Feeds

Firefox extension detects FireSheep snoop software

Unleash the BlackSheep

The Essential Guide to IT Transformation

Researchers from security firm Zscaler have published free software that detects when users' web connections are being monitored by a controversial tool that steals log-in credentials from Facebook, Google and dozens of other websites.

Dubbed BlackSheep, the Firefox extension alerts users when computers on a local area network are using FireSheep to steal unencrypted cookies the websites use to grant users access to their account pages. When BlackSheep detects the snoop software in a hotspot or other open Wi-Fi network, it displays a message that reads “Somebody is using FireSheep on this network.” It then displays the LAN IP address of the offending party.

BlackSheep's release comes two weeks after security researcher Eric Butler published FireSheep in an attempt to expose the bovid practices of Facebook and other websites that don't bother to encrypt session cookies used to authenticate their users. With the exception of Twitter and a handful of Google services, few popular websites offer the end-to-end encryption needed to foil such attacks, a shortcoming that seemed to be lost on the masses until FireSheep made it easy to exploit the weakness.

FireSheep listens to web traffic for instances when users on an unsecured network log in to known websites such as Facebook, Google, and Yahoo. Although such websites encrypt the login name and password entered by the user, most send the corresponding session cookie in the clear, making it easy for people performing man-in-the-middle attacks to appropriate them and use them to access the user's account.

FireSheep had been downloaded 659,620 times at time of writing, according to figures supplied by Butler.

BlackSheep, which is based on the FireSheep source code, works by broadcasting fake session IDs over the network and then monitoring to see if other machines use them to sign in. By default, it checks a network every five minutes, but can be configured to send out faux cookies more or less frequently as preferred by the user. Zscaler has more information here.

Since FireSheep's release, Microsoft appears to have added detection for it to its antivirus software. This seems like a reactionary and futile move on the part of Microsoft, since detecting the snoop software will in no way protect users from the underlying vulnerability. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.