Can you give me an example of a session fixation attack?

Question

I have read about session fixation and from what I understand it forces a user to use an attacker's session. Is this correct? Can you give me an example of how this could offend the user?

Caucasus

Answer 1

I don't usually like to post links to Wikipedia, but here's a link to a very good explanation on Wikipedia...

Here's the meat of it:

• Alice has an account at the bank http://unsafe/. Unfortunately, Alice is not very security savvy.

• Mallory is out to get Alice's money from the bank.

• Alice has a reasonable level of trust in Mallory, and will visit links Mallory sends her.

  1. Mallory has determined that http://unsafe/ accepts any session identifier, accepts session identifiers from query strings and has no security validation. http://unsafe/ is thus not secure.
  2. Mallory sends Alice an e-mail: "Hey, check this out, there is a cool new account summary feature on our bank, http://unsafe/?SID=I_WILL_KNOW_THE_SID". Mallory is trying to fixate the SID to I_WILL_KNOW_THE_SID.
  3. Alice is interested and visits http://unsafe/?SID=I_WILL_KNOW_THE_SID. The usual log-on screen pops up, and Alice logs on.
  4. Mallory visits http://unsafe/?SID=I_WILL_KNOW_THE_SID and now has unlimited access to Alice's account.

Pentahedron

@Pentahedron This would mean that if the bank site does create session ids , and do nout just accept any session id ,then this attack is not possible or am I missing some thing here ? – Pulpiteer

Even if the bank only accepts IDs that it generated, Alice is not safe. Mallory can visit the bank's site to obtain a bank-generated session ID, and then use that in the link that he sends to Alice. See the linked Wikipedia article for details on how to defend against session fixation attacks. – Pentahedron

@Pentahedron and the bank would generate a new session id... Am I missing something here? – Ratel

Wait. I think I get it. Sorry. But this means the bank doesn't issue a token but that it grants permissions to the session when somebody logs in. Which is silly. – Ratel

I do understand this, but I don't get the key thing, that is, how does "unsafe" server know this is Alice? Does Alice send any cookie with the SID, or she specifies it in the query string? Why Mallory does not just get the Alice's SID? – Drews

@Adam: "accepts any session identifier" ... "Alice logs on" – Pentahedron