Security Professional Identifies New Cookiejacking technique

Recently, an Italian security researcher identified a new cookiejacking technique, which exploits zero day vulnerability in all versions of Internet Explorer to extract confidential information.

Albuquerque, NM (prHWY.com) May 30, 2011 - Albuquerque, NM, United States - Recently, an Italian security researcher identified vulnerability in Internet Explorer (IE), which attackers may exploit to extract sensitive information related to Internet users. Rosario Valotta, identified a new cookiejacking technique, which he used to hijack cookies by bypassing the protection on IE. However, the attack requires user action to be successful. The researcher has termed the cookiejacking technique as an advanced clickjacking approach, which exploits zero day vulnerability. Attackers need to extract victim's username on Windows, identify the operating system in use. This helps attackers to determine the folders, which store the cookies. Attackers may then use clickjacking technique to place cookie text behind a picture. Again, fraudsters need to target cookie related to the website logged in by the user at the time of the attack. Attackers may exploit the vulnerability on all versions of IE including IE9 on any Windows operating system such as XP, Vista and even Windows 7. In this case, security researcher enticed Facebook users to play a game, which involves clicking, dragging and dropping. When users drag an object in the game to a picture, they inadvertently also send cookies to the fraudsters. Valotta was able to extract cookies of around 80 of his friends on Facebook within three days.

While the attack looks sophisticated, cybercriminals may extract the requisite information through browser exploits, javascript detection tools, and use social engineering techniques to make user perform a specific action. Web browsers use cookies to store site preferences and login credentials. Unwary Internet users often do not clear the cookies on the web browser. Some Internet users also check 'Remember my password' option or 'keep me logged in' option. Attackers may exploit the popularity of games on social networking sites to trick users into revealing sensitive information, without being aware of the malicious activity. Attackers may also attempt to steal confidential user information related to e-mail accounts, and online banking and shopping sites. Organizations must encourage employees to undertake e-learning and online degree programs on cyber security to avoid falling prey to social engineering attacks directed at stealing privileged business information. Cybercriminals may use the collected information to impersonate a legitimate user, conduct fraudulent transactions, and steal further personally identifiable information. Attackers may also leverage the victim's user name on Windows to gain remote access to a computer system.

Microsoft has reportedly described the latest security threat as not a high risk threat as successful attack requires high user interaction, visit to a malicious webpage, lured to drag and drop objects, and knowledge of the website, which the user is logged on to. However, security researchers at Trend Micro have argued that attackers may take advantage of negligence, and lack of security awareness among non-technical users to extract sensitive information through social engineering techniques. According to the Internet security firm, they block on an average around 13 million attempts by users to access malicious sites.

Developers must constantly identify the security flaws and initiate remediating measures to prevent their exploitation by attackers. The prevailing IT security scenario requires professionals to constantly enhance their skill sets and awareness through online university degree programs, and security conferences.

Internet users must refrain from clicking on links send by strangers, and be cautious while clicking links on websites. Deleting cookies, avoid clicking on 'remember my password' option, clearing browsing history may help protect Internet users from securing sensitive information. Internet users must avoid falling prey to playing enticing games and puzzles. Usually, professionals qualified in masters of security science and IT security certifications identify and warn users on latest security threats. Internet users must follow security blogs and advisories to abreast themselves of latest cyber threats.

Contact Press

EC-Council
Website: http://www.eccuni.us
Email: iclass@eccouncil.org
Tel: 505-341-3228

EC-Council University is based in Albuquerque, New Mexico and offers Master of Security Science (MSS) degree to students from various backgrounds such as graduates, IT Professionals, and military students amongst several others. The MSS is offered as a 100% online degree program and allows EC-Council University to reach students from not only the United States, but from all around the world.

EC-Council is a member-based organization that certifies individuals in cybersecurity and e-commerce skills. It is the owner and developer of 16 security certifications, including Certified Ethical Hacker (CEH), Computer Hacking Forensics Investigator (CHFI) and EC-Council Certified Security Analyst (ECSA)/License Penetration Tester (LPT). Its certificate programs are offered in over 60 countries around the world.

EC-Council has trained over 80,000 individuals and certified more than 30,000 members, through more than 450 training partners globally. These certifications are recognized worldwide and have received endorsements from various government agencies including the U.S. federal government via the Montgomery GI Bill, Department of Defense via DoD 8570.01-M, National Security Agency (NSA) and the Committee on National Security Systems (CNSS). EC-Council also operates the global series of Hacker Halted security conferences.

###

Tag Words: internet explorer, zero day vulnerability, cookiejacking, ie, clickjacking, cookies, internet security, web browser, windows xp, vista, facebook

Categories: Security

Link To This Press Release:

URL HTML Code