bugtraq - Re: Invision Power Board v2.1.4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0603161206020.11733@odyssey.billn.net>
Date: Thu, 16 Mar 2006 12:17:22 -0500 (EST)
From: Bill Nash <billn@...ssey.billn.net>
To: matt@...isionpower.com
Cc: bugtraq@...urityfocus.com
Subject: Re: Invision Power Board v2.1.4 - session hijacking

On Thu, 16 Mar 2006, matt@...isionpower.com wrote:

> This report is ridiculous and quite frankly shows that the author does not understand how IPB works.
>
> Yes, the author is correct in finding that if you: copy the user's IP address, copy the user's user-agent and copy the user's session ID then they can "hijack" your session.
>
> That's because, to all intents and purposes you are the same person.
>
> A stateless HTTP application HAS to authenticate against SOMETHING.
>
> This report is bogus. Feel free to relabel it "Stateless HTTP authentication potential vulnerability" and remove it from Invision Power Board's category.
>

`/dev/cheek < tongue`

Upon close examination of the report, and after exhaustive testing, it's 
been determined that the cases in which this flaw can be exploited are 
limited to users sharing a NAT egress point, usually a home DSL or cable 
modem gateway. Session IDs that involve a combination of user supplied 
token (usually from a cookie) and a second factor that can't be easily 
forged (IP address) are susceptible to a slightly technical 'sneaker net' 
style attack, usually in concert with the common 'biobreak' attack, which 
leverages socially engineering against known user habits.

In many cases, the exploit becomes evident very quickly.

Users are encouraged to engage in the application of a Nerf Bat, or a more 
sophisticated LART, if needed, to correct the behavioral vector of this 
attack.

- billn