You have undoubtedly heard about celebrities accounts being hacked.  Ashton’s Twitter account, Paris’s Twitter account etc.  Do you want to know how hackers do it?  Then look no further.  Here is the explanation of the concept and a description of the most recent GUI tool that lets you do it.

Let me start by saying this is for educational purposes not for stealing anyone’s information.  The next step is to be on the same network as another user.  If you don’t know what that means…..then you shouldn’t be trying to hack people’s accounts.

Once you are on the same network, you have to understand that most web based authentication is based on a session that is stored as a temporary cookie.  The cookie is an unencryption key that says to the server “Hey…yeah trust this guy and give him access because he already typed in his password”.  The cookie allows that “session” to not have to keep logging in.

The magic comes in at this point.  If you capture that cookie as it is travelling, you too can use the session information to log in as the user. This will allow you to quickly reset their password in their profile and bada-boom-bada-bing….you are now the proud new owner of Perez Hilton’s Blog.

The disclaimer is that this technique will work on any unencrypted web site, but will not work on SSL encrypted sites such as online banking etc.  But Wordpress, Facebook, Twitter, Myspace are just a few examples of the sites where this technique works.

There is a new Firefox plugin that has just been released as an open source tool. It’s called Fire Sheep, and it is a simple plugin that is installed on any Windows or Mac. It was released by Toorcon 12, and can be used to steal cookies from any computer off the same access to unsecured Wi-Fi network that you’re on.

So if you ‘borrow’ your neighbors wifi or access insecure wifi in public, you could lose your FaceBook and many more important logins!

The add-on that goes in the left sidebar of the Firefox web browser allows the user to get login-data capture Facebook accounts, Twitter accounts, and any site that is not logged is secured with SSL (https). When you log into your Facebook account, a cookie is sent back to your computer to use for future logins. Someone using FireSheep for Firefox can simply click a button that says “start recording” and steal your login information. All they have to do is click on your Facebook picture and they will be notified as you.

Click here to download Firesheep.