Researcher finds 'cookiejacking' flaw in Internet Explorer

By Chris Paoli

Connecting state and local government leaders

| May 31, 2011

Breach could occur if a hacker hijacks session cookies from users' visits to a Web site.

Social Media

Internet Explorer could be breached if a hacker hijacks session cookies from users' visits to a Web site, according to Italian security researcher Rosario Valotta.

In a process Valotta has coined "cookiejacking," the stolen data can be used to carry out a zero-day attack. Successfully compromised systems can be installed with malware, send messages or forge clicks. The researcher warns that this flaw affects all versions of Microsoft’s Internet browser.

The exploit only occurs when a user drags and drops an object across the PC screen. Valotta was able to test this by creating a Facebook game where users dragged articles of clothing to reveal an undressed photo of a woman.

"I published this game online on Facebook and in less than three days, more than 80 cookies were sent to my server, " Valotta told Reuters. "And I've only got 150 friends."

To be leveraged into a zero-day attack, a hacker would need to create an IFrame element in a Web site and have a user select the entire cookie. Using Valotta's Facebook demonstration as an example, the cookie would be hidden in the article of clothing object. Once a user drags the piece of clothing, this violates the browser’s cross-zone interaction policy, and allows the attacker access to the victim’s system.

To add another level of difficulty when performing this attack, the exploit involves hackers knowing a potential victim’s Windows username and which OS version is being used, before getting the user to select the entire content of the harmful cookie.

Microsoft is investigating the discovered flaw, but Microsoft spokesman Jerry Bryant believes there is little risk of vulnerability being exploited. "Given the level of required user interaction, this issue is not one we consider high risk," said Bryant.

Social media Case Studies

Browse The Atlas full case study database or read more case studies about Social media.

Forsyth County Sheriff’s Office powers up community engagement with the MySheriff mobile app.

Forsyth County, GA

Sheriff’s Office Expands Beyond Social Media for Public Safety Communications

Greene County, GA

Howey-in-the-Hills Saves $25,000 Per Year by Digitizing Agenda and Meeting Management

Howey-In-The-Hills, FL

BROWSE LOCAL GOV CASE STUDIES

NEXT STORY: Updating IT systems? These checklists help you do it right.

This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. / Do Not Sell My Personal Information

Accept Cookies