Concerns about the Security Level of the NAV Service Credential Typ "AccessControlService"

Ben_Dyson

Hi All

After a previous post helped me to resolve an issue:
https://forum.mibuso.com/discussion/68152/how-to-clear-single-sign-on-credentials

I was reminded by a colleague of a security issue with the WebClient. We've seen that if you start a session with one user, you can copy the cookies etc from their IE temp files and drop them into your own temp files and carry on as the other user without re-authenticating.

We raised this with Microsoft and they didn't accept this as an issue, as users shouldn't be able access these files from another user.... OK, it's a valid point but it doesn't stop it being a security flaw.

So on realising that when using AccessControlService shared credentials, I'm concerned that I could copy the IE temp files and put them on my machine, then NAV would just load as the other user without prompting me for any credentials.

So before I have to make a local system just to test this, I was hoping that someone had already confirmed this? Also if it is an issue, I'm sure you'd all like to know.

Regards

Ben

ama

Rather than re-stating a hammered to death question and answer:

https://stackoverflow.com/questions/17030081/how-do-i-prevent-session-hijacking-by-simply-copy-a-cookie-from-machine-to-anoth

"

It doesn't make sense to "protect" against this. If this kind of copying happens, then either:

The end user did it on purpose because they wanted to change computers. This is, of course, not something you should care about or be concerned about.

An attacker has already compromised the user's browser and gotten access to the cookies stored inside. By definition this cookie is a secret that proves that the identity of the HTTP client. If the attacker already has access to it, they can already use it in any number of ways of their choosing that you won't be able to prevent or distinguish from the real user accessing the server legitimately.

"

ama

Rather than re-stating a hammered to death question and answer:

https://stackoverflow.com/questions/17030081/how-do-i-prevent-session-hijacking-by-simply-copy-a-cookie-from-machine-to-anoth

"

It doesn't make sense to "protect" against this. If this kind of copying happens, then either:

The end user did it on purpose because they wanted to change computers. This is, of course, not something you should care about or be concerned about.

An attacker has already compromised the user's browser and gotten access to the cookies stored inside. By definition this cookie is a secret that proves that the identity of the HTTP client. If the attacker already has access to it, they can already use it in any number of ways of their choosing that you won't be able to prevent or distinguish from the real user accessing the server legitimately.

"

Ben_Dyson

Thanks Ama.