![Institutional Repository [SANDBOX]](images/dias.logo.png "Institutional Repository [SANDBOX]"){kind=logo}
Institutional Repository [SANDBOX]
Technical University of Crete
Technical University of Crete
EN
|
EL
| URI | http://purl.tuc.gr/dl/dias/6BD2C596-CEC8-4BC6-89EF-3B9E7EA3275E | - |
| Identifier | https://doi.org/10.1145/3372297.3417869 | - |
| Identifier | https://dl.acm.org/doi/10.1145/3372297.3417869 | - |
| Language | en | - |
| Extent | 18 pages | en |
| Title | The cookie hunter: automated black-box auditing for web authentication and authorization flaws | en |
| Creator | Drakonakis Kostas | en |
| Creator | Ioannidis Sotirios | en |
| Creator | Ιωαννιδης Σωτηριος | el |
| Creator | Polakis Jason | en |
| Publisher | Association for Computing Machinery (ACM) | en |
| Content Summary | In this paper, we focus on authentication and authorization flaws in web apps that enable partial or full access to user accounts. Specifically, we develop a novel fully automated black-box auditing framework that analyzes web apps by exploring their susceptibility to various cookie-hijacking attacks while also assessing their deployment of pertinent security mechanisms (e.g., HSTS). Our modular framework is driven by a custom browser automation tool developed to transparently offer fault-tolerance during extended interactions with web apps. We use our framework to conduct the first automated large-scale study of cookie-based account hijacking in the wild. As our framework handles every step of the auditing process in a completely automated manner, including the challenging process of account creation, we are able to fully audit 25K domains. Our framework detects more than 10K domains that expose authentication cookies over unencrypted connections, and over 5K domains that do not protect authentication cookies from JavaScript access while also embedding third party scripts that execute in the first party's origin. Our system also automatically identifies the privacy loss caused by exposed cookies and detects 9,324 domains where sensitive user data can be accessed by attackers (e.g., address, phone number, password). Overall, our study demonstrates that cookie-hijacking is a severe and prevalent threat, as deployment of even basic countermeasures (e.g., cookie security flags) is absent or incomplete, while developers struggle to correctly deploy more demanding mechanisms. | en |
| Type of Item | Δημοσίευση σε Συνέδριο | el |
| Type of Item | Conference Publication | en |
| License | http://creativecommons.org/licenses/by/4.0/ | en |
| Date of Item | 2022-01-07 | - |
| Date of Publication | 2020 | - |
| Subject | Black-box testing | en |
| Subject | Cookie hijacking | en |
| Subject | Authentication | en |
| Subject | Authorization | en |
| Subject | Large-scale measurement | en |
| Bibliographic Citation | K. Drakonakis, S. Ioannidis, and J. Polakis, “The cookie hunter: automated black-box auditing for web authentication and authorization flaws,” in 2020 ACM SIGSAC Conf. on Comp. and Commun. Secur. (CCS), pp. 1953–1970. doi: 10.1145/3372297.3417869 | en |
Copyright © DIAS 2013
