Re: [http-state] cake and session stealing

[Adam Barth <[e-mail]>]

On Tue, Jul 27, 2010 at 10:27 AM, Thomson, Martin
<[e-mail]> wrote:
>> > That's where my concern arose.  An attacker that is playing MITM can
>> simply use their own cake.  Are we basically looking for something with
>> basically "leap of faith" characteristics?
>>
>> There's no leap of faith.  How does the MITM alter the cake in the TLS
>> tunnel?
>
> We were talking about the step from unsecured TCP to TLS.  The problem was that state accumulated prior to this step is attributed to the client.

There is no insecure step from TCP to TLS.

> Cake ensures that the same client can be identified.
>
> If you have a MITM, then you can do this:
>
> Accept the client cake C and forward their requests on using a different cake F.  State A is established against cake F.
>
> In parallel, establish desired state against cake C.  Then when the client hops to a secured connection, they start using your desired state.

There's a separate cake for every origin.  In particular, there's a
separate cake for http://bank.com and https://bank.com.  There is no
way for the attacker to learn or overwrite the cake for
https://bank.com.  That means whatever stateful interaction the user
has with the server on https://bank.com is protected from the
attacker.

Of course, the attacker can have their own stateful interaction with
https://bank.com, but that will be with their own cake and won't
interfere with the user's interaction with https://bank.com.

> The only solution I see to this is to treat anything that comes in on an unsecured connection as suspect.  Online shopping services do this - you build a cart, but they confirm again on the secured part (sometimes several times).

If a site uses http, there's nothing we can do to protect them from a
MITM attacker.  We're interested in protecting https sites from MITM
attackers.

Adam