Hackers Think Cookies Are Tasty, Too
blog.tinfoilsecurity.com
Hackers Think Cookies Are Tasty, Too
1–10 of 14 posts
Re: Hackers Think Cookies Are Tasty, Too
#2But...in order to properly execute an XSS attack, you have to get your code onto someone else's computer. You can edit your own cookies all day long and accomplish nothing of value. What piece am I missing here?
That said, as far as the server trusting cookie values to do database lookups or whatever, sure, there's a hole there. Most folks will use something like HMAC-signed cookies in those cases, so that an attacker would have to be in possession of a secret key in order to successfully have altered cookie data accepted by the user. But in any case, the data should be treated like any other user-supplied data - untrusted and to be sanitized.
Re: Hackers Think Cookies Are Tasty, Too
#3Isn't XSS only a client side danger? For URLs, this is relevant since you can post a malicious link and people can click on it. It's much harder to get someone else's browser to accept a cookie you made for a specific website.
Of course, cookies are still client-side data and should not be trusted. But XSS is not a problem here. Correct me if I'm wrong.
Re: Hackers Think Cookies Are Tasty, Too
#4Isn't it a widely adopted practice to encrypt the content of the cookie before setting it? Of course it could still be tampered with, but not as trivially.
Re: Hackers Think Cookies Are Tasty, Too
#5Isn't XSS only a client side danger? For URLs, this is relevant since you can post a malicious link and people can click on it. It's much harder to get someone else's browser to accept a cookie you made for a specific website. Of course, cookies are still client-side data and should not be trusted. But XSS is not a problem here. Correct me if I'm wrong.
Not if your server environment is running Node.js! If you start reading cookies and potentially evaluating their content, this could have a major impact on a Node process. That said, I doubt that you could hack a running Node process with this without the system using eval() on the cookie contents. I've been wrong before....
Re: Hackers Think Cookies Are Tasty, Too
#6But...in order to properly execute an XSS attack, you have to get your code onto someone else's computer. You can edit your own cookies all day long and accomplish nothing of value. What piece am I missing here? That said, as far as the server trusting cookie values to do database lookups or whatever, sure, there's a hole there. Most folks will use something like HMAC-signed cookies in those cases, so that an attacke…
Yeah, it's not a great use-case because it requires other flaws where the cookie value is used. This is just a specific example of the general problem that any variable in the browser can be changed by the user before being sent to the server.
Re: Hackers Think Cookies Are Tasty, Too
#7But...in order to properly execute an XSS attack, you have to get your code onto someone else's computer. You can edit your own cookies all day long and accomplish nothing of value. What piece am I missing here? That said, as far as the server trusting cookie values to do database lookups or whatever, sure, there's a hole there. Most folks will use something like HMAC-signed cookies in those cases, so that an attacke…
Yes, I think what the original article is saying is that the cookie could have been altered by a rogue browser extension/virus on a user's computer, which could be then potentially used to import a script from a different origin into the user's page.
Re: Hackers Think Cookies Are Tasty, Too
#8But...in order to properly execute an XSS attack, you have to get your code onto someone else's computer. You can edit your own cookies all day long and accomplish nothing of value. What piece am I missing here? That said, as far as the server trusting cookie values to do database lookups or whatever, sure, there's a hole there. Most folks will use something like HMAC-signed cookies in those cases, so that an attacke…
Yes, I think XSS from a user-generated cookie is pointless except in very specific attacks. And as far as cookies as an entry-point for SQL injection and other attacks this is a well-known field (albeit less than GET and POST data) that only lazy, 'absent' or uneducated (security-wise) programmers will miss.
Re: Hackers Think Cookies Are Tasty, Too
#9But...in order to properly execute an XSS attack, you have to get your code onto someone else's computer. You can edit your own cookies all day long and accomplish nothing of value. What piece am I missing here? That said, as far as the server trusting cookie values to do database lookups or whatever, sure, there's a hole there. Most folks will use something like HMAC-signed cookies in those cases, so that an attacke…
Yes, I think what the original article is saying is that the cookie could have been altered by a rogue browser extension/virus on a user's computer, which could be then potentially used to import a script from a different origin into the user's page.
If I have my malware on your computer, I'm just going to use it to steal your cookie (any other sensitive information) directly rather than perform some convoluted roundabout XSS. :P
Re: Hackers Think Cookies Are Tasty, Too
#10Isn't it a widely adopted practice to encrypt the content of the cookie before setting it? Of course it could still be tampered with, but not as trivially.
Frameworks like Rails or Django offer options to encrypt or sign session cookies, but any other cookies are often left up to the developer to take care of. The HttpOnly and Secure flags are important to remember as well because otherwise a man-in-the-middle or rogue JS can modify them.