Checksums will not stop Session Fixation attacks. (unless you
only hand out session cookies + checksums to unique logged in
users, but then why not make your cookie your checksum?)
btw// most browsers in the wild adhere more to RFC 2109 as of
the last time I did any meaningful testing, which was early 2005:
http://www.ietf.org/rfc/rfc2109.txt
There are some things like cookie2 stuff that are in 2965 that
are inconsistently supported across browsers. I played with a
number of this like pathing to get my head around the differences
since it seems like less and less new developers understand what
the cookie is (due to framework session object abstraction I suspect).
The bottom line is that the attack Michael described is "Session
Fixation" via session token in a cookie, which is pretty well
covered by the Acros whitepaper and followed up by "Session Riding".
Definitely interesting information by Michael.
I am noticing all the browsers (7, FF 1.5) are tightening up a
bit in what is permissible with cookies and script.
Keep an eye out for our WAF project which transparently turns
your cookied (?) sessions into cookieless sessions with some
anti-xss benefits.
Really it is probably boringly blatantly obvious to anyone on
this list, and I really suspect the functionality will wind up
in frameworks in the long run....
-ae
-----Original Message-----
From: john-secfocus@o-rourke.org [mailto:john-secfocus@o-rourke.org]
Sent: Tuesday, January 31, 2006 2:59 AM
To: webappsec@securityfocus.com
Subject: Re: Cross Site Cooking
It's probably better referring to the cookies RFC
(ftp://ftp.rfc-editor.org/in-notes/rfc2965.txt) rather than a
very old article (http://www.ciac.org/ciac/bulletins/i-034.shtml).
The RFC doesn't mention anything about numbers of dots and
specific domains.
Although it's all definitely a security risk, there's no way
all vendors would change the mechanism without keeping
backwards compatibility, it would cause chaos. So with my
sites I always put a checksum in the cookie data, which
allows the website to be certain no clients have altered the
data manually.
--------------------------------------------------------------
-----------
This List Sponsored by: Watchfire
Watchfire's AppScan is the industry's first and leading web
application
security testing suite, and the only solution to provide
comprehensive
remediation tasks at every level of the application. See for
yourself.
Download AppScan 6.0 today.
https://www.watchfire.com/securearea/appscansix.aspx?id=701300
000003Ssh
--------------------------------------------------------------------------
-------------------------------------------------------------------------
This List Sponsored by: Watchfire
Watchfire's AppScan is the industry's first and leading web application
security testing suite, and the only solution to provide comprehensive
remediation tasks at every level of the application. See for yourself.
Download AppScan 6.0 today.
https://www.watchfire.com/securearea/appscansix.aspx?id=701300000003Ssh
--------------------------------------------------------------------------
