Session hijacking

Session hijacking is understood by the act of operating or controlling a communication session TCP / IP valid between computers without their owner to have knowledge or allow such action.

The action itself usually involves exploring the mechanism that controls the connection between a web server and a browser, known as “session token“. This token is made up of a string that a web server sends to a client at the time of authentication. To anticipate or steal the session token, the malicious user can gain access to the server and have the same features as the authorized user.

One way to compromise the token is to use malicious programs on the client, for example, “cross-site scripting”, JavaScript codes or “Trojan horses”.

The session hijacking is based on the weaknesses of the TCP / IP and can be performed on any computer that uses it, regardless of architecture or operating system used by the computer under attack. Unfortunately, the attack cannot be avoided with complex passwords, multifactor authentication (when more than one form of authentication is implemented to verify the transactions) or patches (fixes) in the software – thus compromising the confidentiality, integrity and application availability. Therefore, it is a very dangerous form of attack.

The attacks can be performed without the use of software tools, yet many attackers use them thanks to their availability and ease of use. Tools like “Juggernaut” to Linux, the “Hunt” for Unix and the “T-Sight”, for Windows, enables users to track network traffic and check for open ports on the server in order to identify vulnerabilities.

Large networks with many open communication sessions are the most likely targets for session hijacking attacks. TCP/IP, for example, requires authentication only at the moment a connection is established; thus, an established connection can be stolen easily. Nevertheless, other network protocols such as FTP and Telnet, do not implement any form of authentication. Indeed, FTP and Telnet transmit data in a completely unprotected form, which is known as “plain text”, and can be intercepted and read by anyone who monitor the network connection.

Because of all this vulnerable scenario, security policies and practices in the application server’s network need to be implemented effectively.

Monitoramento software packages, firewall and the application of strict policies on the use of network access and ensure that the risks of such an attack can be considerably minimized.

So that the risk is further minimized, human control is indispensable. So count on the expertise of a technician if security network ensures that important data is not lost.

Check out more content on our blog!
Learn all about Scriptcase.