This attack targets predictable session ID in order to gain privileges.
The attacker can predict the session ID used during a transaction to perform
spoofing and session hijacking.
Attack Execution Flow
Explore
Find Session IDs:
The attacker interacts with the target host and
finds that session IDs are used to authenticate
users.
Attack Step Techniques
ID
Attack Step Technique Description
Environments
1
An attacker makes many anonymous connections
and records the session IDs assigned.
Network systems issue session IDs or
connection IDs
env-CommProtocol env-ClientServer
env-Peer2Peer
Security Controls
ID
Type
Security Control Description
1
Detective
Monitor logs for
unusual amounts of invalid
sessions.
2
Detective
Monitor logs for
unusual amounts of invalid connections or invalid
requests from unauthorized
hosts.
Characterize IDs:
The attacker studies the characteristics of the
session ID (size, format, etc.). As a results the
attacker finds that legitimate session IDs are
predictable.
Attack Step Techniques
ID
Attack Step Technique Description
Environments
1
Cryptanalysis. The attacker uses
cryptanalysis to determine if the session IDs
contain any cryptographic protections.
The attacker uses the falsified session ID to
access the target system.
Attack Step Techniques
ID
Attack Step Technique Description
Environments
1
The attacker loads the session ID into his
web browser and browses to restricted data or
functionality.
env-Web
2
The attacker loads the session ID into his
network communications and impersonates a
legitimate user to gain access to data or
functionality.
env-CommProtocol env-Peer2Peer
env-ClientServer
Security Controls
ID
Type
Security Control Description
1
Detective
Monitor the
correlation between session IDs and other station
designations (MAC address, IP address, VLAN,
etc.). Alert on session ID reuse from multiple
sources.
2
Preventative
Terminate both
sessions if an ID is used from multiple
origins.
Attack Prerequisites
The target host uses session IDs to keep track of the users.
Session IDs are used to control access to resources.
The session IDs used by the target host are predictable.For example, the
session IDs are generated using predictable information (e.g., time).
Typical Likelihood of Exploit
Likelihood: High
Methods of Attack
Spoofing
Brute Force
Analysis
Examples-Instances
Description
Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1
before 6.1.0pre3 generates predictable session identifiers using
java.util.random, which makes it easier for remote attackers to guess a
session identifier through brute force attacks, bypass authentication
requirements, and possibly conduct cross-site request forgery
attacks.
Related Vulnerabilities
CVE-2006-6969
Description
mod_usertrack in Apache 1.3.11 through 1.3.20 generates session ID's
using predictable information including host IP address, system time and
server process ID, which allows local users to obtain session ID's and
bypass authentication when these session ID's are used for
authentication.
Related Vulnerabilities
CVE-2001-1534
Attacker Skills or Knowledge Required
Skill or Knowledge Level: Low
There are tools to brute force sesion ID. Those tools require a low
level of knowledge.
Skill or Knowledge Level: Medium
Predicting Session ID may require more computation work which uses
advanced analysis such as statistic analysis.
Probing Techniques
Description
The attacker can perform analysis of the randomness of the session
generation algortihm.
Description
The attacker may need to steal a few valid session IDs using a
different type of attack. And then use those session ID to predict the
following ones.
Description
The attacker can use brute force tools to find a valid session
ID.
Solutions and Mitigations
Use a strong source of randomness to generate a session ID.
Use adequate length session IDs
Do not use information available to the user in order to generate session
ID (e.g., time).
Ideas for creating random numbers are offered by Eastlake [RFC1750]
Encrypt the session ID if you expose it to the user. For instance session
ID can be stored in a cookie in encrypted format.
Description
