Project Presentation Ram Santhanam Application Level Attacks Session

Project Presentation Ram Santhanam Application Level Attacks - Session Hijacking & Defences

What is a session? l Definition from FOLDOC l l Typically maintained by the server l l l Includes a data store or a table to store user state and other user specific information Includes an index to the table (aka session key or session-id) Created on first request or after an authentication process Session-id exchanged between browser and server on every request. Different ways to exchange session-ids l l A lasting connection between a user (or user agent i. e. browser) and a server usually involving the exchange of many requests URL Rewriting Hidden Form fields Cookies (most common) Hijacking l l Stealing of this session-id and using it to impersonate and access data Passive attack difficult to detect

Typical Session

Attack Methods l Guessing Session Id l l Session Fixing l l same subnet as client or server Man in the Middle Attack (SSL) l l trusting private networks, vulnerabilites in web servers, etc Session Sniffing (typical on non SSL sessions) l l predictable, session created before authenticated Security Vulnerabilities in Hops l l shorter length, predictable ARP Poisoning, DNS Spoofing Cross Site Scripting (XSS) l User trusting source, application vulnerability

Session Sniffing

Man in the Middle Attack

Cross Site Scripting (XSS) l Hacker inserts a rogue script to a trusted site. l Common in social / community sites.

Defence Methods l Educating the users l l Using high entropy in session id generation (see Tomcat e. g. ) l l reduce window of vulnerability Using Context data for validating session-ids. l l limit damage if session is hijacked Re-generating session-ids l l difficult to sniff Forcing Re-authentication or step-up authentication l l reduce window of vulnerability Using SSL for all communications l l Higher the entropy more difficult to predict Timing out sessions l l Paying attention to https vs. non-https Properly signing out Not clicking on links but copying and pasting them. make it difficult to use a hijacked id Input validation l prevent XSS and other vulnerabilities

Tomcat Session Id generation l l l l The session id is generated through by a random number. For random number generation, Java's Secure. Random class is used. This class provides a cryptographically strong random number generator using DSA/RSA/MD 5 or SHA-1 The seed (64 bit) for generating the random number is constructed by bitwise xoring the system time with an entropy string The entropy string comes from a hash value constructed from the device drivers running on the server. Using the Secure. Random class a 16 (128 bit) byte random number is generated. A one way hash of the random number is performed. A 32 byte (256 bit) hexadecimal number is created from by taking 4 bits at a time from the 16 bytes. This 32 byte (256 bit) is used as the jsessionid

Questions?