HTTP Cookie Hijacking in the Wild: Security and Privacy Implications
summary
An empirical audit of 25 major sites finds 15 support HTTPS but fail to enforce it everywhere, allowing stolen HTTP cookies to reveal names, email, home/work addresses, full search histories (Bing, Baidu), contacts and send-mail capability (Yahoo), and partial/complete purchase histories (Amazon partial, eBay full). IRB-approved measurements on a university Wi‑Fi for 30 days detect 282K accounts exposing hijackable cookies; focused tests recover 67,000 Google accounts and show ~75% of a Tor exit node’s connections are HTTP. HSTS and HTTPS Everywhere reduce but do not eliminate exposure.
AI-written summary · about
chapters (26)
- 0:00Intro
- 1:46Who we are
- 2:22Current State of Affairs
- 3:45Chapters
- 4:53Bad Cookies!!!
- 7:02Migrating to HTTPS
- 8:54Cookie Hijacking in the Wild
- 11:01Eavesdropping
- 11:47Stealing the Cookies
- 13:03Accessing the Data
- 15:17Search engines
- 16:58Yahoo
- 19:08E-commerce
- 20:51Ad Networks
- 22:03Cookie Hijacking Cheat Sheet
- 23:35Attack Evaluation
- 25:59Large-scale Cookie Exposure
- 27:20Attack Implications - Tor Network
- 30:27Countermeasures
- 32:40HSTS: Issues
- 36:19HTTPS Everywhere: Issues
- 37:50HTTPS Everywhere: Effectiveness
- 38:45Disclosure
- 41:10Aftermath
- 42:24Sound Bytes
- 45:40Questions
related talks
43mIf you Give a Hacker a Cookie
28mCookie Crumbles: Unveiling Web Session Integrity Vulnerabilities
21mDeath to Cookies
40mHow the Cookie Crumbles: What OSINT Tells Us About Dark Web Cookie Sales
49mSecurity and Insecurity of HTTP Headers
49mBeyond Cookies: The Unseen Privacy Risks of Web Analytics
27mWho Left Open the Cookie Jar? A Comprehensive Evaluation of Third-Party Cookie Policies
53mThe BEAST Wins Again: Why TLS Keeps Failing to Protect HTTP