firesheep I could see who was logged into Facebook and a bunch of other sites and with a double-click be that person.

Holy crap.

I’m not usually a terribly paranoid person online, but this gave me the willies. Anyone could have this running and you’d never know it. Oh sure, packet sniffers have been around for a while (that’s how it works), but packet sniffing isn’t easy for most people. Firesheep is easy enough for a kid to use. So how do you combat this? Well let’s get to that now…

First thing, if you have a wireless network at home and you haven’t set up a WPA (or even WEP) password on it, do it now.

Next, for all the businesses that have open wifi, now is the time to bite the bullet and put a password on the network. No, I’m not talking about a “gatekeeper” password that lets you in for a period of time, but WPA/WEP. Encryption. Yes, I know it’s a hassle for people to ask, but just make it obvious. This isn’t about access control, it’s about safety. I showed the manager of the place where the CBC segment was shot what the risk was and he was pretty shocked.

If you frequent a place that has open wifi, ask them to put a password on it. If you lock down your wireless network, then that’s it. Firesheep isn’t a problem. If you’re slightly techie and know how to do this, offer to help. For free.

In the meantime, you can try Firefox extensions like Force-TLS or HTTPS Everywhere or Chrome a extension like KB SSL enforcer all of which force the site you’re on to load the HTTPS (encrypted) version of the site. The problem I ran into with KB SSL today was that a lot of sites don’t have their HTTP and HTTPS versions working together very well. I had to shut it off to read some things…so what does that do? These solutions are only a stop gap as far as I’m concerned.

For those of you lucky enough to have a mobile data stick or can tether your phone for access—both of those are nice and secure. What about your WiFi only mobile devices? Those I don’t have good solutions for. Myself I have both my iPhone and iPad set not to just autoconnect to available networks and I’m going to have them both “forget” several of the local places I go to that don’t have secured wifi. Yes, mobile devices are also vulnerable because this isn’t a vulnerability in a browser or device it’s while how you can the sites connect to each other.

This is what bugs me the most about the whole Firesheep problem. Websites like Facebook and Twitter could force everyone to https like gmail does, but they choose not to. Until now, the risk hasn’t been that huge, but now…now I don’t think they can say that.

From now on, if it’s unsecured WiFi, I’m not using it. Period. If I absolutely have to, then I’ll run a proxy. Yeah, it’s harsh, but even the Firefox and Chrome extensions are only a partial solution. They aren’t 100% and they don’t work with all sites equally well. All you need to do is forget to turn them on or have an application notifier running in the background and …

Done like dinner.

My last tip is for the rather geeky of you who happen to have a web host who lets you have an SSH (shell or terminal) connection (both Dreamhost and Bluehost do) is to use this awesome trick for setting up a secure/encrypted proxy. I use this one all the time, it takes just a moment to set up, but is very, very secure.

If you want to see the entire CBC piece (which gives the right level of urgency I think), the video is up on the CBC site now.

And if you have more suggestions…please let us know in the comments.

Notorious Koobface worm ported to Mac OS X

Security researchers say they've been monitoring a Mac OS X version of the notorious Koobface worm, which uses advanced rootkit techniques to stealthily hijack infected machines.

Although the Mac version isn't yet ready for prime time, it is nonetheless a sophisticated piece of software that developers put a fair amount of effort into implementing. It was designed to use Oracle's Java framework to infect not just Macs, but Linux and Windows machines as well, according to Mac antivirus provider Intego. Once installed, the malware gives attackers complete control over the computer.

“While this is an especially malicious piece of malware, the current Mac OS X implementation is flawed, and the threat is therefore low,” Intego researchers wrote in a blog post published Wednesday. “However, Mac users should be aware that this threat exists, and that it is likely to be operative in the future, so this Koobface Trojan horse may become an issue for Macs.”

For that to happen, attackers will probably have to figure out how to bypass a window OS X prominently displays warning that a self-signed Java applet is requesting access to the computer. Assuming they do, or are able to trick users into clicking “Allow” anyway, they will also need to resolve issues preventing the downloaded files from installing.

Those are high hurdles. But Koobface's considerable success on Windows shows just how gullible many marks are when it comes to scams promising free videos.

Once installed, the downloaded files are stored in an invisible folder and give the infected Mac the ability to run a local webserver or IRC server and to act as an DNS changer.

Intego is calling the malware OSX/Koobface.A, while SecureMac, which also blogged about the attack, calls it trojan.osx.boonana.a.

Lists of Ultimate Wap Sites You Should Know. Enjoy!!!!!

I was searching for a few WAP sites to download ringtones, software, videos, wallpapers, software for mobiles. In the process, I came across all these links that I thought will be helpful for everyone :

 

Free Ringtones, logos, SMS services : http://twilightwap.com/mobile/

Latest Nokia ringtones : http://tagtag.com/kwapster

Get your own photos on WAP : http://wappy.to/moppylot

Keep track of your movie collection and related information : http://www.leofun.com/m/

Hungarian Portal ENCI: http://tagtag.com/enci

Images and screenshots for SonyEricsson Phones: http://tagtag.com/corradine

Free games and pictures http://users.fireflyuk.net/~queens14/wap/index.wml

Games, wallpapers, applications : http://tagtag.com/all4u

National Flags of all countries : http://tagtag.com/allflags4u

Wallpaper for Nokia 3530 : http://tagtag.com/jignesh

Free games, ringtones, screensavers : http://tagtag.com/skillz

Free graphics : http://www.mrbadger.com/artyfarty

Remove your operator logo : http://www.mrbadger.com/logowash

Wallpapers for Nokia phones : http://tagtag.com/vkfloyd

Email on your mobile phones : http://www.tlogi.com/wap/

Free Polyphonic ringtones, MP3, games, video clips, http://summerston.org/wap/index.php

Games, ringtones, wallpapers : http://abdulsathar.bizhat.com/wap/home.wml

Data Care Point: http://wap.datacarepoint.com

Free Graphics, Wallpapers, Games, Polyphonic, True, Real Ringtones.

WAP-related software download sites on the web : http://www.palowireless.com/wap/downloads.asp

Bollywood polytones, wallpapers, animations, games : www.wapgautam.somee.com/wap

Online image software : www.wap.sayni.net

Bollywod ringtones : www.geocities.com/psychonishtarian/wapsite

Pinoy : www.bestpinoy.wen.ru/main.wml

Orkut mobile login : www.tagtag.com/orkutlogin

WAP Video – http://m.vtap.com

Football livescore and football search : http://www.betscores.mobi

AOL: http://mobile.aol.co.uk

EBay: http://wap.ebay.com

ESPN: http://wap.espn.com

Google: http://wap.google.com

Google for WAP Sites: http://wap.google.com/wml?hl=en&wmlmode=wml

MapQuest: http://wl.mapquest.com

Movie Times: http://wap.hollywood.com

OAG Flight Info: http://www.oag.com

PayPal: http://www.makemoneykingdom.com

Radio Song Info: http://mobile.yes.com

SuperPages: http://superpages.com

Telco Data: http://www.telcodata.us/index.wml

Software: http://www.forexfreedownload.com

Weather Channel: http://cingular.weather.com/myweather/home#start

(National) Weather Service: http://www.srh.noaa.gov/port/

I’ll add more links as I come across new ones and if you have some to share please do comment on the box below

New N900 software update available! (PR 1.3 aka 20.2010.36-2.002)

A new software update is now available for your Nokia N900. The update adds Ovi Suite support to your N900 and makes it even easier to access and sync files and messages between your device and your desktop. In addition, we’ve added hundreds of tweaks and fixes that will make your N900 run faster and smoother than ever.
And there’s even more great news. Ovi Music Store is now accessible right from your N900 (where available). You can use your inbuilt browser to access music.ovi.com and download your favorite tunes straight to your device in DRM-free format.
Be sure to check out the latest games and apps from Ovi Store, like Angry Birds Level Packs 2 & 3, Kroll, Tower Boxx Deluxe 3D and Joiku WiFi Hot Spot. If you receive a not enough memory warning when you try to update the software, just uninstall a few apps and try again.
Also worth noting is that the phone has less lag and is faster along with Qt Applications support. Don't forget dual booting Meego and Maemo at the same time, although I'm not sure if this was implemented yet.
Happy downloading!

Don't Treat Customers As Revenue Sources.

My mobile phone provider frequently fills my time with irrelevant offers designed to bring them more revenue. My mobile phone provider also knows I make a lot of international calls. But when they implemented a new international call plan six months ago, they failed to tell me about it. As someone admitted, "they don't shout about it".

Presumably, they don't expect their customers to shout about it, but I did.

Firstly on the phone where I had to endure a whole bunch of security questions despite making it clear at the outset that I was just seeking to clarify when the plan was implemented.

That just served to remind me of the insurance company with which I once worked. They discovered that they asked a woman more than twenty scripted questions when she rang their emergency claim line before they got to the important question are you ok? At the time she was less than ok - her house was burning down in front of her along with the policy details they were demanding.

Then I tried by letter. I addressed it by name to the customer service director, but received a written response from someone else. Its first words? "Good Morning" followed by an acknowledgment that I had now signed myself up to the plan and the implication that all was now well.

That just served to give me the impression they were an outsourced worker with no authority to deal with my query (other than to fob it off). It also made me realise that this customer was in the middle of a common pincer movement comprised of a cost-cutting exercise and a revenue-maximising approach.

Yes, it maximises marginal profit. But in a world of inert (and thus continually profitable) customers, your focus should be on making them more inert. You really should avoid giving them reasons to contemplate leaving you.

How To "hack" Msn Accounts + Related Questions

I have been seeing a lot of topics lately about users wanting to know how to hack into msn messenger accounts or steal password to msn and so on. I thought I would clear up a few things so that you hopefully will get your questions answered.

Firstly. If you don't have time to learn the background information needed or you simple can't be bothered to research this topic on your own and you just want to Hack MSN then this service http://www.astalavis...service=hotmail is for you and just let the astalavista autohacking service for hotmail take care of the rest.

Hopefully you want to learn more and are continuing to read my blog entry...

Quick Q & A:

• Q: I want a program or software that hack msn passwords / accounts for me. Where can I get that and please give me this program.
• A: There are NO such program that will hack msn passwords. I mean NO available software online. The reason for this statement is simple. Think about who is developing MSN messenger.. Microsoft has thousands of programmers, have introduced numerous security standards, spend billions of dollars on their software. Do you really think that 1) Microsoft would not be able to secure one of its most used services from your little point-and-click program? Think again. 2) If a vulnerability was found it would most likely be with the software in itself (and then you only can extract your own password and not other peoples). 3) Real hacking programs don't come with a messed up graphical user interface screaming "MSN HACK MSN HACK". 4) These programs usually ask for YOUR username / password in order to hack other peoples account. If you are smart enough to give away that information you have just been the victim of a social engineering attack. Stupid...
• Q: How can I get msn passwords?
• A: I am assuming you are not interested in your own password. 1) Just ask them for their password. This is known as a "social engineering attack" and is the most effective means of stealing information. "Kevin Mitnick" might be a nice thing to search google for. An example: "Hello, I'm calling from msn tech support. We are currently changing all the passwords and are wondering if you have recieved information about this? No? Then we will have to do it manually... What is you password and username?" 2)Trick the victim into running a file you send them. This file would then contain a trojan that monitores keystrokes and transmits it back to your computer. There are numerous software available for that. Just use google. 3) If all that fails or you again can't be bothered learning "how to hack" by educating yourself. You can again use the autohack service located here: http://www.astalavis...service=hotmail
• Q: How do I learn how to hack?
• A: You start by learning how to program. Start with a simple programming language such as Python or Java (not so simple, but anyway). Read books such as Practical Programming: An Introduction to Computer Science Using Python http://pragprog.com/...cal-programming and Learn to Program, 2nd Edition http://pragprog.com/...ram-2nd-edition Once you have read these books you should start learning SQL and trying to understand what SQL Injection is.
• A v2: Hacking is just knowing a programming language so well that you can see problems that the original developers did not see. Example: A developer that does not sanitize the input to the program, may have create a vulnerable attack point to injection attacks. The hackers SQL injection is dangerous because he/she knows that the developer might not have programmed the application correctly and by inserting values that the original developer did not intent to be handled. One can perform a "hack". In is simplest form this will be entering a string ('abc') when the software / web page wants a number as an input.
• 
  
• Q: Teach me how to hack!
• A: That is not a question and you will recieve no help. Start by asking!
• Q: CAN you teach me how to hack?
• A: Still no! If you don't try to learn about SQL atleast and programming in general, you will NOT understand what I am telling you anyway. One must have a common background knowledge in order to teach anything to anybody.

Note: One thing to think about is that "point and click" hacking is dangerous. You should always know what you are asking the program to do. It's still illegal and you WILL be caught because you don't know what you are dooing. Educate yourself, help others. Don't be destructive, be creative. If you are serious about learning hacking you should download backtrack: http://www.remote-ex.../backtrack.html and start webGoat from OWASP: http://www.owasp.org...WebGoat_Project This way you can educate yourself by using your own computer instead of ruining someone else's day.

Advice: If you are so desperate to hack msn passwords, email accounts and so forth I assume you want to spy on your girlfriend/boyfriend. If you are gooing to the step of trying to hack their private accounts you should step back and think about the trust issues you have and consider dumping that person. It's just not worth it.

Web 2.0 Expo: Top ten Web hacking techniques

A large portion of the Web 2.0 Expo attendees are focused on content. They want to create better, more engaging content for social media programs and Web engagement with their customers. But the Web and application developers behind this content need to know how to secure it. This is what Jeremiah Grossman, CTO and founder of WhiteHat Security, discussed today during his presentation, “The Web Just Got A Little More Dangerous.”

“I say a little more dangerous because the Web was already broken,” he said.
Grossman stressed that the more we rely on the Web, the more attractive the Web becomes as an attack vector. Companies need to be concerned both about data security and potential brand damage when it comes to Web security. He shared with the audience a top ten — or most dangerous — list of Web hacking techniques from 2008 of which developers especially should be aware:

10.  Flash Parameter Injection - Using cross-site scripting, this can grant the attacker full control over the page, as well as control over other objects within the movie. Best defense, when you’re developing flash applications be sure to sanitize user input according to context before its reflected back to the user.

9. ActiveX Repurposing - Multi-staged attack to get code execution on victims who were running a vulnerable and popular SSL-VPN attack. Defenses are making sure ActiveX makes use of Sitelock wherever possible and restrict Active X to the maximum degree possible.

8. Tunneling TCP over HTTP over SQL-injection - The best defense against this kind of attack is a good network architecture, solid application design and database hardening.

7. Cross-domain leaks of site logins via authenticated CSS - Checks the contents of a stylesheet property across domains to determine whether the victim is logged in to a given Web site. Do not store anything user-sensitive in a CSS style sheet. It won’t prevent the bad guy from knowing the user uses your site, but it will prevent them for knowing if they are logged in.

6. Abusing HTML 5 structured client-side storage. Attackers could steal or modify sensitive data online or offline. If a Web app uses this kind of client-side storage is vulnerable to attacks. Avoid saving sensitive data on the users machine and clear the client-side storage whenever possible; regularly check the content of the HTML5 client-side storage.


5. A different Opera - Exploit an XSS in Opera, however, upgrading to Opera 9.62 versions and up should take care of the problem.

4. Clickjacking / videojacking - An attacker can invisibly hover buttons, images or links below a user’s mouse so that when a user clicks on what they think is a trusted button or link, but they are actually executing an embedded code . Without the user knowing, it can even capture pictures and video, and even audio. Clickjacking enables corporate espionage, government surveillance, home user spying, etc.  Upgrading to Adobe Flash 10 can help. Also, frame-busting code to make sure any pages you deem important are not as susceptible for clickjacking. Internet Explorer 8 also has some anti-clickjacking functionality.

3. Safari carpet bomb - Allows an attacker to litter a Windows’ user’s desktop or a Mac users’ desktop with arbitrary files and malware. Windows users should download the latest ersion of Safari.

2. Breaking google gears’ cross-origin communication model - The cross-origin comm model could be bypassed so an attacker could gain access to sensitive resources of the victim in other Web sites (even those that do not use Google Gears). Update Google Gears to minimize risk.

1. GIFAR - Content ownership issue. The attacker combines a GIF image file and a Java archive (JAR) that contains class files for a Java Applet. A Web application will then allow the upload the image to a server, but the malicious applet code can be executed. To protect against this do not accept file uploads. Or, upload you get convert it to another image no matter what (Facebook does a good job with this). For an end user, disable the third-party browser extensions and install the latest JVM and remove older versions.

Kick off your day with ProHackingTricks daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.