Firesheep hack catches out Mr Demi Moore
aplusk minus for security
Posted in Enterprise Security, 3rd March 2011 14:04 GMT
Free whitepaper – Enabling Datacenter and Cloud Service Management for Mid-Tier Enterprises
Ashton Kutcher's Twitter profile was hacked on Wedesday to spout pro-SSL graffiti.
Instead of the usual updates of the life of Mr Demi Moore, the aplusk account regaled its 6.4 million followers with security warnings, such as the one below.
Ashton, you've been Punk'd. This account is not secure. Dude, where's my SSL?
The actor was attending the TED awards (the tech world's equivalent of the Oscars at the time). The most likely explanation for the mischievous hack is that Kutcher made a Twitter or Firefox update using an open wireless connection at the show.
This, in turn, allowed someone to capture his login credentials before posting messages in his name, probably using a tool called Firesheep.
Firesheep neatly illustrates a well-known risk that previously had received little mainstream attention. Both Twitter and Facebook as well as browser developers are moving towards mandating logins through more secure SSL links, but this process is taking time, presumably prompting aplusk's high-profile hacker to push the message out a bit further – a harmless celebrity hack.
Alternatively Kutcher himself may have simulated the hack to try and make a point about Web 2.0 security.
More on the prank (if that's what it is) can be found in a blog post by net security firm Sophos here. ®
Free whitepaper – Enabling Datacenter and Cloud Service Management for Mid-Tier Enterprises
Enabling Datacenter and Cloud Service Management for Mid-Tier Enterprises
Secure Mobile Working
Linux on the Desktop
The Register Guide to Web Security
Risk and Resilience
