Mozilla: No 'kill switch' for Firesheep add-on

It won't -- or can't -- yank session hijacking add-on from Firefox

Mozilla today said it wouldn't -- or couldn't -- pull a "kill switch" to disable the Firesheep add-on that lets anyone steal log-on and account access information to Facebook, Twitter and other major Web services.

Firesheep adds a sidebar to Mozilla's Firefox browser that shows when anyone on an open network -- a coffee shop's Wi-Fi network, for instance -- visits any insecure site on a list that includes the microblogging service Twitter and the hugely-popular Facebook social networking site.

Mozilla has a "blocklist" mechanism that it can, and has in the past, applied as a last-resort defense against potentially-dangerous browser add-ons. The blocklist automatically cripples or uninstalls unwanted extensions that have been added to Firefox.

But Mozilla either can't or won't add Firesheep to the blocklist.

"[Firesheep] demonstrates a security weakness in a number of popular websites, but does not exploit any vulnerability in Firefox or other Web browsers," said Mike Beltzner, director of Firefox, in an e-mail reply to questions about Mozilla's possible moves.

Beltzner did not respond to questions about whether Mozilla is technically able to cripple Firesheep, or simply chooses not to.

As Beltzner pointed out, Firesheep is not an officially-approved Firefox add-on, but was "created and distributed by a third-party developer."

Most Firefox add-ons are obtained by users from the browser's Add-On center , which hosts Mozilla-vetted extensions.

In earlier instances when Mozilla has dealt the blocklist "kill switch" card, it's done so for add-ons that the company had previously approved, but later discovered were stealing information or distributing malware. In July, for example, it yanked a password-stealing extension that had been available from Firefox's gallery for more than a month before its malfeasance was detected.

The add-on, called "Mozilla Sniffer," contained code that intercepted login data submitted to any site, then sent that information to a remote server. Firesheep does some of the same, but it doesn't show what it finds to anyone but the tool's user.

In May 2008, Mozilla acknowledged that a worm had gone unnoticed in Firefox's Vietnamese language add-on for months, and last February it warned users that the Sothink Web Video Downloader 4.0 and all versions of Master Filer were infected with a Trojan horse .

As with Mozilla Sniffer, those add-ons had also been offered in the Firefox add-on center.

Firesheep has proved very popular. Since its Sunday debut, the add-on has been downloaded nearly 320,000 times, or an average of about 79,000 downloads per day. That puts it within striking distance of the Firefox's most popular add-on, Adblock Plus, which has averaged just over 80,000 downloads daily during its lifespan.

Using Firesheep may be a criminal offense under U.S. law, suggested Chet Wisniewski, a senior security adviser at antivirus vendor Sophos. "[Firesheep] isn't illegal, but using this tool is a crime in the U.S.," he said. "It would be considered wiretapping. You can play with it on your own network, use it for research, but not to invade the privacy of others."

While testing the tool, Wisniewski said he was careful only to use it on his own wireless network.

Wisniewski's analysis, however, may be on shaky ground. According to federal wiretapping statutes , it's not a violation of the law "to intercept or access an electronic communication made through an electronic communication system that is configured to that such electronic communication is readily accessible to the general public."

During the dustup over its harvesting of information from insecure Wi-Fi networks using its Street View vehicles, Google cited the statute to claim that it had not broken the law.

Some disagreed with Google at the time. In a June story published by the Security Threat site in June, Marc Rotenberg, executive director of the Electronic Privacy Information Center, said he believed Google's actions amounted to wiretapping, and asked the Federal Communication Commission (FCC) to investigate.

Rotenberg did not immediately reply to a request for comment on Firesheep, and whether its packet sniffing activities are similarly illegal.

Eric Butler, who created Firesheep, has defended releasing the add-on, saying that warnings by others of the site insecurities that the tool exposed have been ignored. "[Sites have] been ignoring this responsibility for too long, and it's time for everyone to demand a more secure Web," Butler wrote in a blog post on Sunday. "My hope is that Firesheep will help the users win."

Butler and his colleague, Ian Gallagher -- the two led a Firesheep presentation at last weekend's ToorCon security conference -- have declined Computerworld's requests for interviews. Instead, Gallagher said in an e-mail Tuesday, the pair plan to use Butler's blog to answer media inquiries.

Mozilla's Beltzner suggested that Firefox users could protect themselves against Firesheep sniffing and hijacking by installing Force-TLS to force the browser to use an encrypted HSTS (HTTP Strict Transport Security) connection when it accesses certain sites.

"Mozilla recommends that Web sites start supporting HSTS, which will be supported by default in Firefox 4," Beltzner added.

On Tuesday, security experts offered several other strategies for defending against Firesheep snooping.

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags browsersFacebooktwittersoftwareapplicationsmozillaMalware and VulnerabilitiesCybercrime and Hacking

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Computerworld (US)
Show Comments


James Cook University - Master of Data Science Online Course

Learn more >




TerraCycle Zero Waste Box Pens and Markers Small

Learn more >

Back To Business Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles


PCW Evaluation Team

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill


I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?