New threat when using your laptop etc at an internet café

[butters]

in an article by Steve Bass, he not only names the hacker tool but actually encourages others to try it out by providing a link and telling people to so they get weirded out and do something to protect themselves from it.

There's a pervasive, serious Facebook and Twitter exploit that leaves you wide open to any and every hacker who can download a simple-to-use, free tool called ********. It's a threat if you're using an unsecured, public Wi-Fi network, typically available at an Internet cafe, airport, hotel, or RV campground.

Last week TechBite paid subscribers got the first dispatch about this in the Extra newsletter; here's a more detailed version.

The Hacking Tool
********* is an HTTP session hijacker that runs as a Firefox extension and sniffs around for cookies on any unsecured Wi-Fi connection.

When you log onto Facebook, Twitter, or any of over 26 other social networking sites, your computer sets a session cookie. A person running ********* can read the cookie and log onto your Facebook page. Then he (okay, or she) can do anything from your Facebook account, such as send e-mail or write on a wall.

Every browser is vulnerable to the exploit.

The one saving grace is that ********* doesn't have access to your password -- that's encrypted and safe. If the hacker tries to change it from within Facebook, you'll get an e-mailed alert. But everything else on Facebook is fair game.

he goes on to say:

Who's Behind *********?

********'s author has an open agenda: to force social networking sites to make the entire online session secure, just as the online banking sites do. (When you're on PayPal or your bank's site, you'll see an icon of a lock somewhere on your browser, and the link will start with "https" rather than just "http.")

I think it's a dang stupid way of getting people to see the problem, but what do I know?

I'd have to say he uses a 'dang stupid method of getting people to wise up to the problem'.

 

[Beco]

how do you get this, *********?

 

[firespin]

It reads like the name of my livestock, prized for their wool.

 

[phrodeau]

It reads like the name of my livestock, prized for their wool.

I sure hope you don't mean Goatse.

 

[Sonny Limatina]

I sure hope you don't mean Goatse.

I always hope no one ever means goatse.

No idea why Lit asterisked this one. It's the words 'fire' and 'sheep' together in one compound noun.

 

[butters]

how do you get this, *********?

i asterisked the name out as it made no sense to advertise the name of the app here

It reads like the name of my livestock, prized for their wool.

I always hope no one ever means goatse.

No idea why Lit asterisked this one. It's the words 'fire' and 'sheep' together in one compound noun.

Lit didn't, i did, so no stupid fucker thought 'oh yeah, i'll get that and fuck with people's internet accounts'

which was my point about the guy who wrote the article in the first place.............

sigh

 

[Sonny Limatina]

i asterisked the name out as it made no sense to advertise the name of the app here





Lit didn't, i did, so no stupid fucker thought 'oh yeah, i'll get that and fuck with people's internet accounts'

which was my point about the guy who wrote the article in the first place.............

sigh

Oh. Sorry about that. To make it up to you, I'm going to tell you where I hid a small suitcase filled with money when I lived in England. If you go to the fifth floor of ********, you'll see a ******** underneath a *******. Simply lift the handle, remove the ******** and the money is yours.

 

[butters]

Oh. Sorry about that. To make it up to you, I'm going to tell you where I hid a small suitcase filled with money when I lived in England. If you go to the fifth floor of ********, you'll see a ******** underneath a *******. Simply lift the handle, remove the ******** and the money is yours.

you ******

 

[Spider Rand]

in an article by Steve Bass, he not only names the hacker tool but actually encourages others to try it out by providing a link and telling people to so they get weirded out and do something to protect themselves from it.



he goes on to say:

I'd have to say he uses a 'dang stupid method of getting people to wise up to the problem'.

Also from the article, a few protective measures -

Three Sure-Fire Solutions:

It was difficult to find a product to defeat Firesheep that I liked and trusted. Most of the tools I tried — VPNs with proxy features — were either difficult to use or half-baked. I’ll get to those in a minute. But first, three recommendations for safer Wi-Fi journeys:

* Hide My Ass! Pro VPN (known in polite circles as HMA) creates an encrypted Internet connection, so Web browsing, using Skype, sending e-mail, chatting — whatever — is protected. HMA can change your IP address so you can browse anonymously (test it with WhatsMyIPAdress). The site has freebies, too – a file upload hosting service, Web proxies, anonymous e-mail, and search and link anonymizers.

Hide My Ass Pro VPN protecting me

Tech Note: There’s no bandwidth limitation; connection slowdown is minimal; and HMA’s servers are mostly in the U.S., with some in Europe, Canada, and elsewhere.

It met my criterion: It’s easy to use. After you download and install it, one click is all you need to start it cooking. And it provides all-inclusive, non-intrusive online protection.

Of course, it’s not free — but I think it’s a reasonable pay-as-you-go deal at $11.50 a month. If you don’t travel much, the month-to-month is appealing. If you’re out and about often, it makes sense to pop for the yearly payment of $79, just a little over $6 per month.

* If you have a PC at home and are on the road with your notebook, use LogMeIn Free. It’s a VPN, a program that lets you securely connect to your home computer. Once you log in, you’re using your home PC. Every application — including the browser — is on an encrypted connection. And with a fast connection at both ends, there’s minimal slowdown.

* Most important, if you travel often, don’t use public Wi-Fi. Bite the bullet and invest in a portable — and secure — Sprint or Verizon hotspot card. To date, there are a gazillion plans and providers, but they generally run about $40 to $60 per month with a set amount of bandwidth use. An neat alternative is Boingo, with 125,000 hotspots around the world, for about $10 per month.

Protection That Won’t Cost a Dime

I tried dozens of free tools, but rejected them because they were difficult to use or didn’t offer enough protection. (Well, except for LogMeIn Free.) The apps below — two are Firefox add-ons — offer protection, but have limitations.

* ForceTLS, a Firefox add-on, changes regular links to secure links (including Firefox and Twitter). The problem is convenience: You have to add each link you want changed to its database. It’s hit or miss because not all links can be made secure.

* HTTPS Everywhere forces about 30 sites into a secure https condition. For me, that’s half-baked, because to add a site you need to learn Bulgarian (well, okay, Rulesets).

HTTPS Everywhere forces sites to be secure


* Hotspot Shield (an ad-supported freebie) failed the Bass International Sniff Test. It protected me, sure, but the intrusive toolbar was littered with ads.

Hotspot Shield's toolbar is loaded with ads--and intrudes on my browser

Even if I didn’t use the toolbar, the product tried to change my home page and attempted to switch my search engine. And I wasn’t keen on the product’s cozy relationship with advertisers. (Privacy Notice: “third-party ad servers or ad networks use technology to send, directly to your browser, the advertisements and links that appear on the Hotspot Shield …[including the use of] cookies, **********, or web beacons”.) No thanks.

 

[Byron In Exile]

http://i115.photobucket.com/albums/n307/byroninexile/et/compbomb.jpg

 

[overthebow]

I had my laptop in a cafe in Seattle a few years back and, out of boredom more than anything else, I turned on my packet sniffer. I could see all kinds of traffic going by in the clear. I could read emails, dating web sites, all kinds of stuff. It freaked me out that it was all in the clear and I closed the sniffer and left the place. I've never used a sniffer in a public place like that again.

It is probably against the law. I don't know.

Here's a tip: if you use Gmail, use https not http to connect to it. https://www.gmail.com