Twitter cookie fail + FireSheep

while playing with FireSheep (http://goo.gl/yEcU) I discovered something a bit disturbing about twitter...

Category:

Science & Technology

Tags:

• cybersecurity
• computer hacks
• hacking
• hacks
• twitter
• cookies

[xxdigipiratexx]

Lots of sites don't destroy cookie data on logout, only destroy the current session in the current browser, but saved cookies(ala firesheep) will revalidate the session if they don't do date/time stamps or even IP checks.

Thats kind of the point of firesheep, to do some drive by session stealing, and then take the cookies home with you to login from another place. I know the Hak5 forums do IP and agent checks, so if someone stole the cookies but came in from another IP you have to login again

[mubix]

@xxdigipiratexx it was my understanding that when a 'sign out' or 'log out action occurs that token or session ID should be invalidated on the back end. I realize thats not always the case, but do we really teach CS majors that leaving authentication tokens laying around a database is a ok idea?

[xxdigipiratexx]

Not sure what you are trying to show, but firesheep obviously saved the cookies and used them again to login as you. Twitter isn't using unique session data, which looks to me like you can save the cookies and take them with you anywhere to login again and again. Lots of sites fail to use unique cookie data per session. Or am I missing another point you were trying to make in the video?

[mubix]

@xxdigipiratexx I'm trying to demonstrate that their signout procedure doesn't invalidate the session like it should

[DarkStar851]

@mubix The session ID is likely held to your account's row until the next login, where it would be regenerated dynamically and the row updated. It's common practice, as most end-users don't touch the cookies. They're relying on human stupidity for security, which is NEVER a good idea. Oh well, no worse than the XSS exploit in New Twitter not too long ago. Got a lot of cookies that day. ;-]

[xxdigipiratexx]

I don't know what they teach in school for for computer science, but what I do know is, there are multiple vulns in not just cookies, but even php session data. I've seen implementations that show the php session data in the referrer urls from server logs, where the hash was enough to be used to login as the user when combined with their email or signon for the sites. You can also copy cookies to the clipboard to use in other browsers with simple javascript from the address bar.