1 1 00:00:00,360 --> 00:00:02,250 Session Hijacking. 2 2 00:00:02,250 --> 00:00:04,140 In this lesson, we are going to talk 3 3 00:00:04,140 --> 00:00:07,200 all about session hijacking, but before we do, 4 4 00:00:07,200 --> 00:00:09,030 we need to talk about session management 5 5 00:00:09,030 --> 00:00:10,440 because session management is 6 6 00:00:10,440 --> 00:00:12,180 a fundamental security component 7 7 00:00:12,180 --> 00:00:14,370 in our web applications these days. 8 8 00:00:14,370 --> 00:00:16,050 When we talk about session management, 9 9 00:00:16,050 --> 00:00:19,110 this enables web applications to uniquely identify a user 10 10 00:00:19,110 --> 00:00:21,660 across a number of different actions and requests 11 11 00:00:21,660 --> 00:00:23,370 while keeping the state of the data generator 12 12 00:00:23,370 --> 00:00:27,090 by that user and ensuring it's assigned to that user. 13 13 00:00:27,090 --> 00:00:29,040 Now, when we do session management, for instance, 14 14 00:00:29,040 --> 00:00:31,260 you log into my website and there's a lot 15 15 00:00:31,260 --> 00:00:33,840 of other students who are logged into my website right now. 16 16 00:00:33,840 --> 00:00:34,710 When you're logged in, 17 17 00:00:34,710 --> 00:00:36,360 I need to know what lesson you're watching. 18 18 00:00:36,360 --> 00:00:38,880 I need to know what quiz you've passed, and all 19 19 00:00:38,880 --> 00:00:41,850 of that is session information while you're connected to me. 20 20 00:00:41,850 --> 00:00:43,050 And then when you're done with that session, 21 21 00:00:43,050 --> 00:00:44,700 I need to save that in my database 22 22 00:00:44,700 --> 00:00:46,200 so that way when you log in next time, 23 23 00:00:46,200 --> 00:00:47,790 we didn't lose your results. 24 24 00:00:47,790 --> 00:00:50,520 Now, a lot of the way that people do this though is not just 25 25 00:00:50,520 --> 00:00:52,920 in the database, but they also use cookies. 26 26 00:00:52,920 --> 00:00:55,080 Hmm, delicious cookies. 27 27 00:00:55,080 --> 00:00:56,550 No cookies aren't that delicious. 28 28 00:00:56,550 --> 00:00:59,070 We're talking about cookies in the cyber sense. 29 29 00:00:59,070 --> 00:01:00,690 And the reason we have to use cookies is 30 30 00:01:00,690 --> 00:01:04,020 because web or HGTP is a stateless protocol. 31 31 00:01:04,020 --> 00:01:06,600 This means that the server doesn't preserve any information 32 32 00:01:06,600 --> 00:01:08,310 about the client by default. 33 33 00:01:08,310 --> 00:01:09,810 So, if you want to store that information, 34 34 00:01:09,810 --> 00:01:13,380 you have to either store it in a cookie or in your database. 35 35 00:01:13,380 --> 00:01:15,510 Now, cookies allow web applications to retain 36 36 00:01:15,510 --> 00:01:17,970 this information about the users of the website. 37 37 00:01:17,970 --> 00:01:19,920 And normally these cookies are going to be stored 38 38 00:01:19,920 --> 00:01:21,360 on your client. 39 39 00:01:21,360 --> 00:01:23,610 Now, a cookie is essentially just a text file. 40 40 00:01:23,610 --> 00:01:25,650 It's a text file that's used to store information 41 41 00:01:25,650 --> 00:01:27,810 about a user when they visit the website. 42 42 00:01:27,810 --> 00:01:30,450 Now that cookie is created when the server first sends 43 43 00:01:30,450 --> 00:01:33,270 the HTTP response header with that cookie. 44 44 00:01:33,270 --> 00:01:35,760 Then any subsequent request headers that are sent 45 45 00:01:35,760 --> 00:01:37,530 by the client will also include the cookie. 46 46 00:01:37,530 --> 00:01:39,990 So we can send that information back and forth. 47 47 00:01:39,990 --> 00:01:41,760 Because of that, we want to make sure 48 48 00:01:41,760 --> 00:01:43,020 that that cookie is protected 49 49 00:01:43,020 --> 00:01:46,050 because it is being transmitted across the internet. 50 50 00:01:46,050 --> 00:01:48,600 Now, when we talk about session cookies like these, 51 51 00:01:48,600 --> 00:01:50,190 these are going to be non-persistent. 52 52 00:01:50,190 --> 00:01:51,600 They reside in memory. 53 53 00:01:51,600 --> 00:01:52,770 And when you're done 54 54 00:01:52,770 --> 00:01:55,350 and you close out that browser instance, guess what? 55 55 00:01:55,350 --> 00:01:57,480 That cookie would be deleted as well. 56 56 00:01:57,480 --> 00:01:59,730 But not all cookies are just session cookies. 57 57 00:01:59,730 --> 00:02:01,710 Some cookies are going to be more persistent 58 58 00:02:01,710 --> 00:02:03,270 and these are known as persistent cookies 59 59 00:02:03,270 --> 00:02:05,160 because they stay around for a while. 60 60 00:02:05,160 --> 00:02:06,180 These cookies are stored 61 61 00:02:06,180 --> 00:02:08,520 in the browser cache until they're deleted by the user 62 62 00:02:08,520 --> 00:02:10,500 when you do the clearing your cookies 63 63 00:02:10,500 --> 00:02:13,950 or when they pass a defined expiration date, for instance, 64 64 00:02:13,950 --> 00:02:16,620 you might connect to my website and my cookie might say 65 65 00:02:16,620 --> 00:02:18,840 this cookie is good for seven days. 66 66 00:02:18,840 --> 00:02:20,490 And so if you came back in eight days, 67 67 00:02:20,490 --> 00:02:21,660 that cookie would be gone and you'd be 68 68 00:02:21,660 --> 00:02:24,120 like a new user doss if we were configured that way. 69 69 00:02:24,120 --> 00:02:25,770 That's the way cookies work. 70 70 00:02:25,770 --> 00:02:27,660 Now, when we talk about cookies, again, 71 71 00:02:27,660 --> 00:02:29,100 they have to be protected. 72 72 00:02:29,100 --> 00:02:30,540 And so when you're sending these cookies 73 73 00:02:30,540 --> 00:02:32,460 or you're storing any kind of confidential information 74 74 00:02:32,460 --> 00:02:34,800 in them, you should make sure they are encrypted. 75 75 00:02:34,800 --> 00:02:35,820 By encrypting those cookies, 76 76 00:02:35,820 --> 00:02:38,460 you can keep that information confidential because remember, 77 77 00:02:38,460 --> 00:02:41,760 confidentiality and encryption go hand in hand. 78 78 00:02:41,760 --> 00:02:42,870 Now the next thing we need to talk 79 79 00:02:42,870 --> 00:02:44,850 about is session hijacking. 80 80 00:02:44,850 --> 00:02:47,880 As I said, a lot of these cookies are session cookies. 81 81 00:02:47,880 --> 00:02:50,940 And so, session hijacking relates to this really well. 82 82 00:02:50,940 --> 00:02:53,100 When we talk about session hijacking, it's a type 83 83 00:02:53,100 --> 00:02:55,800 of spoofing attack where the attacker disconnects a host 84 84 00:02:55,800 --> 00:02:57,060 and then replaces it with his 85 85 00:02:57,060 --> 00:03:00,270 or her own machine spoofing the original host IP address 86 86 00:03:00,270 --> 00:03:02,130 or using some other mechanism. 87 87 00:03:02,130 --> 00:03:04,860 For instance, a lot of session hijacking attacks occur 88 88 00:03:04,860 --> 00:03:07,350 through the theft or the modification of cookies. 89 89 00:03:07,350 --> 00:03:08,610 So if I can steal your cookie, 90 90 00:03:08,610 --> 00:03:11,580 I can take over your session and pretend I'm you. 91 91 00:03:11,580 --> 00:03:12,413 Now, another way 92 92 00:03:12,413 --> 00:03:15,060 that this can be done is by doing session prediction. 93 93 00:03:15,060 --> 00:03:16,290 If you remember from your security 94 94 00:03:16,290 --> 00:03:19,320 plus or network plus days, every time you make a connection, 95 95 00:03:19,320 --> 00:03:21,240 there is a session number that's associated 96 96 00:03:21,240 --> 00:03:23,820 with that by the HGTP protocol. 97 97 00:03:23,820 --> 00:03:25,380 And if I can guess what that number is, 98 98 00:03:25,380 --> 00:03:27,180 I can jump in and take over. 99 99 00:03:27,180 --> 00:03:29,250 Session prediction attacks are simply a type 100 100 00:03:29,250 --> 00:03:31,650 of spoofing attack where the attacker attempts to predict 101 101 00:03:31,650 --> 00:03:34,320 the session token to hijack that session. 102 102 00:03:34,320 --> 00:03:36,600 Now, this session token has to be generated using 103 103 00:03:36,600 --> 00:03:39,330 a non-predictable algorithm, and it must not reveal 104 104 00:03:39,330 --> 00:03:41,670 any information about the session client. 105 105 00:03:41,670 --> 00:03:45,060 Essentially, it's a one-time use ticket for the duration 106 106 00:03:45,060 --> 00:03:47,940 of that session, and so it might be some long random number, 107 107 00:03:47,940 --> 00:03:50,580 but how it's generated has to be non-predictable. 108 108 00:03:50,580 --> 00:03:52,680 If it is predictable, somebody can guess it 109 109 00:03:52,680 --> 00:03:54,570 and they can take over your session. 110 110 00:03:54,570 --> 00:03:56,190 Now, the next thing we need to talk about here 111 111 00:03:56,190 --> 00:04:00,690 is cross-site request forgery, which is XSRF or CSRF. 112 112 00:04:01,620 --> 00:04:02,823 It's written both ways. 113 113 00:04:03,774 --> 00:04:06,180 As an abbreviation, I tend to prefer CSRF 114 114 00:04:06,180 --> 00:04:08,490 and you'll see me use that throughout the course. 115 115 00:04:08,490 --> 00:04:10,320 Now, cross-site request forgery is 116 116 00:04:10,320 --> 00:04:11,910 a malicious script that's being hosted 117 117 00:04:11,910 --> 00:04:15,030 on the attacker site that can then exploit a session started 118 118 00:04:15,030 --> 00:04:17,520 on another site within the same browser. 119 119 00:04:17,520 --> 00:04:18,720 Now, as an attacker 120 120 00:04:18,720 --> 00:04:21,360 if I want to conduct a cross-site request forgery, 121 121 00:04:21,360 --> 00:04:23,550 I need to convince the victim to start a session 122 122 00:04:23,550 --> 00:04:25,260 with the target website. 123 123 00:04:25,260 --> 00:04:28,170 Now, the attacker can then pass the HCTP request 124 124 00:04:28,170 --> 00:04:30,120 to the victim's browser and spoof this 125 125 00:04:30,120 --> 00:04:33,420 as an action on the target site, such as changing a password 126 126 00:04:33,420 --> 00:04:35,790 or an email address or something else like that. 127 127 00:04:35,790 --> 00:04:37,410 Now, this request could be disguised 128 128 00:04:37,410 --> 00:04:39,000 in a lot of different ways. 129 129 00:04:39,000 --> 00:04:42,030 They can use things like image tags and other HTML coding 130 130 00:04:42,030 --> 00:04:43,170 and this could also be accomplished 131 131 00:04:43,170 --> 00:04:46,050 without the victim necessarily even having to click a link 132 132 00:04:46,050 --> 00:04:47,580 if they do it successfully. 133 133 00:04:47,580 --> 00:04:49,140 Now, if the target site is going to 134 134 00:04:49,140 --> 00:04:51,060 assume the browser is authenticated, 135 135 00:04:51,060 --> 00:04:52,860 this is because they have a valid session token 136 136 00:04:52,860 --> 00:04:55,350 from that browser already from that victim, 137 137 00:04:55,350 --> 00:04:57,690 it doesn't have to have any additional authorization 138 138 00:04:57,690 --> 00:04:59,910 for the attacker to do what it wants to do. 139 139 00:04:59,910 --> 00:05:01,440 So think of it this way. 140 140 00:05:01,440 --> 00:05:03,030 You have two tabs in your browser. 141 141 00:05:03,030 --> 00:05:05,610 One is the attacker's website and one is your bank. 142 142 00:05:05,610 --> 00:05:07,140 You've already authenticated to your bank, 143 143 00:05:07,140 --> 00:05:07,973 but now you connect it 144 144 00:05:07,973 --> 00:05:09,870 to the attacker's website and another tab 145 145 00:05:09,870 --> 00:05:13,038 they can use cross-site request forgery to try to manipulate 146 146 00:05:13,038 --> 00:05:16,560 and be able to go and do things on your bank account as you 147 147 00:05:16,560 --> 00:05:18,270 because you're already in that state. 148 148 00:05:18,270 --> 00:05:19,890 And that's really what this cross-site request 149 149 00:05:19,890 --> 00:05:21,120 forgery is going to do for them. 150 150 00:05:21,120 --> 00:05:23,640 Now, how can you prevent cross-site request forgery 151 151 00:05:23,640 --> 00:05:24,720 as a defender? 152 152 00:05:24,720 --> 00:05:25,950 Let's say you are working for the bank 153 153 00:05:25,950 --> 00:05:27,840 and you want to make sure that nobody's going to perform this 154 154 00:05:27,840 --> 00:05:29,070 against your customers. 155 155 00:05:29,070 --> 00:05:30,180 What do you do? 156 156 00:05:30,180 --> 00:05:32,370 Well, you can use user specific tokens 157 157 00:05:32,370 --> 00:05:33,960 in all the form submissions 158 158 00:05:33,960 --> 00:05:35,790 to prevent cross-site request forgery 159 159 00:05:35,790 --> 00:05:37,680 and this is something your web developers would be able 160 160 00:05:37,680 --> 00:05:40,560 to do as part of their secure coding practice. 161 161 00:05:40,560 --> 00:05:41,760 So the last thing I want to talk 162 162 00:05:41,760 --> 00:05:43,470 about here is cookie poisoning. 163 163 00:05:43,470 --> 00:05:45,330 I know we've talked a lot about cookies 164 164 00:05:45,330 --> 00:05:46,710 and it's making me hungry, 165 165 00:05:46,710 --> 00:05:48,180 but let's talk about cookie poisoning 166 166 00:05:48,180 --> 00:05:49,920 and then we'll finish up this lesson. 167 167 00:05:49,920 --> 00:05:51,630 When we talk about cookie poisoning, 168 168 00:05:51,630 --> 00:05:53,670 this modifies the contents of a cookie 169 169 00:05:53,670 --> 00:05:56,100 after it's been generated and sent by the web service 170 170 00:05:56,100 --> 00:05:57,390 to the client's browser 171 171 00:05:57,390 --> 00:05:59,730 so that newly modified cookie can then be used 172 172 00:05:59,730 --> 00:06:02,550 to exploit vulnerabilities in a web application. 173 173 00:06:02,550 --> 00:06:04,530 If you want to be able to counter cookie poisoning 174 174 00:06:04,530 --> 00:06:07,230 on your systems, you want to make sure you validate the input 175 175 00:06:07,230 --> 00:06:10,290 of your web app to account for any tampered with cookies. 176 176 00:06:10,290 --> 00:06:11,730 By doing encryption of your cookies 177 177 00:06:11,730 --> 00:06:13,980 during transmission and storage, you can help prevent this. 178 178 00:06:13,980 --> 00:06:16,350 And if you delete cookies from the browser cash 179 179 00:06:16,350 --> 00:06:18,030 when the client terminates their session, 180 180 00:06:18,030 --> 00:06:20,010 it doesn't leave those cookies sitting there 181 181 00:06:20,010 --> 00:06:22,140 being able to be poisoned by somebody else. 182 182 00:06:22,140 --> 00:06:24,630 So this is all about good cookie management. 183 183 00:06:24,630 --> 00:06:27,120 Now, I know a lot of people are against cookies and websites 184 184 00:06:27,120 --> 00:06:28,800 and a lot of people turn off cookies, 185 185 00:06:28,800 --> 00:06:31,470 but a lot of sites need these cookies to operate. 186 186 00:06:31,470 --> 00:06:33,030 And so you have to be able to think about this. 187 187 00:06:33,030 --> 00:06:35,557 If you're the guy or gal who's programming these websites, 188 188 00:06:35,557 --> 00:06:37,530 do you have to use cookies to do this? 189 189 00:06:37,530 --> 00:06:40,410 Can you do this as saving things in your own database? 190 190 00:06:40,410 --> 00:06:42,060 Can you do this another way? 191 191 00:06:42,060 --> 00:06:44,010 And if you can't and you have to use cookies, 192 192 00:06:44,010 --> 00:06:45,660 make sure you're doing it securely 193 193 00:06:45,660 --> 00:06:47,370 by making sure they're very time limited, 194 194 00:06:47,370 --> 00:06:48,810 they're deleted when you're done 195 195 00:06:48,810 --> 00:06:51,710 and they're encrypted anytime you're storing data in them.