HTTP Cookie Hijacking
in the Wild: Security
and Privacy Implications
Suphannee Sivakorn*, Jason Polakis*,Angelos D. Keromytis*Joint primary authors

Who we areSuphannee Sivakorn
PhD Student @ Columbia University

Jason Polakis
Assistant Professor @ University of Illinois at Chicago

Current State of Affairs
q Public discussion about need for encryption- Crypto Wars, part 2

q Getting crypto right is difficult- DROWN, FREAK, POODLE, Logjam, …

q SSL/TLS is fundamental for protecting our communications
q Talk about encryption?
Ø More about lack of encryption
Ø “Web Services and the Quest for Ubiquitous Encryption”…sad tale without a happy ending … or perhaps partially happy?

OutlineBad Cookies!!!
User tracking using third party cookies(Englehardt et al., WWW 2015)

Cookie injection attacks via HTTP response(Zheng et al., Usenix Security 2015)

HTTP Cookie Hijacking
HTTP Cookie

HTTPWeb Service

HTTP Cookie Hijacking – Known ThreatMigrating to HTTPS~40% of top sites (140k) on the internet support HTTPS– SSL Pulse, 2016

Oh, you thought it was encrypted?
www.google.com
Web ServerBrowser

Oh, you thought it was encrypted?
http://www.google.com

GET / HTTP/1.1

Web Server

301/302 redirection https://Browser✓ HTTPSOh, you thought it was encrypted?
https://www.google.com

GET / HTTP/1.1

Web Server

301/302 redirection https://Browser
HTTPS communication✓ HTTPSOh, you thought it was encrypted?
https://www.google.com

GET / HTTP/1.1

Web ServerHTTP Cookie
301/302 redirection https://Browser
HTTPS communication✓ HTTPSCookie Hijacking in the Wild
• Studied 25 major services• 15 support HTTPS, but not ubiquitous• Offer personalization over HTTP
• Many cookies, complicated inter-operability à flawed access control• Expose sensitive information and/or account functionality

Threat ModelEavesdropping• Access to the targeted network• Open Wi-Fi Network, Wiretapping, Middle box, Proxy, Tor exit node

• Network traffic sniffing tools• e.g. TCPdump, Wireshark, TShark, Kismet, KisMac• TCP Reassembly (if necessary)

Stealing the Cookies• HTTP Request:

Host, Cookie

GET /dst_path HTTP/1.1
Host:
www.google.com
Connection:
keep-alive
Cookie:SID=XXXXX; HSID=YYYYY; APISID=ZZZZZUser-Agent:
Mozilla/5.0 (X11; Linux x86_64; rv:47.0)
Gecko/20100101 Firefox/47.0
Accept-Language:
en-US
Accept-Encoding:gzip, deflate• HTTP Response:

Set-cookie

Set-cookie:
SID=XXXXX; Expires=Mon, 01 Jan 1970 00:00:01 GMT;
Path=/; Domain=.google.com;

Accessing the Data
• Send requests with the stolen cookies• Try both HTTP and HTTPS• Reveal access control flaws• Getting personal information?

• Requests with and without the stolen cookies
Return different
size/elements/text

Personal information?

• curl, Selenium WebDriver, PhantomJS (renders active contents)• Identify HTML elements

What can we access using the stolen
HTTP cookies?

Search engines
GoogleBaidu

BingYahoo• User information
email, profile picture, first/last nameSearch engines
GoogleBaidu

BingYahoo• User information
email, profile picture, first/lastname• Search/visited history

Search engines
GoogleBaidu

Bing• User information
email, profile picture, first/lastname• Search/visited history• Saved locations

Yahoo• Many services• Yahoo answers• Email notification
title and snippet• Extract contact list
• Send email as userE-commerce
AmazonEbay

WalmartTarget• All support HTTPS• HTTPS pages only for login, account and checkout pages• User information: username, email• Items in cart, wish list, recent view items, purchased items

E-commerce
AmazonEbay

WalmartTarget• All support HTTPS• HTTPS pages only for login, account and checkout pages• User information: username, email• Items in cart, wish list, recent view items, purchased items• Ebay reveals shipping addressE-commerce
AmazonEbay

WalmartTarget• All support HTTPS• HTTPS pages only for login, account and checkout pages• User information: username, email• Items in cart, wish list, recent view items, purchased items• Ebay reveals full shipping address• Facilitate spam and phishing• Send recommendations to any email with custom message

E-commerce
AmazonEbay

WalmartTarget• All support HTTPS• HTTPS pages only for login, account and checkout pages• User information: username, email• Items in cart, wish list, recent view items, purchased items• Ebay reveals full shipping address• Facilitate spam and phishing• Send recommendations to any email with custom message

Amazon now redirects to HTTPS, but attack still works!

Ad Networks• Ads presented to user based on user’s profile• Ads reveal browsing history and/or sensitive user data
visited by user

shown to attacker

Cookie Hijacking Cheat SheetCollateral Exposure – Extensions & Mobile Apps

Attack EvaluationØDifferent behavior when on public WiFi?
ØMechanisms that prevent hijacking?
• Monitored ~15% of Columbia’s public WiFi for 30 days
(IRB approval)• Collected HTTP and HTTPS traffic• URL / SNI• Cookie name• Hash of cookie value (differentiate users per website)Large-scale Cookie Exposure
124k

67k
9k

23k
1.6kIn total, 282K vulnerable accounts

“Government agencies can collect HTTP
traffic without notice to users or admins.”– Edward Snowden

Attack Implications – Tor Network• Used by privacy-conscious users, whistleblowers, activists• Tor Bundle is user-friendly• HTTPS Everywhere pre-installed• Monitored fresh Tor exit node for 30 days (IRB approval)• Did not collect cookies, only aggregate statistics

Attack Implications – Tor Networka ~75%
practicalof connections
deanonymization
over HTTPattack

Countermeasures•Server-controlled mechanisms
HTTPS Strict Transport Security (HSTS)
HSTS Preload

Client-controlled mechanisms
HTTPS Everywhere

HSTS• Server instructs browser to only communicate over HTTPS• HTTP response header sent over HTTPSStrict-Transport-Security: max-age=10886400; includeSubdomains; preload• HSTS Preload protects initial connection to server• Eliminates HTTP à HTTPS redirection

HSTS: Issues• Preload requires HTTPS on all subdomains
Legacy URL and functionality• HSTS partial adoption

Main google and regional pages (google.*) still not protected by HSTS
Protected
account.google.com
mail.google.com

Not protected
google.com/accountgoogle.com/mail• Early state of adoption and misconfigurations[Kranch and Bonneau, NDSS 2015]• Attacks[J. Selvi, BlackHat EU ‘14], [Bhargavan et al., Security and Privacy ’14]

HTTPS Everywhere• Browser extension from EFF and Tor Project• Pre-installed in Tor browser• Ruleset collections (community effort)<ruleset name=“Example”><target host=“example.com” /><rule from=“^http:” to “https:” /></ruleset>• Regular expressions rewrite “http://” to “https://”http://example.com/foo à https://example.com/foo

HTTPS Everywhere: Issues• Rulesets do not offer complete coverage (also contain human errors)• Exclude when HTTPS not supported
Amazon: HTTPS breaks adding products to basket<exclusion pattern="^http://(?:www\.)?amazon\.com/gp/twister/(?:ajaxv2|dynamic-update/)" />• Complicated for large websites
http://rcm-images.amazon.com/images/foo.gif
https://images-na.ssl-images-amazon.com/images/foo.gif

HTTPS Everywhere: EffectivenessØExtract URLs of HTTP requests
from WiFi datasetØTest URLs against rulesets

Over 73% of accounts remain exposed!

Disclosure
Sent detailed reports to all audited web services“The“Inrelated“We
tokenslookedin thethebehavior
existence
thishavecase,
wepredatefound
theissue
toofbe of the
HttpOnly
XXXXXXXand havehijackingseveralyoulegacy
invalid
as itsetting
is ancookie
acceptedbusinessrisk.”
applications
reportedthat
anddo
can
notconfirm
supportthat
thisthissetting.
isOn
newer
expected
applications
fromwe'rethe XXXXXXX
working on
Servicenew session
management
stack.
tokensWe dothatnotarerelymarkedon the as "Secure"‘XXXXXXX’andcookie"HttpOnly".”
for authentication
purposes and as such authentication
would be required before visiting
sensitive areas of an account.”Aftermath

Still in testing phase. Max-age is only 1 day.

Sound BytesØBack to Basics… or “always assume the worst”- Cookie hijacking remains a significant (yet overlooked?) threatØ Put in the effort … or “stop accepting the risk”- Services sacrifice security for usability, and support of legacy codebaseØ Halfway is no way… or “understand the limitations”- Partial adoption of defenses not enough- Attack surface reduced, but a single HTTP request is all you need!Questions
Feel free to contact us:
polakis@cs.columbia.edu
suphannee@cs.columbia.edu