1. Ram Santhanam Application Level Attacks - Session Hijacking & Defences
Project Presentation
Ram Santhanam
Application Level Attacks - Session Hijacking & Defences

2. What is a session? Definition from FOLDOC
A lasting connection between a user (or user agent i.e. browser) and a server usually involving the exchange of many requests
Typically maintained by the server
Includes a data store or a table to store user state and other user specific information
Includes an index to the table (aka session key or session-id)
Created on first request or after an authentication process
Session-id exchanged between browser and server on every request.
Different ways to exchange session-ids
URL Rewriting
Hidden Form fields
Cookies (most common)
Hijacking
Stealing of this session-id and using it to impersonate and access data
Passive attack difficult to detect

3. Typical Session

4. Attack Methods Guessing Session Id Session Fixing
shorter length, predictable
Session Fixing
predictable, session created before authenticated
Security Vulnerabilities in Hops
trusting private networks, vulnerabilites in web servers, etc
Session Sniffing (typical on non SSL sessions)
same subnet as client or server
Man in the Middle Attack (SSL)
ARP Poisoning, DNS Spoofing
Cross Site Scripting (XSS)
User trusting source, application vulnerability

5. Session Sniffing

6. Man in the Middle Attack

7. Cross Site Scripting (XSS)
Hacker inserts a rogue script to a trusted site.
Common in social / community sites.

8. Defence Methods Educating the users
Paying attention to https vs. non-https
Properly signing out
Not clicking on links but copying and pasting them.
Using high entropy in session id generation (see Tomcat e.g.)
Higher the entropy more difficult to predict
Timing out sessions
reduce window of vulnerability
Using SSL for all communications
difficult to sniff
Forcing Re-authentication or step-up authentication
limit damage if session is hijacked
Re-generating session-ids
Using Context data for validating session-ids.
make it difficult to use a hijacked id
Input validation
prevent XSS and other vulnerabilities

9. Tomcat Session Id generation
The session id is generated through by a random number.
For random number generation, Java's SecureRandom class is used. This class provides a cryptographically strong random number generator using DSA/RSA/MD5 or SHA-1
The seed (64 bit) for generating the random number is constructed by bitwise xoring the system time with an entropy string
The entropy string comes from a hash value constructed from the device drivers running on the server.
Using the SecureRandom class a 16 (128 bit) byte random number is generated.
A one way hash of the random number is performed.
A 32 byte (256 bit) hexadecimal number is created from by taking 4 bits at a time from the 16 bytes.
This 32 byte (256 bit) is used as the jsessionid

10. Questions?