It has been suggested that this article be merged into Session hijacking. (Discuss) Proposed since November 2024. |
The CookieMonster attack is a man-in-the-middle exploit where a third party can gain HTTPS cookie data when the "Encrypted Sessions Only" property is not properly set. This could allow access to sites with sensitive personal or financial information.[1]
It is a Python based tool, developed by security researcher Mike Perry.
Perry originally announced the vulnerability exploited by CookieMonster on BugTraq in 2007. A year later, he demonstrated CookieMonster as a proof of concept tool at Defcon 16.[2]
Users of the World Wide Web can reduce their exposure to CookieMonster attacks by avoiding websites that are unprotected to these attacks. Certain web browsers make it possible for the user to establish which sites these are. For example, users of the Firefox browser can go to the Privacy tab in the Preferences window, and click on 'Show Cookies.' For a given site, inspecting the individual cookies for the top level name of the site, and any subdomain names, will reveal if 'Send For: Encrypted connections only,' has been set. If it has, the user can test for the site's vulnerability to CookieMonster attacks by deleting these cookies and visiting the site again. If the site still allows the user in, the site is vulnerable to CookieMonster attacks.[3][4]
Affected websites
editWebsites allegedly affected by CookieMonster included:[5]
- Google services including: Gmail, Blogger, Google Docs, Google Finance and search history
- Airline/Travel websites: Southwest, United, Expedia, USAirways.com, priceline.com
- Banks: National City, USAA, Patelco, CapitalOne
- Domain Registrars: Register.com, namesecure.com
- Merchants: eBay, wireless.att.com, Netflix, Newegg
See also
editFurther reading
edit- Prince, Brian (September 12, 2008). "HTTPS Cookie-Hijacking Tool CookieMonster Gobbles Personal Data". eWeek. Ziff-Davis. Archived from the original on October 29, 2024.
References
edit- ^ Goodwin, Dan. "CookieMonster nabs user creds from secure sites • The Register". www.theregister.co.uk. Retrieved 2009-02-18.
- ^ Perry, Mike (4 August 2008). "CookieMonster: Cookie Hijacking | fscked.org". fscked.org. Retrieved 2018-12-18.
- ^ Claburn, Thomas (11 September 2008). "CookieMonster Can Steal HTTPS Cookies -- Security -- InformationWeek". InformationWeek. Archived from the original on 12 September 2008.
- ^ Goodin, Dan (11 Sep 2008). "CookieMonster nabs user creds from secure sites". www.theregister.co.uk. Retrieved 2018-12-18.
- ^ Perry, Mike (24 August 2008). "Incomplete List of Alleged Vulnerable Sites | fscked.org". fscked.org. Retrieved 2018-12-18.
External links
edit- Perry's Defcon Presentation (YouTube)
- https://fscked.org/proj/cookiemonster/ActiveHTTPSCookieStealing.pdf - Defcon Presentation slides
- http://fscked.org/blog/cookiemonster-core-logic-configuration-and-readmes
 | This computer networking article is a stub. You can help Wikipedia by expanding it. |
 | This computer security article is a stub. You can help Wikipedia by expanding it. |
 | This World Wide Web–related article is a stub. You can help Wikipedia by expanding it. |