This sounds bad.

[conuly]

Firesheep In Wolves’ Clothing: Extension Lets You Hack Into Twitter, Facebook Accounts Easily

What is this, why is this, and how scary is it?

Comments

[pne]

I'd replace "(wireless)" with "(usually wireless)" or something like that - the attack would work equally well in, say, a company where there are lots of people on the local LAN.

(Or, theoretically, at home, but there LANs usually only connect a single-figure number of computers, typically under the control of people you know and have some level of trust with.)

Ditto on the "this isn't new in principle, it just got easier and more idiot-proof (script-kiddie enabled)", though.

[silver-chipmunk.livejournal.com]

Holy crap! Thanks for posting this!

[prezzey.livejournal.com]

In practice IMO it's only dangerous if you are on an open wifi network (or a LAN where you do not trust all the computers physically connected to the network - I've been in that situation) and you transmit sensitive information unencrypted. Which is something you should not do, anyway. There are people who run open wifi networks only to capture the data of people using their hotspot.

This thing just grabs cookies but there are tools which grab everything and you can cherry-pick. I think the key attraction here is that this piece of software does not require much by way of technical expertise.

[dandelion.livejournal.com]

It doesn't sound all that different to ordinary cookie-grabbing on sites like Neopets. The only scary part is it can now be done by people with very little technical knowledge (which widens the field of potential abusers significantly).

[siderea]

"ordinary cookie-grabbing on sites like Neopets"?

[siderea]

See my post if you haven't.

[conuly]

We know each other from a Neopets-related board. CG-ing is epidemic there.

[siderea]

Yes, but how is the CGing done? Do you guys have a convenient App For That?

[dandelion.livejournal.com]

No, hence why it's limited to people with some technical experience; it's done by inserting fairly freely-available Javascript into user-editable areas. Each time it's happened, more of the areas have been sanitised but people are quite creative.

[siderea]

Ah! The technical term for that is a "Cross-site Scripting Attack", or XSS for short. LJ has had it's own problems with those.

[pne.livejournal.com]

The only scary part is it can now be done by people with very little technical knowledge

This.