Hello, welcome to the Friday, June 25th, 2021 edition of the Sandtonet Storm Center's Stormcast.

My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

In our defending web application security class, when we cover session cookies, I often mention that, hey, these cookies are as valuable

as a username and a password, and you have to defend them accordingly.

Looks like the bad guys have also been listening.

Xavier notes that in addition to usernames and passwords, cookies apparently are being traded online.

Of course, Malware can always be used to steal these cookies from an infected system, and if

the sessions aren't properly protected, in a particular web application, they may be valid for a significant amount

of time, which then enables them to be traded.

And talking about cookies and weak sessions, a checkpoint published a fairly extensive report

looking at weaknesses in various components of Adelagian's software.

Adelaian, if you're not familiar with the company, they do make software that is commonly used to organize software projects.

There are a number of project management tools and the like that are part of their portfolio. So at its heart,

of course, a compromise of their software would compromise a company's software development process.

And with that, essentially, you're good old and these days highly popular supply chain attack.

Many of the vulnerabilities outlined in Checkpoints Report are attacking sessions and session

cookies and are allowing impersonation of users, also including vulnerabilities, like, for

example, session fixation and cross-site scripting being used to steal cookies as well

as cross-site request forging, then being used to trick victims to perform certain actions

on the attackers' behalf. If you're using any of the Alation products, patches have been released, but you probably do want to take a look at the report at Checkpoint published.

It's very detailed and verify that these vulnerabilities are addressed, also that any software that you are building doesn't include these particular vulnerabilities.

And we have an interesting vulnerability in Dell's support assistant and bias.

...