The Cracked Cookie Jar: HTTP Cookie Hijacking and the Exposure of Private Information Suphannee Sivakorn∗, Iasonas Polakis∗ and Angelos D. Keromytis Department of Computer Science Columbia University, New York, USA fsuphannee, polakis, [email protected] ∗Joint primary authors Abstract—The widespread demand for online privacy, also the necessity of securing web connections from prying eyes. fueled by widely-publicized demonstrations of session hijacking The publicity garnered by the Firesheep extension [1], which attacks against popular websites, has spearheaded the increasing demonstrated how easily attackers can hijack a user’s session, deployment of HTTPS. However, many websites still avoid ubiq- uitous encryption due to performance or compatibility issues. The was a catalyst in expediting migration of critical user activity prevailing approach in these cases is to force critical functionality to mandatory HTTPS connections in major services (e.g., and sensitive data access over encrypted connections, while transmitting user credentials during the log-in process). allowing more innocuous functionality to be accessed over HTTP. Nonetheless, many major websites continue to serve content In practice, this approach is prone to flaws that can expose over unencrypted connections, which exposes the users’ HTTP sensitive information or functionality to third parties. In this paper, we conduct an in-depth assessment of a diverse cookies to attackers monitoring their traffic. Not enforcing set of major websites and explore what functionality and infor- ubiquitous encrypted connections may be attributed to various mation is exposed to attackers that have hijacked a user’s HTTP reasons, ranging from potential increases to infrastructure costs cookies. We identify a recurring pattern across websites with and the loss of in-network functionality [2] to maintaining partially deployed HTTPS; service personalization inadvertently support for legacy clients. If access control policies correctly results in the exposure of private information. The separation of functionality across multiple cookies with different scopes separated privileges of authenticated (e.g., session cookies) and inter-dependencies further complicates matters, as imprecise and non-authenticated cookies (e.g., persistent tracking cook- access control renders restricted account functionality accessible ies), stolen HTTP cookies would not allow attackers to obtain to non-session cookies. Our cookie hijacking study reveals a any personal user information. However, that is not the case number of severe flaws; attackers can obtain the user’s home in practice [3], and things become worse as services continue and work address and visited websites from Google, Bing and Baidu expose the user’s complete search history, and Yahoo to sacrifice security over usability. Websites assign privileges allows attackers to extract the contact list and send emails from to HTTP cookies to personalize functionality, as it improves the user’s account. Furthermore, e-commerce vendors such as user experience, but avoid requesting re-authentication unless Amazon and Ebay expose the user’s purchase history (partial absolutely necessary, as it impacts user engagement. While and full respectively), and almost every website exposes the session hijacking has been extensively explored, limited at- user’s name and email address. Ad networks like Doubleclick can also reveal pages the user has visited. To fully evaluate the tention has been given to the privacy risks of non-session practicality and extent of cookie hijacking, we explore multiple cookies being hijacked; Castelluccia et al. [4] demonstrated aspects of the online ecosystem, including mobile apps, browser how stolen HTTP cookies could allow attackers to reconstruct security mechanisms, extensions and search bars. To estimate a user’s Google search history. the extent of the threat, we run IRB-approved measurements A subset of the problem we explore has been highlighted in on a subset of our university’s public wireless network for 30 days, and detect over 282K accounts exposing the cookies studies that measured the exposure of personal or personally required for our hijacking attacks. We also explore how users identifiable information (PII) in unencrypted traffic [5]–[8]. can protect themselves and find that, while mechanisms such as However, those studies are limited by nature and do not the EFF’s HTTPS Everywhere extension can reduce the attack capture the full extent of the privacy threat that users face surface, HTTP cookies are still regularly exposed. The privacy due to unencrypted connections. First, modern websites are implications of these attacks become even more alarming when considering how they can be used to deanonymize Tor users. Our highly dynamic and information can be fetched in obfuscated measurements suggest that a significant portion of Tor users may form and constructed on the client-side at runtime. Second, currently be vulnerable to cookie hijacking. websites may only serve private information over encrypted connections, while flawed access control separation renders I. INTRODUCTION that information accessible to HTTP cookies (we demonstrate With an ever-increasing part of our everyday life revolving this with Google Maps exposing a user’s address in Google around the Internet and a large amount of personal data Search). Third, eavesdropping is limited to the user’s actions being uploaded to services, ensuring the privacy of our digital for a specific time window, and certain pieces of information communications has become a critical and pressing matter. In require specific actions to be exposed, which may not occur the past few years, there has been much discussion regarding during the monitoring period. Fourth, we find that stolen HTTP cookies can also access account functionality, both explicitly Overall, our goal is twofold. First, to alert developers (e.g., send an email from the user’s account) and implicitly of the pitfalls of partially enforcing HTTPS while offering (e.g., receive personalized query results from a search engine). personalized functionality. Second, to inform users about the In this paper, we explore the extent and severity of the un- protection offered by popular security and privacy-enhancing safe practice followed by major services of partially adopting systems and the caveats of not knowing the precise extent of encrypted connections, and its ramifications for user privacy. their protection. The main contributions of this paper are: We demonstrate how HTTP cookie hijacking attacks not only • We conduct an in-depth study on the impact and gravity enable access to private and sensitive user information, but can of HTTP cookie hijacking attacks against major services. also circumvent authentication requirements and gain access Our findings demonstrate that a wide range of private to protected account functionality. To our knowledge, this information and protected account functionality is acces- is the first in-depth study exploring the privacy implications sible. The diversity of these websites suggests that this is of partial adoption of HTTPS. We audit 25 major services, a widespread systemic risk of unencrypted connections, selected from a variety of categories that include search and not a topical threat against a specific class of sites. engines and e-commerce sites. In each case, we analyze the • Our measurement study demonstrates the extent of the use of HTTP cookies, the combination of cookies required to risk; we monitor part of our university’s public wireless expose different types of information and functionality, and network over the course of one month, and identify search for inconsistencies in how cookies are evaluated. This over 282K user accounts that exposed the HTTP cookies allows us to obtain a comprehensive understanding of the required for the hijacking attacks. feasibility and impact of this class of attacks in practice. We • Our analysis on the collateral exposure of cookies shows uncover flaws in major websites that allow attackers to obtain that browser extensions, search bars, and mobile apps of a plethora of sensitive user information and also to access major vendors expose millions of users to risk. protected account functionality. As a precautionary measure, • We explore how HSTS can impact HTTP cookie hi- we conduct all experiments on our personal or test accounts. jacking. We demonstrate that partial deployment renders We conduct an IRB-approved measurement study on a sub- the mechanism ineffective, as a single unencrypted con- set of our university’s public wireless network, to understand nection may be sufficient for an attacker to obtain the the browsing behavior of users when connected to unprotected required cookies. public networks. On average, we detect more than 8K unique • We describe how major websites can be used as accounts exposing their cookies for hijacking each day. Our deanonymization vectors against users that rely on the Tor measurements have the sole purpose of estimating the number bundle for anonymity, and find that existing mechanisms of users that are susceptible to hijacking attacks; we do not cannot adequately protect users. access any user accounts, collect any personal information, • We disclosed our findings to the services we audited or attempt to deanonymize any users. and the Tor community, in an effort to assist them in Furthermore, we look at multiple practical aspects of cookie protecting their users from this significant privacy threat.