2

If I visited a malicious site while being logged in to Google, Hotmail, Facebook, or Twitter in the same browser window, how hard is it for the site to discover my account IDs without my explicit permission?

Assume:

  • fully patched operating system,
  • fully patched web browser with plug-ins disabled,
  • fully patched router with strong password and remote administration disabled,
  • all hardware, software, and Internet are bona fide and not tampered with,
  • all accounts are protected with strong passwords,
  • I am computer literate and aware of good security practices,
  • no additional software (malicious or legitimate) are present.

Bonus question:

If you can invalidate any assumption from the above list, which one would you want to invalidate? What is the weakest link of the security?

  • Are you browsing with cookies enabled? Do you always check your URLS? Do you always ensure that logins to sites are running on SSL with a verified root certificate? Do you have flash and java enabled? Are you spoofing your browsers user agent? Are you using a proxy to reach the site? – P0LYmath Nov 8 '14 at 5:15
  • Patched doesn't mean it's immune. It just means that KNOWN/PUBLIC vulnerabilities have been protected against. How do you know your equipment hasn't been tampered with? How do you define a strong password? Also, I think you mean "illegitimate". – P0LYmath Nov 8 '14 at 5:22
2

This really depends on the sites you're logged in to and how alert you are as a person. I can imagine the following scenarios (not specific to any of the sites you mentioned, but just general scenarios):

  1. Sensitive information is transmitted in the URL: For each request, a session ID is transmitted in the URL. In this case proxy servers will log the session ID and anyone access to these log files is able to perform session hijacking. This information could also be stored in your local cache, anyone having physical access to your machine might use it.

  2. Cross Site Request Forgery: Missing or poor implementations of anti CSRF tokens could lead to un-validated actions on your behalf because the origin of the request is not validated. An example of a poor implementation of anti CSRF is transmitting these tokens in the URL (see #1.)

  3. Cross Site Scripting & Insufficient cookie settings: If a website does not properly secure its cookies (e.g. missing the HTTPOnly attribute) and an XSS vulnerability exist in the same website, your session ID might get stolen while visiting a malicious site (e.g. cookie stealer).

  4. HTTP Resonse Splitting: Also known as CRLF injection (%0A%0D) is a vulnerability due to the lack of input validation. It may lead to poisoning of the client’s web-cache, cross site scripting, theft of sensitive information and other.

Does this apply to the sites you mentioned? Unfortunately yes, it does! Although most of these sites are known to be secure, every once in a while certain vulnerabilities are discovered.

A question you should ask yourself is, should I always have an active session while browsing possible malicious websites?

Another question could be, why do I browse possible malicious websites with the same browser I use for the sites mentioned?

Your bonus question:

I would like to invalidate the "fully patched operating system". There are 0days out there that are not reported to the manufacturer(s) (that's why they're called 0days in the first place). There's no such thing as being 100% secure.

Your router: We've seen in the past that even though the router's remote administrative interface was not enabled, there was a backdoor in a specific router which could access the administrative interfaces with a specific User Agent (no credentials required).

Having said that, it doesn't mean you should get paranoid.

  • So I conclude the answer to my question is "In theory it shouldn't be possible but any vulnerability (known or unknown) in my or Google's part could void that assumption. The greater the separation between the Google session and the malicious site, the better." Actually I always browse unknown sites in different browser than the one I use to browse sensitive sites (Google, Bank, etc.) This is rather cumbersome though so I asked here whether browsing sensitive and malicious sites in the same window is secure. My gut tells me no and it is indeed a no. – user60461 Nov 9 '14 at 1:41
  • Another idea that you might want to consider is using a tool like Sandboxie. Among other things Sandboxie can run your browser sand boxed. This should add a layer of protection while browsing possible malicious websites. – Jeroen - IT Nerdbox Nov 9 '14 at 9:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.