Internet Explorer: cookie theft made easy
Security researcher Rosario Valotta has discovered a zero-day hole in all versions of Internet Explorer that allows arbitrary cookies to be stolen on the net. Internet Explorer's security zone mechanism usually prevents sites in the internet zone from embedding local zone content, for instance from a user's hard disk, into iFrames; however, the researcher discovered that cookies appear to be exempt from this mechanism and can actually be loaded into iFrames. The cookies are then marked as invisible text and shifted from the iFrame to the main window by the user via drag&drop. To prevent users from noticing what was happening, Valotta packaged the whole thing in a game.
This is not a trivial attack: apart from having to solicit a user's co-operation so that the data can be extracted via drag&drop – something Valotta solved using a simple puzzle game in his demo video – a potential attacker must also know the exact path of the cookie. As that path contains the victim's Windows user name, the attacker needs to find this out beforehand.
Talking to Reuters, Valotta said that he harvested more than 80 cookies from his 150 Facebook friends within three days. The researcher notified the Microsoft Security Response Center of the original hole on 28 January 2011 and Microsoft solved the problem before the final version of IE9 was released on 18 March. However, only two weeks later, Valotta found a slightly modified approach that also allowed him to steal cookies from IE9 users, which he demonstrated (direct download PowerPoint file) at the Hackinthebox conference in Amsterdam.