Session Hijacking over HTTP

Hello Everyone,

I was curious to know how would webmail portals like gmail.com and
yahoo.com protect their users from session hijacking when they use
HTTP after authentication.

As I see it is trivial to capture traffic over the wire including
session cookies. In such a case can an attacker just reuse the session
cookies in his/her browser and compromise the user account?

WHat is the best way to protect session cookies from hijacking esp.
due to network eavesdropping? Of course HTTPS can also be bypassed
with MITM attacks if users ignore browser warnings.

Looking forward to some knowledge here.

Cheers!!

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

Relevant Pages

  • Re: Session Hijacking over HTTP
    ... How to protect yourself. ... The fact that each HTTP connection is a different IP session makes using ... To protect session cookies you can set the cookie property: ...
    (Pen-Test)
  • Re: Firewall session disconnects after 2 minutes of inactivity
    ... I want to start by pointing out the following: HTTP keep-alives and anything ... involved in the early stage of the connection when the client downloads the ... The HOD server I mean. ... when the session takes place through the ISA Server? ...
    (microsoft.public.isa)
  • Re: Opinion sort re user authentication ?
    ... Tony Benham wrote: ... I'm not storing financial data or anything very sensitive. ... known as "session based" or "form based" because it doesn't use HTTP ...
    (alt.php)
  • Re: HttpContext.Current.Session is null
    ... private static readonly CProjTest Instance = new CProjTest; ... HttpContext,as well as Session are created only for a HTTP request, ... I think you're trying to get session from a code that has nothing to do ...
    (microsoft.public.dotnet.framework.aspnet)
  • [NT] ASPSession IDs Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... An ASP SessionID is allocated even if the .ASP pages sets the session ... The same ASP SessionID is shared between a HTTP and HTTPS ...
    (Securiteam)