Firesheep: Baaaaad News for the Unwary
Summary: Firesheep, a Firefox add-on released at the Toorcon hacker conference in San Diego, lets users on the same wired or wireless network capture session cookies from sites like Facebook and Twitter, which send post-login data in unencrypted plain text. Krebs tested it on two wireless routers with and without WEP/WPA and found it only captured his own logins until combined with a tool like Ettercap, which routes other users' traffic through the attacker's machine.
Key Takeaway: The weakness is not new - session and cookie hijacking has been discussed since at least 2003 - but Firesheep turns it into a point-and-click attack, and the only effective fix Butler names is full end-to-end HTTPS encryption, which popular sites had not adopted.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026