Presented at
DeepSec 2015 „DeepSec No. 9“,
Nov. 19, 2015, 10 a.m.
(50 minutes)
Since cookies store sensitive data (session ID, CSRF token, etc.) they are interesting from an attacker's point of view. As it turns out, quite many web applications (including sensitive ones like bitcoin platforms) have cookie related vulnerabilities, that lead, for example, to user impersonation, remote cookie tampering, XSS and more.
Developers tend to forget that multi-factor authentication does not help if cookies are insecurely processed. Security evaluators underestimate cookie related problems. Moreover, there are problems with the secure processing of cookies in modern browsers. And browser dependent exploitation can be used to launch more powerful attacks.
That's why secure cookie processing (from the perspective of web application and browser) is a subject worth discussing. The following topics will be presented:
- cookie related vulnerabilities in web applications
- insecure processing of secure flag in modern browsers
- bypassing HttpOnly flag in Safari
- problems with Domain attribute in Internet Explorer
- cookie tampering in Safari
- underestimated XSS via cookie
- HTTP Strict Transport Security (HSTS)
- importance of regeneration
- and more
Presenters:
-
Dawid Czagan
- Silesia Security Lab
Dawid Czagan (@dawidczagan) has found security vulnerabilities in Google, Yahoo, Mozilla, Microsoft, Twitter, BlackBerry and other companies. Due to the severity of many bugs, he received numerous awards for his findings.
Dawid is founder and CEO at Silesia Security Lab, which delivers specialized security auditing and training services. He also works as Security Architect at Future Processing.
Dawid shares his security bug hunting experience in his hands-on training "Hacking web applications - case studies of award-winning bugs in Google, Yahoo, Mozilla and more".
He delivered security trainings/workshops at Hack In The Box (Amsterdam), CanSecWest (Vancouver), DeepSec (Vienna), Hack In Paris (Paris) and for many private companies. He also spoke at Security Seminar Series (University of Cambridge) and published over 20 security articles (InfoSec Institute).
To find out about the latest in Dawid's work, you are invited to visit his blog (https://silesiasecuritylab.com/blog) and follow him on Twitter (@dawidczagan).
Links:
Similar Presentations: