Firesheep hack catches out Mr Demi Moore
aplusk minus for security
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Ashton Kutcher's Twitter profile was hacked on Wedesday to spout pro-SSL graffiti.
Instead of the usual updates of the life of Mr Demi Moore, the aplusk account regaled its 6.4 million followers with security warnings, such as the one below.
Ashton, you've been Punk'd. This account is not secure. Dude, where's my SSL?
The actor was attending the TED awards (the tech world's equivalent of the Oscars at the time). The most likely explanation for the mischievous hack is that Kutcher made a Twitter or Firefox update using an open wireless connection at the show.
This, in turn, allowed someone to capture his login credentials before posting messages in his name, probably using a tool called Firesheep.
Firesheep neatly illustrates a well-known risk that previously had received little mainstream attention. Both Twitter and Facebook as well as browser developers are moving towards mandating logins through more secure SSL links, but this process is taking time, presumably prompting aplusk's high-profile hacker to push the message out a bit further – a harmless celebrity hack.
Alternatively Kutcher himself may have simulated the hack to try and make a point about Web 2.0 security.
More on the prank (if that's what it is) can be found in a blog post by net security firm Sophos here. ®
COMMENTS
"...Kutcher himself may have simulated the hack..."
That'll be easy to prove. He'll have fallen over and choked on his bubblegum while he was doing that.
Re: Why is this new?
Because FIreSheep makes it easy, obviously.
Most people with the knowledge to hijack sessions have got better things to do.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
