In Chrome, you can view and manage cookies here: chrome://settings/cookies
Thanks for that! I always went through chrome's preferences which is like navigating a maze.
Fun with your friend's Facebook and Tinder sessions
41–50 of 59 posts
Re: Fun with your friend's Facebook and Tinder sessions
#42In Chrome, you can view and manage cookies here: chrome://settings/cookies
You can also get a nice tabular view for the domain you're on by going to "Resources" from dev tools and navigating to the "Cookies" subsection.
Re: Fun with your friend's Facebook and Tinder sessions
#43Earlier quoted context omitted.
It seems like the most reasonable mitigation would be to disallow Burp Suite from working at all by using SSL cert pinning. (I'm actually pretty surprised that they don't do this already -- I know that Google pins certs for their own apps in Chrome.) This, of course, would not completely stop the issue. But, it would make the author's job that much harder, since he'd have to emulate the Tinder protocol without the as…
In the story, BurpSuite was used only on the attacker's machine for ease of use. You could also hand-craft the requests using curl. Cert pinning doesn't help when someone installs their own certificate authority. It stops other CAs that came bundled with the browser from working, but if it stopped self-installed certificates from working it never would have gotten off the ground because many organizations demand the…
[deleted]
Re: Fun with your friend's Facebook and Tinder sessions
#44As I was recently doing some reading, it seems like the cookie stealing could be made more difficult by adding something harder to fake? I think for flask-login they add in the ip and user agent. https://flask-login.readthedocs.org/en/latest/#session-prote... This probably wouldnt work given that I am assuming its the external IP and a user agent is pretty easy to copy/clone. Seems like there should be another value…
IP can cause weird behavior for mobile, since it changes all the time, especially if they hop onto/off of wifi. User agent is trivial to fake.
Re: Fun with your friend's Facebook and Tinder sessions
#45Earlier quoted context omitted.
Couldn't the author just copy Steve's private key to his computer then?
Not if it's a hardware key. You give the processor something you want to encrypt, but you can't look at the actual key itself (the only way to do that would be with an electron microscope).
That said, if you could gain persistent remote access to the computer, you can just repeatedly ask the processor to encrypt things.
This is incidentally part of why the Chromebook design makes it hard to persistently change the machine; a reboot starts from a clean signed image and then mounts a home directory. It's still possible to stick a persistent exploit somewhere in the home directory, but it's not as simple as just dropping a file in /etc/init.
Re: Fun with your friend's Facebook and Tinder sessions
#46Meta: I was hesitant to click on this link, as the HN comments implied it was "enjoyable", which in my experience when applied to technical articles is usually codeword for "fluffy and un-informative".
But this article has all the technical details, and just-enough-but-not-too-much humor and background story to make this entertaining. Highly recommended, even if you're a "the details, all the details and nothing but the details" technical reader like me.
Re: Fun with your friend's Facebook and Tinder sessions
#47The only hole I can see here is that chrome extensions can read HTTP-only cookies. What are your thoughts on this?
First, some chrome extensions might legitimately need this. But even if they were disallowed -
The guy had physical access to a running chrome capable of sending those cookies, and the ability to install an extension. This basically means no software policy was going to stop him.
Re: Fun with your friend's Facebook and Tinder sessions
#48Excellent article aside I also enjoyed the reference to Darkplace in the header. :)
Re: Fun with your friend's Facebook and Tinder sessions
#49Earlier quoted context omitted.
It seems like the most reasonable mitigation would be to disallow Burp Suite from working at all by using SSL cert pinning. (I'm actually pretty surprised that they don't do this already -- I know that Google pins certs for their own apps in Chrome.) This, of course, would not completely stop the issue. But, it would make the author's job that much harder, since he'd have to emulate the Tinder protocol without the as…
In the story, BurpSuite was used only on the attacker's machine for ease of use. You could also hand-craft the requests using curl. Cert pinning doesn't help when someone installs their own certificate authority. It stops other CAs that came bundled with the browser from working, but if it stopped self-installed certificates from working it never would have gotten off the ground because many organizations demand the…
Cert-pinning in the application for their own server is totally doable, that's exactly what Google is doing with Chrome.
Re: Fun with your friend's Facebook and Tinder sessions
#50> you most likely have 2 minutes alone with his computer Install a RAT and do whatever you want later. You have have a lot more fun with a RAT than just grabbing FB cookies.
Grabbing cookies can be done easily as an offline attack though, assuming they don't clear cookies on every shutdown (which I'd bet 99% of users don't). You simply copy their cookies file/s from chrome and temporarily replace yours with it.
I previously carried out a similar attack whereby I temporarily borrowed the hard-drive out of a housemates laptop when they had left it not locked in their room and gained access to many of their frequented accounts (after they had made a point of saying I wouldn't be able to gain access). I was able to maintain access for several months changing subtle things before someone else notified them and they cleared sessions.
The cookies file is generally small enough to easily upload in the background if your passing around casual programming apps with friends. I don't condone this, but it's a very hard attack to mitigate without services breaking UX. Shopping websites do this by asking you to re-enter your password before changing account details/making a purchase, I'm not sure whether such a UX change would hurt social media.
Note: This was all probably around 6+ months ago, chrome may have mitigated this exact attack since by encrypting the file with something Google account specific.