Sidejack Prevention
A Firefox plugin called Firesheep was released this week that makes it easy to capture and exploit other user’s HTTP session cookies sent over insecure connections on untrusted networks. This…
A Firefox plugin called Firesheep
was released this week that makes it easy to capture and exploit other user’s
HTTP session cookies sent over insecure connections on untrusted networks.
This vulnerability makes it possible to login to other people’s accounts on a
variety of services by spying on network traffic and extracting those cookies.
Wikipedia has a decent article on this technique: Session
Hijacking.
GitHub was susceptible to this attack, but we have now taken measures to
protect you and your data. As a result, you will be prompted to re-login to the
site on your next visit. This is necessary in order to switch you to the more
secure system.
The Technical Details
Today, we’re rolling out the first in a series of measures we have planned to
make GitHub more resilient to session hijacking attacks. The basic approach revolves
around setting a second cookie (in addition to the normal session cookie) that is
marked as secure. Cookies marked secure, are sent only over SSL requests
and are omitted on non-SSL requests. They look like this on the wire:
Set-Cookie: somename=somevalue; path=/; secure
When someone logs on, we set the secure cookie (_github_sec
in our case) to
the checksum of the user’s id and password hash along with a secret (known
only to the application) salt value. Then, on subsequent SSL requests, we
verify that the cookie’s value matches the same checksum. If the values are
different, authentication fails.
Most browsers have a way of viewing cookie details. Here, we see the cookie
is sent only over secure requests:
![cookie inspector](https://github.blog/wp-content/uploads/2010/10/20101027-ck7dhmcxykpgbg5wt1kbpjb6j1.jpg)
Since we already require SSL for all sensitive requests, including
browsing/admin’ing private repositories and viewing/editing account details,
this extra bit of verification ensures that sidejacked session cookies cannot
be used to gain access to any sensitive information.
Broader Solutions
Sidejacking is still a problem for many sites on the internet. The only way to
protect yourself on every site you visit is to secure and encrypt your
connection for all requests.
SheepSafe from Nick
Sieger is an easy to install solution for Mac
that relies on an SSH tunnel and SOCKS proxy to encrypt every HTTP request you
make, no matter what site you’re on.
Written by
Related posts
![](https://github.blog/wp-content/uploads/2023/10/Collaboration-DarkMode-2.png?resize=400%2C212)
2024 is the biggest global election year in history. What’s at stake for developers?
GitHub is considering what is at stake for our users and platform, how we can take responsible action to support free and fair elections, and how developers contribute to resilient democratic processes.
![](https://github.blog/wp-content/uploads/2023/10/AI-DarkMode-2.png?resize=400%2C212)
GitHub named a Leader in the Gartner first-ever Magic Quadrant for AI Code Assistants
This year, as part of its annual Magic Quadrant series, Gartner published a first-of-its-kind report analyzing the state of play in the AI Code Assistants market–and named GitHub a Leader.
![AI in software development 2024 survey results with colorful graphics and percentages.](https://github.blog/wp-content/uploads/2024/08/ai-survey-header.png?resize=400%2C212)
Survey: The AI wave continues to grow on software development teams
We surveyed 2,000 people on software development teams at enterprises in the U.S., Brazil, India, and Germany about the use, experience, and expectations around generative AI tools in software development.