CERT / CC Warns Cookie Vulnerability In Browsers

One problem with the way placed HTTP cookies can ensure that attackers can circumvent HTTPS and can steal private information, warns the CERT Coordination Center (CERT / CC) at Carnegie Mellon University. The problem is in all major browsers.

The problem is that the standard for cookies specifies no mechanism for separation and integrity and browsers do not always authenticate the domain settings of a cookie. An attacker could use this to set a cookie that is used later for an HTTPS connection, instead of the cookie from the website. An attacker can therefore a cookie for example.com locations on the computer that the actual cookie for www.example.com overwrites the victim loads HTTPS content. By another vulnerability used in the server use the cookie to the attacker to obtain private information.

The investigators who have the problem during the last USENIX Security Symposium discussed state that a cookie a so-called "secure flag" may contain, indicating that it has to be sent only over a HTTPS connection. However, there is no corresponding flag that indicates how the cookie is placed. An attacker could via a man-in-the-middle thus inject cookies used on subsequent HTTPS connections. According to the CERT / CC are there attempts to secure cookie management undertaken but all failed due to a lack of a widely implemented standard.

As a solution, the organization that the standard must be adjusted for cookies. In the meantime, the researchers advise websites HSTS (HTTP Strict Transport Security) for a top-level domain to set up and use the "includeSubDomains" option.This partly avoids the possibility of an attacker to place top-level cookies cookies for a subdomain, such as www.domeinnaam.tld override. End users are advised to use the latest browser version. In particular IE users make wise here. Internet Explorer 11 is the only IE version that supports HSTS.

Samsung Smart TV transmits voice audio unencrypted

The voice commands that smart saving TVs from Samsung and forwarding are sent unencrypted to a third party, as has discovered a security researcher. Recently there was great commotion about the voice recognition of the Samsung SmartTV which consumers via voice commands can control the TV.

Security Researcher David Lodge decided the traffic that comes to investigate the television. While he saw a connection on port 443, which normally indicates HTTPS. Lodge then decided to view the contents of the data stream and saw that it was not going to encrypted data. It was not even HTTP data, but a combination of XML, and a binary data packet. "The weasels, they use 443 / TCP to tunnel over the dates, probably because many standard default firewall configurations traffic to port 80 and 443 permit outside the network," said the researcher.

It also showed that all kinds of information on the screen is sent, such as MAC address and the version of the operating system. The voice command could be seen that he gave. It suggests Lodge that television does not listen to users unless it is activated by the command. Something, however, with each subsequent firmware update may change, making continuous listening which would be possible, he warns. Lodge Samsung therefore calls to use anyway SSL.