Re: CSS, CSS & let me give you some more CSS

From: E M (rdnktrk@hotmail.com)
Date: 02/01/02 

From: "E M" <rdnktrk@hotmail.com>
To: billp@boarder.org, vuln-dev@securityfocus.com
Date: Fri, 01 Feb 2002 11:13:43 -0800

I think we are getting away from the original topic, CSS and how it effects
you.

Basically the general agreement is that cookie stealing via embedded code is
the most dangerous use for CSS and the most common.

This brings me to the point that cookie based authentication is unsafe
inherently and as far as I can tell not something that security minded
developers would even consider.

So the jist is that CSS is mainly used to exploit older web app's that use
cookie based authentication (Prime example older versions of Yet another
Bulletin Board (Yabb). Not to say it can't be used for other things, just
that from what I'm seeing... its not.

Eric McCarty

>From: "Bill Pennington" <billp@boarder.org>
>To: "Securityfocus-Vulndev" <vuln-dev@securityfocus.com>
>Subject: Re: CSS, CSS & let me give you some more CSS
>Date: Fri, 1 Feb 2002 08:38:35 -0800
>
>For any commercial site it is almost impossible to use any portion of the
>address for "authentication" or non-repudiation. The main reason is AOL.
>The
>last e-com site I managed 70% or our traffic came from AOL. IIRC AOL used
>proxy "pods" for their netblocks. I would watch users hop from IP to IP and
>sometime across entire subnets during a session. Now you could code your
>app
>to break for AOL users but if you are a commercial entity that could
>present
>a few problems.
>
>The best use to IP address authentication is in a LAN environment where
>users are far less likely to go address hoping.
>
>
>----- Original Message -----
>From: <info@elitesoft.org>
>To: "Obscure" <obscure@eyeonsecurity.net>
>Cc: "Joe Harrison" <list-general@ntlworld.com>; "Securityfocus-Vulndev"
><vuln-dev@securityfocus.com>
>Sent: Friday, February 01, 2002 8:08 AM
>Subject: RE: CSS, CSS & let me give you some more CSS
>
>
> > If you use IP address for session cookie attacker can't use
> > stolen cookie.
> > However, you can't use IP address when BGP or Proxy are used.
> > In this case the best protection is to change session cookie
> > for each transaction using transaction counter.
> > This will provide a transaction non-repudiation.
> > If such session cookie is stolen and used by a hacker prior
> > to a user, then user session will be blown away.
> >
> > Mike
> >
>
>

_________________________________________________________________
MSN Photos is the easiest way to share and print your photos:
http://photos.msn.com/support/worldwide.aspx

Relevant Pages

  • Re: CSS, CSS & let me give you some more CSS
    ... > Basically the general agreement is that cookie stealing via embedded code is ... > the most dangerous use for CSS and the most common. ... Their inherent security is similar too uid/pw: ... > cookie based authentication (Prime example older versions of Yet another ...
    (Vuln-Dev)
  • Re: CSS switcher in Ruby?
    ... The trick is to not change the URL for each style, rather change something else like a cookie or a session variable. ... I'm going to assume that you have figured out some way to set the cookie and have the css load itself. ... When you get a request to dynamic_css.rb and your STYLE cookie is set to to Style1, ... and include the ETag header of the CSS you want to be used. ...
    (comp.lang.ruby)
  • RE: IE6 Caching and mod_rewrite-ing
    ... depending on a cookiee setting documents shall ... > be delivered with different CSS style sheets. ... > So if the cookie stylesheet is set portal.css is automagically ... You set the preference in a cookie using javascript. ...
    (microsoft.public.windows.inetexplorer.ie6.browser)
  • Re: CSS Question
    ... Subject: CSS Question ... | Cross site scripting is all about stealing a cookie, ... | worst thing attacker can do (besides stealing cookie), ...
    (Security-Basics)
  • Re: CSS, CSS & let me give you some more CSS
    ... > I think we are getting away from the original topic, CSS and how it effects ... > Basically the general agreement is that cookie stealing via embedded code is ... >>> In this case the best protection is to change session cookie ...
    (Vuln-Dev)