as i start traveling again, i know i will be using public wifi zones like that from coffee shops and airports. like many, i have seen on the news in the last few months regarding a program that can take control over your account. i wanted to see exactly how this works, so i can better protect myself. i installed the program and tried it at home with a friend as my test subject.
so first and foremost, this program can not (yet?) pull your password. what it does is leverage your existing log in and basically continues your session.
amazingly, within seconds of him turning on his web browser (he was using chrome, but we tried this with ie and firefox and all are vulnerable), i had FULL ACCESS to his facebook account. i also had his log in name for amazon, yahoo, and gmail. i could see his amazon history, but could not modify his account, as it required me to enter his password. i could see part of his my.yahoo.com page and part of his igoogle page.
he did not even have to login. he had his credentials stored in cookies on his computer, so right when he turned on his browser, the program grabbed it right out of the air.
i read that using an https (vs http) on sites will block this program. this is partially true. gmail, yahoo, hotmail, and most of your banks out there use these secure connections. even facebook can be forced to use the https (by default it only uses http) to log in. however, once you get to the main page, it switches back to http, and i was able to take full control again. so all you facebook heads out there, i highly highly suggest you wait till you get home, have a wired connection, or tether through your cell phone before using your facebook in public. this applies to your cellphone or ipad or whatever else if you connect through public wifi.
if you must use a public wifi, i would suggest either setting your browser to clear cookies when you shut it down so when you turn it back on it won’t get snatched. but if you’re like me (lazy) and like my credential loaded and ready to go, then i would suggest designating a second web browser that is dedicated to public use, and make sure that it is only used to access non private data, like weather, flight information, maps, etc….
Recent Comments