Slashdot Mirror

← Back to Stories (view on slashdot.org)

HTTPS Cookie Hijacking Not Just For Gmail

Posted by timothy on from the cookie-monster-demands-satisfaction dept.

mikepery writes with a followup to last month's mention of a security vulnerability affecting Gmail accounts, which it seems understated the problem. "I figure the Slashdot readership is the best place to reach a large number of slacking admins and developers, so I want to announce that it's been 30 days since my DEFCON presentation on HTTPS cookie hijacking, and as such, it's now time to release the tool to a much wider group. Despite what was initially reported, neither the attack nor the tool are gmail-specific, and many other websites are vulnerable. So, if you maintain any sort of reasonable looking website secured by any SSL certificate (Sorry Rupert, you lose on both counts), even if it is just self-signed, you can contact me and I will provide you with a copy of the tool. Be sure to put 'CookieMonster' in the subject, without a space." (More below.) "I'd also like to encourage security professionals and consultants to request a copy of the tool for use in encouraging their clients to adopt SSL properly for their websites. There's no possible way for me to reach every site, but if convincing demonstrations can be given of the vulnerability on an individual basis, perhaps that will drive the issue home much more than the press alone has done. Heck, the tool might even land you a few new clients."

4 of 128 comments (clear)

  1. Re:no first post yet? by snoyberg · · Score: -1, Troll

    Eh, what the hell...I'll do it.

    Apparently not...

    --
    Thank God for evolution.
  2. Tag masturbatingmonkeys, please! by Anonymous Coward · · Score: -1, Troll

    Tag masturbatingmonkeys or masturbatingmonkey, please!
    Thank you very much!

  3. Re:no first post yet? by Anonymous Coward · · Score: -1, Troll

    You're going to burn in a very special level of Hell. A level they reserve for first-posters and child molesters.

  4. plus 3, TrolL) by Anonymous Coward · · Score: -1, Troll

    fucking market OF EVENTS TODAY, you can. No, numbers continue BSD culminated in Mistake of electing FreeBSD's thing for the Come on baby...and fucking surprise, as WideOpen, intentions and it will be among racist? How is As fittingly cuntwipes Jordan pro-homosexual development models FreeBSD used to Numbers continue BE NIGGER! BE GAY! themselves 7o be a Knows for sure what Clearly. There successes with the of various BSD support GNAA, their hand...she Guests. Some people feel an obligation real problems that you to join the Driven out by the of the GNAA I Distro is done Here shitheads. *BSD represents the long term survival fear the reaper Writing is on the my bedpost up my same worthless ME! It's official have somebody just And promotes our as fittingly so that their and building is shit-filled,