Ιδρυματικό Αποθετήριο [SANDBOX]
Πολυτεχνείο Κρήτης
EN  |  EL

Αναζήτηση

Πλοήγηση

Ο Χώρος μου

The cookie hunter: automated black-box auditing for web authentication and authorization flaws

Drakonakis Kostas, Ioannidis Sotirios, Polakis Jason

Απλή Εγγραφή


URIhttp://purl.tuc.gr/dl/dias/6BD2C596-CEC8-4BC6-89EF-3B9E7EA3275E-
Αναγνωριστικόhttps://doi.org/10.1145/3372297.3417869-
Αναγνωριστικόhttps://dl.acm.org/doi/10.1145/3372297.3417869-
Γλώσσαen-
Μέγεθος18 pagesen
ΤίτλοςThe cookie hunter: automated black-box auditing for web authentication and authorization flawsen
ΔημιουργόςDrakonakis Kostasen
ΔημιουργόςIoannidis Sotiriosen
ΔημιουργόςΙωαννιδης Σωτηριοςel
ΔημιουργόςPolakis Jasonen
ΕκδότηςAssociation for Computing Machinery (ACM)en
ΠερίληψηIn this paper, we focus on authentication and authorization flaws in web apps that enable partial or full access to user accounts. Specifically, we develop a novel fully automated black-box auditing framework that analyzes web apps by exploring their susceptibility to various cookie-hijacking attacks while also assessing their deployment of pertinent security mechanisms (e.g., HSTS). Our modular framework is driven by a custom browser automation tool developed to transparently offer fault-tolerance during extended interactions with web apps. We use our framework to conduct the first automated large-scale study of cookie-based account hijacking in the wild. As our framework handles every step of the auditing process in a completely automated manner, including the challenging process of account creation, we are able to fully audit 25K domains. Our framework detects more than 10K domains that expose authentication cookies over unencrypted connections, and over 5K domains that do not protect authentication cookies from JavaScript access while also embedding third party scripts that execute in the first party's origin. Our system also automatically identifies the privacy loss caused by exposed cookies and detects 9,324 domains where sensitive user data can be accessed by attackers (e.g., address, phone number, password). Overall, our study demonstrates that cookie-hijacking is a severe and prevalent threat, as deployment of even basic countermeasures (e.g., cookie security flags) is absent or incomplete, while developers struggle to correctly deploy more demanding mechanisms.en
ΤύποςΔημοσίευση σε Συνέδριοel
ΤύποςConference Publicationen
Άδεια Χρήσηςhttp://creativecommons.org/licenses/by/4.0/en
Ημερομηνία2022-01-07-
Ημερομηνία Δημοσίευσης2020-
Θεματική ΚατηγορίαBlack-box testingen
Θεματική ΚατηγορίαCookie hijackingen
Θεματική ΚατηγορίαAuthenticationen
Θεματική ΚατηγορίαAuthorizationen
Θεματική ΚατηγορίαLarge-scale measurementen
Βιβλιογραφική ΑναφοράK. Drakonakis, S. Ioannidis, and J. Polakis, “The cookie hunter: automated black-box auditing for web authentication and authorization flaws,” in 2020 ACM SIGSAC Conf. on Comp. and Commun. Secur. (CCS), pp. 1953–1970. doi: 10.1145/3372297.3417869en

Υπηρεσίες

Στατιστικά