16 ms·
Ok, plausible attack I thought up based on what I could suck up from homakov's and various other posts: 1. User is browsing an HTTPS Django site and a HTTP sit
by antihero 13y ago
Ok, plausible attack I thought up based on what I could suck up from homakov's and various other posts:
1. User is browsing an HTTPS Django site and a HTTP site on WiFi.
2. Hacker is MITMing a connection (on WiFi), cannot decrypt SSL.
3. Changes user's CSRF token for Django via cookie-forcing.
4. Hacker can now use user's other HTTP session, and inject JS (or whatever) so their browser sends stuff to the HTTPS Django site, fully knowing their CSRF token (because we set it) and thus can forge requests easily.
Does Django mitigate something like that already? I think should be pretty easy to mitigate by using Django's signing to sign the session ID or something into the CSRF token?
- donaldstufft 13y agoAn unrelated HTTP session cannot set a cookie for another domain (unless it's a subdomain in which you have the more serious issue of session theft or session fixation). The solution to both of these problems is HSTS with the includeSubDomains option.
- antihero 13y agoExcept we can set the cookie because we're already doing that to HTTPS requests via cookie-forcing.
- donaldstufft 13y agoI've just woken up and I haven't tested it, but off the cuff I believe HSTS will prevent the browser from trusting a plaintext HTTP response at all. So you cannot force a cookie if I understand the blog post correctly. You'd have to create a cookie inside of a verifiable HTTPS connection, which if you can do you've already executed a much worse attack.
- homakov 13y ago> but off the cuff I believe HSTS will prevent the browser from trusting a plaintext HTTP response at all Cookies are broken (i write about it on my blog like, daily). The essential idea of Forcing is injecting cookies into HTTPS space from HTTP.
- donaldstufft 13y ago@homakov, so you can get a browser to trust a cookie from a HTTP response under a domain protected by HSTS?
- antihero 13y agoDoesn't HSTS just mean that the browser will just always make HTTPS responses?
- antihero 13y agoI think this is what it hinges on: http://scarybeastsecurity.blogspot.com.es/2008/11/cookie-forcing.html http://scarybeastsecurity.blogspot.com.es/2008/11/cookie-for... Is that possible under HSTS?
- homakov 13y ago1) simulate request to http(NOT SECURE)://site.com 2) simulate response with Set-Cookie: csrf_token=123123; > unless it's a subdomain in which you have the more serious issue of session theft or session fixation elaborate plz? From what I know, subdomain can only do same attack (cookie tossing). Are you talking about phishing?