[HTC One X] kreindler:
DroidSheep is an Android application that demonstrates security weaknesses (not using https) and is capturing facebook, twitter, linkedin , yahoo, and other accounts.

PS> this is NOT my work, nor do i intend it to be taken as my work, I just wanted to share with the community!

NOTE FROM THE GERMAN DEVELOPER:

DroidSheep was developed as a tool for testing the security of your accounts.

This software is neither made for using it in public networks, nor for hijacking any other persons account.

It should only demonstrate the poor security properties network connections without encryption have.

So do not get DroidSheep to harm anybody or use it in order to gain unauthorized access to any account you do not own! Use this software only for analyzing your own security!

So do not get DroidSheep to harm anybody or use it in order to gain unauthorized access to any account you do not own! Use this software only for analyzing your own security!

Now>

WHAT DO YOU NEED?

1. A rooted phone (no, it will for sure not work without root)

2. The App installed on the phone (latest build attached to the present post)

3. A WIFI network to test it on

How do you use it?

DroidSheeps main intention is to demonstrate how EASY it can be, to take over nearly any internet account. Using DroidSheep any user – even without technical experience – can check if his websession can be attacked or not. For these users it is hard to determine, if the data is sent using HTTPS or not, specially in case of using apps. DroidSheep makes it easy to check this.

This video demonstrates what DroidSheep can do:

http://droidsheep.de/?page_id=14

How does it work?

As already announced DroidsSheep supports almost every website – also “big” webservices like facebook and Yahoo.

How does that work this simple?

There are many users that do not known that air is the transmission medium when using WiFi. Therefore information is not only transfered to its receiver but also to any other party in the network within the range of the radio waves.

Usually nothing special happens because the WiFi users discard packets that are not destined to themselves. DroidSheep does not do this. It reads all the packets looking at their contents.

Is a website sending a clear recognition feature within a message’s content, which can identify a user (“SessionID”), then DroidSheep is able to read it although it is not intended to external users. Moreover DroidSheep can use this token to use it as its own. The server can’t decide whether the authorized user or DroidSheep has sent the request.

http://droidsheep.de/?page_id=424

How can I protect myself?

The only satisfying answer is: SSL respectively HTTPS.

Many providers already offer HTTPS, even facebook, however it must often be enabled in the settings first.

When using HTTPS the data are still sent to alle participants in the WiFi-network, too, but because the data has been encrypted it is impossible for DroidSheep to decrypt the contect of a message - remaining only a complete mess of letters, with which an attacker can’t do anything.

The real problem is that not every website provides SSL. What to do when you are in a public network (hotel, airport, etc.), you also want to use this and the site does not offer HTTPS though?

You can use a VPN-connection

For this the computer sets up an encrypted channel to a confidential computer which again transfers the data to the website.

You can also install DroidSheep Guard from the Market:

https://play.google.com/store/apps/details?id=de.trier.infsec.koch.droidsheep.guard.free&hl=en

A very interesting feature is the possibility to save cookies!!

Source>

http://droidsheep.de

Imagine the possibilities....