11.6 Session hijacking - countermeasures
11.6 Session hijacking Countermeasures
Methods to prevent session hijacking
Use SSL/TLS – Encrypt data traffic passed between the parties
Use of a long random number or string as the session key
Regenerating the session id after a successful login
Make secondary checks against the identity of the user
Change the value of the cookie with each and every request
Log out of websites whenever finished using them
Use HTTPS Everywhere browser extension to protect from Firesheep like attacks
Forensic analysis
Analyze captured network traffic for forensic analysis which includes:
• IP address of the server
• DNS name of the server
• X.509 certificate of the server
– Is the certificate self signed?
– Is the certificate signed by a trusted CA?
– Has the certificate been revoked?
– Etc.
MITM attacks can be prevented by two means:
Authentication provides some degree of certainty that a given message has come from a legitimate source.
Tamper detection merely shows evidence that a message may have been altered.
All cryptographic systems that are secure against MITM attacks provide some method of authentication for messages.
A public key infrastructure, such as Transport Layer Security (TLS) protect from Man-in-the-middle-attacks.
Latency examination can potentially detect the attack in certain situations.
Quantum Cryptography, provides tamper-evidence for transactions through the no-cloning theorem.
HTTP Public Key Pinning or "certificate pinning", helps prevent a MITM attack in which the certificate authority (CA) itself is compromised.
DNSSEC extends the DNS protocol to use signatures to authenticate DNS records, preventing simple MITM attacks from directing a client to a malicious IP address.
Using a Wired Equivalent Privacy (WEP) password is not secure.
Using Wi-Fi Protected Access (WPA or WPA2) encryption, preventing the attacker from using Firesheep or similar ones, from decrypting cookies sent over the network.
Session hijacking tools
• Burp Suite
• OWASP ZAP
• Cain and Abel
• Hamster and Ferret
• JHijack
• Ettercap
• Dsniff
• Telerik Fiddler
• Firesheep
• CookieCatcher
• TamperIE
• PerJack
• Surf Jack
• Juggernaut
• Cookie Cadger
• Charles Proxy
• Websense Content Gateway – used to perform inspection of SSL traffic at the proxy.
• Wsniff - tool for 802.11 HTTP/HTTPS based MITM attacks.
• Opendium Web Gateway /UTM is used to perform inspection of HTTPS traffic at the gateway.