I’ve seen this from quite a few sources so it seems it’s fairly legitimate, it seems all major websites have some flaws in the way they implement cookies meaning they are vulnerable to certain types of attack.
The only current solution seems to be using full time SSL or https connections full-time, if any of you use gmail you’ve probably noticed it forces all logins through https now, but reverts back to http after it’s done logging you in.
The change is due to this problem.
If you use Gmail, eBay, MySpace, or any one of dozens of other web-based services, the United States Computer Emergency Readiness Team wants you to know you’re vulnerable to a simple attack that could give an attacker complete control over your account.
Five weeks after we reported this sad reality, US CERT on Friday warned that the problem still festers. It said the world’s biggest websites have yet to fix the gaping security bug, which can bite even careful users who only log in using the secure sockets layer protocol, which is denoted by an HTTPS in the beginning of browser address window.
US CERT warned that Google, eBay, MySpace, Yahoo, and Microsoft were vulnerable, but that list is nowhere near exhaustive. Just about any banking website, online social network or other electronic forum that transmits certain types of security cookies is also susceptible.
It seems pretty serious eh? And it’s definitely related to cookies. It seems there are some workarounds which can alleviate the majority of risk but only Google has implemented them.
Not surprising eh?
The vulnerability stems from websites’ use of authentication cookies, which work much the way an ink-based hand stamp does at your favorite night club. Like the stamp, the cookie acts as assurance to sensitive web servers that the user has already been vetted by security and is authorized to tread beyond the velvet rope.
The thing is just about every website transmits these digital hand stamps in the clear, which leaves them wide open to snoops monitoring public Wi-Fi traffic or some other type of network. Once attackers have the cookie, they gain complete access to the victim’s account, and depending on the way many cookies are crafted, those privileges may continue in perpetuity – even if the victim changes the account password.
So just be careful what you are doing online and where you are storing your important data, because things might not be as secure as you assume.
If you are using Google Apps (Gmail) and Firefox you can use the CustomizeGoogle Add-on to force full-time SSL connections, I’ve done this for a long time anyway.
Source: The Register