Firesheep Extension Released

What happened

At the ToorCon security conference in October 2010, Eric Butler released Firesheep, a free extension for the Firefox web browser. The tool demonstrated how easy it was to perform HTTP session hijacking on open Wi-Fi networks. It allowed users with no technical skills to click a button and take over the Facebook, Twitter, or Amazon accounts of anyone on the same network who was logged in without full HTTPS encryption.

Technical mechanism

Firesheep worked by acting as a packet sniffer, intercepting unencrypted HTTP traffic on an open wireless network. It specifically looked for session cookies sent after a user logged into a popular website. By capturing the session cookie, the attacker could impersonate the victim and access their account without needing the password.

Why it matters

Firesheep forced major internet companies to accelerate their adoption of end-to-end HTTPS encryption, fundamentally improving the baseline security and privacy of the web.

Impact

The tool was downloaded hundreds of thousands of times within days, causing widespread panic and demonstrating the severe risk of relying on unencrypted HTTP for session management. It led to a massive public outcry for better security.

Response

Major websites, which previously only used HTTPS for the initial login page, were pressured to implement 'HTTPS Everywhere' (encrypting the entire session). The EFF and Tor Project released the HTTPS Everywhere extension to force encrypted connections where available.

Defensive lessons

• Session cookies must be transmitted over encrypted channels (HTTPS).
• End-to-end encryption is necessary for web security, not just encryption at login.
• Public Wi-Fi networks are inherently untrustworthy without VPNs or HTTPS.

Evidence register

1. Electronic Frontier Foundation — The Message of Firesheep: "Baaaad Websites, Implement HTTPS" (verified)
2. Eric Butler — Firesheep (verified)