Improving Web Application Security: Threats and - CGISecurity

Chapter 2: Threats and Countermeasures 37Countermeasures to help address the threat of session replay include:●●●Re-authenticate when performing critical functions. For example, prior toperforming a monetary transfer in a banking application, make the user supplythe account password again.Expire sessions appropriately, including all cookies and session tokens.Create a “do not remember me” option to allow no session data to be stored on theclient.Man in the Middle AttacksA man in the middle attack occurs when the attacker intercepts messages sentbetween you and your intended recipient. The attacker then changes your messageand sends it to the original recipient. The recipient receives the message, sees that itcame from you, and acts on it. When the recipient sends a message back to you, theattacker intercepts it, alters it, and returns it to you. You and your recipient neverknow that you have been attacked.Any network request involving client-server communication, including Webrequests, Distributed Component Object Model (DCOM) requests, and calls to remotecomponents and Web services, are subject to man in the middle attacks.Countermeasures to prevent man in the middle attacks include:● Use cryptography. If you encrypt the data before transmitting it, the attacker canstill intercept it but cannot read it or alter it. If the attacker cannot read it, he or shecannot know which parts to alter. If the attacker blindly modifies your encryptedmessage, then the original recipient is unable to successfully decrypt it and, as aresult, knows that it has been tampered with.● Use Hashed Message Authentication Codes (HMACs). If an attacker alters themessage, the recalculation of the HMAC at the recipient fails and the data can berejected as invalid.CryptographyMost applications use cryptography to protect data and to ensure it remains privateand unaltered. Top threats surrounding your application’s use of cryptographyinclude:● Poor key generation or key management● Weak or custom encryption● Checksum spoofing