Open public wi-fi is not safe, thousands of amateur hackers are watching, made easy by a new hack tool called Firesheep…
Firesheep:
This tool takes almost everything you need to be a Wi-Fi hacker and makes it look like an everyday program that anybody can use. And, as it transpires, a lot of people are using it.
How it works is an individual running Firesheep can use it to scan all the information being exchanged on the public Wi-Fi. What happens next is a list pops up detailing all the accounts being used and accessible. At that point the Firesheep user can link in and do whatever the user can.
Many accounts associated with websites such as Facebook, Twitter, Amazon, Google, various e-mail providers and several other types of services have been determined to be vulnerable through the use of Firesheep.
Gregg Keizer reports on Computerworld.com that “Although it’s common for sites to encrypt user log-ons with HTTPS or SSL, few encrypt the actual traffic.” This allows the session or stored cookie to be broadcast over the Wi-Fi, and cookies can contain a lot of information about a user. Once a hijacker obtains the information contained in a cookie, the captor can do almost, if not everything, the user can do.
As public Wi-Fi becomes less of a novelty and more of a given, every day millions of individuals surf the web in public hotspots. This means, thanks to Firesheep, anyone is at risk to have their accounts hijacked not only by expert hackers, but the average computer user as well when using non-password protected public hotspots.
How to protect yourself:
Don’t use public unsecured wi-fi. If you do use it, log into a VPN. VPN services are availble for abut $10 a month. If you are on a smart phone, use 3G connection instead of unsecured wi-fi. Only log into sites with HTTPS SSL connection such as like Gmail has. This problem will not go away until all sites change to have better security with all HTTPS links when logged in.
Unsecured Wi-Fi is like an open door to mischief. Make sure your WI-Fi connection is secured with a password. Contact Mike for an appointment.
Sources:
tech.blorge.com, guardian.co.uk, zdnet.com, wfryer.posterous.com
