Slashdot Log In
The Dangers of Improper Cookie Use
Posted by
CmdrTaco
on Mon Dec 18, 2006 01:22 PM
shifted89 writes "Over the last year, the security community have exposed web application security for what it is — extremely lacking. However, for all the focus on XSS, CSRF, history stealing, etc., not much attention has been given to the cookie. Unfortunately, cookie misuse can be just as dangerous, if not more so than XSS attacks and InformIT illustrates why. In short, the author clearly demonstrates what can happen when a website improperly uses cookies for customer tracking — including a working illustration."
Related Stories
[+]
Your Rights Online: Delete Cookies, Inflate Net Traffic Estimates 217 comments
eldavojohn writes "In my browser, I regularly go to the tools menu and clear my private data. This includes my cookies. As a result, people like me who destroy cookies by the thousands may be inflating estimates of Web traffic by up to 150 percent. People have good reasons for clearing out cookies — we've heard about bad cookies before (and I think the FCC is still investigating the issue). But every time you delete cookies, many of the sites you've visited count you as a new visitor next time."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Old News (Score:5, Funny)
Remember.. (Score:2, Funny)
Cookies? Javascript? Etc? (Score:5, Funny)
Re: (Score:2, Funny)
As Scott McNealy once said, "Privacy is dead, deal with it". I've extended that to security which is why I enable javascript and install the binary-only flash player which is configured to auto execute bytecode from any server on the web. In my vision of the future, anybody with disabilities, privacy concerns, security concerns or who is running something other than Windows isn't worth bothering with. Viva innovation, especially from Microsoft!
Re:Cookies? Javascript? Etc? (Score:5, Insightful)
Hmm. Animated GIFs? Check. Blink? Check. Scrolling status bar? Check. Background MIDI files? Check. Pop-ups? Check. Flash ads with full video and sound? Check. Garish color schemes? Double-check.
I think you're on to something!
Parent
Re:Cookies? Javascript? Etc? (Score:4, Funny)
Parent
Re: (Score:3, Funny)
Re:Cookies? Javascript? Etc? (Score:4, Insightful)
Parent
You lie! FUD! FUD! (Score:4, Funny)
If you were really that old-fashioned, you wouldn't have to disable JavaScript. The graphical web browser was invented in 1992, so you'd be compelled to use a text-only browser, such as Lynx. And those don't have any JavaScript to disable.
You are obviously part of an Evil Conspiracy. Please rant some more so I can figure out which one.
Parent
Obligatory (Score:2, Informative)
Re: (Score:3, Insightful)
My problem is that I missed the Anonymous Coward Check box, and now, my karma has taken a hit. Sigh.
Oh well. Live and learn
Re:Obligatory (Score:4, Insightful)
No need to beat a man while he's down.
Parent
What about clipboard theft? (Score:2)
Re: (Score:3, Funny)
From that site:
Damn Microsoft for removing features in IE7!
cookies passed as plaintext (Score:3, Informative)
Re: (Score:2)
Mind you, nobody's bitched about it in a couple of years now. Maybe their proxies are smarter now?
Re: (Score:2)
Re: (Score:2)
Re:cookies passed as plaintext (Score:5, Insightful)
There was a merchant site that I visited quite some time ago that did something like this. Except they screwed it up and, along with putting the session ID in the URL, they "automatically" tied the session id with account information. The effect this had was that anyone who visited a copied URL would pull up the account information of the person who had spread the URL around.
It took some time to figure it out. The URL was posted on a fairly busy forum, and it was a fairly fast selling item, and 50+ people had used the link to try and make a purchase.. and every time someone checked out, the account was updated with their information.
I'm not sure what the lesson here is, other than the fact that any "safe practice" can become insecure in the hands of idiots. Cookies aren't an inherently stupid idea, but the ease of using them invites a lot of abuses.
Parent
Re:cookies passed as plaintext (Score:4, Insightful)
How does that do anything for the example given? If someone uses a sniffer at a wireless access point with NAT, they have access to the same IP as their victim.
Parent
Re: (Score:2)
How does this break?
(Of course it does break for anyone using anonymizer-type services)
practical, perhaps? (Score:5, Insightful)
Oh well, I guess this is just another lesson in how marketers will shoot themselves in the foot. Animated gifs are abused, so i turn animation off. Cookies are abused, so i reject any cookie that is not obviously necessary. Flash is useful, but no way to request that it does not start automatically, so either I don't install it or install a hack to block it. I don't even see the product that is being advertised.
I hope this gets everyone off thier high horse, and realize that third party cookies should be rejected on all machines by default. What I really wish existed was a screen that popped up every time you went to a new site that informed the user of the site, and asked for a cookie preference for that site. That way, all cookies could be accepted at the corporate site, and no cookies might be accepted at google.
Re: (Score:2, Informative)
Maybe you should learn about or change your browser.
Edit - Preferences - Privacy & Security - Cookies
Here Check 'Allow Cookies based on privacy settings' and 'Ask for each cookie'.
Also, for flash, google for flashblock. Nice plugin, disables all flash and replaces it with a 'play' button. You can then click on that button to show the flash.
Re: (Score:3, Interesting)
Maybe you should learn about or change your browser.
For some crazy reason, FireFox 2 has now removed this option - I had to go poking around in about:config to turn it back on.
Re: (Score:3, Informative)
Re: (Score:3, Informative)
Oh well, I guess this is just another lesson in how marketers will shoot themselves in the foot. Animated gifs are abused, so i turn animation off. Cookies are abused, so i reject any cookie that is not obviously necessary. Flash is useful, but no way to request that it does not start automatically, so either I don't install it or install a hack to block it. I don't even see the product that is being advertised.
Well just use Firefox with the Adblock and Flashblock extensions (ok addblock does not fix flash
Re: (Score:2)
Firefox could do better (Score:3, Insightful)
For example, just look at their cookie management under "privacy". Sure, they have white and blacklists for cookies, and that's fine. But bring up your cookie list - the *ONLY* option you have for each cookie is to delete.
Why isn't there are "delete and block" button? It would be SO SIMPLE to add this function, and make the management of cookies so much simpler for the 95% of web users like me who want to accept *most* cookies, and only block obvious cross-site trackin
Re: (Score:3, Insightful)
Re: (Score:3, Informative)
If you use NoScript (which you should to stop dangerous and irritating javascript code), you don't need Flashblock.
Re: (Score:3, Interesting)
What I really wish existed was a screen that popped up every time you went to a new site that informed the user of the site, and asked for a cookie preference for that site. That way, all cookies could be accepted at the corporate site, and no cookies might be accepted at google.
Actually, Konqueror does that if you set it up to ask what to do when you receive a cookie. I fiddled around with Firefox and couldn't find a way to do it, but maybe messing around with Network.cookie.cookieBehavior [mozillazine.org] and Network.c [mozillazine.org]
Re: (Score:3, Funny)
Where the hell do you live? Soviet Russia?
How old is this article? (Score:5, Insightful)
It says "updated Dec 15, 2006" but the comments at the end of the article are all dated from 2004. I mean, the problem is much older than that, but it seems the article was just updated with 2006 dates to make it seem more current. Or am I missing something?
Cookie on cookie misuse link (Score:4, Insightful)
Other things they do is prohibit tabbed browsing by using javascript to open an image from a thumbnail to a new window. Can someone please send these guys to a usability crash-course?
Re:Cookie on cookie misuse link (Score:4, Informative)
I can't believe how common that still mistake still is.
It's not like it's hard to use the following instead:
<a href="image.jpg" onclick="popup(this.href);return false;">link</a>...
Parent
Re:Cookie on cookie misuse link (Score:5, Insightful)
The correct way is - and always has been - to leave that to the user. Useability studies have shown time and again that new windows popping open unannounced are unwelcome, even frightening to many computer users. And the quickest way to piss off power users like me is to presume to know better than I how your site should be displayed.
This behaviour is another legacy of assuming that the entire world browses with certain versions of MSIE. The only reasonable way in that browser to keep track of multiple sites was to open links in new windows. But even then, such presumption was unwelcome to most people, even many IE users.
The only remaining (valid) use of the target attribute is in a frameset, and that monstrousity is not needed any more, what with the moderately decent CSS positioning support that is present in all modern browsers.
Parent
I love the start of this article (Score:3, Insightful)
Maybe (Score:3, Informative)
Maybe that's because the dangers of cookies have been known for AGES?
Worse and worse (Score:4, Informative)
Cookie abuse reached new heights a few weeks ago when top sites in Google search results throw cookies on the search results page. So far it's not a guaranteded occurance, and only happens for the top search result. Still, it's jumping the gun.
I can't wait for the Mozilla devs to clean up their cookie code so that blocking cookies is as easy and configurable as blocking images. Even being able to prompt to block everything other than a session cookie would be a nice improvement.
Re: (Score:2)
Re:Worse and worse (Score:5, Informative)
Parent
The Real Danger of Improper Cookie Use (Score:2, Funny)
Two Words: Crumby Milk
Thank You and Tip your Servers.
Obligatory Simpsons reference.... (Score:5, Funny)
Homer: Oh, yeah, like you don't know. We're gonna have sex!
Mindy: Oh...well, we don't have to.
Homer: Yes we do! The cookie told me so.
Mindy: Well...desserts aren't always right.
Homer: But they're so sweet!
OMG cookie misuse! (Score:2)
This article shows us that you shouldn't let people in only by username without their password. Well duh.
What's the big deal? (Score:2)
As is said everytime the issue of cookies comes up, DELETE THEM! You don't need to keep them.
Once you delete them, you're a new, unique visitor to a web site. You screw with their statistics since they think you're someone new, thus increasing their ad
More "Cookie Monster" Hysteria (Score:5, Informative)
FTFA:
That section about the "personal identification code" talk is very weaselly. It makes cookies sound like any website can read a cookie on your computer that's flagged as "owned" by that website at any time. Cyrus Peikari and Seth Fogie (article authors) leave out the important, necessary link: the DoubleClick cookie can be read only when your computer makes an outgoing HTTP connection to DoubleClick. Like when a DoubleClick banner ad is included in a Slashdot page's HTML. Which HTTP request includes a CGI param (REFERER) pointing to the Slashdot page from which the IMG tag instructed the computer to pull the DoubleClick banner image. That's how Doubleclick gets its cookie, and the context that you visited a Slashdot page.
DoubleClick cannot read its cookie any other time, when there's no HTTP connection from your computer to DoubleClick. Like all the rest of the pages on which DoubleClick has no banner or other "self-clicking" link. There are web bugs, invisible images tags embedded in other pages just to hit their server with the REFERER of the page triggering their bug, updating your computer's cookie with their counter (etc). But they cannot be read "at any time".
Besides, the cookie is a nonessential part of this snooping. DoubleClick doesn't need to keep its counter on your computer - the IMG hit can update its server-side counter DB. It can ID you, though not as precisely, by your IP# and other CGI parameters you send with every HTTP request. Or DoubleClick's deal with, say, Slashdot, is that Slashdot encode the DoubleClick banner IMG tags the Slashdot server sends you with its pages with a unique ID, like your Slashdot userid. ACs and public terminals mostly escape, but they're not really targets for these marketdroids.
And you can turn off cookies in any non-retarded browser, making them anonymous (encoded IMG URLs are much harder - see?). And you can inspect the cookies stored on your computer.
All these issues were discussed in great detail by the HTTP Working Group as we invented cookies, almost a decade ago. Some people were philosophically opposed to letting untrusted servers store any data on users' computers. Though every page, every image is stored on users' computers, after retrieval for presentation. And we realized that stopping cookies would mean only people with money to make "cross-site" deals and maintain large centralized databases would get the power to exploit cookies for tracking. So the cost would motivate more profit-exploitation of the tech. Ultimately only profiteers would track you, and there'd be plenty of them, without even the local control that cookies offer. And the entire Web would lose even voluntary easy tracking of intersession client state.
We decided to make cookies simple and use them. They're mostly harmless - a good balance with the huge benefit they deliver all day long in the Web Era. But I guess there's still profit to be made by scaring people on the Web, like the naive "technologists" to whom this InformIT article is directed, with incorrect cookie hysteria, and offers to help protect us.
That's the way the cookie crumbles.
Cookies (Score:5, Informative)
Yup, you heard it right. base64 decode your cookie, change a few values, stick it back in... Ta-da, you're an admin.
Improper cookie use can be a nasty, nasty thing. The worst part is that this problem was brought up to the lead developer, who had originally wrote this auth system, but... "Well, it is base64 encoded, noone will ever figure that out." Yeah, right.
Re:Cookies (Score:5, Informative)
If I see a nonsensical combination of upper and lower case letters, numbers, and punctuation, especially if it has one or two equal signs tacked onto the end, I immediately think "base64!".
Firefox allows base64 encoding for data: urls, and we can use this to make a quick-n-dirty base64 decoder. Just type data:text/plain;base64, (including the comma) into the address bar and paste the string on the end, and hit enter to see the decoded string (if it's plaintext).
Base64 is not encryption and it should not be used where encryption is needed (or in this case, a secure DATABASE). Base64 is a way to represent binary data in plaintext without having to worry about data corruption due to non-binary safe programs.
Parent
Let's discuss something new (Score:4, Informative)
Re: (Score:2)