Cookies: Smart The Unstealable Authentication Cookie
Andrew Miklas, Shvetank Jain October 1, 2006
The web has become a new, highly interactive medium. Many modern websites provide their users with the opportunity to alter their content in some way. This trend is especially evident in Wikis, where users are encouraged to collaboratively edit pages if they have something to add. Blogs and online forums are another example of sites which encourage their readers to contribute content. Finally, web-based e-mail providers such as GMail and Yahoo can be considered collaborative web-pages in some respects, as ordinary end-users are able to directly inuence the content that is rendered on the mailbox owners browser. <a href="#" onclick="window.location= http://example.com/stole.cgi? text=+escape(document.cookie); return false;">Click here!</a> Figure 1: Sample cross-site cooking attack code [3]
ming environments provide the necessary functions to escape scripts, there have been a number of highprole cases of cookie theft [1, 4]. Another approach explores the eect that each cookie has on the rendering of the page, and concludes that if there are The collaborative web has made a large number no eects, the cookie is unnecessary [2]. While the new applications possible. However, like many other authors dont describe their solution as a method of advances in Internet development, it has also cre- preventing cookie theft, it is possible that some of ated a number of security issues, including cross- their techniques could be adapted in order to detect site cooking. This attack, itself a special case of and prevent cookie theft. However, this system is cross-site scripting, allows a malicious user to re- relatively heavy-weight, and does not guarantee that trieve cookies from another users browser set by a cookies cannot be stolen. We propose a new type of cookie to be used for domain the he does not control. In order to capture authentication. These smart cookies use asymmetthe cookies, the attacker simply has to ensure that his script is rendered by the clients browser when he ric encryption as the basis for authentication, rather visits the domain for which the cookies are desired. than the shared-secret approach employed by tradiThe attack does not involve exploiting a bug in the tional cookies. The enrolment phase, corresponding users browser; in fact, the attack can be as simple to the set-cookie HTTP header with ordinary cookas the one shown in Figure 1. Since websites will ies, proceeds as follows: frequently accept a cookie containing a session as ID 1. Server: Request Smart Cookie proof that the user is authenticated, this attack allows a malicious user to gain unauthorized access to 2. Client: Generate public/private key pair, and a service. send the server the public half. An obvious x would be to require interactive websites to carefully escape all user-provided content so that client browsers do not execute untrusted scripts. However, even though many popular web program1 3. Server: Store the public half as the session ID The verication phase, corresponding to the cookie HTTP header, proceeds as follows:
1. Server: Generate a nonce
[3] Wikipedia. HTTP cookie, 2006. http://en. wikipedia.org/wiki/HTTP cookie.
2. Client: Encrypt the nonce with the private key, [4] S. B. Youssef. Hotmail/MSN cookie theft and send the result back to the server. advisory, 2006. http://lists.grok.org.uk/ 3. Server: Decrypt the signed nonce with the pubpipermail/full-disclosure/2006-February/ lic key on le, and verify that it matches the 042518.html. transmitted nonce. Smart cookies have the same domain-based access restrictions and expiration semantics as ordinary cookies. However, note that the private key component of a smart cookie never leaves the clients browser. Therefore, while the browser may wish to provide indirect access to the private key via a sign Javascript method, it should not provide scripts the ability to read the private key directly. In fact, no component of the browser that can be inuenced by downloaded code should be allowed to access the private key. Since the key canno...