Institutional Repository [SANDBOX]
Technical University of Crete
EN  |  EL

Search

Browse

My Space

The cookie hunter: automated black-box auditing for web authentication and authorization flaws

Drakonakis Kostas, Ioannidis Sotirios, Polakis Jason

Simple record


URIhttp://purl.tuc.gr/dl/dias/6BD2C596-CEC8-4BC6-89EF-3B9E7EA3275E-
Identifierhttps://doi.org/10.1145/3372297.3417869-
Identifierhttps://dl.acm.org/doi/10.1145/3372297.3417869-
Languageen-
Extent18 pagesen
TitleThe cookie hunter: automated black-box auditing for web authentication and authorization flawsen
CreatorDrakonakis Kostasen
CreatorIoannidis Sotiriosen
CreatorΙωαννιδης Σωτηριοςel
CreatorPolakis Jasonen
PublisherAssociation for Computing Machinery (ACM)en
Content SummaryIn this paper, we focus on authentication and authorization flaws in web apps that enable partial or full access to user accounts. Specifically, we develop a novel fully automated black-box auditing framework that analyzes web apps by exploring their susceptibility to various cookie-hijacking attacks while also assessing their deployment of pertinent security mechanisms (e.g., HSTS). Our modular framework is driven by a custom browser automation tool developed to transparently offer fault-tolerance during extended interactions with web apps. We use our framework to conduct the first automated large-scale study of cookie-based account hijacking in the wild. As our framework handles every step of the auditing process in a completely automated manner, including the challenging process of account creation, we are able to fully audit 25K domains. Our framework detects more than 10K domains that expose authentication cookies over unencrypted connections, and over 5K domains that do not protect authentication cookies from JavaScript access while also embedding third party scripts that execute in the first party's origin. Our system also automatically identifies the privacy loss caused by exposed cookies and detects 9,324 domains where sensitive user data can be accessed by attackers (e.g., address, phone number, password). Overall, our study demonstrates that cookie-hijacking is a severe and prevalent threat, as deployment of even basic countermeasures (e.g., cookie security flags) is absent or incomplete, while developers struggle to correctly deploy more demanding mechanisms.en
Type of ItemΔημοσίευση σε Συνέδριοel
Type of ItemConference Publicationen
Licensehttp://creativecommons.org/licenses/by/4.0/en
Date of Item2022-01-07-
Date of Publication2020-
SubjectBlack-box testingen
SubjectCookie hijackingen
SubjectAuthenticationen
SubjectAuthorizationen
SubjectLarge-scale measurementen
Bibliographic CitationK. Drakonakis, S. Ioannidis, and J. Polakis, “The cookie hunter: automated black-box auditing for web authentication and authorization flaws,” in 2020 ACM SIGSAC Conf. on Comp. and Commun. Secur. (CCS), pp. 1953–1970. doi: 10.1145/3372297.3417869en

Services

Statistics