Convenience over safety: How authentication cookies compromise user account security on the web, 2014

Authentication cookies allow for convenient online user authentication, but potential security prob-lems may be encountered if a malicious adversary were able to obtain a given user’s authentication cookie. The Firefox add-on, Firesheep, and cross-site scripting methods have demonstrated that attackers are capable of achieving this goal. In this study, we hope to survey user logins across the Web in order to evaluate the vulnerability of user accounts on major websites and to gain insight on potential defenses. Our approach consists of running two browser profile instances per site: a primary crawler and a shadow crawler. For every website, the primary profile performs a legitimate login and saves the persistent cookies. The secondary profile loads the cookies and visits the same website. If the resulting webpage recognizes a user as having logged in, then the attack is considered successful. For different tests, the shadow crawler is instantiated on either the same computer as the primary crawler, or remotely, on a computer with a different browser fingerprint and IP address. The findings of this study show that on a large scale, many sites do not yet implement additional authentication factors once an authentication cookie is obtained. We see industry beginning to develop more secure systems, and hope to encourage further progress with our results. In addition, specialized Web security companies have emerged, using more sophisticated methods to protect user accounts that will require investigation. 1