Can cookies carry viruses?

Question

I was wondering whether a cookie can carry a virus (or any security-threatening code). In some sense it is similar to a download. So by simply visiting a site, could I get harmed?

Answer 1

You can put any text strings into a cookie, so in theory you could put some kind of code there. But for code to do any harm something needs to run it. The web browser does not interpret the content of cookies as code and does not try to run it, so cookies should not be dangerous. (If you have heard cookies being referenced in security related discussions, it is probably in relation to privacy and not viruses.)

In theory there could be a bug in the browser that makes it possible to craft a special cookie that somehow fools the browser to run it, e.g. by causing a buffer overflow. Such a bug is quite unlikely in a major browser, and if you could find one it would be considered a big deal.

So I would not worry about cookies infecting me with a virus. However it is possible to be infected by malware from just visiting a website. This is called "drive by downloads" and is nowadays a common method to spread viruses. The vector that is exploited for this is generally not cookies though, but plugins like Java or Flash.

Answer 2

In addition to Anders' excellent answer, there was a vulnerability in Internet Explorer 5 and 6 which allowed a malicious cookie to be set that could then read or set other sites cookie values.

Article here.

An information disclosure vulnerability related to the handling of script within cookies that could allow one site to read the cookies of another. An attacker could build a special cookie containing script and then construct a web page that would deliver that cookie to the user's system and invoke it. He could then send that web page as mail or post it on a server. When the page executed and invoked the script in the cookie, it could potentially read or alter the cookies of another site. Successfully exploiting this, however, would require that the attacker know the exact name of the cookie as stored on the file system to be read successfully.

While not a virus as such, your browser could be "infected" by this script in a cookie that the attacker could then use to compromise your browser. However, regarding the cookie here it is more about the mechanism used for the exploit rather than the browser being infected, because only malicious sites can use the cookie and it won't be invoked when benign sites are visited.

Answer 3

Cookies can only transfer TEXT values, meaning it cannot harm your computer stand-alone, but it can contain very important informations, that can be used against you if stolen. Read about Session hijacking, and you will understand what specificaly the exploiter can use it for.

Answer 4

Theoretically they can, as Anders already mentioned. The "problem" is that they won't be executed by the browser. However, another software/malware on your computer could. Which would be particularly dangerous, because anti virus programs most likely won't detect the cookie or the executing software on their own when carried out in separate files.

Answer 5

The cookie itself does not do damage, but it may contain code used by executables. A tactic of some viruses is to store the cookie with some partial code and that code will be alter run by a virus-like application.

Example: cookie stores decryption key for an executable that bypasses initial scans due to being well encrypted. Then the .exe is using the key to decrypt itself and attempt to run.

Answer 6

The short answer, albeit deceiving without the long answer: Yes, a cookie can carry a virus. Yes, it is possible to get such a virus by merely visiting a website delivering the cookie.

In the above paragraph, replace "a cookie" with "any file, data, or anything else," and replace "visiting a website" with "possessing," and the statement still holds true.

The questions "Can I get a virus from X?" or "Can doing Y give me a virus?" are naïve questions (naïve, but not ignorant if you enlighten yourself). This is because any file, any data, any action has the potential to contain/transfer/catch a virus. Anything at all. There have been viruses which have been transferred in JPGs merely by having them be visible on your monitor, and there have been viruses transferred in Windows shortcut files merely by possessing the infected shortcut in a folder that has been opened. It has also happened in the past that computer users have caught viruses merely by being connected to a network, without actually doing anything to download/view/interact-with a virus, since it is possible for a cracker to gain access to your computer without you actively doing anything.

That's the doom and gloom (yet true) answer. Analogy: It's like a real virus - you can catch a deadly virus merely by standing a dozen (or more, for some of them) feet away from an infected person breathing a virus out. You don't have to actually do anything to die from it. It's sort of similar with computer viruses.

Just as with dying because you are standing 20 feet from the bus stop, getting a virus on your computer while surfing smart is so unlikely that you should not worry about it.

The kind of examples I gave above require critically severe security holes in the software that you use. As long as you use trusted software and keep it up to date, you are usually fine. Usually.

The problem is that a security hole in software is generally not known. If people knew about it, then it would (hopefully) get fixed soon; that's one of the reasons to update your software. Since the holes are not known, none of us can say what is or is not safe, since a cracker can stumble upon the next big security hole and abuse it at any moment, and it can literally be anywhere. Heck, it could be in a malformed website address for all anyone knows, and nobody can reasonably claim otherwise (though I will be the first to say it's highly doubtful).

But don't let this turn you into a frightened hermit. Worrying about the next big security hole is like worrying that the next meteor is going to land on your head - again, possible but not likely.

Now if we ask a different question: I'm concerned about getting malware; is it unsafe to visit websites that give me cookies if I'm using a major, modern browser that is kept up to date? Then the answer is "No, it's not unsafe and you're not likely to get any malware. There are privacy concerns with cookies, but that's not related and won't harm your computer. If you're interested in the privacy concerns, either Google 'computer cookie privacy' or ask another question about that."

Answer 7

The question of whether or not cookies can be dangerous or spread viruses has to do with whether or not a file is an "executable" one. In theory, if an executable cookie was set with malicious contents, then it is possible that it could affect your computer with a virus and open a proverbial can of worms. This is a fairly rare occurrence and one that I have personally not seen - but entirely possible under the right circumstances.