CAPEC-59 Session Credential Falsification through Prediction

This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

1. [Explore] [Find Session IDs] The attacker interacts with the target host and finds that session IDs are used to authenticate users. 2. [Explore] [Characterize IDs] The attacker studies the characteristics of the session ID (size, format, etc.). As a results the attacker finds that legitimate session IDs are predictable. 3. [Experiment] [Match issued IDs] The attacker brute forces different values of session ID and manages to predict a valid session ID. 4. [Exploit] [Use matched Session ID] The attacker uses the falsified session ID to access the target system.

• The target host uses session IDs to keep track of the users. • Session IDs are used to control access to resources. • The session IDs used by the target host are predictable. For example, the session IDs are generated using predictable information (e.g., time).

• [Low] There are tools to brute force session ID. Those tools require a low level of knowledge. • [Medium] Predicting Session ID may require more computation work which uses advanced analysis such as statistical analysis.

• Confidentiality, Access Control, Authorization: Gain Privileges

• Use a strong source of randomness to generate a session ID. • Use adequate length session IDs • Do not use information available to the user in order to generate session ID (e.g., time). • Ideas for creating random numbers are offered by Eastlake [RFC1750] • Encrypt the session ID if you expose it to the user. For instance session ID can be stored in a cookie in encrypted format.