CERT / CC Warns Cookie Vulnerability In Browsers

One problem with the way placed HTTP cookies can ensure that attackers can circumvent HTTPS and can steal private information, warns the CERT Coordination Center (CERT / CC) at Carnegie Mellon University. The problem is in all major browsers.

The problem is that the standard for cookies specifies no mechanism for separation and integrity and browsers do not always authenticate the domain settings of a cookie. An attacker could use this to set a cookie that is used later for an HTTPS connection, instead of the cookie from the website. An attacker can therefore a cookie for example.com locations on the computer that the actual cookie for www.example.com overwrites the victim loads HTTPS content. By another vulnerability used in the server use the cookie to the attacker to obtain private information.

The investigators who have the problem during the last USENIX Security Symposium discussed state that a cookie a so-called "secure flag" may contain, indicating that it has to be sent only over a HTTPS connection. However, there is no corresponding flag that indicates how the cookie is placed. An attacker could via a man-in-the-middle thus inject cookies used on subsequent HTTPS connections. According to the CERT / CC are there attempts to secure cookie management undertaken but all failed due to a lack of a widely implemented standard.

As a solution, the organization that the standard must be adjusted for cookies. In the meantime, the researchers advise websites HSTS (HTTP Strict Transport Security) for a top-level domain to set up and use the "includeSubDomains" option.This partly avoids the possibility of an attacker to place top-level cookies cookies for a subdomain, such as www.domeinnaam.tld override. End users are advised to use the latest browser version. In particular IE users make wise here. Internet Explorer 11 is the only IE version that supports HSTS.

Microsoft Gives Details On HSTS Security In IE

Last month it was announced that Microsoft finally HTTP Strict Transport Security (HSTS) is added to Internet Explorer, which users must protect against man-in-the-middle attacks. Now the software giant has more details given about the security measure.

HSTS allows websites visited to visit over HTTPS only over HTTPS, even though HTTP is introduced into the address bar.The browser in this case captures the user's command and turns off automatically in HTTPS. Thus, no information is transmitted over unsecured HTTP there. HSTS websites offers two options to secure their connections with visitors.

The first option is to register the website on a table loaded by Internet Explorer and other browsers with HTTP traffic directly to HTTPS is put through. This makes IE using the Chromium HSTS list. Chromium is the open source browser on which Google Chrome is based. The second option is to offer a HSTS header. In this case, the browser after having visited the site for the first time over HTTPS, all future HTTP connections run over HTTPS.

Microsoft warns that HSTS can have two important effects on users. If there namely a certificate warning is displayed, the user can not ignore and must disconnect. Additionally supported by HSTS sites no mixed content. All content should be delivered over HTTPS. This can be a problem for websites where for example ads and images are loaded over HTTP. The HSTS-feature is already testing the Windows 10 Technical Preview and will later be added to the Project Spartan browser of the new OS.

Incognito Mode Does Not Protect Against Super Cookies

Users who use the incognito or private browsing mode of their browser are still to follow through so-called "super cookies", according to an online test of the British developer Sam Greenhalgh . The problem is caused by a security measure called "HTTP Strict Transport Security" (HSTS). The measure ensures that websites only be accessed through a secure connection.

In case a website HSTS enabled the browser via a special "flag" remember and ensure that there is made only over HTTPS connection. If the user specifies HTTP in the address he is automatically redirected to HTTPS. However, this automatic forwarding can also be used by a malicious website to save a unique number in the user's browser and follow him. This number can then be read by other websites. HSTS can also be used as a tracking mechanism in this way.

To give users more privacy browsers have for some time been added incognito or private browsing mode. These cookies are not shared with existing web sites and the user can delete the cookies so they can be tracked online. Because HSTS is a security measure and is not really meant for tracking, browsers go it differently than is the case with cookies.

Some browsers such as Google Chrome, Firefox and Opera are trying to resolve this issue by removing both cookies stored as HSTS-flags. According to Greenhalgh, existing HSTS-flags, unlike cookies, or shared with other websites, even if the user incognito or private browsing mode enabled. In the case of Safari, the problem seems to be even greater because Safari users on an Apple device have no possibility to remove the HSTS-flags. She even be synchronized with iCloud, so they can be returned if the user clears his extension.

"I do not know if the technique is used in the wild to track users, although that does not mean that this is not so," said Greenhalgh. He calls the technical community to see how the tracking area can be resolved while the value of HSTS retained. In a response to Google Chrome Security Team states that there are measures added to the browser to address the problem, but it is ultimately a tradeoff between security and privacy. This form of "fingerprinting" would therefore not be solved unless fundamental changes are made to the way the web works. "