CookieMonster Loves HTTPS Cookies

[steveseguin]

A small oversight in the way HTTPS cookies are being configured by some major websites is allowing the new CookieMonster tool to actively steal a user's cookies for many major websites

CookieMonster Loves HTTPS Cookies : Read more

 

[Kari]

so this can only happen if you're using public wifi hot-spots? and I'm guessing unprotected WLAN as well??

 

[steveseguin]

It can actually happen on many levels, with public wifi probably being the most straight forward. Unsecured or WEP-based wifi are straight forward to exploit, with WPA-based wifi being very difficult, but still possible.

Using a VPN connection through a public wifi I would imagine might help prevent safe-guard yourself. Really, just clearing your cookies before using public wifi and not accessing secure sites while connected to it should help, i think.

DSL/Cable connections are also vulnerable, but a special modified modem would be needed in that case.

Also, virtually any man-in-the-middle attack could would work -- so a compromised proxy for example would do it.

 

[dariushro]

Cookies SHOULD be used only for common stuff, like visual preference of a site etc...if a cookie has sensitive information stored, it's only the site developer's fault.

 

[michaelahess]

I've been using a program called ferret to test my clients wifi networks for over a year (make sure and use layer 2 segregation), sounds about the same as this. I can capture gmail and yahoo accounts and login instantly. I don't see how this is news except maybe for the fact that he did it at Defcon which WILL get a response.

 

[steveseguin]

I can capture gmail and yahoo accounts and login instantly. I don't see how this is news except maybe for the fact that he did it at Def

Do they have to be currently using their Gmail/yahoo for you to steal their accounts? In this hack, they never need to even visit the site during their session-- it works actively rather than passively. This could be used to steal banking information from a user on a public wifi, for example, even though the user never the banking site.

if ferret does do this actively as well, that is neat. But the main news as you point out is the fact it is getting a response, when there was none previously.

 

[nukemaster]

The Cookie Monster pic made it worth it.