Welcome to December. Unless you live in one of those weird places on the planet like Australia, where it's currently summer, more than likely you are trying to stave off ol' man winter's chill. For some, that endeavor takes them and their laptops to a local coffee shop for a Grande and free Wi-Fi. As you sit and sip your favorite brew, you login to your Facebook account and reach over for one of the cookies carefully selected from behind the glass counter. Blindly searching the area to the side of your laptop, you feel nothing... the cookies are gone! Where did they go? You turn to look behind you, but there's nothing there save for a sheep casually enjoying his latte. This would seem strange on any other day... a sheep having a latte? Are animals even allowed in here? This matters not at the moment though, as realistically there's nothing more important than your lost cookies. The sheep catches your eye, and without a lost skip, gives you a quick wink. Now he has your attention, and as you focus a bit closer, you notice what appears to be cookie crumbs dusting his sheepishly small goatee...

Fiction? Not so much. Let's put it into context. The setting, random consumer relaxation stop with free Wi-Fi? Check. The cookies? Digital, they reside on your computer. The sheep? An extension to Firefox known as Firesheep. The theft of your cookies? Extremely real, and your Facebook page was just hijacked. By the sheep.

A few weeks ago, the sheep that was capable of stealing cookies was unleashed. But why? According to developer, Eric Butler, he was sick and tired of high-profile websites ignoring the security of their own networks. Notice we aren't talking about "privacy" here, which sites like Facebook and Twitter are constantly taking a look at and tweaking to ensure users that their information is secure. This is something completely different. Butler went out and brought together all the tools a hacker would need to steal information over a network, and bundled them all into an app/extension that ANY novice could immediately use. No geek code necessary, nor any command prompts or cryptic commands. You can have it too, play the role of the sheep, and at this point, it seems like it's perfectly legal - to a point. Eric decided that these huge websites were simply ignoring this problem, because the few who owned and used these tools in the past were, shall we say, "manageable". He decided to blow the door open in order to force them into securing their connections.

Let me explain to you how dynamic websites work, since I have a fair amount of experience there. We will use the NK site as the example. When you first get here NOT already logged in, you are presented with a login interface, usually a username and password form. When our server receives that form, it pulls the password from the database associated with your username, then compares it to the password you provided. If those match, your computer is issued a cookie. This tiny data file is now your access card. Every single page you request, your computer presents that tiny digital card, and you are allowed or denied whatever you requested. If you took that little cookie, put it on a removeable media of your choice (I was about to say a "floppy", but that would just be showing my age...), and transferred it to another computer, you could continue on this website right where you left off - no username/password needed. Without cookies, you would have to provide a username/password for every page you requested from here, and that's hardly efficient. To sum up, you MUST have a valid username/password to receive a cookie. Once you receive the cookie, no further checks are done, which means if anyone (or any sheep) snatches your cookie out of mid-air, they now can just assume whatever session your having with whatever website.

Firesheep allows you to steal cookies, without any hassle, without breaking a sweat. You sit down, run it, and it sits, scanning the available Wi-Fi networks. When it finds a cookie being transmitted, it grabs it and gives it to you, along with the website it belongs to. You can now login to that Facebook session for that gal sitting over in the corner of the shop, give her a sheepish wink, and play some Farmville on her account. Or umm.. whatever... Maybe you'll get lucky and grab her Amazon cookie. You could get pretty creative with her "wish list", no? Maybe post the new "wish list" to her Facebook account. It's very real. This isn't some security hole that is someone else's problem. It isn't rare anymore, thanks to Firesheep. In fact, this new app has over 700,000 (yes, you read that right) downloads, and it is EVERYWHERE. It will be everywhere else in no time at all.

Let's talk about the legalities of it. Well, at this point, it's basically a "new crime" that isn't on the books yet; up to a point. It is apparently quite legal to steal a cookie and assume someone's website session. Browsing is basically "stealing" with just your eyes, and there isn't any law that covers that yet. Should you actually DO something with that person's account, well then sure, now we're into fraud and theft laws, chin deep. That's not much of a consolance, since that's probably not much of a deterrant to certain sheep. Let's put it this way. Say your co-worker was logged into Amazon and went out for lunch. You sit down at his desk and start browsing for whatever. Have you committed a crime? Well, unless your company has a clear policy about using co-worker's terminals, certainly not. Let's say you are browsing around, and buy something for yourself with your co-worker's login. Now I think we all can agree a crime has been committed. Can Eric Butler be held the least bit accountable for any losses his application causes? According to Washington State Attorney General Rob McKenna, "The maker of the crowbar isn't guilty of burglary because a burglar uses it to break into a house. It's not the creator of the tool that's liable; it's the user of the tool." I don't necessarily want to agree, but I have to. 700k of those crowbars have been distributed, none of them actually illegal to own.

How can you protect yourself from this? Hard and fast fact is, right now, a dedicated internet connection plugged straight from the modem to your Network Interface Card is the only 100% guarantee to avoid any sheepish winks. The weakest link of course is going to be a Wi-Fi hotspot, just because it's far more likely you'll run into a sheep at a place like that. It's like your chances of being struck by lightning are far greater if you hang out on golf courses. In between those two extremes lies everything else, and your odds of having a cookie hijacked become quite variable. The bottom line is, this shouldn't be your problem, because it is something that EVERY website can take care of with relative ease. Eric Butler has simply unleashed the Arc of the Covenant to ensure the more popular sites get it in gear. What do they need to do? Well certainly "future technology" will have an answer eventually, but for now, it appears that fully encrypted sessions from start to finish are the only way around Firesheep. Most networks use HTTPS connections to authenticate a submitted username/password, but once the cookie has been set, the rest of the page requests go out, and the returning data comes back in, over non-encrypted vanilla HTTP. The current solution that could be implemented right now is to have every single transaction go out and come in over HTTPS.

Hell, we don't even use HTTPS to authenticate your login here at Neon Knights, much less your entire session. Good thing no one uses this website then.

Peace.

No one read that.

I'd like to wish everyone a very happy Thanksgiving, especially to everyone outside the US who don't murder millions of Turkeys (the bird, not to be confused with the populace of Turkey) each year on the last Thursday of November! Yes, meat IS murder, but it does smell excellent while in the oven! If you're vegan, enjoy that Turkfu or Tofurkey, or whatever you enjoy! Just thought I would drop in a quick article here from my Lear Jet. We're on our way to our annual Ski Speedflying junket, but I can't stay long... we do need to be back in time for dinner tomorrow night! Not familiar with Ski Speedflying? Well, here's some video of us at last year's meet. Enjoy!

- Keith

PS - I needed a new topic icon, so I ran across this pic of Teaa and the girl who lives out in the backyard in the shed we built. Apparently Teaa was choking on something, and this girl immediately sprang into action! She used this very invasive procedure whereby you shove your own tongue down the victim's throat, hopefully dislodging the object threatening their life! Well, it worked.. and Teaa is still with us... :: whew! :: Anyways, in an effort to promote lifesaving procedures this holiday, I have adopted this pic as the Topic Icon for all Holiday related stories!! Hooray!!