“C is for Cookie, that’s good enough for me.” – Cookie Monster

While I may not agree with all of Cookie Monster’s ideas, he does have one thing unquestionably right: Cookies. We all love them. Who doesn’t? Anyone who doesn’t love cookies is not to be trusted. There is, however, a genus of actors that both love cookies and are not to be trusted. Those actors are known as “hackers.” Sound familiar? That’s right. Hackers will steal your cookies and use them to access your secure and private information! What is the world coming to….

To explain Cookie Spoofing, we must also cover the larger group of attacks that it falls into, known as Session Spoofing. Session Spoofing is enacted when a highly qualified specialist actor obtains the identifiers (TCP Sequence Number and TCP Acknowledgement Number) of a user’s active web service session. The actor can then use the current identifiers to create a falsified data packet which can be sent from any internet connection to fool the service that the actor’s session is a legitimate session, providing the actor with access control of whatever credentials the user was implementing. Session Spoofing is rarely used by modern actors, as OS providers have developed defenses against these attacks; however, some estimates put the number as high as 35% of modern systems still being vulnerable to Session Spoofing.

Spooky, right? Like evil Cosplayers, Session Spoofers extract the useful information from your unencrypted data flows and use it to stitch together a digital You-Suit!

Cookie Spoofing is a specialized form of Session Spoofing. Also known as “Session Hijacking” or “Cookie Side-Jacking,” the Cookie Spoof attack utilizes the service-set cookie to fraudulently take over a user’s session, most commonly applying to browser sessions or web applications.

How do they do this?

In most cases, when a user logs into a web application, the server sets a temporary session cookie in the user’s browser to remember that the user is currently logged in and authenticated. The actor need only obtain the victim’s session ID, which is stored in the cookie. This information can be obtained through two primary means: “packet-sniffing” (the grabbing of unencrypted network data through the use of a NIC in Monitor mode) or using a Notification Spoof. The Notification Spoof, which falls under Cross-Side Scripting (XSS), is the most common method of performing the Cookie Spoof attack. An actor injects client-side scripts into a web page to execute arbitrary code upon loading the compromised page. This arbitrary code produces a false notification (YOUR COMPUTER IS INFECTED WITH 23 VIRUSES!!!!!) to trick the user into clicking on a malicious link with a pre-set session ID. The actor can then use the stolen session ID for their browser session, which will trick the server into believing the actor’s session is legitimate, enabling the actor to perform any functions the user would have been authorized to perform (such as accessing secure documents, sending emails, or even transferring money or making credit card purchases!).

How do you defend yourself against these attacks?

For packet-sniffing, the solution is as simple as using a VPN whenever you connect to a network. This ensures that your traffic is encrypted, which will make it largely useless to a bad actor.

For defending against Cross-Side Scripting, however, you just need to be wary. Your Operating System will typically warn your of insecure websites. Heed that warning, and walk the other way. If a website asks you to “enable this” or “install that” to view their content, err on the side of caution and conclude that you didn’t REALLY need to see that 5,000th cat picture of the day, even IF the thumbnail looks super-adorable.

Avoiding the Cookie Spoof attack is as simple as being mindful of where you are, what you are connected to, and where your data is going!

That’s it!