RE: A technique to mitigate cookie-stealing XSS attacks

["Michael Howard" <mikehow () microsoft com>]

> > This new HTTPOnly security feature would simply stop cookie hijacking
via document.cookie. Nothing else. Which is good, but important to know
the limitations and the risks.

Actually, the change is not in IE - it's lower-level in WinInet, which
IE uses. So any app that uses document.cookie, or, say,
InternetGetCookie, will see an empty string in the cookie is marked
HttpOnly. 

Cheers, Michael
Secure Windows Initiative
Writing Secure Code 
http://www.microsoft.com/mspress/books/5612.asp


-----Original Message-----
From: Jeremiah Grossman [mailto:jeremiah () whitehatsec com] 
Sent: Monday, November 11, 2002 10:20 AM
To: Michael Howard
Cc: bugtraq () securityfocus com
Subject: Re: A technique to mitigate cookie-stealing XSS attacks


First, I'd like to thank the "Microsoft Internet Explorer Team" for
instituting some level of security to thwart the plague that is XSS.
Sure it might not be a solution for everyone in all instances, but what
is. Small steps to find better solutions, use what you have where you
can.


However, I'd like to point out that this security feature does not help
prevent disclosure of information to third-parties that JS/VB (and more)
have access to. (Highly browser dependent of course.) 


Client-Side languages have been seen to have access to information
regarding Plugin's, User-Agent's, History, Cache, IP/Hostname, Screen
Size/Resolution, Machine Type, OS-Type, etc etc etc. This information
can quite easily be passed off-domain to third-parties.


This new HTTPOnly security feature would simply stop cookie hijacking
via document.cookie. Nothing else. Which is good, but important to know
the limitations and the risks.


> From a user standpoint, I'd like to see my browsers give me the ability
to assess my own client-side scripting DOM restrictions on a domain per
domain, site by site basis. The ability to give site the minimum DOM
access as possible for desired functionality. Mozilla already has some
form of this.

This might be a bit more than a normal user can handle, but this is why
we have defaults.


Jeremiah Grossman
WhiteHat Security, Inc.



On Tue, 2002-11-05 at 10:44, Michael Howard wrote:
> During the Windows Security Push in Feb/Mar 2002, the Microsoft 
> Internet Explorer team devised a method to reduce the risk of 
> cookie-stealing attacks via XSS vulnerabilities.
>       
> In a nutshell, if Internet Explorer 6.0 SP1 detects a cookie that has 
> a trailing HttpOnly (case insensitive) it will return an empty string 
> to the browser when accessed from script, such as by using 
> document.cookie.
>
>
> Obviously, the server must add this option to all outgoing cookies.
>
> Note, this does _not fix_ XSS bugs in server code; it only helps 
> reduce the potential damage from cookie disclosure threats. Nothing 
> more. Think of it as a very small insurance policy!
>
> A full write-up outlining the HttpOnly flag, as well as source code to

> set this option, is at 
> http://msdn.microsoft.com/library/en-us/dncode/html/secure10102002.asp
> .
>
> Cheers, Michael Howard
> Secure Windows Initiative
> Microsoft Corp.
>
> Writing Secure Code
> http://www.microsoft.com/mspress/books/5612.asp