Forest Global Training Partners

Cyber Risks · The Hacker News

Session Cookie Theft: You Showed Your ID at the Door. But Someone Else Has Your Room Key

Summary: Session cookie theft lets an attacker replay a stolen token from their own browser and reach an application without a username, password, or MFA prompt, because the application checks the token rather than the credentials after login. Infostealers sold on underground markets for tens to hundreds of dollars a month harvest these tokens from browser local storage within minutes, running as the current user without administrator access, and the stolen sessions are then sold on dark web marketplaces. The article notes that many organizations have never reviewed their session lifetime settings, which are often configured for 8 hours, 12 hours, or longer.

Bottom line: MFA protects only the login event, so a token stolen after an MFA-verified login stays valid for the full session window - 8, 12 hours or more - and no login event fires and no alert triggers when it is replayed. An infostealer costing tens of dollars a month can pull tokens for email, cloud storage, corporate SaaS tools, and identity security providers in minutes.

Read the original at The Hacker News ↗

Topics
Identity & Access Management
Related