Session hijacking, also known as TCP session hijacking, is a method of taking over a web user session by surreptitiously obtaining the session ID and masquerading as the authorized user. Once the user's session ID has been accessed, the attacker can masquerade as that user and do anything the user is authorized to do on the network.
A byproduct of this type of attack is the ability to gain access to a server without having to authenticate to it. Once the attacker hijacks a session, they no longer have to worry about authenticating to the server as long as the communication session remains active. The attacker enjoys the same server access as the compromised user because the user has already authenticated to the server prior to the attack.
What is a session?
HTTP is stateless, so application designers had to develop a way to track the state between multiple connections from the same user, instead of requesting the user to authenticate upon each click in a web application. A session is a series of interactions between two communication end points that occurs during the span of a single connection. When a user logs into an application, a session is created on the server in order to maintain the state for other requests originating from the same user.
Applications use sessions to store parameters that are relevant to the user. The session is kept "alive" on the server as long as the user is logged on to the system. The session is destroyed when the user logs-out from the system or after a predefined period of inactivity. When the session is destroyed, the user's data should also be deleted from the allocated memory space.
A session ID is an identification string (usually a long, random, alpha-numeric string) that is transmitted between the client and the server. Session IDs are commonly stored in cookies, URLs and hidden fields of web pages.
Besides the useful functionality of session IDs, there are several security problems associated with them. All too typically, websites use algorithms based on easily predictable variables, such as time or IP address, in order to generate the Session IDs, causing their session IDs to be predictable. If encryption is not used (typically SSL), Session IDs are transmitted in the clear and are susceptible to eavesdropping.
How does session hijacking work?
The most popular culprits for carrying out a session hijacking are session sniffing, predictable session token ID, man in the browser, cross-site scripting, session sidejacking, and session fixation.
- Session sniffing. This is one of the most basic techniques used with application-layer session hijacking. The attacker uses a sniffer, such as Wireshark, or a proxy, such as OWASP Zed, to capture network traffic containing the session ID between a website and a client. Once the attacker captures this value, he can use this valid token to gain unauthorized access.
- Predictable sessions token ID. Many web servers use a custom algorithm or predefined pattern to generate session IDs. The greater the predictability of a session token, the weaker it is and the easier it is to predict. If the attacker can capture several IDs and analyze the pattern, he may be able to predict a valid session ID.
- Man-in-the-browser attack. This is similar to a man-in-the-middle attack, but the attacker must first infect the victim's computer with a Trojan. Once the victim is tricked into installing malware onto the system, the malware waits for the victim to visit a targeted site. The man-in-the-browser malware can invisibly modify transaction information and it can also create additional transactions without the user knowing. Because the requests are initiated from the victim's computer, it is very difficult for the web service to detect that the requests are fake.
- Cross-site scripting. Cybercriminals exploit server or application vulnerabilities to inject client-side scripts into web pages. This causes the browser to execute arbitrary code when it loads a compromised page. If HttpOnly isn’t set in session cookies, cybercriminals can gain access to the session key through injected scripts, giving them the information they need for session hijacking.
- Session side jacking. Cybercriminals can use packet sniffing to monitor a victim’s network traffic and intercept session cookies after the user has authenticated on the server. If TLS encryption is only used for login pages and not for the entire session, cybercriminals can hijack the session, act as the user within the targeted web application.
- Session fixation attacks. This technique steals a valid session ID that has yet to be authenticated. Then, the attacker tries to trick the user into authenticating with this ID. Once authenticated, the attacker now has access to the victim's computer. Session fixation explores a limitation in the way the web application manages a session ID. Three common variations exist: session tokens hidden in an URL argument, session tokens hidden in a form field and session tokens hidden in a session cookie.
Session hijack attacks are usually waged against busy networks with a high number of active communication sessions. The high network utilization not only provides the attacker with a large number of sessions to exploit, but it can also provide the attacker with a shroud of protection due to a large number of active sessions on the server.
What Do Attackers Gain from Session Hijacking?
When cybercriminals have hijacked a session, they can do virtually anything that the legitimate user was authorized to do during the active session. The most severe examples include transferring money from the user’s bank account, buying merchandise from web stores, accessing personally identifiable information (PII) for identity theft, and even stealing data from company systems.
CRIME: Setting the stage for session hijacking attacks
In April of 2022, The Recorded Future Platform identified 14,905 references to criminal underground posts in the past year which include the keywords “cookies”, “session cookies”, “session hijacking”. It cited "a steady increase in the number of references from April 2021 to April 2022."
In September 2012, security researchers Thai Duong and Juliano Rizzo announced CRIME, an attack that takes advantage of an information leak in the compression ratio of TLS requests as a side channel to enable them to decrypt the requests made by the client to the server. This, in turn, allows them to grab the user’s login cookie and then hijack the user’s session and impersonate her on high-value destinations such as banks or e-commerce sites.
The demonstration showed how an attacker might execute this attack to recover the headers of an HTTP request. Since HTTP headers contain cookies, and cookies are the primary vehicle for web application authentication (after login), this presents a significant attack.
CRIME decrypts HTTPS cookies set by websites to remember authenticated users by means of brute force. The attack code forces the victim's browser to send specially crafted HTTPS requests to a targeted website and analyzes the variation in their length after they've been compressed in order to determine the value of the victim's session cookie. This is possible because SSL/TLS uses a compression algorithm called DEFLATE, which eliminates duplicate strings, as we saw above.
The attack code can't read the session cookie included in the requests because of security mechanisms in the browser. However, it can control the path of every new request and can insert different strings into it in an attempt to match the value of the cookie.
Session cookie values can be quite long and are made up of uppercase letters, lowercase letters and digits. As a result, the CRIME attack code has to initiate a very large number of requests in order to decrypt them, which can take several minutes. However, the researchers have developed some algorithms that make the session hijacking attack more efficient.
What are other examples of session hijacking attacks?
In addition to CRIME, there are several new models that show what cybercriminals can accomplish in a session hijacking attack. Here are some prominent examples:
- CookieCadger: An open source tool that can identify “information leakage” from web applications, CookieCadger can monitor both wired ethernet and unsecure Wi-Fi for unencrypted information including session cookies. This graphical utility was the first open-source pen-testing tool ever made for intercepting and replaying specific insecure HTTP GET requests into a browser. The wide adoption of SSL/TLS for web-based transactions now prevents cookie data from leaking over wired Ethernet or insecure Wi-Fi.
- DroidSheep: As an open-source Android security testing tool, DroidSheep is capable of hijacking a logged-on session conducted over a shared wireless network. Intended to demonstrate poor security properties in a network connection, DroidSheep may also be misused by cybercriminals to allow “packet sniffing” to grab session cookies and other unprotected information from unprotected Wi-Fi web browsing sessions.
- FireSheep: Originally released as a browser extension made for Firefox, FireSheep used a packet sniffer to intercept unencrypted session cookies from websites. Intended to be used as a way to demonstrate the risk of session hijacking for visitors of websites that did not encrypt cookies created during the login process, FireSheep could also be used to exploit security loopholes that allowed cybercriminals to find and copy unencrypted session cookies to use in session hijacking attacks. Once most websites began to migrate to HTTPS, this threat was largely neutralized.
- Zoombombing: During the increased use of video conferencing during the COVID-19 lockdowns, it became a target for session hijacking. Due to the increased popularity of Zoom during this time, these attacks became known as zoombombing. In these attacks, a cybercriminal hijacks a teleconferencing session and inserts material that is lewd, obscene, or otherwise offensive. Zoom responded by providing stronger protections, like gathering passwords, enforcing sitting areas and allowing session hosts to manually approve attendees.
- Slack attack: In 2019, a researcher found an HTTP Request Smuggling vulnerability in Slack that could be used to force users into open redirects that ultimately resulted in in the theft of secret user session cookies. These cookies could then be stolen by cybercriminals and be used to compromise Slack customer accounts and sessions. Slack was notified of the vulnerability and remediated it in less than 24 hours—before it was even made public.
- GitLab vulnerability: In a routine pen test, researchers discovered a vulnerability that could leave users exposed to session hijacking attacks. The vulnerability stems from the use of short tokens, which made them susceptible to brute-force attacks. But they were also persistent, which means that they never expire. And because they lacked role-based access control, a simple copy/paste of the token could grant access to GitLab user dashboards, account information, individual projects and website code. GitLab ultimately alleviated the vulnerability by modifying how tokens were used and put away.
How to prevent session hijacking attacks
It is important to remember that it is possible for an attacker to steal and reuse session identifiers or other sensitive cookie values when they're stored or transmitted insecurely. While providing 100% protection can be difficult, encryption is the main defense. When a user authenticates, SSL and a secure cookie should be mandatory. When authenticated users visit one or more secure pages, they should continue to be forced to use HTTPS.
Here are some steps you can take to help prevent session hijacking:
- Avoid public Wi-Fi connections. Whenever possible, avoid using a public Wi-Fi, especially for important transactions like banking, online shopping, or private email or social media accounts. A nearby cybercriminal could be using packet sniffing to try to pick up your session cookies.
- When in doubt, use a VPN. When you need to connect over a public Wi-Fi, using a virtual private network (VPN) will help keep cybercriminals out of your sessions. A VPN masks your IP address and keeps your online activities private by creating a “private tunnel” through which all your online activity travels.
- Keep your security software up to date. Install reputable security software on your devices and make sure to update it regularly. Security software can protect you from the malware that cybercriminals hijack sessions.
- Keep an eye out for potential scams. Session hijackers can send you an email with a link to click. Unless you have verified an email is from a legitimate sender, avoid clicking on any links that it may contain. Malicious links can download and install malware on your device or take you to a login page where you may inadvertently sign in to a site that is using a session ID created by the cybercriminal.
- Be wary of a site’s security. If you are accessing an obscure website or online store, you may not be confident that they are using the best security. That could leave you defenseless against a session hijacking assault. On the other hand, reputable banks, email providers, online merchants and social media sites will have safeguards in place to avoid session hijacking.
Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) can also be very useful in defending your network from session hijacking attacks. While implementing these devices can be difficult, the benefits far outweigh the steep implementation costs. IDS/IPS systems look at the data that enters the network and compares it to an internal database of known attack signatures. If the packet is matched against an entry in the IDS/IPS database, the IDS will generate an alert, and the IPS will block the traffic from entering the database.
(This post has been updated. It was originally published on April 12, 2021.)
Related posts
