What Is a Sidejacking Attack?

Corey Nachreiner, CISSP, demonstrates a relatively simple way for someone sitting near you at a wireless hotspot to steal your credentials for any Web account you log into... then later, log on as you and see your private info. Based on a Black Hat presentation by Robert Graham of Errata Security.

Category:

Howto & Style

Tags:

• sidejacking
• wireless
• hacking
• WiFi
• security
• WatchGuard
• LiveSecurity
• network
• Errata
• session
• highjacking

[steadysnper]

Can this also be done against other mail clients such as Yahoo?

[LiveSecurity]

Yes, the point is that the attacker can see the victim's login credentials. Any web site the victim logs into can work for the attacker, UNLESS the victim has configured the site to encrypt sessions.

[HeadShot360IN]

Thankyou for teaching me this :|

[MrCluttermania]

sarah is beautiful!

[megaKstudios]

Will it work with online flash games? I want to steal people's accounts.

[FusionNinjin]

so basicly the only way the hacker can get to my g mail then he has to be logged on to my network, hence not possible

[legomaniac150]

@ZepplinProgramming The only hard part i that is getting them to accept the fake certificate. Worked on my sister though :)

[darkphaux]

Gotta admit though, for how potentially dangerous this attack can be it is fucking easy

[taeyoungchoon]

Easy to understand.. Cool~! but it make me sad about can not trust world.. Hmm.. Bye..

[lolzk0]

Knew it. Just another whitehat buzzword for an old technique.

Jesus Christ whitehats.

[ZepplinProgramming]

While encryption may be a little more secure and would prevent this particular attack, all a malicious user would have to do is fire up Ettercap and do ARP poisoning on their target computer and then generate a fake SSL certificate and if the user accepts they can de-crypt all traffic.

Great video though, 5 stars!

[Agentoxedo07]

holy-terrorist:> *=* hahaha im new sidejacker *=*