Active HTTPS Cookie Hijacking (Mike Defcon 16)

In this talk given at Defcon 16, Mike Perry talks about how website cookies can be hijacked even if they are sent over an HTTPS connection. So how does this work? Generally a cookie which is created and sent over SSL needs to have its "secure" flag set. When a browser sees a "secure" cookie, it will only send it over an SSL connection and will not transmit it over the plain text HTTP connection. The problem happens when a website creates an authentication cookie while communicating over SSL but does not set the "secure" parameter in the cookie. Thus, this cookie is vulnerable to being sent in plain text over HTTP. An attacker sniffing this connection can use this cookie to authenticate on behalf of the victim to the vulnerable website.

So how can an attacker force the cookie to be sent over HTTP? An easy way could be to hijack the TCP connection using say a DNS Hijack attack and inject images corresponding to the vulnerable site into the HTTP page recevied by the victim. This causes the victim to try and fetch them from the vulnerable site. As the cookie does not have the secure bit set, the victim's browser will send the cookie over the unencrypted channel and thus the attacker can now impersonate the victim by using the cookie. Mike mentions in his blog, that popular sites such as Gmail had this vulnerability for over a year, since his first announcement on Bugtraq and barely fixed the problem 4 days before his Defcon talk. Interesting.

The presentation and video of the talk are available below. Mike also released the CookieMonster tool to automate the attack. You may also want to visit his blog for more details.


 

Vivek Ramachandran is a security evangelist and has been working in computer security related fields for the past 7 years. In 2007, Vivek spoke at world renowned conferences Defcon (WEP Cloaking Exposed) and Toorcon (The Caffe Latte Attack). The discovery of the Caffe Latte Attack was covered by CBS5 news, BBC online, Network World etc news agencies.In 2006, Vivek was announced as one of winners of the Microsoft Security Shootout contest held in India among 65,000 participants. He has also been a recipient of a Team Achievement at Cisco Systems for his work on 802.1x and Port Security modules on the Catalyst 6500 switches. Currently he spends all of his time maintaining Security- Freak.Net , SecurityTube.Net and is the co-founder of Axonize. Vivek, is a Bachelor in Electronics and Communications Engineering from the prestigious Indian Institute of Technology, Guwahati.You can contact him at vivek[at]securitytube.net