A session is the period of time when you as a user are actively accessing an application, website, or other online service. Each user session begins when you log into a website or app and ends when you log out of it. For example, when you type your username and password into a banking application, that begins your session on that online application.
Applications use sessions to store parameters that are relevant to the user. The session is kept “alive” on the server as long as the user is logged on to the system. The session is destroyed when the user logs-out from the system or after a predefined period of inactivity. When the session is destroyed, the user’s data should also be deleted from the allocated memory space.
A session ID is an identification string (usually a long, random, alpha-numeric string) that is transmitted between the client and the server. Session IDs are commonly stored in cookies, URLs and hidden fields of web pages. Besides the useful functionality of session IDs, there are several security problems associated with them. Many of the popular websites use algorithms based on easily predictable variables, such as time or IP address, in order to generate the Session IDs, causing their session IDs to be predictable. If encryption is not used (typically SSL), Session IDs are transmitted in the clear and are susceptible to eavesdropping.
Session hijacking, also known as TCP session hijacking, is a method of taking over a web user session by surreptitiously obtaining the session ID and masquerading as the authorized user. Once the user’s session ID has been accessed, the attacker can masquerade as that user and do anything the user is authorized to do on the network. One of the most valuable byproducts of this type of attack is the ability to gain access to a server without having to authenticate to it. Once the attacker hijacks a session, they no longer have to worry about authenticating to the server as long as the communication session remains active. The attacker enjoys the same server access as the compromised user because the user has already authenticated to the server prior to the attack.
How does session hijacking work?
The most popular culprits for carrying out a session hijacking are session sniffing, predictable session token ID, man in the browser, cross-site scripting, session sidejacking, session fixation.
- Session sniffing. This is one of the most basic techniques used with application-layer session hijacking. The attacker uses a sniffer, such as Wireshark, or a proxy, such as OWASP Zed, to capture network traffic containing the session ID between a website and a client. Once the attacker captures this value, he can use this valid token to gain unauthorized access.
- Predictable sessions token ID. Many web servers use a custom algorithm or predefined pattern to generate session IDs. The greater the predictability of a session token, the weaker it is and the easier it is to predict. If the attacker can capture several IDs and analyze the pattern, he may be able to predict a valid session ID.
- Man-in-the-browser attack. This is similar to a man-in-the-middle attack, but the attacker must first infect the victim’s computer with a Trojan through some form of trickery or deceit. Once the victim is tricked into installing malware onto the system, the malware waits for the victim to visit a targeted site. The man-in-the-browser malware can invisibly modify transaction information and it can also create additional transactions without the user knowing. Because the requests are initiated from the victim’s computer, it is very difficult for the web service to detect that the requests are fake.
- Cross-site scripting. Cybercriminals exploit server or application vulnerabilities to inject client-side scripts into web pages. This causes the browser to execute arbitrary code when it loads a compromised page. If HttpOnly isn’t set in session cookies, cybercriminals can gain access to the session key through injected scripts, giving them the information they need for session hijacking.
- Session side jacking. Cybercriminals can use packet sniffing to monitor a victim’s network traffic and intercept session cookies after the user has authenticated on the server. If TLS encryption is only used for login pages and not for the entire session, cybercriminals can hijack the session, act as the user within the targeted web application.
- Session fixation attacks. This technique steals a valid session ID that has yet to be authenticated. Then, the attacker tries to trick the user into authenticating with this ID. Once authenticated, the attacker now has access to the victim’s computer. Session fixation explores a limitation in the way the web application manages a session ID. Three common variations exist: session tokens hidden in an URL argument, session tokens hidden in a form field and session tokens hidden in a session cookie.
What Do Attackers Gain from Session Hijacking?
When cybercriminals have hijacked a session, they can do virtually anything that the legitimate user was authorized to do during the active session. The most severe examples include transferring money from the user’s bank account, buying merchandise from web stores, accessing personally identifiable information (PII) for identity theft, and even stealing data from company systems.
How to avoid Session Hijacking if you are a user?
- First of all, avoid logging into secure sites on PUBLIC NETWORKS (e.g. coffee shop, restaurants, airports, etc.). Public Wi-fi networks are especially vulnerable to “session sniffing,” in which hackers intercept web traffic, seeking out and recording cookies as they appear on the network connection. Plus, with broader access to the same network, public Wi-fi servers are harder to secure.
- Next, employ a quality ad-blocker on your browser and devices to prevent ads that may contain malicious software and links. Browser extension ad blockers can protect your personal web server while standalone ad blockers intercept potentially malicious software from entering any stream on your device, thereby protecting your entire system.
- Then, regenerate your session ID after you login. Hackers can often use “brute force” to try to access your unique session key. This can sometimes be accomplished simply by guessing; session ID’s often contain easy to predict numerical chains, such as your IP address and the time and date of login. By changing your session ID after login, you can confuse and frustrate attempts at access.
- You can clear your cookies regularly to get rid of any sensitive information stored in browsers like Google Chrome.
- Only accept session IDs from trusted servers. Time out inactive sessions, ensuring that you don’t stay logged in for longer than you need to. And, importantly, log out of your session when you are done.
- VPNs can also be used to encrypt everything, not just the traffic to the webserver using personal VPN solution tools.
