ITPEC IP October 2018 Question 33

Web service accounts are hijacked — a stolen cookie carries the victim's session ID, and presenting it lets the attacker use the web service as that user.

After a user logs in, the web server gives the browser a session ID in a cookie, and the browser sends it with every request so the user need not log in again. In cross site scripting, a script the attacker plants in a vulnerable site runs in the victim's browser, reads the cookie and sends it to the attacker. The attacker then sends the same cookie from their own browser, and the server takes them for the logged-in user: session hijacking. No password is needed, and they can read the victim's data, change settings or post and buy in the victim's name.

Answer (c)

Why not others:

• •(a) — a virus infects a PC through a malicious program or infected file being run; stealing a cookie takes data out of the browser and installs nothing
• •(b) — sending the PC's files outside needs malware running on the PC; a cookie gives access to the web service account, not to the files on the PC
• •(d) — intrusion over the wireless LAN exploits weak Wi-Fi security, such as a guessed encryption key, and has nothing to do with cookies

Key rule: To the server, whoever presents a valid session cookie is the logged-in user, so stealing the cookie hijacks the account without the password.

Security · AI-written, may contain errors