Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I think someone is using my cookie info to log into my Facebook account on a public Wi-Fi network. How can I determine if this is happening and from what IP address?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

If you're logging in over HTTP (as opposed to HTTPS) on a wifi network (except with some versions of WPA2), anyone connected to that network can snoop on your traffic, and you will not find out. This is a purely passive eavesdropping attack. Your only defense is to never use Facebook through anything but HTTPS.

You may be able to find out which IP address accessed your account, if Facebook keeps a log of that (you bet they do) and they expose that log to you (I don't know about that). But that may or may not tell you anything: if the attacker connected from the same wifi network as you, he'll usually show up as coming from the same IP address.

share|improve this answer

They might be using FireSheep, create a fake Facebook account and try BlackSheep http://research.zscaler.com/2010/11/blacksheep-tool-to-detect-firesheep.html

share|improve this answer
    
i couldn't get it installed. said it wasn't compatible with my firefox version. tried many different versions. –  Marty Feb 17 '12 at 10:00
    
It was written for 3.6. It's still on their supported list mozilla.org/en-US/firefox/all-older.html –  mgjk Feb 17 '12 at 14:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.