Re: Web session tracking security prob. Vulnerable: IIS and ColdF usion (maybe others)

[Dug Song <dugsong () monkey org>]

On Thu, Aug 30, 2001 at 03:37:01PM -0400, Jose Nazario wrote:

> predictive cookie values are nothing new. :)

fubob cracked the WSJ.com master key with a simple adaptive chosen
plaintext attack last year. see his paper on client web authentication
(which won best student paper at this past USENIX) for a nice overview:

        http://cookies.lcs.mit.edu/

-d.

---
http://www.monkey.org/~dugsong/