What are Firesheep Attacks & How to Protect Yourself (10-Ways)

Michelle Wilson - November 22, 2021

Online safety needs to remain a top priority for anyone browsing online. For many, the ability to access the internet from virtually anywhere is something we take for granted, often forgetting the potential attacks that can occur if security measures aren’t in place. With increased accessibility through public and open networks, more data is at risk of exposure than ever before.

What is Firesheep, and How Does It Work?

If you’re unfamiliar with the term, Firesheep is a Firefox plug-in that automatically starts session hijacking attacks. The extension uses a packet sniffer to intercept unencrypted session cookies from websites. This plug-in uses unsecured Wi-Fi networks to gain access to these cookies, which collects the identity belonging to that victim. The type of information disclosed varies, depending on the collected cookies. Social media networks or other platforms failing to use SSL are at significant risk. All collected identities display in a sidebar on Firefox, complete with sensitive data and personal details. The hacker clicks on the victim’s name, which takes over the session.

Information collected varies by user, but most often include social media accounts like Facebook or Instagram and other account details from unsecured websites. Eric Butler indicates the add-on has been downloaded nearly 220,000 times. If that’s any indication of future hacking attempts, it’s going to become quite popular moving forward.

Protecting Yourself Against Attack

Thankfully, users aren’t defenseless against Firesheep attacks. The easiest defense method is avoiding public Wi-Fi networks, particularly ones that aren’t encrypted and don’t require a password to use. Wi-Fi is arguably the easiest access method, but it’s not the main culprit for online vulnerabilities. The most significant issue is the lack of security offered through standard websites you’re browsing.

When asked, Chet Wisniewski, a senior security advisor, indicates that using a VPN (a virtual private network) is the best way to connect to a public Wi-Fi network. Although many business individuals use a VPN when connecting to an office network on the road, many forget the security feature when browsing online.

Most VPN services are a monthly subscription, ranging from five to ten dollars a month. This feature will prevent anyone running Firesheep from sidejacking your sessions. A VPN encrypts all traffic from your device to the internet in general. Experts warn that this method isn’t fool-proof, still leaving your information open to any cookie hijack attack.

In addition to the VPN, here are ten other methods to prevent a Firesheep attack while continuing to protect your personal information online. These methods work on public networks, where individuals are increasingly vulnerable to device compromise.

Avoid Sites that Stick To or Revert To HTTP

Any website that uses unencrypted platforms (HTTP) or revert to HTTP after login are prime targets of Firesheep attacks. Anyone capable of intercepting the traffic can easily record and repurpose the cookie, identifying an individual on subsequent requests. As a result, hackers are able to hijack your authenticated session.

Websites like Amazon, Twitter, Facebook, and PayPal are known for being vulnerable, but other platforms are vulnerable too. This vulnerability gives Firesheep the ability to grab the cookies as well.

Stop Leaking Cookies Over HTTP

Servers must set a Secure flag when instructing browsers to send cookies over SSL. Most websites fail to set this flag, letting cookies leak over HTTP. A URL entered without the secure prefix might cause your browser to send your cookie over the HTTP before redirecting. It’s impossible to determine which sites make this mistake unless you have Firesheep and test it yourself.

Always Log Off Websites

When browsing online, it’s always wise to end your session when you’re finished. Whether you’re using a public PC or you’re trying to protect your information, logging off can invalidate a session cookie secured by Firesheep. Some cookies will store for weeks, meaning the session may continue to be vulnerable to damage.

Avoid Unencrypted Wi-Fi

Encrypting information is critical in protecting your information online. Not many hotspots offer WPA2-Enterprise, significantly reducing the likelihood of being hacked. WPA2-Personal also provides encryption, but it starts with a shared password. This shared passphrase does little to prevent snooping at public hotspots.

Only Use Trustworthy Hotspots

Using WPA2-Enterprise allows users to check the 802.1X server certificate, making it difficult to impersonate a hotspot. With an open hotspot, users have no way of knowing whether the access point is trustworthy. Even still, it’s a good idea to verify any SSL portal certificates and pay attention to browser warnings. Failing to do this might result in sending traffic through an Evil Twin (a fraudulent Wi-Fi access point), including Firesheep.

Stick to Secure LANs

Always remember that Firesheep is not limited to Wi-Fi. Sidejacking attempts can occur inside networks and Ethernet LANs, anywhere with unencrypted traffic. When users plug into a public LAN from a business center or hotel room, traffic can become intercepted by other guests on the same network. All network operators should prevent eavesdropping, inter-client communication, and ARP spoofing, whether wired or wireless.

Consider Fighting Fire with Fire

While this method doesn’t work for all potential threats online, performing counterattacks against Firesheep might be highly effective. The FireShepherd sends packet bursts every half second, which ultimately crashes Firesheep and prevents prolonged sidejacking. This tactic may discourage casual attackers but will slow the entire LAN. Unfortunately, this may also elevate to a DoS attack, preventing network use overall. Unless the network belongs to you, it’s probably not an ideal approach.

Establish Your Own Secure Internet Connection

As an application layer attack, Firesheep is best handled by network-independent solutions. For example, users might use the same secure Internet connection every time they roam. The computer can be tethered to the 3G smartphone or using the phone as a secure mobile hotspot.

This tactic might stop other individuals using the public network from stealing your traffic, but it exclusively relies on a provider’s network.

Insist on Full-Time SSL

Another way to potentially protect yourself from Firesheep is by enforcing proper full-time use of SSL for all sensitive websites. Full-time SSL can be arranged using Force-TLS or HTTPS-Everywhere. Both options are Firefox extensions, meaning you’ll need another option if you’re using a different browser. It’s important to note that these extensions only work with a predefined list, meaning you’ll have to add sensitive sites you use individually.

Protect Everything with VPN

When you can’t be certain sensitive websites, use SSL properly, send all traffic through an adequately configured VPN tunnel. Always make sure that the tunnel offers authenticated and encrypted options, preventing HTTP leaks as it travels. When deployed correctly, VPN tunnels can eliminate the risk of sidejacking, regardless of network, websites used, or ongoing vulnerabilities.

Conclusion

While Firesheep is not a new attack, it’s definitely raised awareness of the ongoing vulnerabilities at play within the industry. The end goal for website operators needs to hold recognition for vulnerabilities that exist within the current workings. Users also need to accept ownership in these aspects, increasing security on their end that they may not have considered previously.

Security issues can pose ongoing issues for users, particularly when sensitive data is hijacked. As the reliance on social media networks continues to climb, protecting user details keeps prying eyes away from personal data. Increasing security measures, particularly when browsing on shared networks, can minimize these risks. While each of these options may not singularly remove all risk of the Firesheep attack, it can mitigate the risk when used with other efforts.