Improving Web Application Security: Threats and - CGISecurity

Chapter 2: Threats and Countermeasures 31Cookie Replay AttacksWith this type of attack, the attacker captures the user’s authentication cookie usingmonitoring software and replays it to the application to gain access under a falseidentity.Countermeasures to prevent cookie replay include:● Use an encrypted communication channel provided by SSL whenever anauthentication cookie is transmitted.● Use a cookie timeout to a value that forces authentication after a relatively shorttime interval. Although this doesn’t prevent replay attacks, it reduces the timeinterval in which the attacker can replay a request without being forced to reauthenticatebecause the session has timed out.Credential TheftIf your application implements its own user store containing user account names andpasswords, compare its security to the credential stores provided by the platform, forexample, a Microsoft Active Directory® directory service or Security AccountsManager (SAM) user store. Browser history and cache also store user logininformation for future use. If the terminal is accessed by someone other than the userwho logged on, and the same page is hit, the saved login will be available.Countermeasures to help prevent credential theft include:● Use and enforce strong passwords.● Store password verifiers in the form of one way hashes with added salt.● Enforce account lockout for end-user accounts after a set number of retry attempts.●To counter the possibility of the browser cache allowing login access, createfunctionality that either allows the user to choose to not save credentials, or forcethis functionality as a default policy.AuthorizationBased on user identity and role membership, authorization to a particular resource orservice is either allowed or denied. Top threats that exploit authorizationvulnerabilities include:● Elevation of privilege● Disclosure of confidential data● Data tampering● Luring attacks