Facebook hacking, how the cookie crumbles

#facebook #wifi #hacking #twitter #firefox

There was once a time and place where hacking facebook was never heard of.  Now it seems like every other day, someone has fallen down the rabbit hole of a lost account.  How does it keep happening and why?  Who is out there trying to do this and for what reason?  To be honest... the person doing it is either bored and wants to have fun, wants to put some egg on a celebrities face, or has a serious motive behind their actions in an attempt to profit.

The exploit of today I believe has been patched, but on the same note, it doesn't seem to be fully fixed.  This exploit requires these following tools, and before your jaw drops at how easy this is going to be, be prepared... this is damn easy.

1. Laptop
2. Public WiFi (private if you want to mess with a friend)
3. Firefox
4. Fire Sheep Firefox plugin

Yep... 3 things, and 2 of them are completely free.  And if you're trying to hack without a computer or some sort of micro-controller... that's not really hacking.

This exploit focuses on a few problems with WiFi and with Facebook, before I start getting into the nitty gritty details of why these are problems, let me explain how to do what needs to be done to "hack" a facebook account.

1. Turn on laptop
2. Connect to public Wifi
3. Open Firefox
4. Click Capture on FireSheep
5. Tuh Dah you're about to start getting peoples logins.

Yes, that easy.  No need to learn hash cracking, no need to learn TCP/IP functions, no need to learn a microsoft registry location; just click capture on a window and you're in.  But why does this work so easily?  Does this mean you can steal anyones facebook account?

This doesn't work 100% of the time, there are a few exceptions such as VPN users, not much can be done to them, because they circle navigate the system through a secure pipe, smart.  As for us regular schmucks, the problem with WiFi is... its not a direct link.  With a cable connection you know that box goes to computer, physical, straight line, boop boop 1 thing.  As for WiFi, a computer can't figure out where the information is coming from, so instead of beaming info in a straight line to the WiFi antenna, it shoots information in every direction, this means... that any user connected to WiFi... their data goes everywhere.

Well facebook and twitter and the whole lot would put security on their systems wouldn't they?  They do, but its horribly horribly broken.  What they'll do after a user logs into, lets say facebook, is transmit an authentication cookie, to authenticate the session between the laptop, cell phone, tablet, or what have you, with the server.  Going back to the WiFi problem, where a computer can't physically locate an access point, an access point can't physically locate a computer, so it transmits in all directions.

In a more simple dumbed down explanation, when someone goes to login on facebook or twitter, or really any authentication site, when they hit enter, a request goes out for authentication from that computer.  If someone using firesheep is on that network, they can grab that request for authentication and open the session that's attempting to gain approval.  Now that computer opens up a session under another users login and attempts to login.  As the authentication cookie comes back and gets transmitted to everyone in the room, both sessions trying to gain access are authenticated, as they are the same session.

This is why I personally don't trust WiFi because its literally stupid, its a glorified hub, makes all private data public to someone who wants it.

Lesson of the day?  If you can set up a VPN, DO IT!!  The authentication and requests are done over the VPN network and not over the public WiFi.  VPN is a topic for another day, and as always, be safe my goblins.

SHARE

About Unknown