2

One of our clients has an issue with a government security audit on one of their mobile applications.

The finding states that the application stores session cookies on the device in clear text format therefore on a rooted device it is theoretically possible for an attacker to steal the session cookie while it the session is active and perform transactions on behalf of the victim (provided they can also bypass the root detection mechanism in the application itself).

My questions are:

1) Is this a valid finding?

2) If the application encrypts/decrypts the cookie on the device storage does this add more security or not because the application will have to store the key inside it?

3) If the application will encrypt cookies does this mean it will be the same key for all devices obfuscated in the program code or it will be a combination of a key with random data generated on first run to have a unique key for every device and at the same time not have a standalone key stored with the data itself.

2

1) Is this a valid finding?

Depends on the threat model. Is it allowed to use the application on a rooted device in the first place? Need it to be assumed that the rooted device is insecure so that a remote attacker can run its own malware as root on the device?

2) If the application encrypts/decrypts the cookie on the device storage does this add more security or not because the application will have to store the key inside it?

It makes it harder but it does not fully solve the problem. The attacker might also change or hijack the application so that he gets access to the decrypted cookie.

3) If the application will encrypt cookies does this mean it will be the same key for all devices obfuscated in the program code or it will be a combination of a key with random data generated on first run to have a unique key for every device and at the same time not have a standalone key stored with the data itself.

With a device specific secret it needs to be stored somewhere too which adds another attack vector (some devices have secure compartments which might help here). With a common secret more effort can be done to obfuscate it but also more time can be spend off the target device to analyze the application.

In general: the more control a user (or attacker) has over a device the less you can trust anything running on it. Thus you either need to make sure that the device can be trusted enough (like trying to detect root, make sure it has a current patch level, check for uncommon applications, trust only company managed devices ...) or to limit the impact of what can be done with a stolen cookie.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.