Vulnerabilities / Threats
9/11/2008
06:14 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

CookieMonster Can Steal HTTPS Cookies

The Python-based tool actively gathers insecure SSL information and records that as well as normal HTTP cookies to Firefox-compatible cookie files.

A so-called CookieMonster attack is coming, and if you use Web-based services that involve login credentials, such as Web e-mail or online banking, you may want to turn your fear and paranoia dial to 11, one researcher warns.

"CookieMonster is a Python-based tool that actively gathers insecure HTTPS cookies, and records these as well as normal http cookies to Firefox compatible cookie files," explains Mike Perry, the security researcher who created the software, in a documentation file.

HTTPS is supposed to be secure; the "S" stands for Secure Sockets Layer, or SSL.

Sadly, it turns out that many Web sites do not properly set the "Encrypted Sessions Only" property of their cookies. Such sites will send HTTPS cookies in the open, unprotected. This allows an attacker to conduct a cross-site request forgery attack, to inject spoofed data into any Web page that the user visits, and thereby retrieve related cookies.

Because HTTPS cookies are full of tasty authentication information, they can be used to access online banking accounts, Webmail accounts, and the like.

"The most crucial aspect of this sort of attack that most people seem to miss is its ability to cull arbitrary cookies for a list of insecure domains from every client IP on a network even when the user is not using those sites at the time," Perry explains in a blog post. "The second most crucial aspect is how the tool is still able to compromise arbitrary insecure SSL sites in the common case without the need to provide such a target list."

Perry has made CookieMonster available to a limited set of security researchers and plans to make it available to the public shortly.

Perry proposes the following test to see whether sites you use are vulnerable: "To check your sites under Firefox, go to the Privacy tab in the Preferences window, and click on 'Show Cookies.' For a given site, inspect the individual cookies for the top level name of the site, and any subdomain names, and if any have 'Send For: Encrypted connections only,' delete them. Then try to visit your site again. If it still allows you in, the site is insecure and your session can be stolen. You should report this to the site maintainer."

Having tried these steps with two "Encrypted connections only" Google cookies, Google appears to be vulnerable to a CookieMonster attack. A Google spokesperson confirmed this to be the case and said the company's engineers are working with Perry to eliminate the vulnerability.

"Gmail users concerned about this issue can protect themselves by enabling the always-https option in their accounts," the Google spokesperson said in an e-mail. "The fix we're planning to roll out shortly is aimed at users who haven't activated the https-only preference."

Google is hardly the only company affected. Perry last month posted a list of sites that appeared to be vulnerable at the time. Among the sites listed are various banks and travel sites.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0619
Published: 2014-10-23
Untrusted search path vulnerability in Hamster Free ZIP Archiver 2.0.1.7 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the current working directory.

CVE-2014-2230
Published: 2014-10-23
Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) dest parameter to adclick.php or (2) _maxdest parameter to ck.php.

CVE-2014-7281
Published: 2014-10-23
Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN allows remote attackers to hijack the authentication of administrators for requests that reboot the device via a request to goform/SysToolReboot.

CVE-2014-7292
Published: 2014-10-23
Open redirect vulnerability in the Click-Through feature in Newtelligence dasBlog 2.1 (2.1.8102.813), 2.2 (2.2.8279.16125), and 2.3 (2.3.9074.18820) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter to ct.ashx.

CVE-2014-8071
Published: 2014-10-23
Multiple cross-site scripting (XSS) vulnerabilities in OpenMRS 2.1 Standalone Edition allow remote attackers to inject arbitrary web script or HTML via the (1) givenName, (2) familyName, (3) address1, or (4) address2 parameter to registrationapp/registerPatient.page; the (5) comment parameter to all...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.