Check this FF addon

Quote:

---

Now the bad news; it’s been made available a Firefox add-on you can install that will do everything for you: sniff the traffic, gather the cookies around and show you the different ’stolen’ cookies, so you only have to click on them to steal the session. Easy, isn’t it? Even Netkairo, the Mariposa guy, would be able to do such thing.

---

I thought this was a good read ...

http://pandalabs.pandasecurity.com/f...ng-my-cookies/

and ... the counter! http://download.cnet.com/HTTPS-Every...-75211397.html

Been using it and does the trick.

EDIT: Better link: https://www.eff.org/https-everywhere

Brilliant and scary.

Interesting!

I mostly use RJ45 connections but I am just starting to install wireless so the information is useful.

I don't really know what to say about the skiddie tool........in one sense it is a bad thing, as a lot more people will be vulnerable now that skiddies have been brought into the frame.

On the other hand it has brought the issue to people's attention?

All I can suggest is that you let everyone you are in contact with who uses WiFi know about it.

Nice post Cider!

EDIT:

Hmmmmm

The skiddie tool is a FireFox plugin, as is the solution; yet all other browsers expose you to this vulnerability?

Does anyone else get the distinct aroma of rodent?

This is totally shocking ... I honestly dont know what to say.

This is kind of forcing us to use FF to counter this unless you want to https everything manually. In the HTTPS anywhere addon there are quite a few ones built in but you can write your own but not every server has this capability.

So whats the answer?

Hi Cider,

Quote:

---

So whats the answer?

---

Until the other browsers catch up I think that the only one is to use FireFox, as the attack is against your wireless traffic rather than the OS or an application. I believe that this only applies to public hotspots though so the other solution is just don't use them.

I have been looking at my home setup and the hub will support 4 RJ45 cable connections, one USB connection, and Wireless (a "hub" is what we call a combined router and ADSL modem). Now, the RJ45 and USB are cable connects to the hub, and the hub connects to the ISP via the copper wire telephone cable. The connection between the hub and the telephone is a regular RJ11 cable. No worries there, as the traffic cannot be intercepted like omni-directional wireless. [OK,OK, the latest version of TEMPEST or whatever, but if the spooks are after you I think that you must have more pressing problems?]

OK, if you are using WEP you have always been vulnerable, it's just that this skiddie tool has made it a hell of a lot easier? You really need to go to WPA, and set a strong encryption algorithm?

At home, I would recommend cable connecting to the router or directly to the DSL modem if you are doing anything like online shopping or banking.

My wireless connections could be sniffed by someone within range, but my router is encrypting the traffic with WPA2 PSK. When I look at what is going on around me, I see several hotspots that are using WEP :rolleyes:

I really don't understand that; if their router doesn't support anything better then all they have to do is call their ISP and they will be sent a free one that does!

Just my thoughts right now, and I am no expert on the subject. :)

Never been a fan of wireless anyways.

I have instructed IT to move from WEP to WPA :P

Yes, I have never been a WiFi fan either, although the technology seems to have improved a lot over the past few years since broadband took off over here.

1. The ISP's earlier hubs would only support WEP
2. Cable connect problems (RJ45/RJ11) are usually easier to troubleshoot than WiFi ones. I even have a cable tester!
3. I am a dinosaur :eek:

I am now using some WiFi connections. This is because I have some older machines that do not have a network port, and I have found a source of cheap USB wireless adapters.............. they look like and connect the same as a USB memory stick. Cheaper and a lot easier that messing around with internal cards, and they can be ported from machine to machine so I only need two: one for upstairs and one for downstairs.

I have put the new laptop in our library, which would be a very long run for an RJ45 connection (although it does have the port) and it has built in WiFi and BlueTooth. Also it means that I can use computers both upstairs and downstairs at the same time. For some reason the telephone system will not support 2 RJ11 connections.

I can see WiFi as being very useful where a cable solution would be messy or problematic. If I do internet shopping I always use cable connect via a USB dial-up ADSL modem. That way there is no chance of a signal being broadcast.

Quote:

---

I have instructed IT to move from WEP to WPA :P

---

Actually I was not being facetious when I mentioned that. Over here I believe that all the ISPs that give you a free hub, ship it with WEP enabled by default; you have to manually change it to WPA yourself. People just take them out of the box and connect them as is................that is why I see so many WEP connections :)

Quote:

---

I mostly use RJ45 connections but I am just starting to install wireless so the information is useful.

---

I am thinking that arp poisoning would make this possible on a wired/switched network.

Quote:

---

I am thinking that arp poisoning would make this possible on a wired/switched network.

---

Quite probably, at any rate there are plenty of other vulnerabilities and exploits that will affect wired systems. It is just that this skiddie tool appears to be aimed specifically at sniffing wireless traffic.

And the reason I mostly use RJ45s is because I already have a load of them, and I am too astute as to waste good beer vouchers on wireless cards :drink::D

FYI it's usuable on both wep & wpa :)

True, as this is to do with the connection security, rather than the underlying encryption.

You should still use WPA rather than WEP if possible?


Hmmmmmm..............."get behind me Satan!"

I am refurbing a few old boxes...............maybe set one up on my 1.0 hub (only does WEP) and serve them with Goatse in plain?

:lildevil::lildevil::lildevil::lildevil:

Where do you get all these old boxes? Ive been looking on my side to get some old ones but cant find any :(

Quote:

---

Originally Posted by Cider

Where do you get all these old boxes? Ive been looking on my side to get some old ones but cant find any

---

I can't speak for nihil, and I don't know anything about Africa. But here in Texas, I can get an old computer nearly any day of the week on craigslist -especially if I make a post requesting old computers.

Also, there are several places that "recycle" computers here in Corpus Christi.

Another way to go would be to call local computer shops - they'd probably just give you all of their junked computers (which may be refurbished.)

Garage Sales/Rummage Sales/(actual)Going Out of Business Sales are other good places to hunt. Flea markets are good too, and if you really wanted to, you could post ads in local stores - "I Pay Cash for Old Computers" - of course, I wouldn't pay much for them - maybe $5-$10?

If you try all of these things, you may end up with more old computers than you know what to do with! I have accumulated so many throughout the years... Nowadays if my place on the wall that I have set aside for old computers gets full, I just give them away via craigslist.

Anyway, just noticed your post - hope that helps. :thumbsup:

I have a ton of old computers. I am saving some of them for the next time I go out shooting with my friend. It is amazing what an M44 will do to a tower. Not to mention the AK-47 [70 round drum], M16, G3, etc. He works at a gun shop. He provides the firearms, I chip in on ammo, and provide the targets. :D


:shootem: :drink:

Oh yeah, almost forgot... anyone been following the firesheep vs. blacksheep arms race? Pretty entertaining.

yeah im watching it. getting crazy. this addon combats the other. lol! it will never stop will it?

welp at least it will keep the skiddies entertained, and i will miss the occasional how do i steal the GF cookie session so i can "Ghost" my way into her account to spy on her cause i'm a paranoid little boy. :D :drink: