Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Cookiemonster Can Steal Https Cookies


  • Please log in to reply
1 reply to this topic

#1 buddy215

buddy215

  • BC Advisor
  • 12,589 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:West Tennessee
  • Local time:04:26 PM

Posted 12 September 2008 - 01:08 PM

http://www.informationweek.com/news/securi...cleID=210601197
A so-called CookieMonster attack is coming, and if you use Web-based services that involve login credentials, such as Web e-mail or online banking, you may want to turn your fear and paranoia dial to 11, one researcher warns. ...............

Perry proposes the following test to see whether sites you use are vulnerable: "To check your sites under Firefox, go to the Privacy tab in the Preferences window, and click on 'Show Cookies.' For a given site, inspect the individual cookies for the top level name of the site, and any subdomain names, and if any have 'Send For: Encrypted connections only,' delete them. Then try to visit your site again. If it still allows you in, the site is insecure and your session can be stolen. You should report this to the site maintainer."

Having tried these steps with two "Encrypted connections only" Google cookies, Google appears to be vulnerable to a CookieMonster attack. A Google spokesperson confirmed this to be the case and said the company's engineers are working with Perry to eliminate the vulnerability.

"Gmail users concerned about this issue can protect themselves by enabling the always-https option in their accounts," the Google spokesperson said in an e-mail. "The fix we're planning to roll out shortly is aimed at users who haven't activated the https-only preference." ....................................


NoScript mitigates HTTPS cookie hijacking attacks
http://blogs.zdnet.com/security/?p=1882

September 11th, 2008
The invaluable NoScript for Firefox plug-in just got a tad better.

According to Giorgio Maone, the developer behind the popular browser extension, a new experimental feature called “Forced Secure Cookies” has been added to NoScript v1.8.0.5 to mitigate the HTTPS cookie hijacking attack vector discussed at DEFCON 16 last month.

Enabled by default, [the new feature] can be disabled either globally, by toggling the noscript.secureCookies about:config preference, or for specific domains only, by listing them (space or comma separated) in the noscript.secureCookiesException about:config preference...............................

Maone described the new feature as a countermeasure against Mike Perry’s automated HTTPS cookie-hijacking attack (see CookieMonster tool) that’s unobtrusive and non-interactive:...............................

Edited by buddy215, 12 September 2008 - 01:20 PM.

“Every atom in your body came from a star that exploded and the atoms in your left hand probably came from a different star than your right hand. It really is the most poetic thing I know about physics...you are all stardust.”Lawrence M. Krauss

A 1792 U.S. penny, designed in part by Thomas Jefferson and George Washington, reads “Liberty Parent of Science & Industry.”


BC AdBot (Login to Remove)

 


m

#2 samuel3

samuel3

  • Members
  • 2,349 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:26 PM

Posted 14 September 2008 - 04:56 AM

Cheers for the heads up.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users