Black Hat Report: All Your Wifi Are Belong To Us
The Black Hat conference is in full swing down in Las Vegas and already there’s some scary stuff coming out, the BBC reports that one demonstrated exploit allows the attacker to see cookies via wifi.
Robert Graham of Errata Security has created two programs, named “Hamster” and “Ferret,” which sniff wifi traffic and grab cookies as people log in to and out of their webmail or social network accounts.
Although the attack doesn’t allow the perpetrator to reset your password, it does allow them near full access to your accounts, despite that fact that the cookie is encrypted.
Naturally, if you’re using a secure connection to login via https, then you aren’t at risk. If you’d like to force secure connections to GMail and your browser supports Greasemonkey, check out Mark Pilgrim’s handy script.
If you’re not a GMail user, check to see what sort of security options your favorite webmail and other online accounts offer, and remember nearly anything you do on public wifi that isn’t to a secure site can be snooped using Graham’s tools.
If you’d like to check out Hamster and Ferret, Graham says they’ll be available later this week from the Errata site.
