Hello and welcome to
another application of the minor
attack framework discussion
today we're going to be looking at
still obsession cookie as
it's listed in minor or stealing
websites and cookies.
So the objectives for today
are as follows.
We're going to describe what
steelwork obsession Cookie is with
respect to that vector in the
Mannatech framework.
So mitigation techniques and
some detection techniques.
So let's go ahead and jump right
in.
So still, Obsession Cookie is
a Web application or service
session. Cookie can be used
by a thread actor to gain
access to the application
or Internet service without needing
to authenticate other places.
Cookies can be found or on the disk
in memory and in network traffic
for sessions.
And so that's why a lot of times you
hear about things like Berp Suite
and other tools being
used to proxy
in between something to do like a
man in the middle and capture cookie
information.
Sex session cookies can
be used to bypass some multifactor
authentication protocols.
So that's a good note to have.
Now, there is an open source
framework in this case.
We're just looking at one, but
there are a number of other ones.
But we're just going to talk about
evil Jinkx, too, in this case.
And so this is a standalone
man in the middle attack framework
used for fishing login credentials
along with session cookies.
And so there are a number of other
ones out there.
But essentially there are ways in
which threat actors can
deceive an end user from making a
connection to a bad site
or essentially
putting something up again between
the site, the legitimate site and
the user to scrape credentials
and get session information
now. So mitigation techniques
here, a physical site,
second factor key that uses
the target login domain as part of
the negotiation protocol will
prevent session cookie theft through
proxy methods, forced
browsers to delete persistent
cookies, and then end user training
to look for phishing and other
credential gathering techniques.
As big here as well.
I've seen a number of systems
like Office 365 that
has some functions where if you are
in one state and you magically
log in in another state or
China or out of the country, it
will scratch its head and tell you
that this cannot be possible.
You cannot be in two places at once
and it will not allow
that login to occur.
Now, some detection
techniques. We can look for
repository access on local systems
used to store browser
cookie seargent session
cookies. And so, like in Chrome,
your user's username, Abdala
local Google Chrome user data
default is a location for cookies.
And then in Mozilla, cookies are all
stored in the cookies, not obscure
like file monitor for
attempts to inject into or don't
browser process memory.
So whether we're looking
in these areas for access or
manipulation as far as against
these particular browsers, or
if we're looking for attempts to
skim cookies out of memory or out
of browser information,
those are all great ways to kind of
detect when a threat actor may be
doing something nefarious.
So let's do a quick check on
learning, true or false,
still in Web session.
Cookies, in some cases will allow
the threat actor to bypass
multifactor authentication.
All right, well, if you need more
time, please pause the video.
So in this case, this is a true
statement. There are some
cases where stealing websites
and cookies will allow a threat
actor to bypass multifactor
authentication. So that is a true
statement summary.
So today's summary is as followed.
We describe Web session, cookie
stealing and what that is.
So essentially you authenticate
against the website and a threat
actor is able to intercept that
communication and steal that token,
that cookie, and they can then use
that to replicate the session and
log in as you we reviewed
some mitigation techniques.
We talked about some detection
techniques, again,
monitoring areas where cookie
information is stored, when those
are accessed, looking for scraping
techniques and things of that
nature, as well as
implementing the factor in some
cases can help to mitigate
the use of cookies to
steal a session.
So with that in mind, I want to
thank you for your time today, and I
look forward to seeing you again
soon.