What is session hijacking?

Session hijacking, also sometimes called cookie hijacking, is a type of cyber attack where an attacker steals a user’s valid session ID, leverages it to pretend to be the user, and gains unauthorized access to the user’s account and information.

Session hijacking, explained

To help explain session hijacking, let’s start with the basics of how a session works.

Every time a user logs in to a website, the website generates a session ID and sends it to the user’s browser, usually as a cookie. The session ID is a unique identifier that a website assigns to a user for the duration of the session, so it is essential for tracking authenticated users.

Now, if an attacker was able to acquire that session ID from the user, the attacker could impersonate the legitimate session to take advantage of the user. The impersonator could do plenty of damage in the process, from changing the account password to making fraudulent purchases and even stealing sensitive company information.

How does session hijacking happen?

You may be wondering how an attacker gets hold of a session ID. There are a few ways session hijacking could occur:

• Phishing emails: The attacker sends the user an email with a malicious link that already contains a fixed session ID (something like: http://yourbank.example.com/?sid=1234567890). Should the user click the link and authenticate with the application, then the attacker will be able to use the same link to access the user’s account. 
• Session sniffing: An attacker can also gain access to a user’s session ID through a process called session sniffing, which allows the attacker to inspect (or sniff out) network traffic and acquire the session ID. Public Wi-Fi networks are especially prone to sniffing, so users need to be extra cautious when logging in to accounts. Enabling employees to log in through a VPN network helps mitigate session sniffing by encrypting all information coming and going from workers’ devices.
• Cross-site scripting: When a threat actor exploits a trusted website’s vulnerability and adds malicious code or script to that site, it is known as cross-site scripting. Oftentimes, the malicious code is sent to a victim in the form of an email, which includes a link. If the user clicks the link, and if the code is written in a way that copies the user’s active session cookies, then the attacker could hijack the session.
• Brute force attacks: In a brute force attack, the cybercriminal attempts all possible session IDs until the correct one is found. Once they have the session cookies, they are authenticated and can hijack the user’s website session. 

Session hijacking is a particularly dangerous type of cyber attack because it can be executed relatively quickly and can cause an incredible amount of damage to the user.

Consequences of session hijacking

Oftentimes, session hijacking occurs without the user realizing it. This is because the attacker is operating under the guise of an authenticated user and can perform actions just like the real user would be allowed to do. 

Unfortunately, there are a number of consequences that victims can suffer as a result of cookie hijacking, such as:

• Full account takeovers: Not only can the attacker gain access to the user’s account, but they can also change any of the information, like the password, email address, or physical address. 
• Business email compromise: Once the attacker has full access to the account, he or she can also impersonate the user and send emails to their contacts. The contacts may click on malicious links within the email, since they believe the email comes from a legitimate source. 
• Data breaches: Should an attacker gain access to company data, she or he may be able to steal customers’ personal information and exploit it for financial gain.

Financial loss: If the attacker successfully steals customer data, then they could use it for many nefarious reasons. This could cost the victim financially, as they could require emergency remediation and suffer from the loss of business.

Preventing a session hijacking attack

As a website admin, you can help prevent session hijacking with a few critical actions:

• Use HTTPS sitewide: Some websites only enforce HTTPS at the sign-in screen. However, it is absolutely critical that you use it across the entire website, because this encrypts data transmitted between the site and your users (including session IDs). In addition, to ensure that browsers always establish HTTPS connections, you should set up HSTS (HTTPS Strict Transport Security).
• Focus on session management: To help reduce the risk of session ID theft via cross-site scripting, you should generate session IDs using random values and set up sessions with appropriate expiration periods (so users don’t stay logged in indefinitely). Make sure to use “HttpOnly” and “Secure” on session cookies for extra security.
• Strengthen endpoint security: A solid endpoint security software can prevent session hijacking by blocking malicious activity that attempts to steal your session cookies or other sensitive information used to manage your online logins.

As a consumer, there are also several things you can do to protect yourself:

• Use security software on every device you use.
• Keep your devices and the software on them up to date, so there aren’t any known vulnerabilities on them.
• Delete cookies, or—even better—log out of websites and accounts when you are done. That should also remove or invalidate the session ID from the server, so nobody can use it to log in, even if they have your session cookie.
• Only visit sites with a secure, HTTPS connection to protect your data from being intercepted during transmission. 
• For important accounts, regularly check the log in history where you can see which devices logged in when and from where. You should be able to find this option in your account settings.

Not sure which endpoint security solution is right for you? Get the free evaluation guide with 11 vital criteria for making the best decision.