Page 287 - StudyBook.pdf

Communication Security: Web Based Services • Chapter 5 271

As seen in Figure 5.7, you can view and edit the contents of a cookie using any
text editor. Despite the warning messages that may appear when you try to open a
cookie, they are simply text files that contain information. Unfortunately, this also
means that any information in the file can be read and altered by a hacker. In addi-
tion to this, since the format of a cookies name is username@domain.txt, looking at
the cookies on a machine allows you to gleam an overall picture of you and your
habits. For example, by looking at Figure 5.7, you can see that a person using the
“administrator” account on the computer visited www.experts-exchange.com. By
opening the cookie, you can also see that this person went to the site through a
link from Google while searching for “Looking for new job.” Even a cursory
examination of a cookie can provide a significant amount of information about the
person using this machine, and their browsing habits.

Figure 5.7 Contents of a Cookie

Being able to modify cookies is the means of another type of attack called
cookie poisoning. Because cookies are supposed to be saved to a computer so that the
site can later read the data, it assumes this data remains unchanged during that time.
However, if a hacker modified values in the cookie, inaccurate data is returned to
the Web server. For example, imagine that you were purchasing some items online,
and added them to a shopping cart. If the server stored a cookie on your computer
and included the price of each item or a running total, you could change these
values and potentially be charged less than you were supposed to.
Another problem with information stored in a cookie is the potential that the
cookie can be stolen. Since it is expected that a cookie will remain on the com-
puter it was initially stored on, a server retrieving the data from it assumes its
coming from the intended computer.A hacker could steal a cookie from your
machine and put it on another one. Depending on what was in the cookie, the
cookie theft would then allow them to access a site as if they were you.The Web
server would look at the cookie information stored on the hacker’s computer, and
if it contained a password, it would give the attacker access to secure areas. For
example, if the site had a user profile area, the hacker could view your name,
address, credit card numbers, and any other information stored in the profile.

www.syngress.com