Session hijacking: What is a session hijacking and how does it work?

What is session hijacking? When an attacker takes over your internet session and controls your web activities, like while you’re checking your credit card balance, paying your bills, or online shopping, such an attack is known as session hijacking. 

Session hijackers usually target browser or web application sessions. Once they access these sessions, they could do anything that is accessible to you on the site. In effect, a hijacker fools the website into thinking they are you.

Like a terrorist hijacking an aeroplane and putting the passengers in danger, when a session hijacker takes over an internet session, they can cause massive trouble for the users.

How does session hijacking work?

There are many ways an attacker can perform a session hijacking. But before moving into that, let’s take a quick look at how session hijacking works, step by step:

Session hijacking Step 1: An unsuspecting internet user logs into an account. The user may log into a banking or credit card site, online store, or some other application or site. The application or site installs a temporary “session cookie” in the user’s browser, which contains information about the user that, during the session, allows the site to keep them authenticated as well as logged in, and track their activity. The session cookie stays in the browser until the user manually or automatically logs out.

Session hijacking Step 2: A criminal gains access to the internet user’s valid session. Cybercriminals use different methods to steal sessions. Many common types of session hijacking involve seizing the user’s session cookie, locating the session ID, also known as a session key, within the cookie, and using that information to hijack the session. When the criminal gets the session ID, they can take over the session undetected.

Session hijacking Step 3: The session hijacker gets a payoff for stealing the session. Once the original user logs out, the hijacker can then use the ongoing session to commit various illicit acts, ranging from exploiting the user’s bank accounts to extracting their personal data for committing identity theft, selling their info on the dark web, or encrypting their data and demanding a ransom in return.

Here are a few hypothetical examples of session hijacking:

• Session hijacking example #1: Aditya is sitting in a coffee shop sipping a latte and checking his bank balance. A hijacker at the next table uses “session sniffing”, one of the techniques to grab the session cookie, take over the session, and access his bank account. 
• Session hijacking example #2: Brinda gets an email about a sale at her favourite online store, and she clicks the link and logs in to start shopping. But, the link contains an attacker’s own session key, who sent the email. The attacker then steals the session, goes on a shopping spree, and pays with Brinda’s saved credit card.

Session hijackers know numerous tricks for stealing sessions, and it’s imperative that you’re aware of how they work so you can help identify the attacks and protect yourself.

5 Methods of Session Hijacking

Want to know more about how session hijacking works? Here are the main types of session hijacking attacks that hijackers often use to take over internet sessions: 

1. Brute force – In a brute force attack, the attacker simply guesses the session ID and uses it to perform the attack. Brute force attacks usually work only when the website has weak security and uses short, easy-to-guess session keys. 
2. Cross-site scripting – A cross-site scripting attack initially takes advantages of weak security spots and vulnerabilities in a web server. Then, the attacker inserts scripts into web pages that cause your web browser to reveal your session key to the attacker so they can take over the session.
3. Malware – One of the most common methods cybercriminals use is Phishing attacks. 1 In this attack, hackers send you disguised professional-looking emails that contain malicious links, which installs malware and viruses on your device, allowing them to hijack a session.2  The malware then may conduct “session sniffing” to find the session and send it to the criminal, who can then get your session ID to take over your session.
4. Session side jacking – In this type of attack, criminals need access to a user’s network traffic. They do so when the user is using a public or unsecured Wi-Fi network or by engaging in man-in-the-middle attacks. After successfully accessing the network, a criminal then uses “packet sniffing” to monitor an internet user’s web traffic to search for sessions. This way, the attacker can get ahold of a session cookie and further the hijacking.
5. Session fixation – In a session fixation attack, the criminal creates a session ID and tricks the user into starting a session with it. One common way to do this is to send a malicious link through emails that lead to a login form for the attacker’s website. Then, when the user logs in with the phoney session ID, the attacker continues the hijack. 

These are some of the most common methods attackers use for session hijacking. As you can see, most of them either involve guessing or intercepting an existing users’

Popular session hijacking exploits

Here are some session hijacking exploits and tools that attackers have previously used to gain entry to internet sessions:

• CookieCadger – CookieCadger is an open-source tool that can recognize “information leakage” from web applications and sites. It can monitor both wired ethernet and unsecure Wi-Fi for unencrypted information, which also includes session cookies.
• DroidSheep – DroidSheep is an open-source Android tool that allows users to use “packet sniffing” to extract session cookies and other unprotected information through vulnerable Wi-Fi web browsing sessions.
• FireSheep – FireSheep was a browser extension made for Firefox, which allowed attackers to use “packet sniffing” to find and copy unencrypted session cookies that could be used to perform session hijacking attacks. FireSheep exploited security loopholes and no longer worked with the FireFox browser.

As soon as attackers find tools to help them engage in session hijacking, website owners and technology providers try to fix the security holes. For users, it’s a good idea to frequently update to the latest versions or enable automatic updates, so that the vulnerabilities are fixed.

How to prevent session hijacking

Although these attacks might seem overwhelmingly terrifying, there’s a lot you can do to help protect yourself from them. Below are some steps you can take to help prevent session hijacking and improve your online security:

1. Avoid public Wi-Fi. Never use public Wi-Fi, especially when dealing with critical transactions like banking, online shopping, or logging into your social accounts and emails.3 There could be a cybercriminal at the next table using packet sniffing to pick up session cookies and other information. 
2. Use a VPN. If it is urgent and you really need to use public Wi-Fi, enable a virtual private network (VPN) to help stay safe and keep session hijackers out of your sessions. A VPN masks your IP address and keeps you anonymous while surfing the web by creating a “private tunnel” where all the data you exchange is encrypted and becomes inaccessible to hackers.4
3. Add security software. Install reputable security software, such as Norton 360, on your devices and make sure to update it regularly.5  (You can also set automatic updates.) Security software can detect viruses and protect you from malware, including the malware attackers use to perform session hijacking
4. Watch out your scams. Avoid clicking on suspicious links attached within unknown emails. Session hijackers often use this phishing method to install malware on your device through the link or take you to a login page that will log you in to a site using a session ID prepared by the attacker
   
5. Be aware of site security. Reputable banks, email providers, online merchants, and social media sites always have secured addresses and web pages to avoid session hijacking. Legitimate owners often install HTTPS on the entire site, not just their homepage. On the other hand, malicious websites will only have HTTP, which you can notice in the page's address bar. Also, visiting suspicious online shops or other services that may not have the best security can leave you vulnerable to a session hijacking attack
   

The possibility of falling victim to a session hijacking attack can be scary. But just following these steps and being aware of the symptoms will go a long way toward protecting you from these attackers who want to steal your sessions. 

1. https://in.norton.com/blog/online-scams/how-to-protect-against-phishing-scams
2. https://in.norton.com/blog/malware/what-is-a-computer-virus
3. https://in.norton.com/blog/mobile/why-public-wifi-could-be-a-disaster
4. https://in.norton.com/blog/privacy/secure-browsing-with-a-vpn-for-desktop-computers
5. https://in.norton.com/antivirus