Firesheep Hijacks Facebook, Twitter Cookies

Did you think you were safe when logging into your social media accounts? Think again.

A free Firefox extension called Firesheep was released this week that exploits a hack known as sidejacking to help users gain access to the social media accounts of other people on the same network. The creator, Eric Butler, developed this extension “to demonstrate just how serious this problem is.” The exploit, which hijacks the unencrypted cookie files sent between the user and the website, can be utilised on a large number of popular websites including Google, Facebook, Twitter, Flickr and Tumblr.

Most websites encrypt the username and password you use to log in when they are transmitted to the server. However, they often fail to encrypt other data including the aforementioned cookies, which, if obtained by a hacker, can be used to ‘spoof’ a log in session and access your account fraudulently.

We believe that this software has been written to raise awareness of the problem and compel the faulty sites to fix the issue as possible. However, many have noted that fully encrypted all communication between the user and the server can increase the required bandwidth by up to 20 times, making full encryption very costly.

Are you concerned about the security of your online accounts? We advise you to avoid logging in to sensitive websites on public wireless hotspots until the exploit has been rectified.

Do you think Mr Butler was right to release this software?

Leave a comment below.