Defcon 22-david-wyde-client-side-http-cookie-security
1 like1,894 views
Cookies stored by web browsers can be easily stolen, as most browsers store them in plaintext. Popular browsers like Firefox store cookies in SQLite databases, Internet Explorer in text files, and Opera and Safari in custom binary formats - all of which can be read easily by tools or code. Chromium encrypts cookies on Windows, Mac, and Linux, but cookies can still be decrypted on Linux. Physical access, social engineering, malware, and other attacks can steal browser cookies. Defenses include disk encryption, application firewalls, SELinux, and a master password for cookies.
![Reading Opera Cookies
$ python opera_reader.py ~/.opera/cookies4.dat
file_version_number 4096
app_version_number 8193
idtag_length 1
length_length 2
domain record
[('0x1e', 'name of the domain part', 3, 'org')]
end of path record
domain record
[('0x1e', 'name of the domain part', 8, 'slashdot')]
cookie record
[('0x10', 'name of the cookie', 6, '__gads'), ('0x11',
'value of the cookie', 69,
'ID=2628549bf6c27042:T=1405392507:S=ALNI_Maix2zTTIQ4159AfUM0tH
p7h_ODgQ'), ('0x12', 'expiry', 8, '2016-07-13 21:48:27'),
('0x13', 'last used', 8, '2014-07-14 21:49:28'), ('0x28',
'unknown cookie data id', 8,
'x00x00x00x00x00x00x00x00'), ('0xa9', 'unknown cookie
data id', 0, '')]](https://image.slidesharecdn.com/defcon-22-david-wyde-client-side-http-cookie-security-140813160859-phpapp02/85/Defcon-22-david-wyde-client-side-http-cookie-security-18-320.jpg)
![Reading Chromium Cookies: Linux
[david@localhost Desktop]$ python chromium_b64_cookie_linux.py
djEwXgab42ZPnVqGRirZqEHsvEN8bC/
chT84CbmJxMSJDr6XA7mQLZdCuLwYSNA6srVf7NDn7rHdBOFJf8SX4jdCxlQhcrUGH
+0KzFz
+hUxUcgRzy6jWEZyAe4QDegh1YGtfdCGiZ2TgHkEifJ0Mojf4VpuKhFw7SVpCzCorz86JF
czNpco7LZwM/xng7UPmVEY4sIQwAGlTXoY9ThgaliP8HGviwkK0ozW9/FMUiGaxBIqDD
+FSfsGszckv9zRbK8XL2PbHVslRmG2ENQ8wESu2Czajb20BQ+L3dMRvOcVbW+gwt+H/
cBG23dnjnhFxGcvm9DSDyz87o5ssILocgMT+kddTBCG8ohvy7iNE3njT6WOFktK8Hd/
+rhSUarnCtZt9UB1EZtikWbpqn0PKrVCKn0wVpO4oyeDIe96xEesn/IM=
david@computer /d/code/snickerdoodle/chromium-linux $
LD_LIBRARY_PATH=/d/code/lib/chromium/src/out/Release/lib ./
base64_reader $(cat fedora-cookie.txt)
DQAAANMAAAD55DvOAnmlugeHzwGKs0asFxYtMfXl-
Xdg7MtLYmdj5GDI3iyPh70Ds6OKgogfATna2KV9d7JqZxJ5e7SA-
sbH1oxvQFs1WsFo_9WzEfj9VamEV5C0uml6tVuzhIGzrrKM0__0SI6QANb-y-
qyM3QJSKCB7QrXR_Ug7lFzjibDW7Fsfg15SUCTmfQz9YLBP4oYSOt_pJRVf5XZgbN_2J-
KQzBqtZznZwKVE4TatBaAucT-
R9jXnjM5aMdoJvr7ubghi0p1m7yvPevqNNRItPkeB5aV_cPXHKRMjwhAAk6_2w](https://image.slidesharecdn.com/defcon-22-david-wyde-client-side-http-cookie-security-140813160859-phpapp02/85/Defcon-22-david-wyde-client-side-http-cookie-security-22-320.jpg)
Defcon 22-david-wyde-client-side-http-cookie-security
- 1. Client-Side HTTP Cookie Security: Attack and Defense David Wyde DEF CON 22
- 2. Game Plan • Why are HTTP cookies valuable to attackers? • How do popular web browsers store cookies? • How can cookies be stolen? • How can cookies be protected?
- 3. Disclaimers • The opinions in this presentation are mine, and not my employer’s. • The security issues I discuss are not specific to any one website, and are not vulnerabilities in the conventional sense.
- 4. What is an HTTP Cookie? • Cookies are transmitted as HTTP headers • Name-value pairs • HTTP clients store state using cookies • E.g., trade credentials for a session cookie
- 6. User-Readable Data • Any process that runs as your user can read: • Your private keys • Some software saves passwords as plaintext • Web browser cookies • Damage is done without privilege escalation
- 7. Cookies Are Valuable to Attackers • Cookies can be more valuable than passwords • Gmail: bypass two-factor authentication • Facebook: don't warn of login from a new device • Counterpoints • "Please re-enter your password” • Cookies expire
- 9. Facebook: New Login Email
- 11. Cookie Storage: Intro • Almost all browsers store cookies as plaintext • The HttpOnly and Secure flags apply inside browsers • Malware need not respect them
- 12. Firefox • Stores cookies in an SQLite database • Cookies can be read using sqlite3, Python, etc.
- 13. Reading Firefox Cookies $ sqlite3 ~/Library/Application Support/Firefox/Profiles/*/cookies.sqlite SQLite version 3.7.13 2012-07-17 17:46:21 Enter ".help" for instructions Enter SQL statements terminated with a ";" sqlite> .schema CREATE TABLE moz_cookies (id INTEGER PRIMARY KEY, baseDomain TEXT, appId INTEGER DEFAULT 0, inBrowserElement INTEGER DEFAULT 0, name TEXT, value TEXT, host TEXT, path TEXT, expiry INTEGER, lastAccessed INTEGER, creationTime INTEGER, isSecure INTEGER, isHttpOnly INTEGER, CONSTRAINT moz_uniqueid UNIQUE (name, host, path, appId, inBrowserElement)); CREATE INDEX moz_basedomain ON moz_cookies (baseDomain, appId, inBrowserElement); sqlite> SELECT value FROM moz_cookies WHERE name='GX'; DQAAAPEAAABWYmsr2PFvwQi4XhQWYcw_5coZVfjh-efmKTNeLjyLx04sHi_Ih- xMOsSRaZ6J38QzDGyCt5v6DKYkkoc6TeX8QKuaOPSAqqGTEo4v2Y6kvmzlS-SvdU4zTcuJ- z4uCf7uiZ7Ic- H6U5Mt7leqmsDhQeEoL01z5OF6iLoxUeCHU_91eWrA2bOpU8ppqVjutpi4WVhyqLV7WX6hgSnE kWnpsN-XwcDF84V7u0DrlKCQFupzmCfa3nt_tARY-SxbyNrmY_0rH4YF- xBVvPFXBQpKqUZrW_zMdGmWgmPER_7mBTGXtlh9PM5nCP_bw09oIqXrQb_OhHe7c3AnnIg2EIq g
- 14. Internet Explorer • Stores cookies as text files • The folder varies depending on IE version • Filenames are random: need to read the files
- 15. Reading Internet Explorer Cookies
- 16. Opera and Safari • Custom binary formats • Can be parsed by free software tools • Safari: Cookies.binarycookies • Opera: cookies4.dat
- 17. Reading Safari Cookies $ python ~/Desktop/BinaryCookieReader.py ~/Library/ Cookies/Cookies.binarycookies | grep yahoo Cookie : hpc=d=ItIKgZXDu9Pkv2_sEb7ygoVyN9bHZ2mmjnr8eBC8z9Ynw88Tayw 7ixgQfT4vleMQ56bGUussxMNmYBusbq3RHgXIkea3DhM.Yzckc.y6GAQE iJoPoK1DzyvYg1cyBoMWlZccOkvv7wvPUmDHnNk1uyiJwon3_YjfMMyCX stKdmUKmePy_Wn04tFoVbui1wlLTuSpqTw-&v=2; domain=.www.yahoo.com; path=/; expires=Wed, 15 Jul 2015; Cookie : B=2b26v3t9s955p&b=3&s=oh; domain=.yahoo.com; path=/; expires=Fri, 15 Jul 2016; Cookie : CRZY=%7B%221048616551%22%3A%7B%22expires %22%3A1405564858541%2C%22data%22%3A%7B%22nv%22%3A1%2C %22bn%22%3A0%7D%7D%7D; domain=.yahoo.com; path=/; expires=Thu, 17 Jul 2014;
- 18. Reading Opera Cookies $ python opera_reader.py ~/.opera/cookies4.dat file_version_number 4096 app_version_number 8193 idtag_length 1 length_length 2 domain record [('0x1e', 'name of the domain part', 3, 'org')] end of path record domain record [('0x1e', 'name of the domain part', 8, 'slashdot')] cookie record [('0x10', 'name of the cookie', 6, '__gads'), ('0x11', 'value of the cookie', 69, 'ID=2628549bf6c27042:T=1405392507:S=ALNI_Maix2zTTIQ4159AfUM0tH p7h_ODgQ'), ('0x12', 'expiry', 8, '2016-07-13 21:48:27'), ('0x13', 'last used', 8, '2014-07-14 21:49:28'), ('0x28', 'unknown cookie data id', 8, 'x00x00x00x00x00x00x00x00'), ('0xa9', 'unknown cookie data id', 0, '')]
- 19. Chromium • Encrypts cookies in recent versions • Implementation and security vary by platform • Stores cookies in an SQLite database • BLOB field for encrypted cookie values
- 20. Chromium on Linux • Linux has no single standard keyring mechanism • (KDE, Gnome, etc.) • Cookies encrypted with AES (symmetric key) • Hard-coded key and salt • Can be decrypted on any machine • Link against Chromium libs, call code to decrypt
- 21. Reading Chromium Cookies: Linux
- 22. Reading Chromium Cookies: Linux [david@localhost Desktop]$ python chromium_b64_cookie_linux.py djEwXgab42ZPnVqGRirZqEHsvEN8bC/ chT84CbmJxMSJDr6XA7mQLZdCuLwYSNA6srVf7NDn7rHdBOFJf8SX4jdCxlQhcrUGH +0KzFz +hUxUcgRzy6jWEZyAe4QDegh1YGtfdCGiZ2TgHkEifJ0Mojf4VpuKhFw7SVpCzCorz86JF czNpco7LZwM/xng7UPmVEY4sIQwAGlTXoY9ThgaliP8HGviwkK0ozW9/FMUiGaxBIqDD +FSfsGszckv9zRbK8XL2PbHVslRmG2ENQ8wESu2Czajb20BQ+L3dMRvOcVbW+gwt+H/ cBG23dnjnhFxGcvm9DSDyz87o5ssILocgMT+kddTBCG8ohvy7iNE3njT6WOFktK8Hd/ +rhSUarnCtZt9UB1EZtikWbpqn0PKrVCKn0wVpO4oyeDIe96xEesn/IM= david@computer /d/code/snickerdoodle/chromium-linux $ LD_LIBRARY_PATH=/d/code/lib/chromium/src/out/Release/lib ./ base64_reader $(cat fedora-cookie.txt) DQAAANMAAAD55DvOAnmlugeHzwGKs0asFxYtMfXl- Xdg7MtLYmdj5GDI3iyPh70Ds6OKgogfATna2KV9d7JqZxJ5e7SA- sbH1oxvQFs1WsFo_9WzEfj9VamEV5C0uml6tVuzhIGzrrKM0__0SI6QANb-y- qyM3QJSKCB7QrXR_Ug7lFzjibDW7Fsfg15SUCTmfQz9YLBP4oYSOt_pJRVf5XZgbN_2J- KQzBqtZznZwKVE4TatBaAucT- R9jXnjM5aMdoJvr7ubghi0p1m7yvPevqNNRItPkeB5aV_cPXHKRMjwhAAk6_2w
- 23. Chromium on Windows • CryptProtectData is used to encrypt • A Windows cryptography API • Uses login credentials as part of the encryption • CryptUnprotectData is used to decrypt • Must be called by the user that encrypted, on the same machine
- 24. Chromium on Mac • Store an encryption key in the system keychain • If no key exists, a random one is generated • AES is used to encrypt/decrypt • Keychain prompts when accessed from unsigned apps
- 25. Reading Chromium Cookies: Mac
- 26. Browser Cookie Storage: Summary • Chromium encrypts cookies on Windows and Mac • Chromium obfuscates cookies on Linux • Other popular browsers store cookies as plaintext
- 27. Attack Vectors
- 28. Physical Access • Cookies are there for the taking with most browsers • Chromium protects you on Windows and Mac
- 29. Social Engineering • Excel/Word macros • Malicious executables • Don't need to install anything - just run once
- 30. Malware • Drop and run an executable to extract cookies • Metasploit • Any process that runs as your user • HTTP POST cookies to a malicious server
- 31. Proof of Concept
- 32. Proof of Concept: Login
- 33. Defenses
- 34. Disk Encryption • Protect against physical access to plaintext cookies
- 35. Application Firewalls • Block/allow (server, port) pairs for each application • Chromium can access www.google.com on port 443 • Examples • Mac: Little Snitch • Windows: NetLimiter? • Linux: ?
- 36. Little Snitch
- 37. SELinux • Security-Enhanced Linux • Separate from standard Unix permissions • Can isolate a user’s applications from each other
- 38. Idea: Master Password for Cookies • Type in a password to decrypt your cookies • Firefox has this to protect passwords
- 40. Server-Side Defenses • Tie a session cookie to the login IP • The cPanel web hosting tool can optionally enforce this • Kind of annoying in a world of mobile clients • Warn users, rather than force them to log in again • “You’ve logged in from X and Y countries this month”
- 41. Conclusions • Cookies should be handled with care • Client-side cookie security is not a solved problem
- 42. References • Opera reader: https://gist.github.com/gwarser/1324501#file-readcookies-py • Safari reader: http://www.securitylearn.net/2012/10/27/cookies-binarycookies- reader/ • Firefox master password: http://kb.mozillazine.org/Master_password • cPanel cookie IP validation: http://www.cpanelkb.net/cpanel-security-settings-checklist/ • CryptProtectData (Microsoft documentation): http://msdn.microsoft.com/en-us/library/aa922939.aspx