Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 8 down vote favorite
1

Why is Firesheep unable to session hijack when a user is using SSL?

share|improve this question

2 Answers

up vote 10 down vote

It needs to read the content of the HTTP transactions between the victim's computer and the remote server. SSL features point-to-point encryption using a key that's negotiated by the two systems, so a third system passively eavesdropping cannot read the content.

Note that it is possible to inspect SSL content by interposing the attacking system between the two parties. This is called man-in-the-middle, and is used by corporate content filters so that they can filter both HTTP and HTTPS communication.

share|improve this answer
2  
"Note that it is possible to inspect SSL content by interposing the attacking system between the two parties. This is called man-in-the-middle, " - This should be reworded since SSL is supposed to, and indeed can, prevent this. The corporate content filters described work by breaking SSL using a horrible kludge that involves a self-inflicted compromise of SSL's trust model :-) – frankodwyer Apr 20 '11 at 14:06
1  
@frankodwyer: which still means it's possible ;-) – Graham Lee Apr 21 '11 at 9:38
1  
@graham - not in the firesheep 'coffee shop' scenario though, or at least it is possible for the user to detect it (granted, this doesn't mean the average user will, I'd fully expect most of them to dismiss the browser warning and carry on regardless - indeed if I hadn't had my coffee yet I might myself :-) – frankodwyer Apr 21 '11 at 9:45
@frankodwyer your parenthesis expresses almost everything that is wrong with SSL. "Dear user, here's some stuff that I, a developer, understand and you do not. However, I have decided that you should be the person to decide what we do here." The remaining stuff that is wrong is brought to you by the letters C and A. – Graham Lee Apr 21 '11 at 10:50
up vote 3 down vote

The web browser and the web server establish an encrypted connection before any HTTP communication, so when the session data is exchanged it is within the encrypted tunnel and is protected from man-in-the-middle attacks or eavesdropping.

For details, check out the SSL sequence diagram from: http://www.eventhelix.com/RealtimeMantra/Networking/

Technically Firesheep could session hijack SSL connections, but then you would likely get a warning from the browser about establishing an untrusted connection, for example:

If this:

you <--- SSL ---> attacker <--- SSL ---> bank.com

then:

alt text

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.