Re: Session Hijacking over HTTP

Hi.

IMHO when attacker controls HTTP flow it can read and modify all data
which is sent to you. Public key cryptography can solve this issue,
however browsers have only SSL implementation (transport OSI layer) by
default. You can not use javascript implementation to protect cookies
in case it is downloaded from the site, as I said before
attacker can modify your javascript routienes when they're downloaded
for the first time. For custom, corporate solution you should use
customization and addons for browser so the user can not bypass SSL
warning. The customized software should be distributed by trusted
channel.

2008/3/18, 11ack3r <11ack3r@xxxxxxxxx>:
Hello Everyone,

I was curious to know how would webmail portals like gmail.com and
yahoo.com protect their users from session hijacking when they use
HTTP after authentication.

As I see it is trivial to capture traffic over the wire including
session cookies. In such a case can an attacker just reuse the session
cookies in his/her browser and compromise the user account?

WHat is the best way to protect session cookies from hijacking esp.
due to network eavesdropping? Of course HTTPS can also be bypassed
with MITM attacks if users ignore browser warnings.

Looking forward to some knowledge here.

Cheers!!

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------




--
Best regards.
Gleb Pakharenko.
http://gpaharenko.livejournal.com

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

Relevant Pages

  • Re: How to write something to a html textfield and send it?
    ... > No need for controlling any particular browser. ... I'm not familiar with HTTP user ... and building the request in your program. ... The server doesn't know anything about a textfield; ...
    (comp.programming)
  • Re: [PHP] Problems with Zip+IE6
    ... I would even say you're bound to hit a browser configured for some ... original HTTP RFC spec. ... either uninterpreted binary data or information to ... IE, which was using Content-Disposition, originally conceived for MIME ...
    (php.general)
  • Re: Generated javascript from .pl files
    ... Because web servers might use a different HTTP specification than ... the visiting browser, so possible HTTP version conflicts arise. ... I'd like to see an otherwise usable Web client that does not support ... one that is used here does not rely on the (Content-* request) HTTP headers. ...
    (comp.lang.javascript)
  • Re: Run As/Domain Login Windows XP Home
    ... I access my company's exchange webmail service also via a browser ... ... relate to some sophisticated user concept encapsulated in arbirtrary HTTP ... in Information Security. ...
    (Security-Basics)
  • RE: Link from corporate site to internal corp. network
    ... By hijacking any Web browser located on your internal network, an attacker ... Moving beyond a single server ... If the client in use is Microsoft Internet Explorer, ...
    (Security-Basics)