The Cracked Cookie Jar: HTTP Cookie Hijacking and the Exposure of Private Information

Sivakorn, Suphannee; Polakis, Iasonas; Keromytis, Angelos D.

doi:10.1109/sp.2016.49

Cited by 64 publications

(56 citation statements)

References 42 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…If it is possible to reuse an intercepted cookie, the interceptor can hijack a session. Leaked cookies can also reveal user data directly [50]. Cookies should be protected by a secure connection.…”

Section: Methodsmentioning

confidence: 99%

Client-Focused Security Assessment of mHealth Apps and Recommended Practices to Prevent or Mitigate Transport Security Issues

Müthing¹,

Jäschke²,

Friedrich³

2017

JMIR Mhealth Uhealth

View full text Add to dashboard Cite

BackgroundMobile health (mHealth) apps show a growing importance for patients and health care professionals. Apps in this category are diverse. Some display important information (ie, drug interactions), whereas others help patients to keep track of their health. However, insufficient transport security can lead to confidentiality issues for patients and medical professionals, as well as safety issues regarding data integrity. mHealth apps should therefore deploy intensified vigilance to protect their data and integrity. This paper analyzes the state of security in mHealth apps.ObjectiveThe objectives of this study were as follows: (1) identification of relevant transport issues in mHealth apps, (2) development of a platform for test purposes, and (3) recommendation of practices to mitigate them.MethodsSecurity characteristics relevant to the transport security of mHealth apps were assessed, presented, and discussed. These characteristics were used in the development of a prototypical platform facilitating streamlined tests of apps. For the tests, six lists of the 10 most downloaded free apps from three countries and two stores were selected. As some apps were part of these top 10 lists in more than one country, 53 unique apps were tested.ResultsOut of the 53 apps tested from three European App Stores for Android and iOS, 21/53 (40%) showed critical results. All 21 apps failed to guarantee the integrity of data displayed. A total of 18 apps leaked private data or were observable in a way that compromised confidentiality between apps and their servers; 17 apps used unprotected connections; and two apps failed to validate certificates correctly. None of the apps tested utilized certificate pinning. Many apps employed analytics or ad providers, undermining user privacy.ConclusionsThe tests show that many mHealth apps do not apply sufficient transport security measures. The most common security issue was the use of any kind of unprotected connection. Some apps used secure connections only for selected tasks, leaving all other traffic vulnerable.

show abstract

Section: Methodsmentioning

confidence: 99%

Client-Focused Security Assessment of mHealth Apps and Recommended Practices to Prevent or Mitigate Transport Security Issues

Müthing¹,

Jäschke²,

Friedrich³

2017

JMIR Mhealth Uhealth

View full text Add to dashboard Cite

show abstract

“…The session ID is a unique number which is assigned by the server to the specific user during user visit to that website. The session ID is assigned inside the cookies form field or sometime in the field of URL [6]. There are many ways to generate the session ID some of the web servers generate the session IDs by incrementing static numbers, but the way of generating session IDs is not much suitable way and this is not much secure also, attacker can easily predict the session ID if the attacker is continuously monitoring the packets which are passed through the victim machine to server.…”

Section: Non-blind Spoofing Attackmentioning

confidence: 99%

Session Hijacking and Prevention Technique

Baitha¹,

Vinod²

2018

IJET

View full text Add to dashboard Cite

Session Hijacking is an attack which is basically used to gain the unauthorized access between an authorized session connections. This is usually done to attack the social network website and banking websites in order to gain the access over the valid session as well as over the website too. These attacks are one of the commonly experienced cyber threats in today’s network. Most of the websites and networks are vulnerable from this kind of attack. For providing the protection I have given the multiple ways to protecting from this session hijacking attack. I have especially focused on one of the major attacks in this session hijacking attack SSL Strip attack which play very vital role in this kind of attack. Sometimes this session hijacking attack is also known as the Man in the Middle attack (MIMA).In this paper, I have covered many security mechanisms to stay away and protect you and the network. This session hijacking attack is very dangers for the security perspective. Even it can steal all users’ most sensitive data. This can create a big loss for the users financially. From all these types of attack, I have proposed many mechanisms to help the users to stay away from the attack. The main objective of this paper is to give detail information of session hijacking and countermeasure from session hijacking attacks.

show abstract

“…In a 2016 in-depth assessment of a diverse set of major websites and explore what functionality and information is exposed to attackers that have hijacked a user's HTTP cookies by [13], it was noted that "38% of mobile users have experienced mobile cybercrime in past 12 months (of 2016). "…”

Section: Cookie Theft/hijackingmentioning

confidence: 99%

An Analysis of Security and Performance Concerns in Mobile Web Application Development: Challenges and Open Issues

Kunda

Chishimba

Mulenga

et al. 2017

Int. J. Recent Contrib. Eng. Sci. IT

View full text Add to dashboard Cite

Abstract-The paper focuses on security and performance concerns in mobile web development. The approach used in the study involved surveying journal publications to identify security and performance concerns. The paper highlights some of the contemporary issues currently being faced by application developers as they create, update and maintain mobile web applications including Cross-Site Scripting, Cookie hijacking/theft, location hijacking, history theft, behavior analysis, session hijacking, API design, security and the type of web server used considered.

show abstract

The Cracked Cookie Jar: HTTP Cookie Hijacking and the Exposure of Private Information

Cited by 64 publications

References 42 publications

Client-Focused Security Assessment of mHealth Apps and Recommended Practices to Prevent or Mitigate Transport Security Issues

Client-Focused Security Assessment of mHealth Apps and Recommended Practices to Prevent or Mitigate Transport Security Issues

Session Hijacking and Prevention Technique

An Analysis of Security and Performance Concerns in Mobile Web Application Development: Challenges and Open Issues

Contact Info

Product

Resources

About