I think you are definitely on the right track here, though I unfortunately haven't had time to look at your code (thus, I'm just going by your description).
Due to frequent vulnerabilities found in Internet Explorer's cookie handling (versions 4.0 - 6.0 allow anyone to view cookies from any domain, regardless of the cookie's characteristics), cookies should be considered public by any system attempting to be secure. Meaning, if both your key that you describe as well as the session ID are stored in cookies, a compromise of both these cookies opens you up to a presentation attack. This does not require the attacker to sniff the HTTP traffic in any way, so even the use of another security method such as SSL does not prevent this type of attack. Instead, you should consider some sort of combination approach, where you utilize both URL variables and cookies. URL variables are quite exposed (and can be revealed with the Referer HTTP header), so you want to make the exposure of this by itself useless to an attacker. At the same time, you want a cookie compromise to not compromise your entire mechanism. By requiring both types of attacks, you at least make a compromise more difficult and therefore slightly strengthen what you've already got. Hope that helps. Happy hacking. Chris mar tin wrote: >Dear all: > >Until I read the article "PHP Session security" >(http://www.webkreator.com/php/configuration/php-session-security.html) >I haven't noticed how insecure PHP Sessions are. > > > >Basically there're 2 problems: > >*) It's possible to hijack a session if you know the >SID (session id) > > 1) If you're on a shared server (cheap webhosting) >other users can get the SIDs by doing "ls /tmp/sess_*" >(/tmp/ is defined on session.save_path on the config >file, so it may be different). > > 2) When a user clicks on an external link, the >browser sends the REFERER url and sometimes it >contains the SID (if session.use_trans_sid is enabled) > >PHP offers a security measure: with >session.referer_check it will reject SIDs comming from >other referers, but the referer url can be easily >forged. > >*) Users can read session data from the session files, >which are owned by the server process (every user >which has an account on the webserver can read server >owned files) > >(If you're intrested in the subject I would recommend >to read full the article: >http://www.webkreator.com/php/configuration/php-session-security.html) > >I have developed some functions to avoid this >problems. They replace the standard session functions >(using session_set_save_handler), so you only have to >include the file at the beggining of your script and >(afaik) you're safe :) > >This is the idea: > >Apart from the session cookie, I set another one (with >the same name and the string '_sec' appended). On this >cookie I set a random KEY. >The name of the file which contains the session data >is the md5 hash of the SID and the KEY together. This >turns impossible to guess the session id by looking at >the filenames. > >To hide the data inside the file, the serialized >string is crypted using the KEY as password, so nobody >can see the content of your user's sessions. > >You can find the code here: >http://www.n3rds.com.ar/files/docs/php_sessions/sess_handler.txt > >Im looking for suggestions to make it 100% compatible >with the standard session functions, and I would like >to hear some thougts about the idea > -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php
