TY - GEN
T1 - SERENE
T2 - 12th IFIP International Conference on Distributed Applications and Interoperable Systems, DAIS 2012
AU - De Ryck, Philippe
AU - Nikiforakis, Nick
AU - Desmet, Lieven
AU - Piessens, Frank
AU - Joosen, Wouter
PY - 2012
Y1 - 2012
N2 - The web is the most wide-spread and de facto distributed platform, with a plethora of valuable applications and services. Building stateful services on the web requires a session mechanism that keeps track of server-side session state, such as authentication data. These sessions are an attractive attacker target, since taking over an authenticated session fully compromises the user's account. This paper focuses on session fixation, where an attacker forces the user to use the attacker's session, allowing the attacker to take over the session after authentication. We present Serene, a self-reliant client-side countermeasure that protects the user from session fixation attacks, regardless of the security provisions - or lack thereof - of a web application. By specifically protecting session identifiers from fixation and not interfering with other cookies or parameters, Serene is able to autonomously protect a large majority of web applications, without being disruptive towards legitimate functionality. We experimentally validate these claims with a large scale study of Alexa's top one million sites, illustrating both Serene's large coverage (83.43%) and compatibility (95.55%).
AB - The web is the most wide-spread and de facto distributed platform, with a plethora of valuable applications and services. Building stateful services on the web requires a session mechanism that keeps track of server-side session state, such as authentication data. These sessions are an attractive attacker target, since taking over an authenticated session fully compromises the user's account. This paper focuses on session fixation, where an attacker forces the user to use the attacker's session, allowing the attacker to take over the session after authentication. We present Serene, a self-reliant client-side countermeasure that protects the user from session fixation attacks, regardless of the security provisions - or lack thereof - of a web application. By specifically protecting session identifiers from fixation and not interfering with other cookies or parameters, Serene is able to autonomously protect a large majority of web applications, without being disruptive towards legitimate functionality. We experimentally validate these claims with a large scale study of Alexa's top one million sites, illustrating both Serene's large coverage (83.43%) and compatibility (95.55%).
KW - security
KW - session fixation
KW - web applications
UR - https://www.scopus.com/pages/publications/84862731352
U2 - 10.1007/978-3-642-30823-9_5
DO - 10.1007/978-3-642-30823-9_5
M3 - Conference contribution
AN - SCOPUS:84862731352
SN - 9783642308222
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 59
EP - 72
BT - Distributed Applications and Interoperable Systems - 12th IFIP WG 6.1 International Conference, DAIS 2012, Proceedings
Y2 - 13 June 2012 through 16 June 2012
ER -