August 8, 2016 By Larry Loeb 2 min read

Suphannee Sivakorn, a Ph.D. student at Columbia University, and Jason Polakis, an assistant professor at the University of Illinois, discussed the state of cookies and cookie encryption during a Black Hat briefing.

They looked at 25 popular websites, including the major search engines and news sites such as The Huffington Post and The New York Times. They found that 15 of these sites supported HTTPS, but not universally.

Many sites offer personalization over HTTP. The researchers felt this could lead to issues such as poor interoperability and flawed access control, Threatpost reported.

It Starts With One Connection

For an HTTP cookie hijacking attack to work, the attacker needs to observe an unencrypted connection to the server. Even HTTPS may have a part at the beginning of the session that is unencrypted.

“This process seems to be very secure to users as the server and browser cooperatively redirect the user to a secure connection,” the authors noted. “However, [the initial step] leaves a window of opportunity for attackers to steal the cookies. This also means that even when users see HTTPS in the address bar and the other visual clues of a trusted connection, they might still have been exposed to a cookie hijacking attack during the initial request.”

Default actions seem to be a problem in certain services. For example, the researchers found that Bing serves all connections over HTTPS by default, and all searches on the site are in cleartext. In fact, users must type HTTPS in the address bar to protect themselves.

Cookie Encryption Is Not Enough

Efforts such as HTTPS Everywhere have tried to increase adoption of more secure browsing. The presenters found that the main limitation of HTTPS Everywhere is the rule sets. These are created and maintained by the community, which requires a lot of manual effort.

It can also result in incomplete rules. HTTPS Everywhere cannot protect the user in a situation where websites contain pages or subdomains whose functionality breaks over HTTPS; the unavoidable result is an unencrypted connection. User cookies can then be exposed since a single HTTP request is enough to cause a cookie reveal.

Extensions may reduce the attack surface of a browser, but really don’t help if the website doesn’t use encryption for all data transmissions.

It’s Not Just Websites

In general, the problem is not just limited to websites. Researchers found that cookies are also exposed by “official browser extensions, search bars and mobile apps.” Additionally, they looked at Wi-Fi connections and detected that a large portion of the outgoing traffic in public wireless networks remains unencrypted, which exposes numerous users to cookie hijacking attacks.

The security versus usability conundrum has been around for a while. The price paid for easily usable websites may lie in how they enable exposure of user information.

More from

Protecting your digital assets from non-human identity attacks

4 min read - Untethered data accessibility and workflow automation are now foundational elements of most digital infrastructures. With the right applications and protocols in place, businesses no longer need to feel restricted by their lack of manpower or technical capabilities — machines are now filling those gaps.The use of non-human identities (NHIs) to power business-critical applications — especially those used in cloud computing environments or when facilitating service-to-service connections — has opened the doors for seamless operational efficiency. Unfortunately, these doors aren’t the…

Communication platforms play a major role in data breach risks

4 min read - Every online activity or task brings at least some level of cybersecurity risk, but some have more risk than others. Kiteworks Sensitive Content Communications Report found that this is especially true when it comes to using communication tools.When it comes to cybersecurity, communicating means more than just talking to another person; it includes any activity where you are transferring data from one point online to another. Companies use a wide range of different types of tools to communicate, including email,…

Research finds 56% increase in active ransomware groups

4 min read - Any good news is welcomed when evaluating cyber crime trends year-over-year. Over the last two years, IBM’s Threat Index Reports have provided some minor reprieve in this area by showing a gradual decline in the prevalence of ransomware attacks — now accounting for only 17% of all cybersecurity incidents compared to 21% in 2021. Unfortunately, it’s too early to know if this trendline will continue. A recent report released by Searchlight Cyber shows that there has been a 56% increase in…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today