Full Disclosure mailing list archives
Re: defense against session hijacking
From: Bill Pennington <billp () boarder org>
Date: Mon, 17 Nov 2003 14:09:30 -0800
Hey Thomas this has been discussed many times in the past and basically it boils down to these problems:
1. Many corporations use proxies so everyone appears to come from one IP address. A session based only on IP will have some pretty bad results like session jumping without people trying.
2. Large ISPs (AOL, Sympatico.ca, etc...) use super proxies that cause their clients to not only come from 1 IP but also these clients can hop across entire class A networks. This means your users get pretty mad when they keep getting kicked off.
3. Given 1 and 2 will cause you all sorts of problems it is easier (not more secure) to go with psuedo-random session-ids.
If you have an application that is in a tightly controlled environment (like LAN access only) then IPs can be considered. Although with remote access/VPN and B2B access this can also be problematic.
On Nov 17, 2003, at 1:16 PM, Thomas M. Duffey wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi All, Sorry if this is common knowledge or regularly discussed; I'm fairly new to the list. I see quite a few messages on this and other security lists about session hijacking in Web applications. Isn't it good defense for a programmer to store the IP address of the client when the session is initiated, and then compare that address against the client for each subsequent request, destroying the session if the address changes? Do many programmers really overlook this simple method to protect against such an attack? It's not perfect but should significantly increase the difficulty of such an attack with little or no annoying side effects for the legitimate user. Would it be useful to extend the session modules of the common Web scripting languages (e.g. PHP) to enable an IP address check by default? Best Regards, - -- :: t h o m a s d u f f e y :: h o m e b o y z i n t e r a c t i v e -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQE/uTrH8fKWAp8CzDARAhyOAJ9kXkkiUERgEVRWhH5GtGACTKA1hwCfak+7 KsyUSQG+iAcPVxX3BIdTTRc= =9f2R -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
--- Bill Pennington, CISSP, CCNA Chief Technology Officer WhiteHat Security Inc. http://www.whitehatsec.com _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: defense against session hijacking, (continued)
- Re: defense against session hijacking Gary E. Miller (Nov 17)
- Re: defense against session hijacking Ron DuFresne (Nov 19)
- Re: defense against session hijacking David Maynor (Nov 17)
- Re: defense against session hijacking Damian Gerow (Nov 17)
- Re: defense against session hijacking Frank Knobbe (Nov 17)
- Re: defense against session hijacking Damian Gerow (Nov 17)
- Re: defense against session hijacking David Maynor (Nov 17)
- Re: defense against session hijacking Damian Gerow (Nov 17)
- window hiding sir kaber (Nov 17)
- Re: defense against session hijacking |reduced|minus|none| (Nov 17)
- Re: defense against session hijacking Gary E. Miller (Nov 17)
- Re: defense against session hijacking Scott Taylor (Nov 17)
- Re: defense against session hijacking Bill Pennington (Nov 17)
- Re: defense against session hijacking Jason Ziemba (Nov 18)
- Re: defense against session hijacking Tim (Nov 18)
- Re: defense against session hijacking Jakob Lell (Nov 19)
- Message not available
- Re: defense against session hijacking flatline (Nov 19)