Abstract

Abstract: Since cookies store sensitive data (session ID, CSRF token, etc.) they are interesting from an attacker’s point of view. As it turns out, quite many web applications (including sensitive ones like bitcoin platforms) have cookie related vulnerabilities that lead for example to user impersonation, remote cookie tampering, XSS and more.

Developers tend to forget that multi-factor authentication will not help when cookies are insecurely processed. Security evaluators underestimate for example XSS via cookie – they claim that local access is needed for exploitation, but this is not always the case (browser dependent exploitation can be used to launch an attack remotely). Moreover, there are problems with secure processing of cookies in modern browsers.

That’s why secure cookie processing (from the perspective of web application and browser) seems to be a subject worth discussing.

Bio: Dawid Czagan (@dawidczagan) has found security vulnerabilities in Google, Yahoo, Mozilla, Microsoft, Twitter, BlackBerry and other companies. Due to the severity of many bugs, he received numerous awards for his findings.

Dawid is founder and CEO at Silesia Security Lab, which delivers specialized security auditing and training services. He also works as Security Architect at Future Processing.

Dawid shares his security bug hunting experience in his hands-on training “Hacking web applications – case studies of award-winning bugs in Google, Yahoo, Mozilla and more”. He delivered security trainings/workshops at CanSecWest (Canada), DeepSec (Austria), IAESTE CaseWeek (Silesian University of Technology, Poland) and for many private companies. Dawid also published over 20 security articles (InfoSec Institute, USA ).

To find out about the latest in Dawid’s work, you are invited to visit his blog (https://silesiasecuritylab.com/blog) and follow him on Twitter (@dawidczagan).