RE: Cross Site Cooking

["Evans, Arian" <Arian.Evans () fishnetsecurity com>]

Checksums will not stop Session Fixation attacks. (unless you
only hand out session cookies + checksums to unique logged in
users, but then why not make your cookie your checksum?)

btw// most browsers in the wild adhere more to RFC 2109 as of
the last time I did any meaningful testing, which was early 2005:
http://www.ietf.org/rfc/rfc2109.txt

There are some things like cookie2 stuff that are in 2965 that
are inconsistently supported across browsers. I played with a
number of this like pathing to get my head around the differences
since it seems like less and less new developers understand what
the cookie is (due to framework session object abstraction I suspect).

The bottom line is that the attack Michael described is "Session
Fixation" via session token in a cookie, which is pretty well
covered by the Acros whitepaper and followed up by "Session Riding".

Definitely interesting information by Michael.

I am noticing all the browsers (7, FF 1.5) are tightening up a
bit in what is permissible with cookies and script.

Keep an eye out for our WAF project which transparently turns
your cookied (?) sessions into cookieless sessions with some
anti-xss benefits.

Really it is probably boringly blatantly obvious to anyone on
this list, and I really suspect the functionality will wind up
in frameworks in the long run....

-ae

> -----Original Message-----
> From: john-secfocus () o-rourke org [mailto:john-secfocus () o-rourke org] 
> Sent: Tuesday, January 31, 2006 2:59 AM
> To: webappsec () securityfocus com
> Subject: Re: Cross Site Cooking
>
>
> It's probably better referring to the cookies RFC 
> (ftp://ftp.rfc-editor.org/in-notes/rfc2965.txt) rather than a 
> very old article (http://www.ciac.org/ciac/bulletins/i-034.shtml).
> The RFC doesn't mention anything about numbers of dots and 
> specific domains.
>
> Although it's all definitely a security risk, there's no way 
> all vendors would change the mechanism without keeping 
> backwards compatibility, it would cause chaos.  So with my 
> sites I always put a checksum in the cookie data, which 
> allows the website to be certain no clients have altered the 
> data manually.
>
> --------------------------------------------------------------
> -----------
> This List Sponsored by: Watchfire
>
> Watchfire's AppScan is the industry's first and leading web 
> application 
> security testing suite, and the only solution to provide 
> comprehensive 
> remediation tasks at every level of the application. See for 
> yourself. 
> Download AppScan 6.0 today.
>
> https://www.watchfire.com/securearea/appscansix.aspx?id=701300
000003Ssh
--------------------------------------------------------------------------


-------------------------------------------------------------------------
This List Sponsored by: Watchfire

Watchfire's AppScan is the industry's first and leading web application
security testing suite, and the only solution to provide comprehensive
remediation tasks at every level of the application. See for yourself.
Download AppScan 6.0 today.

https://www.watchfire.com/securearea/appscansix.aspx?id=701300000003Ssh
--------------------------------------------------------------------------