Session hijacking, aka sidejacking, or cookie sidejacking, is a type of cyberattack where an unauthorized user gains control over your user session while you are attempting to access a website or web app, allowing them to impersonate you and perform actions on your behalf.
Becoming a victim of a session highjacking attack may result in your data being stolen, fraudulent transactions, or the hacker gaining unauthorized access to sensitive accounts.
How Does Session Highjacking Happen?
Session highjacking always involves an attacker obtaining your session ID, cookies or other unique token that identifies you and your device while accessing a system.
Session highjackers aim to exploit the structure of HTTPS as a stateless protocol, meaning one that does not keep track of data passing through it. Because HTTP/HTTPS is stateless, most websites and web applications rely on cookies or other session tokens to keep track of user sessions and authentication.
A session highjack can be either “active” or “passive” and often rely on using widely available network protocol analyzers (aka “packet sniffers”1) that are designed to capture and analyze data traffic within a network.
Some approaches to sidejacking include:
- Cross-site scripting (XSS): An injection attack that inserts executable JavaScript code into a vulnerable website or web application that will execute within your web browser.
- Sniffing attack/Session sniffing: A hacker on the same network as you monitors unencrypted network traffic to intercept and manipulate your data while in transit.
- Session fixation: Hacker tricks you into using a predetermined session ID controlled by the attacker.
- On-path attack: Aka “man in the middle” attack, an on-path attack occurs when a malicious actor places themselves in the middle of an authorized connection and intercepts or alters data in transit.
- Fake WiFi Networks: Attacker creates landing pages for fake WiFi networks that appear legitimate or mimic branded public networks such as at airports, municipalities or retail locations, such as Starbucks.
Publicly Disclosed Sidejacking Attacks
In 2023, hackers breached the customer support system of Okta – an identity management SaaS provider – and gained access to session tokens of several users. Later, those users were targeted in session highjacking attacks.
In 2023, WordPress websites using the plugin “Beautiful Cookie Consent Banner” were found to be vulnerable to malware, computer system compromise, data breach and session highjacking when the plugin was targeted with a cross-site scripting (XSS) attack.
In 2024, state-backed hackers breached the systems of MITRE Corporation, a company that manages research and development centers for the public and private sectors, by chaining two Ivanti VPN zero-day vulnerabilities.2 Once breached, the attackers were able to use session highjacking to bypass multi-factor authentication (MFA).
How Do You Protect Yourself Against Session Highjacking?
One of the simplest ways to protect yourself from potential session highjacking is to turn on iCloud Private Relay if you’re an Apple iCloud user, or use a VPN, or both. Both can significantly enhance your protection against session hijacking attacks because they obscure your data, but they are not standalone solutions.
Here’s how iCloud Private Relay and/or a VPN can help and what additional measures are necessary:
- Encryption of Data: A VPN creates a secure, encrypted tunnel for your internet traffic, which helps prevent attackers from intercepting sensitive information, including session cookies and session IDs. This encryption is crucial when using unsecured networks, such as public Wi-Fi, where session hijackers may target unwary users.
- IP Address Masking: By masking your IP address, a VPN adds an extra layer of anonymity. This makes it more difficult for attackers to target you specifically or track your online activities, reducing the risk of being targeted for session hijacking.
- Protection From Packet Sniffing: Attackers often use packet sniffing techniques to capture unencrypted data packets traveling over an unencrypted network. Many public networks are unencrypted… A VPN encrypts these packets, making it nearly impossible for attackers to read them even if they manage to intercept the traffic.
- Use One-Time Cookies (OTC): While not necessarily related to VPN use, unlike traditional cookies OTCs generate a fresh token per authentication request using a unique hash such that a hacker cannot reuse a cookie token for illicit purposes.
Also, while a VPN provides substantial security benefits, it is not a foolproof solution. As mentioned in the MITRE attack above, the VPN itself could be exploited.
Also, as all your internet traffic is required to be routed through the VPN company itself for the service to work, using a reputable VPN company is very important… Alas, some VPN companies offer “free” VPN services and it makes me wonder how they keep the lights on… You should ask yourself how they are running the business without charging for it… Indeed, it’s often said that if you are not paying for the product then you yourself – or your data – are the product.
Summary
While a VPN can greatly reduce the risk of session hijacking by encrypting your data and masking your IP address, it should be part of a broader strategy that includes secure browsing practices and robust session management techniques.
To further protect yourself from session hijacking, consider implementing always using HTTPS to encrypt your data during transmission, use multi-factor authentication, clear your cookies regularly, keep your software updated and limit the use of public WiFi networks.
Footnotes
- Commonly used packet sniffers are Wireshark and tcpdump. Wireshark has a graphical user interface whereas tcpdump uses the command line. Both can analyze all different packet types, identify protocols and discover network devices.
- A zero day attack is a cyber attack approach, or exploit, that was previously unknown.
