Dear Web Wiz Family, big secure problem.

Wow!  This is a pretty big security problem, I will test it myself later.

Sorry I have not seen this topic earlier, but it was posted in the wrong forum.

I am aware of all these issues and Web Wiz Forums does have security in place to prevent or limit the effects as much as possible.

If you select the auto login feature then an auto login cookie is set on your machine, which can course issues if a hacker gets hold of this cookie.

To prevent and limit this problem as much as possiable a number of things are in place.

Things to prevent this issue in 7.97 include:-

• Session variables are used for the admin section and the admin is forced to re-login to gain access to the admin section.
• Auto login/tracking cookie is updated in many parts, so the auto-login code is changed often
• Session cookies are used if auto-login is not selected
• Access users are informed to rename and protect their Access database so login data is not comprised
  
• Security filters are used to filter unsafe user input to try and prevent cookie data being stolen 
  
• Passwords are 160bit one way encrypted
  

Version 8 builds on this and adds more protection:-

• Version 8 beta 2 onwards uses it's own propriety session tracking system, with additional IP checking for extra protection (much like emr550m mentions)
• New propriety session system times out after 20 minutes of inactivity, meaning if the hacker does get hold of your session ID they have less than 20 minutes to get past the additional session ID security and use the session ID
• Session data held in application array for extra security (unless load balanced or web gardens are used in which case it's stored, slightly less securely, in the database)
  
• Auto-login cookie is still used as people demand this even though there is a small risk off the cookie being hijacked (it is recommended not to use auto-login)
• The admin section uses a second more secure login system that auto-login can not be used on and the admin must re-login to gain access to the admin section
• Security filters have been updated to filter more unsafe content to prevent cookie hijacking
• The auto-login cookie is updated more often

At the end of the day the biggest issue here is that HTTP is a stateless protocol, meaning that the connection to the web server is not maintained and dropped as soon as the page loads in the browser window.

This means the only way to track and identify users is to place some sort of identity seed on the users machine, in either the form of a cookie or a session ID.

Until the system of how HTTP works is changed or a new protocol can be used for viewing web pages there will always be a risk that the identity seed placed on the users machine can be hijacked.

These issues should be known to all web masters, and measures put in place to limit this type of thing as much as possible.

Many months of on-going research, testing, and developing new and improved ways of limiting these inherent issues goes into Web Wiz Forums to make sure it is the most secure forum software around.


Edited by -boRg- - 06 March 2006 at 12:30pm

You may not be able to steal cookies that way, but you sure can steal the session ID stored in the URL of clients with cookies disabled that way. By using a PHP or ASP to process an image and send it to the client, you can capture the HTTP_REFERER (which will have the query string in it) as well as REMOTE_USER for the IP.

So it looks to me that it's safer to enable cookies on the forum than to block them.