Blog Author
Neil Stinchcombe's blog 
29-04-2009 22:23
No easy fix for flaw in secure (https) Web communications
At this year's Infosecurity Europe the information security business remains buoyant and, the good news is that the business appears to relatively immune to the ongoing economic woes that affect the rest of the IT industry
There are also some very interesting stories coming out of the show, not least from Peter Wood, a member of the ISACA Conference Committee.
Peter, who is chief of operations with First Base Technologies, revealed to assembled analysts and reporters that he and his colleagues have discovered a flaw in secure (https) Web communications.
The problem centres on the secure flag that is set on cookies. If, as often the case, the secure cookie flag is not set, then it offers a back door into a Web session that a user has open on his/her PC.
The security flaw stems from the fact that many Web sites switch from secure to standard http sessions - and back again - several times in a typical Web session in order to save on traffic.
The worrying part about the flaw, as Wood and his team cheerfully admit, is that it is a structural issue on the Internet and, as such, there is no ready solution.
In order to solve the problem, Web site operators will have to enhance their IP real estate to support multiple https Internet sessions for multiple site users, and maintain the security of those sessions, with all the attendant data overheads, for their site users.
And given that this can increase a site's data and IT resource usage by several hundred per cent, this is not a security issue that will be solved overnight.
Permalink:
http://www.infosecurityadviser.com/view_message?id=114
Delicious
Digg
Reddit
Facebook
StumbleUponComments:
Just to clarify, this issue is a combination of problems we are finding with many web sites.In a vulnerable site, when the user logs in using https, the cookie which contains the session token is not marked 'secure'. If the user then browses using http (for example on a catalogue site) the cookie and hence the session token is transmitted unencrypted. An attacker may then intercept and use the session token and impersonate the legitimate user without needing to log on. Sites which do not mark the cookie 'secure' frequently also permit multiple single-user instances, which means the attacker's session is valid at the same time as the legitimate session. Also most sites do not expire the session token when the user logs off, allowing the attacker to continue to use the token.A serious attack scenario might include an attacker on a public wifi network where traffic can be intercepted easily. This problem applies equally to remote access servers, including two-factor authentication, if the attacker can entice the user to make an http request to the legitimate server, permitting a man-in-the-middle attack.