1
00:00:00,360 --> 00:00:02,250
Session hijacking.

2
00:00:02,250 --> 00:00:03,210
In this lesson,

3
00:00:03,210 --> 00:00:06,150
we are going to talk all about session hijacking.

4
00:00:06,150 --> 00:00:09,000
But before we do, we need to talk about session management

5
00:00:09,000 --> 00:00:10,260
because session management

6
00:00:10,260 --> 00:00:12,180
is a fundamental security component

7
00:00:12,180 --> 00:00:14,370
in our web applications these days.

8
00:00:14,370 --> 00:00:16,050
When we talk about session management,

9
00:00:16,050 --> 00:00:19,080
this enables web applications to uniquely identify a user

10
00:00:19,080 --> 00:00:21,660
across a number of different actions and requests

11
00:00:21,660 --> 00:00:24,420
while keeping the state of the data generated by that user

12
00:00:24,420 --> 00:00:27,090
and ensuring it's assigned to that user.

13
00:00:27,090 --> 00:00:29,070
Now, when we do session management, for instance,

14
00:00:29,070 --> 00:00:30,510
you log into my website,

15
00:00:30,510 --> 00:00:31,800
and there's a lot of other students

16
00:00:31,800 --> 00:00:33,870
who are logged into my website right now.

17
00:00:33,870 --> 00:00:34,710
When you're logged in,

18
00:00:34,710 --> 00:00:36,360
I need to know what lesson you're watching,

19
00:00:36,360 --> 00:00:38,460
I need to know what quiz you've passed,

20
00:00:38,460 --> 00:00:40,440
and all of that is session information

21
00:00:40,440 --> 00:00:41,850
while you're connected to me.

22
00:00:41,850 --> 00:00:43,050
And then when you're done with that session,

23
00:00:43,050 --> 00:00:44,700
I need to save that in my database

24
00:00:44,700 --> 00:00:46,200
so that way when you log in next time,

25
00:00:46,200 --> 00:00:47,790
we didn't lose your results.

26
00:00:47,790 --> 00:00:49,920
Now, a lot of the way that people do this though

27
00:00:49,920 --> 00:00:52,830
is not just in the database, but they also use cookies.

28
00:00:52,830 --> 00:00:55,380
We're talking about cookies in the cyber sense.

29
00:00:55,380 --> 00:00:56,820
And the reason we have to use cookies

30
00:00:56,820 --> 00:01:00,330
is because web or HTTP is a stateless protocol.

31
00:01:00,330 --> 00:01:02,880
This means that the server doesn't preserve any information

32
00:01:02,880 --> 00:01:04,620
about the client by default.

33
00:01:04,620 --> 00:01:06,090
So if you want to store that information,

34
00:01:06,090 --> 00:01:09,690
you have to either store it in a cookie or in your database.

35
00:01:09,690 --> 00:01:11,280
Now, cookies allow web applications

36
00:01:11,280 --> 00:01:14,280
to retain this information about the users of the website.

37
00:01:14,280 --> 00:01:15,600
And normally these cookies

38
00:01:15,600 --> 00:01:17,640
are going to be stored on your client.

39
00:01:17,640 --> 00:01:19,890
Now, a cookie is essentially just a text file.

40
00:01:19,890 --> 00:01:21,000
It's a text file that's used

41
00:01:21,000 --> 00:01:22,680
to store information about a user

42
00:01:22,680 --> 00:01:24,120
when they visit the website.

43
00:01:24,120 --> 00:01:25,470
Now that cookie is created

44
00:01:25,470 --> 00:01:28,440
when the server first sends the HTTP response header

45
00:01:28,440 --> 00:01:29,580
with that cookie.

46
00:01:29,580 --> 00:01:31,650
Then any subsequent request headers

47
00:01:31,650 --> 00:01:33,840
that are sent by the client will also include the cookie

48
00:01:33,840 --> 00:01:36,300
so we can send that information back and forth.

49
00:01:36,300 --> 00:01:38,070
Because of that, we want to make sure

50
00:01:38,070 --> 00:01:39,330
that that cookie is protected

51
00:01:39,330 --> 00:01:42,330
because it is being transmitted across the internet.

52
00:01:42,330 --> 00:01:44,880
Now when we talk about session cookies like these,

53
00:01:44,880 --> 00:01:46,470
these are going to be non-persistent,

54
00:01:46,470 --> 00:01:47,880
they reside in memory.

55
00:01:47,880 --> 00:01:49,080
And when you're done

56
00:01:49,080 --> 00:01:51,660
and you close out that browser instance, guess what?

57
00:01:51,660 --> 00:01:53,760
That cookie would be deleted as well.

58
00:01:53,760 --> 00:01:56,040
But not all cookies are just session cookies.

59
00:01:56,040 --> 00:01:57,990
Some cookies are going to be more persistent,

60
00:01:57,990 --> 00:01:59,580
and these are known as persistent cookies

61
00:01:59,580 --> 00:02:01,470
because they stay around for a while.

62
00:02:01,470 --> 00:02:03,450
These cookies are stored in the browser cache

63
00:02:03,450 --> 00:02:04,800
until they're deleted by the user

64
00:02:04,800 --> 00:02:06,810
when you do the clearing your cookies

65
00:02:06,810 --> 00:02:09,600
or when they pass a defined expiration date.

66
00:02:09,600 --> 00:02:11,610
For instance, you might connect to my website

67
00:02:11,610 --> 00:02:12,847
and my cookie might say,

68
00:02:12,847 --> 00:02:15,150
"This cookie is good for seven days."

69
00:02:15,150 --> 00:02:16,770
And so if you came back in eight days,

70
00:02:16,770 --> 00:02:17,610
that cookie would be gone

71
00:02:17,610 --> 00:02:19,320
and you'd be like a new user to us.

72
00:02:19,320 --> 00:02:20,370
If we were configured that way,

73
00:02:20,370 --> 00:02:22,080
that's the way cookies work.

74
00:02:22,080 --> 00:02:23,970
Now, when we talk about cookies, again,

75
00:02:23,970 --> 00:02:25,380
they have to be protected.

76
00:02:25,380 --> 00:02:27,450
And so when you're sending these cookies or you're storing

77
00:02:27,450 --> 00:02:29,280
any kind of confidential information in them,

78
00:02:29,280 --> 00:02:31,080
you should make sure they are encrypted.

79
00:02:31,080 --> 00:02:32,130
By encrypting those cookies,

80
00:02:32,130 --> 00:02:33,930
you can keep that information confidential

81
00:02:33,930 --> 00:02:36,360
because remember, confidentiality and encryption

82
00:02:36,360 --> 00:02:38,070
go hand in hand.

83
00:02:38,070 --> 00:02:39,420
Now the next thing we need to talk about

84
00:02:39,420 --> 00:02:41,160
is session hijacking.

85
00:02:41,160 --> 00:02:44,130
As I said, a lot of these cookies are session cookies.

86
00:02:44,130 --> 00:02:47,220
And so session hijacking relates to this really well.

87
00:02:47,220 --> 00:02:48,840
When we talk about session hijacking,

88
00:02:48,840 --> 00:02:50,460
it's a type of spoofing attack

89
00:02:50,460 --> 00:02:52,110
where the attacker disconnects a host

90
00:02:52,110 --> 00:02:54,450
and then replaces it with his or her own machine,

91
00:02:54,450 --> 00:02:56,580
spoofing the original host IP address,

92
00:02:56,580 --> 00:02:58,440
or using some other mechanism.

93
00:02:58,440 --> 00:03:01,170
For instance, a lot of session hijacking attacks occur

94
00:03:01,170 --> 00:03:03,630
through the theft or the modification of cookies.

95
00:03:03,630 --> 00:03:04,920
So if I can steal your cookie,

96
00:03:04,920 --> 00:03:07,890
I can take over your session and pretend I'm you.

97
00:03:07,890 --> 00:03:09,540
Now, another way that this can be done

98
00:03:09,540 --> 00:03:11,460
is by doing session prediction.

99
00:03:11,460 --> 00:03:12,780
Session prediction attacks

100
00:03:12,780 --> 00:03:14,580
are simply a type of spoofing attack

101
00:03:14,580 --> 00:03:16,800
where the attacker attempts to predict the session token

102
00:03:16,800 --> 00:03:18,600
to hijack that session.

103
00:03:18,600 --> 00:03:20,610
Now, this session token has to be generated

104
00:03:20,610 --> 00:03:22,470
using a non-predictable algorithm,

105
00:03:22,470 --> 00:03:24,450
and it must not reveal any information

106
00:03:24,450 --> 00:03:25,980
about the session client.

107
00:03:25,980 --> 00:03:28,590
Essentially, it's a one-time use ticket

108
00:03:28,590 --> 00:03:30,330
for the duration of that session.

109
00:03:30,330 --> 00:03:32,220
And so it might be some long random number,

110
00:03:32,220 --> 00:03:34,860
but how it's generated has to be non unpredictable.

111
00:03:34,860 --> 00:03:36,960
If it is predictable, somebody can guess it

112
00:03:36,960 --> 00:03:38,850
and they can take over your session.

113
00:03:38,850 --> 00:03:40,470
So the last thing I want to talk about here

114
00:03:40,470 --> 00:03:41,760
is cookie poisoning.

115
00:03:41,760 --> 00:03:43,620
I know, we've talked a lot about cookies

116
00:03:43,620 --> 00:03:45,030
and it's making me hungry.

117
00:03:45,030 --> 00:03:46,470
But let's talk about cookie poisoning

118
00:03:46,470 --> 00:03:48,210
and then we'll finish up this lesson.

119
00:03:48,210 --> 00:03:49,920
When we talk about cookie poisoning,

120
00:03:49,920 --> 00:03:51,990
this modifies the contents of a cookie

121
00:03:51,990 --> 00:03:54,420
after it's been generated and sent by the web service

122
00:03:54,420 --> 00:03:55,710
to the client's browser

123
00:03:55,710 --> 00:03:58,020
so that that newly modified cookie can then be used

124
00:03:58,020 --> 00:04:00,840
to exploit vulnerabilities in a web application.

125
00:04:00,840 --> 00:04:02,820
If you want to be able to counter cookie poisoning

126
00:04:02,820 --> 00:04:05,070
on your systems, you want to make sure you validate

127
00:04:05,070 --> 00:04:06,390
the input of your web app

128
00:04:06,390 --> 00:04:08,610
to account for any tampered-with cookies.

129
00:04:08,610 --> 00:04:10,020
By doing encryption of your cookies

130
00:04:10,020 --> 00:04:11,190
during transmission and storage,

131
00:04:11,190 --> 00:04:12,300
you can help prevent this,

132
00:04:12,300 --> 00:04:14,670
and if you delete cookies from the browser cache

133
00:04:14,670 --> 00:04:16,350
when the client terminates their session,

134
00:04:16,350 --> 00:04:18,329
it doesn't leave those cookies sitting there,

135
00:04:18,329 --> 00:04:20,430
being able to be poisoned by somebody else.

136
00:04:20,430 --> 00:04:22,950
So, this is all about good cookie management.

137
00:04:22,950 --> 00:04:25,440
Now, I know a lot of people are against cookies in websites,

138
00:04:25,440 --> 00:04:27,090
and a lot of people turn off cookies.

139
00:04:27,090 --> 00:04:29,790
But a lot of sites need these cookies to operate.

140
00:04:29,790 --> 00:04:31,350
And so you have to be able to think about this

141
00:04:31,350 --> 00:04:34,230
if you're the guy or girl who's programming these websites:

142
00:04:34,230 --> 00:04:35,820
Do you have to use cookies to do this?

143
00:04:35,820 --> 00:04:38,730
Can you do this as saving things in your own database?

144
00:04:38,730 --> 00:04:40,380
Can you do this another way?

145
00:04:40,380 --> 00:04:42,300
And if you can't and you have to use cookies,

146
00:04:42,300 --> 00:04:43,950
make sure you're doing it securely

147
00:04:43,950 --> 00:04:45,690
by making sure they're very time limited,

148
00:04:45,690 --> 00:04:47,130
they're deleted when you're done,

149
00:04:47,130 --> 00:04:50,030
and they're encrypted anytime you're storing data in them.