{"id":222,"date":"2021-02-02T20:02:48","date_gmt":"2021-02-02T20:02:48","guid":{"rendered":"https:\/\/fde.cat\/?p=222"},"modified":"2021-02-02T20:02:50","modified_gmt":"2021-02-02T20:02:50","slug":"how-salesforce-helps-protect-you-from-session-hijacking-threats","status":"publish","type":"post","link":"https:\/\/fde.cat\/index.php\/2021\/02\/02\/how-salesforce-helps-protect-you-from-session-hijacking-threats\/","title":{"rendered":"How Salesforce Helps Protect You From Session Hijacking Threats"},"content":{"rendered":"

Co-authors: Ping Yan and Yuly\u00a0Tenorio<\/em><\/p>\n

\"\"<\/figure>\n

Background on Session Hijacking<\/strong><\/p>\n

All communication on the internet happens over a set of standards called TCP\/IP (Transmission Control Protocol\/Internet Protocol). They are the World Wide Web\u2019s core communication system that enables Internet-connected devices to communicate simultaneously with each other. This system lays the groundwork over which higher level protocols such as HTTP and FTP operate and is necessary to transport data packets over the internet. ARPANET adopted TCP\/IP on January 1, 1983. <\/strong>From there, researchers began to assemble the \u201cnetwork of networks\u201d that became the modern internet.<\/p>\n

While the protocols accelerated the growth of modern communication, they also offered certain characteristics that malicious attackers could take advantage of, such as their statelessness<\/em>. Every time you type in a URL or log into a website, a session <\/em>is established between you (the client) and the website (the server). To make this communication efficient, sessions are often maintained by servers until you log out or are inactive for a period of more than 30 minutes. This way, servers can handle requests originating from the same user efficiently. But this also leads to a type of attack called session hijacking, <\/strong>also known as cookie theft, in which an attacker takes control of a user\u2019s\u00a0session.<\/strong><\/p>\n

\"\"<\/figure>\n

According to application vulnerability trends report 2014, 79% of web applications are susceptible to this session management vulnerability[1]. Even in the recent application vulnerability report from Trustwave[2], authentication bypass using session hijacking is at 5.1% of all the critical vulnerabilities, second only to unpatched Windows systems, which constituted 10.8% of critical vulnerabilities.<\/p>\n

How Attackers Steal Session Identifiers<\/strong><\/p>\n

Session identifiers are often randomly created by the server using timestamp, IP address, and some predictable fields. If an attacker somehow gets access to a session ID, they can get complete access to the user\u2019s session. What does this mean? It means they have opened Pandora\u2019s box. They can escalate their privileges, exfiltrate data, sell the credentials on the dark web, and\u00a0more.<\/p>\n

This attack is possible because authentication is performed only at the beginning of a user session. Therefore, if an attacker gets access to the session identifier after the session is established, then the attacker can perform malicious actions. Attackers can gain access to the session identifiers in one of the following ways:<\/p>\n