Client-Side HTTP Cookie Security: Attack and Defense
David Wyde details slides: Client-Side HTTP Cookie Security: Attack and Defense David Wyde SOFTWARE ENGINEER, CISCO HTTP cookies are an important part of trust on the web.
Summary
Architecture and Background
Slides: Client-Side HTTP Cookie Security: Attack and Defense David Wyde SOFTWARE ENGINEER, CISCO HTTP cookies are an important part of trust on the web. Users often trade their login credentials for a cookie, which is then used to authenticate subsequent requests.
Vulnerability Analysis
Cookies are valuable to attackers: passwords can be fortified by two-factor authentication and "new login location detected" emails, but session cookies typically bypass these measures. This talk will explore the security implications of how popular browsers store cookies, ways in which cookies can be stolen, and potential mitigations.
Exploitation and Demonstrations
David Wyde is a security researcher at Cisco Systems, with a background in web application development. His favorite type of cookie is double chocolate chip, but HTTP cookies are a close second.
Remediation and Defensive Strategies
When he's not working with software, he enjoys playing chess, dodgeball, ping pong, and N64 Super Smash Bros. Website:
Related talks
Main Stage·18 min
Dongsung Kim
Demonstrates browser-based internal network port scanning using precise JavaScript timing side-channels to map intranet devices without elevated privileges.
Main Stage·35 min
Vangelis Stykas
Vangelis Stykas demonstrates how typical web application flaws in abandoned malware C2 infrastructure allow researchers to compromise admin panels and identify threat actors.
Main Stage·40 min
Dongsung Kim
Dongsung Kim demonstrates how modern browser features and emerging Web APIs can be chained to resurrect Cross-Site Request Forgery (CSRF) despite SameSite cookies.