Firesheep and session hijacking

Overview

In 2010 a web developer named Eric Butler did the world a favour. Concerned that websites were failing to protect their users, Butler created a simple Firefox extension called Firesheep to demonstrate just how easy it is to steal the login credentials of people using unencrypted websites over public wireless networks.

In fact it is so easy anyone could do it.

Since then Firesheep has gone mobile. FaceNiff is an Android application that allows users steal login details for many social media sites. Importantly, it also works over WPA-encrypted wireless networks.

This report reveals how many firms are still failing to protect their users from sidejacking by implementing site-wide SSL encryption, and the steps users need to take to protect themselves.