full-disclosure - defense against session hijacking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <B769356E-194A-11D8-8033-0003939DF990@boarder.org>
From: billp at boarder.org (Bill Pennington)
Subject: defense against session hijacking

Hey Thomas this has been discussed many times in the past and basically 
it boils down to these problems:

1. Many corporations use proxies so everyone appears to come from one 
IP address. A session based only on IP will have some pretty bad 
results like session jumping without people trying.

2. Large ISPs (AOL, Sympatico.ca, etc...) use super proxies that cause 
their clients to not only come from 1 IP but also these clients can hop 
across entire class A networks. This means your users get pretty mad 
when they keep getting kicked off.

3. Given 1 and 2 will cause you all sorts of problems it is easier (not 
more secure) to go with psuedo-random session-ids.

If you have an application that is in a tightly controlled environment 
(like LAN access only) then IPs can be considered. Although with remote 
access/VPN and B2B access this can also be problematic.

On Nov 17, 2003, at 1:16 PM, Thomas M. Duffey wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi All,
>
> Sorry if this is common knowledge or regularly discussed; I'm fairly
> new to the list.  I see quite a few messages on this and other
> security lists about session hijacking in Web applications.  Isn't it
> good defense for a programmer to store the IP address of the client
> when the session is initiated, and then compare that address against
> the client for each subsequent request, destroying the session if the
> address changes?  Do many programmers really overlook this simple
> method to protect against such an attack?  It's not perfect but should
> significantly increase the difficulty of such an attack with little or
> no annoying side effects for the legitimate user.  Would it be useful
> to extend the session modules of the common Web scripting languages
> (e.g. PHP) to enable an IP address check by default?
>
> Best Regards,
>
> - --
> :: t  h  o  m  a  s       d  u  f  f  e  y
> :: h o m e b o y z   i n t e r a c t i v e
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.2.2 (GNU/Linux)
> Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
>
> iD8DBQE/uTrH8fKWAp8CzDARAhyOAJ9kXkkiUERgEVRWhH5GtGACTKA1hwCfak+7
> KsyUSQG+iAcPVxX3BIdTTRc=
> =9f2R
> -----END PGP SIGNATURE-----
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>

---
Bill Pennington, CISSP, CCNA
Chief Technology Officer
WhiteHat Security Inc.
http://www.whitehatsec.com