Session Hijacking Prevention

The countermeasures against session hijacking focus on strengthening network security, encrypting communication, enforcing robust session management policies, and utilizing secure application development practices.

1. Network and Protocol Security Countermeasures

To prevent sniffing and Man-in-the-Middle (MITM) attacks, which are often used to steal session IDs:

Encryption of Network Traffic

Encrypt all network traffic using cryptographic network protocols such as IPSec, TLS, SSH, and HTTPS. Using secure versions of communication protocols like HTTPS instead of HTTP (especially to protect usernames and passwords) and SSH instead of Telnet is highly recommended.

IPsec provides data authentication, integrity, and confidentiality, drastically reducing the risk of IP spoofing, which is critical for network-level hijacking attempts.

Preventing Spoofing/Prediction

• Use a random initial sequence number (ISN) to prevent IP spoofing attacks based on sequence number prediction. Most devices choose ISNs based on predictable timed counters, making randomization necessary to prevent attackers from determining the ISN of the next TCP connection.
• Ingress Filtering prevents spoofed traffic from entering the network perimeter by dropping packets with source addresses outside the defined range.
• Egress Filtering prevents IP spoofing by blocking outgoing packets with invalid local IP addresses as the source.

Firewalls and Filtering

Implement firewalls to filter incoming packets from unknown or untrusted sources and to control all traffic.

VPNs

Use Virtual Private Networks (VPNs), configured with strong encryption, to create a secure tunnel for communication over public networks, protecting sensitive data from potential sniffers and mitigating session hijacking threats during remote access.

Wireless Security

For wireless networks, always encrypt traffic with a strong encryption protocol like WPA2 or WPA3.

2. Application and Session Management Countermeasures

These measures focus on protecting the integrity and confidentiality of the session identifier (e.g., cookies).

Session ID Generation

Use long, random session identifiers to prevent prediction and guessing. Using secure session management techniques, including random session token generation, is recommended.

Authentication and Authorization

• Do not rely on IP-based authentication.
• Implement multi-factor authentication (MFA) or two-factor authentication (2FA). This adds an extra layer of security for user accounts, making unauthorized access harder even if the session ID is compromised.
• Require a legitimate user to re-authenticate before performing sensitive actions.

Secure Session Tracking

• Use server-side session ID tracking and match connections with parameters such as timestamps and IP addresses.
• Use authentication credentials of any cookie associated with an IP address.
• Use a secure platform session manager to generate long, random session identifiers for secure session development.

Cookie Security

• Do not store plaintext or weakly encrypted passwords in cookies.
• Ensure cookies are only sent over HTTPS by setting the Secure attribute.
• Prevent access to cookie data via JavaScript by setting the HttpOnly attribute.
• Avoid storing sensitive information in client-side cookies; instead, store sensitive data on the server side and use a session identifier to reference it.
• Sign cookies with a server-side secret to ensure their integrity.
• Use the SameSite attribute for cookies to prevent cross-site requests (which could lead to CSRF used for session theft).

Session State Management

• Implement session timeout to automatically close inactive connections.
• Ensure proper login and logout procedures are used, and ensure the session value is invalid after logging out.
• Clear stored cookies from the browser regularly/automatically upon termination to prevent attackers from accessing authentication credentials.

Input Validation

Ensure all user inputs, including data used in HTTP headers, are parsed and validated to prevent injection attacks (like XSS or header splitting) that could lead to session hijacking.

Limit Information Exposure

• Avoid exposing session IDs in the URL.
• Log authentication failures and send alerts when probable attacks are detected.

3. Mobile Platform Countermeasures

Session hijacking is a threat to mobile applications, particularly when apps use weak or no encryption.

• Use SSL/TLS for all authenticated parts of the application.
• Avoid using public Wi-Fi without a VPN.
• Enable periodic re-authentication mechanism to ensure a legitimate user is accessing the device.
• Use secure session management techniques, including random session token generation and setting appropriate session timeouts.

Detection Methods

Manual Method

The manual method involves the use of packet sniffing software such as Wireshark and SteelCentral packet analyzer to monitor session hijacking attacks. The packet sniffer captures packets in transit across the network, which is then analyzed using various filtering tools.

Forced ARP Entry

A forced ARP entry involves replacing the MAC Address of a compromised machine in the ARP cache of the server with a different one in order to restrict network traffic to the compromised machine.

A forced ARP entry should be performed in the case of the following:

• Repeated ARP updates
• Frames sent between the client and server with different MAC Addresses
• ACK storms

Automatic Method

The automatic method involves the use of an intrusion detection systems (IDS) and intrusion prevention systems (IPS) to monitor incoming network traffic. If the packet matches any of the attack signatures in the internal database, the IDS generates an alert, whereas the IPS blocks the traffic from entering the database.