6

What methodologies do people recommend for mitigating the 'Firesheep' method for website applications?

We have thought about this and from a usability perspective, other than encrypting all traffic to a site, mitigating the attack can be somewhat of a problem for web developers.

One suggestion we came up with was to use path based cookies, and encrypt traffic for a specific path where account operations or personalised interaction happens. This however complicates usability however, in as much as the rest of the site (the un-encrypted - un-authenticated) bit does not know who the user would be.

Does anyone have any other suggestions for mitigating this vector of attack, while maintaining a usable level of usability?

3

4 Answers 4

7

Firesheep is nothing new. Session hijacking has been going on for more than two decades. You don't need "encrypt" your cookie, thats handled by your transport layer. Cookies must always be a cryptographic nonce.

Usually hackers just set their own cookie by typing this into the address bar javascript:document.cookie='SOME_COOKIE', FireSheep is for script kiddies that fear 1 line of JavaScript. But it really doesn't make this attack any easier to perform.

Cookies can be hijacked if you don't use HTTPS for the entire life of the session and this is apart of OWASP A9 - Insufficient Transport Layer Protection. But you can also hijack a session with XSS.

1)Use httponly cookies. (Makes it so JavaScript cannot access document.cookie, but you can still do session riding with xss)

2)Use "secure cookies" (Horrible name, but its a flag that forces the browser to make the cookie HTTPS only.)

3)Scan your web application for xss using Sitewatch(free) or wapiti (open source)

Also don't forget about CSRF! (Which firesheep doesn't address)

7
  • Yes. It's nothing new. The New as you mention is that the skript kiddies can get in on the act. Which is why it's potentially such a problem. I want to protect my users.
    – pobk
    Oct 25, 2010 at 18:07
  • @pobk You should be enabling these security features before Firesheep. This tool doesn't change anything.
    – rook
    Oct 25, 2010 at 18:15
  • Our application is as secure as we can make it (it complies with PCI DSS)... We're just looking beyond at protecting our users.
    – pobk
    Oct 25, 2010 at 18:21
  • @pobk The pci-dss does require regular scans, but is your web appreciation enabling the 2 cookie flags I talked about?
    – rook
    Oct 25, 2010 at 18:29
  • Secure cookies are not enabled since the session is used for personalisation. We don't want to run the entire site from HTTPS... that would be a nightmare for usability. Usability and site personalisation becomes infinitely more difficult.
    – pobk
    Oct 25, 2010 at 19:36
0

Well I found an interesting article on GitHub that describes a method of mitigating the firesheep attack.

https://github.com/blog/737-sidejack-prevention

0

Anybody tried taking advantage of the "Web Storage" in HTML 5 to store a shared key (passed during SSL-encrypted responses during authentication) that is used by javascript to alter the session cookie over time?

That way, the stolen (unencrypted) session cookies would only be valid for a short amount of time.

My guess is that Web Storage is segmented by port (in addition to host), so it wouldn't be possible. Just throwing that idea out there in case anybody wants to run with it.

1
  • The attacker then just has to inject some javascript into one of the HTTP responses, that reveals the shared key.
    – caf
    Nov 8, 2010 at 14:36
-1

When user logs-in, store the IP-address in the session.

On each subsequent request from this session, check that the IP-address matches the one stored in the session.

2
  • I'm afraid that won't work. The remote IP address would be shared in the instances where firesheep would be prevalent
    – pobk
    Nov 15, 2010 at 9:19
  • Even if you also store the value of the X-Forwarded-For HTTP header along with the IP-address?
    – EA.
    Nov 17, 2010 at 6:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.