There are tons of posts on the new FireFox plugin, Firesheep. Firesheep is a plugin that allows you to hijack other user’s social network sessions that are using the same wired or wireless network as you are. Eric Butler, one of the co-authors, has a post explaining how Firesheep works.
The basics of the attack are that websites like Facebook use something called “cookies” to authenticate a user that has already logged in so that the site does not have to ask the user to login again until the cookie expires. The issue is that while the sites often encrypt the initial login they don’t often encrypt any additional network traffic which allows an attacker to capture the cookie and allows them to gain access to victim’s account.
To protect yourself from this type of attack you should always maintain an encrypted session with any of your social network sites. Some folks say not to connect to these sites at all on public WiFi but in general you are better off treating every network as untrusted or hostile and just encrypt your network traffic. You can use the Force-TLS or HTTPS-Everywhere plugins, though they may not work on every site.
The slides for Firesheep from Toorcon are here.
