University of Cambridge > Talks.cam > Computer Laboratory Security Seminar > Insecure processing of cookies in modern web applications and browsers

Insecure processing of cookies in modern web applications and browsers

Add to your list(s) Download to your calendar using vCal

If you have a question about this talk, please contact Laurent Simon.

Abstract: Since cookies store sensitive data (session ID, CSRF token, etc.) they are interesting from an attacker’s point of view. As it turns out, quite many web applications (including sensitive ones like bitcoin platforms) have cookie related vulnerabilities that lead for example to user impersonation, remote cookie tampering, XSS and more.

Developers tend to forget that multi-factor authentication will not help when cookies are insecurely processed. Security evaluators underestimate for example XSS via cookie – they claim that local access is needed for exploitation, but this is not always the case (browser dependent exploitation can be used to launch an attack remotely). Moreover, there are problems with secure processing of cookies in modern browsers.

That’s why secure cookie processing (from the perspective of web application and browser) seems to be a subject worth discussing.

Bio: Dawid Czagan (@dawidczagan) has found security vulnerabilities in Google, Yahoo, Mozilla, Microsoft, Twitter, BlackBerry and other companies. Due to the severity of many bugs, he received numerous awards for his findings.

Dawid is founder and CEO at Silesia Security Lab, which delivers specialized security auditing and training services. He also works as Security Architect at Future Processing.

Dawid shares his security bug hunting experience in his hands-on training “Hacking web applications – case studies of award-winning bugs in Google, Yahoo, Mozilla and more”. He delivered security trainings/workshops at CanSecWest (Canada), DeepSec (Austria), IAESTE CaseWeek (Silesian University of Technology, Poland) and for many private companies. Dawid also published over 20 security articles (InfoSec Institute, USA ).

To find out about the latest in Dawid’s work, you are invited to visit his blog (https://silesiasecuritylab.com/blog) and follow him on Twitter (@dawidczagan).

This talk is part of the Computer Laboratory Security Seminar series.

Tell a friend about this talk:

This talk is included in these lists:

Note that ex-directory lists are not shown.

 

© 2006-2017 Talks.cam, University of Cambridge. Contact Us | Help and Documentation | Privacy and Publicity