Feeds

Browser add-on updated to slaughter Firesheep

HTTPS Everywhere: the missing protection

SANS - Survey on application security programs

The Electronic Frontier Foundation has updated its popular web browser security tool to guard against attacks waged by the Firesheep script-kiddie snoop kit.

HTTPS Everywhere 0.9.0 has been updated to force websites such as Facebook and Twitter to activate a secure flag in cookies used to authenticate users on those websites, said EFF Senior Staff Technologist Peter Eckersley. By forcing the sites to send the authentication cookies only when a connection is protected by secure sockets layer encryption, man-in-the-middle attacks like the ones launched by cookie-jacking Firesheep are thwarted.

“By forcing cookies to Secure, HTTPS Everywhere adds protection against Firesheep that site operators should have but failed to provide,” said Chris Palmer, an EFF technology director who also worked on the project.

Although the web has been vulnerable to such attacks for more than a decade, many webmasters still don't follow best practices when granting users access to restricted parts of a site. A case in point, the latest version of HTTPS Everywhere breaks parts of Facebook that can only send authentication cookies over unprotected HTTP channels. That means that using the updated tool with Facebook chat and certain apps isn't possible – at least until changes are made to parts of social networking site.

The update also works with several widely used cloud-based services, including Amazon storage service s3.amazonaws.com and twimg.com, reducing the problems when one of those sites is used by Twitter, Facebook or another website. It has also been updated to work with more websites, including Bit.ly, Cisco, Dropbox, Evernote and GitHub.

HTTPS Everywhere is a Firefox plugin that, like NoScript, is a must-have for security-minded users of the open-source browser. It was released in June by the EFF and members of the Tor Project. It has been downloaded more than 500,000 times.

The code behind the add-on is based in part on the Strict Transport Security response header that's under consideration by the Internet Engineering Task Force as a way for websites and browsers to exchange data only when an encrypted connection is being used. Eventually, the technology will probably be widely available. For now, it's available for only a small smattering of websites and browsers. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
NSA denies it knew about and USED Heartbleed encryption flaw for TWO YEARS
Agency forgets it exists to protect communications, not just spy on them
prev story

Whitepapers

Designing a defence for mobile apps
In this whitepaper learn the various considerations for defending mobile applications; from the mobile application architecture itself to the myriad testing technologies needed to properly assess mobile applications risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.