Last month we heard about  Firesheep, a new Firefox extension designed to sniff out weak security and hijack web site credentials on open Wi-Fi networks. BlackSheep is an anti-Firesheep tool, designed to alert you whenever Firesheep is active on your local network.

Zscaler, a company specializing in security measures for cloud-based computing services, created Blacksheep to counteract Firesheep session hijacking. Once installed Blacksheep broadcasts fake credentials to essentially fish for Firesheep installations on the network.

When one is detected it displays the alert seen in the screen capture above. The configuration of Blacksheep is dead simple; by default it goes fishing every 5 minutes but you can adjust it down to 1 minute.

Zscaler

At the Toorcon 12 security conference, Eric Butler released a Firefox plugin named Firesheep, which drew significant media attention. Firesheep allowed any user to seamlessly hijack the web session of another user on the same local network. Although such attacks are not new, the ease of use presented by Firesheep brought session hijacking to the masses.

BlackSheep, also a Firefox plugin is designed to combat Firesheep. BlackSheep does this by dropping ‘fake’ session ID information on the wire and then monitors traffic to see if it has been hijacked. While Firesheep is largely passive, once it identifies session information for a targeted domain, it then makes a subsequent request to that same domain, using the hijacked session information in order to obtain the name of the hijacked user along with an image of the person, if available. It is this request that BlackSheep identifies in order to detect the presence of Firesheep on the network. When identified, the user will be receive the following warning message:

It should be noted that Firesheep and BlackSheep cannot be installed on the same Firefox instance as they share much of the same code base. If you want to run both Firesheep and BlackSheep on the same machine, they should be installed in separate Firefox profiles.

The Problem

Session hijacking is nothing new. Web sites typically use SSL connections for initial login pages, but revert to non-encrypted traffic for all subsequent communication. As such, while a user’s username and password may be protected, once they are authenticated, any user on the same network can simply sniff network traffic, obtain a user’s session ID and then hijack their session for a given website. Although this has always been a serious risk, especially on insecure networks such as public wifi hot spots, some degree of technical knowledge was required to accomplish the attack. Firesheep, opens such attacks to the masses as it turns session hijacking into a point and click exercise. Unless websites mandate SSL for all traffic on the site, session hijacking will always remain a threat. Fortunately, BlackSheep can be used to let you know if someone is running Firesheep on the same network.

Configuration

BlackSheep options can be accessed by navigating to Tools > Add-ons within Firefox. Once there, under the Extensions tab, select the Preferences button for BlackSheep.

Check Interval: BlackSheep will continually drop fake session information onto the wire and then listen for another IP address re-submitting this same information, as this will indicate the presence of Firesheep on the network. The Check Interval identifies the number of minutes between checks.

Interface: Allows the user to configure the network interface that BlackSheep should listen on.

Blacksheep is a free tool and works wherever Firefox does. Go Download It Now!