Office 365, Amazon, Others Vulnerable To Exploit Microsoft Knew About In 2012

colinneagle writes "Ethical hacking professor Sam Bowne recently put a cookie re-use method to test on several major web services, finding that Office 365, Yahoo mail, Twitter, LinkedIn, Amazon, eBay, and WordPress all failed the security test. Both Amazon and eBay can be tied directly to your money via the method of payment you have on record. And, just for kicks, we tried it with Netflix. And it worked. Microsoft has apparently known that accounts can be hijacked since at least 2012 when The Hacker News reported the Hotmail and Outlook cookie-handling vulnerability, so Bowne was curious if Microsoft closed the hole or if stolen cookies could still be re-used. He claims he 'easily reproduced it using Chrome and the Edit This Cookie extension.'"

Re:They know how cookies work right?

[Antony T Curtis]

It looks like they're exporting, deleting and then reimporting cookies before the cookies are set to expire. They can then get back into the site they just had access to. I fail to see how this "exploit" isn't actually the expected behavior of a properly functioning login tracked with a cookie.

The complaint is that the expectation of "logging off" should invalidate existing cookies.

Re:They know how cookies work right?

[d00m.wizard]

Again, the issue is that the cookies don't seem to be tied to a unique session, and thus can be used by non-authorized parties if they are able to grab an instance of your session.

Re:They know how cookies work right?

[vux984]

Isn't that the websites problem?

Yes it is, that's why they reported it as a problem with Office 365, Netflix, Amazon, etc you know... websites.

Re:They know how cookies work right?

[Cramer]

Indeed. Except in this case the "logout" function simply instructs the browser to forget that cookie. Any machine that still has that cookie is still logged in. A logout should not only remove the cookie, but invalidate it's contents. Changing your password should invalidate every login immediately. Additionally, each "login" should create a different value.

If (when) someone gets ahold of that cookie, they will have access to the account until the thing expires (if ever.) You have no way to get them out of your account; a logout won't do it, changing your password won't do it. (not that they knew your password in the first place)

Re:What has this got to do with Microsoft?

[Spykk]

There aren't many situations where this vulnerability is relevant, but here is one:

You are logged into your Office 365 account in a coffee shop with unencrypted wifi. You happen to glance at another patrons computer only to realize that he has hijacked your session by sniffing the unencrypted session cookie that you are sending to the server every time you load a page! You quickly hit the logout button expecting your session to be invalidated, but the logout button only deleted the cookie local to your device. The guy who hijacked your session is still logged in and proceeds to send an email to your boss calling him a "nub".

Had Microsoft's service invalidated your session token on the server when you hit logout this disaster could have been avoided.

Bitlocker cracked since at least 2008

[raymorris]

There are three modes of operation possible with Bitlocker. The most secure has had an exploit publicly known for five years. In that most secure mode, reading the disk is inconvenient, but entirely possible even for independent security people like myself. For a nation-state, it's trivial.